SELinux: Fix kernel BUG on empty security contexts.

Setting an empty security context (length=0) on a file will
lead to incorrectly dereferencing the type and other fields
of the security context structure, yielding a kernel BUG.
As a zero-length security context is never valid, just reject
all such security contexts whether coming from userspace
via setxattr or coming from the filesystem upon a getxattr
request by SELinux.

Setting a security context value (empty or otherwise) unknown to
SELinux in the first place is only possible for a root process
(CAP_MAC_ADMIN), and, if running SELinux in enforcing mode, only
if the corresponding SELinux mac_admin permission is also granted
to the domain by policy.  In Fedora policies, this is only allowed for
specific domains such as livecd for setting down security contexts
that are not defined in the build host policy.

[On Android, this can only be set by root/CAP_MAC_ADMIN processes,
and if running SELinux in enforcing mode, only if mac_admin permission
is granted in policy.  In Android 4.4, this would only be allowed for
root/CAP_MAC_ADMIN processes that are also in unconfined domains. In current
AOSP master, mac_admin is not allowed for any domains except the recovery
console which has a legitimate need for it.  The other potential vector
is mounting a maliciously crafted filesystem for which SELinux fetches
xattrs (e.g. an ext4 filesystem on a SDcard).  However, the end result is
only a local denial-of-service (DOS) due to kernel BUG.  This fix is
queued for 3.14.]

Reproducer:
su
setenforce 0
touch foo
setfattr -n security.selinux foo

Caveat:
Relabeling or removing foo after doing the above may not be possible
without booting with SELinux disabled.  Any subsequent access to foo
after doing the above will also trigger the BUG.

BUG output from Matthew Thode:
[  473.893141] ------------[ cut here ]------------
[  473.962110] kernel BUG at security/selinux/ss/services.c:654!
[  473.995314] invalid opcode: 0000 [#6] SMP
[  474.027196] Modules linked in:
[  474.058118] CPU: 0 PID: 8138 Comm: ls Tainted: G      D   I
3.13.0-grsec #1
[  474.116637] Hardware name: Supermicro X8ST3/X8ST3, BIOS 2.0
07/29/10
[  474.149768] task: ffff8805f50cd010 ti: ffff8805f50cd488 task.ti:
ffff8805f50cd488
[  474.183707] RIP: 0010:[<ffffffff814681c7>]  [<ffffffff814681c7>]
context_struct_compute_av+0xce/0x308
[  474.219954] RSP: 0018:ffff8805c0ac3c38  EFLAGS: 00010246
[  474.252253] RAX: 0000000000000000 RBX: ffff8805c0ac3d94 RCX:
0000000000000100
[  474.287018] RDX: ffff8805e8aac000 RSI: 00000000ffffffff RDI:
ffff8805e8aaa000
[  474.321199] RBP: ffff8805c0ac3cb8 R08: 0000000000000010 R09:
0000000000000006
[  474.357446] R10: 0000000000000000 R11: ffff8805c567a000 R12:
0000000000000006
[  474.419191] R13: ffff8805c2b74e88 R14: 00000000000001da R15:
0000000000000000
[  474.453816] FS:  00007f2e75220800(0000) GS:ffff88061fc00000(0000)
knlGS:0000000000000000
[  474.489254] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  474.522215] CR2: 00007f2e74716090 CR3: 00000005c085e000 CR4:
00000000000207f0
[  474.556058] Stack:
[  474.584325]  ffff8805c0ac3c98 ffffffff811b549b ffff8805c0ac3c98
ffff8805f1190a40
[  474.618913]  ffff8805a6202f08 ffff8805c2b74e88 00068800d0464990
ffff8805e8aac860
[  474.653955]  ffff8805c0ac3cb8 000700068113833a ffff880606c75060
ffff8805c0ac3d94
[  474.690461] Call Trace:
[  474.723779]  [<ffffffff811b549b>] ? lookup_fast+0x1cd/0x22a
[  474.778049]  [<ffffffff81468824>] security_compute_av+0xf4/0x20b
[  474.811398]  [<ffffffff8196f419>] avc_compute_av+0x2a/0x179
[  474.843813]  [<ffffffff8145727b>] avc_has_perm+0x45/0xf4
[  474.875694]  [<ffffffff81457d0e>] inode_has_perm+0x2a/0x31
[  474.907370]  [<ffffffff81457e76>] selinux_inode_getattr+0x3c/0x3e
[  474.938726]  [<ffffffff81455cf6>] security_inode_getattr+0x1b/0x22
[  474.970036]  [<ffffffff811b057d>] vfs_getattr+0x19/0x2d
[  475.000618]  [<ffffffff811b05e5>] vfs_fstatat+0x54/0x91
[  475.030402]  [<ffffffff811b063b>] vfs_lstat+0x19/0x1b
[  475.061097]  [<ffffffff811b077e>] SyS_newlstat+0x15/0x30
[  475.094595]  [<ffffffff8113c5c1>] ? __audit_syscall_entry+0xa1/0xc3
[  475.148405]  [<ffffffff8197791e>] system_call_fastpath+0x16/0x1b
[  475.179201] Code: 00 48 85 c0 48 89 45 b8 75 02 0f 0b 48 8b 45 a0 48
8b 3d 45 d0 b6 00 8b 40 08 89 c6 ff ce e8 d1 b0 06 00 48 85 c0 49 89 c7
75 02 <0f> 0b 48 8b 45 b8 4c 8b 28 eb 1e 49 8d 7d 08 be 80 01 00 00 e8
[  475.255884] RIP  [<ffffffff814681c7>]
context_struct_compute_av+0xce/0x308
[  475.296120]  RSP <ffff8805c0ac3c38>
[  475.328734] ---[ end trace f076482e9d754adc ]---

[sds:  commit message edited to note Android implications and
to generate a unique Change-Id for gerrit]

Change-Id: I4d5389f0cfa72b5f59dada45081fa47e03805413
Reported-by:  Matthew Thode <mthode@mthode.org>
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Cc: stable@vger.kernel.org
Signed-off-by: Paul Moore <pmoore@redhat.com>
Signed-off-by: Sivasri Kumar Vanka <sivasri@codeaurora.org>
ping: prevent NULL pointer dereference on write to msg_name

A plain read() on a socket does set msg->msg_name to NULL. So check for
NULL pointer first.

Change-Id: I3773934fb633157ce5011d2f10900b7caef73733
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Git-commit: cf970c002d270c36202bd5b9c2804d3097a52da0
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Avijit Kanti Das <avijitnsec@codeaurora.org>
msm: mdss: Support scalar programming for all usecases

Program scalar registers for both RGB and VIG pipes
when requested by the user. The scalar factors are
also computed by the user.

Change-Id: I6854a9ff3acdef07bb6a964f2f3686612230eff3
Signed-off-by: Sree Sesha Aravind Vadrevu <svadrevu@codeaurora.org>
media: dvb: fix race condition in overflow during read()

During a read operation dvb_dmxdev_buffer_read() may return
sucessfully with some data. Immidiately after that a new TS
packet may arrive and cause an overflow condition which flushes
the event queue and adds a single overflow event.
dvb_dmxdev_update_events() is then called with bytes_read > 0,
but since there is only the overflow event it is skipped and
considered to be notified already. From this point each no events
will be returned as the event queue is empty.
To prevent that, verify overflow state is not in affect before
updating the events.

Change-Id: Iaa4bb41da5b55e0d5856cde614834d4f0eaa4a49
Signed-off-by: Gilad Broner <gbroner@codeaurora.org>
USB: android: release spinlock before queuing work in android_setup

In android_setup we release spinlock after scheduling the work but there
is no need for holding the spinlock during the schedule_work call
is executed this can lead to spinlock timeouts in case where schedule
work takes more time.

So before scheduling work in android_setup we release spinlock to avoid
potential spinlock lockup or timeout.

CRs-Fixed: 661220
Change-Id: Ibf8ff7f07caf20edf9e646fdcef540fbc6441aec
Signed-off-by: Tarun Gupta <tarung@codeaurora.org>
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
Signed-off-by: ChandanaKishori Chiluveru <cchilu@codeaurora.org>
usb: gadget: Ignore the second set_config from the host

Some USB hosts may send SET_CONFIGURATION with same value twice.
The current code implementation of android_work() issues disconnect
event to userspace if SetConfiguration with non-zero value is sent
twice. The Userspace application may disconnect USB and it causes
fail to connect to the USB host.

Fix this by ignoring the second time SET_CONFIGURATION request
from the host only for the same configuration value twice.

CRs-Fixed: 661220
Change-Id: Iec8dd7824fa9f371ea147784cf9137aa88a7128e
Signed-off-by: ChandanaKishori Chiluveru <cchilu@codeaurora.org>
usb: android: Skip the work when set_config arrives with same value twice

Some USB hosts may send SET_CONFIGURATION with same value twice.
The current code implementation processing the 2nd set_config and
schedules the work. The android_work() issues disconnect event to
userspace if SetConfiguration with non-zero value is sent twice.
The userspace applications may disconnect the USB and the device
doesn't connect to the host.

Fix this by avoiding the android_work for the second time SET_CONFIGURATION
request when it receives SetConfiguration request with same configuration
value twice from the host.

CRs-Fixed: 661220
Change-Id: Ic450315a9067b9b679b4936480d125e4e4b7cdf7
Signed-off-by: ChandanaKishori Chiluveru <cchilu@codeaurora.org>
i2c_qup: Fix for unhandled IRQ

I2C qup driver handle scenario where runtime
PM is not enabled and enables clocks explicitly.
But it checks runtime PM suspended state in ISR
routine before processing further which can lead to issue
of unhandled valid IRQ sometimes because I2C client
can initiate transaction very early after system
resume and runtime PM is not enabled.

Add atomic flag to synchronize between active transaction
request when clocks are enabled and ISR.

CRs-Fixed: 670480
Change-Id: I175bc29a7b5b6e713ab6ec28deb34b2b0d23fa8a
Signed-off-by: Sana Venkat Raju <c_vsana@codeaurora.org>
Signed-off-by: Alok Chauhan <alokc@codeaurora.org>
net: fib: fix incorrect call_rcu_bh()

After IP route cache removal, I believe rcu_bh() has very little use and
we should remove this RCU variant, since it adds some cycles in fast
path.

Anyway, the call_rcu_bh() use in fib_true is obviously wrong, since
some users only assert rcu_read_lock().

Change-Id: Ie22d933518d579f4d018a4efec9d3a39c7b64681
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Git-commit: 0c03eca3d995e73d691edea8c787e25929ec156d
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Osvaldo Banuelos <osvaldob@codeaurora.org>
msm-vidc: Modify Q6 HFI not to alter VP8 max supported width

Modify Q6 HFI not to alter the core returned max supported
width and height. Whereas venus HFI will alter the the max
supported width and height to 1080p.

Change-Id: I901862e8fc98a1a6d80e62e7ab2d6477de5f07a4
Signed-off-by: Ravi Kiran Vonteddu <rvontedd@codeaurora.org>
msm: display: Add pipe type selection in overlay request

Allow user to specify the type when requesting an overlay pipe.
If field is set the pipe type indication in the flags will be
ignored.
Change-Id: Iee51d24b96c7a2a987dc70a439342e6548dfc8fa
Signed-off-by: Vineet Bajaj <vbajaj@codeaurora.org>
Merge "msm-vidc: Modify Q6 HFI not to alter VP8 max supported width"
Merge "ping: prevent NULL pointer dereference on write to msg_name"
Merge "i2c_qup: Fix for unhandled IRQ"
Merge "SELinux: Fix kernel BUG on empty security contexts."
msm: camera: Adding interface for power operations in actuator driver

Support for actuator power operation.
- add vreg data parsing from property.
- add interface for power up and down.

Change-Id: I809e23e27d119635e85b565fa6ea2f045b2afdc1
Signed-off-by: Evgeniy Borisov <eborisov@codeaurora.org>
Merge "USB: android: release spinlock before queuing work in android_setup"
Merge "usb: gadget: Ignore the second set_config from the host"
Merge "usb: android: Skip the work when set_config arrives with same value twice"
Merge "msm: display: Add pipe type selection in overlay request"