CHROMIUM: drm: fix lockingin addfb/addfb2

The following commit removed drm_modeset_lock/unlock_all() from the
main path, but left it in the error path:

commit a105bf55b8db429e560550767e887f73027ad6d0
Author: Daniel Vetter <daniel.vetter@ffwll.ch>
Date:   Tue Dec 11 00:09:12 2012 +0100

    UPSTREAM: drm: push modeset_lock_all into ->fb_create driver callbacks

This commit removes the leftover locking.

BUG=chromium:434115,chromium:441409
TEST=compiles and runs on link_freon

Change-Id: Ib762af6109c8ca4552143d4aff9ca5bb9e3ef6d4
Signed-off-by: Stéphane Marchesin <marcheu@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/234788
Reviewed-by: Sean Paul <seanpaul@chromium.org>
CHROMIUM: LSM: fix sysfs parameter exposure

The kernel commandline used to change LSM parameters is exposed to
sysfs, which does not enforce defined DAC permissions. As a result,
it was possible to disable module locking after boot:

    # cd /sys/module/lsm/parameters
    # ls -l module_locking
    -r-------- 1 root root 4096 Dec 10 14:31
    # echo 0 > module_locking
    -bash: module_locking: Permission denied
    # chmod u+w module_locking
    # echo 0 > module_locking
    # insmod /tmp/evil.ko
    # echo $?
    0

BUG=chromium:440990
TEST=test image (with rootfs verification) now ignores sysfs fiddling

Change-Id: I677895749ebc7052073081919cc21c9a69233d25
Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/234520
Reviewed-by: Will Drewry <wad@chromium.org>
CHROMIUM: iwl7000: add firmware coredump support

The firmware coredump support depends on the devcoredump framework
that was only recently accepted into the chromium kernel, so the
code in iwl7000 was removed. Add it back now to support dumping the
firmware state when it crashes.

Note that the whole devcoredump framework is disabled on production
systems, so this is only useful for development/testing.

BUG=N/A
TEST=provoke firmware crash and check for devcoredump

Change-Id: I563a69af2cde3e43d586a1386d26735dca0071f7
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Reviewed-on: https://chromium-review.googlesource.com/234941
Reviewed-by: Paul Stewart <pstew@chromium.org>
UPSTREAM: perf/ftrace: Fix paranoid level for enabling function tracer

The current default perf paranoid level is "1" which has
"perf_paranoid_kernel()" return false, and giving any operations that
use it, access to normal users. Unfortunately, this includes function
tracing and normal users should not be allowed to enable function
tracing by default.

The proper level is defined at "-1" (full perf access), which
"perf_paranoid_tracepoint_raw()" will only give access to. Use that
check instead for enabling function tracing.

Reported-by: Dave Jones <davej@redhat.com>
Reported-by: Vince Weaver <vincent.weaver@maine.edu>
Tested-by: Vince Weaver <vincent.weaver@maine.edu>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Cc: stable@vger.kernel.org # 3.4+
CVE: CVE-2013-2930
Fixes: ced39002f5ea ("ftrace, perf: Add support to use function tracepoint in perf")
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>

BUG=chromium:426983
TEST=kernel compiles and boots

(cherry picked from commit 12ae030d54ef250706da5642fc7697cc60ad0df7)
Signed-off-by: Stephen Barber <smbarber@chromium.org>

Change-Id: I80c62496d249d044e51dded17da365faeefe0edb
Reviewed-on: https://chromium-review.googlesource.com/234513
Trybot-Ready: Stephen Barber <smbarber@chromium.org>
Tested-by: Stephen Barber <smbarber@chromium.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Commit-Queue: Stephen Barber <smbarber@chromium.org>
UPSTREAM: ipv6: udp packets following an UFO enqueued packet need also be handled by UFO

In the following scenario the socket is corked:
If the first UDP packet is larger then the mtu we try to append it to the
write queue via ip6_ufo_append_data. A following packet, which is smaller
than the mtu would be appended to the already queued up gso-skb via
plain ip6_append_data. This causes random memory corruptions.

In ip6_ufo_append_data we also have to be careful to not queue up the
same skb multiple times. So setup the gso frame only when no first skb
is available.

This also fixes a shortcoming where we add the current packet's length to
cork->length but return early because of a packet > mtu with dontfrag set
(instead of sutracting it again).

Found with trinity.

Cc: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

BUG=chromium:426987
TEST=kernel compiles and boots

(cherry picked from commit 2811ebac2521ceac84f2bdae402455baa6a7fb47)
Signed-off-by: Stephen Barber <smbarber@chromium.org>

Change-Id: I1e06d2a19cbd9791e95a14e1e401f0c94492ab50
Reviewed-on: https://chromium-review.googlesource.com/234435
Trybot-Ready: Stephen Barber <smbarber@chromium.org>
Tested-by: Stephen Barber <smbarber@chromium.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Commit-Queue: Stephen Barber <smbarber@chromium.org>
Fixed Atmel touchpad angle error messages in kernel log

The error messages were generated due to the fact that Atmel driver
was sending an invalid angle report. The kernel will report zero in
these cases.

BUG=chromium:440918
TEST=Manually tested on Pixel.

Change-Id: I801aa89f0bf44c1e41ee3b7e2d81e0003d816cbb
Signed-off-by: Amirhossein Simjour <asimjour@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/234897
Reviewed-by: Yufeng Shen <miletus@chromium.org>
Commit-Queue: Yufeng Shen <miletus@chromium.org>
Tested-by: Yufeng Shen <miletus@chromium.org>
UPSTREAM: mnt: Only change user settable mount flags in remount

Kenton Varda <kenton@sandstorm.io> discovered that by remounting a
read-only bind mount read-only in a user namespace the
MNT_LOCK_READONLY bit would be cleared, allowing an unprivileged user
to the remount a read-only mount read-write.

Correct this by replacing the mask of mount flags to preserve
with a mask of mount flags that may be changed, and preserve
all others.   This ensures that any future bugs with this mask and
remount will fail in an easy to detect way where new mount flags
simply won't change.

Cc: stable@vger.kernel.org
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>

BUG=chromium:427071
TEST=kernel compiles and boots

(cherry picked from commit a6138db815df5ee542d848318e5dae681590fccd)
Signed-off-by: Stephen Barber <smbarber@chromium.org>

Change-Id: I396fc609493cec19130e2fc7417642cbd64c3e19
Reviewed-on: https://chromium-review.googlesource.com/234564
Tested-by: Stephen Barber <smbarber@chromium.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Commit-Queue: Stephen Barber <smbarber@chromium.org>
UPSTREAM: fs,userns: Change inode_capable to capable_wrt_inode_uidgid

commit 23adbe12ef7d3d4195e80800ab36b37bee28cd03 upstream.

The kernel has no concept of capabilities with respect to inodes; inodes
exist independently of namespaces.  For example, inode_capable(inode,
CAP_LINUX_IMMUTABLE) would be nonsense.

This patch changes inode_capable to check for uid and gid mappings and
renames it to capable_wrt_inode_uidgid, which should make it more
obvious what it does.

Fixes CVE-2014-4014.

Cc: Theodore Ts'o <tytso@mit.edu>
Cc: Serge Hallyn <serge.hallyn@ubuntu.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Dave Chinner <david@fromorbit.com>
Signed-off-by: Andy Lutomirski <luto@amacapital.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

BUG=chromium:427055
TEST=kernel compiles and boots

(cherry picked from commit 4f80c6c1825a91cecf3b3bd19c824e768d98fe48)
Signed-off-by: Stephen Barber <smbarber@chromium.org>

Change-Id: Ic8ea85666464b26ef21098cd25db3d07140f701c
Reviewed-on: https://chromium-review.googlesource.com/235416
Tested-by: Stephen Barber <smbarber@chromium.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Commit-Queue: Stephen Barber <smbarber@chromium.org>
UPSTREAM: ipv6: don't set DST_NOCOUNT for remotely added routes

DST_NOCOUNT should only be used if an authorized user adds routes
locally. In case of routes which are added on behalf of router
advertisments this flag must not get used as it allows an unlimited
number of routes getting added remotely.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

BUG=chromium:427075
TEST=kernel compiles and boots

(cherry picked from commit c88507fbad8055297c1d1e21e599f46960cbee39)
Signed-off-by: Stephen Barber <smbarber@chromium.org>

Change-Id: I396e4d2389a24e25a864d2d7f18a38b5cc9d4e2d
Reviewed-on: https://chromium-review.googlesource.com/235402
Tested-by: Stephen Barber <smbarber@chromium.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Commit-Queue: Stephen Barber <smbarber@chromium.org>
UPSTREAM: mnt: Move the test for MNT_LOCK_READONLY from change_mount_flags into do_remount

There are no races as locked mount flags are guaranteed to never change.

Moving the test into do_remount makes it more visible, and ensures all
filesystem remounts pass the MNT_LOCK_READONLY permission check.  This
second case is not an issue today as filesystem remounts are guarded
by capable(CAP_DAC_ADMIN) and thus will always fail in less privileged
mount namespaces, but it could become an issue in the future.

Cc: stable@vger.kernel.org
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>

BUG=chromium:427072
TEST=kernel compiles and boots

(cherry picked from commit 07b645589dcda8b7a5249e096fece2a67556f0f4)
Signed-off-by: Stephen Barber <smbarber@chromium.org>

Change-Id: Ifa22d71969ab97c897162e810b2167ecf9140c46
Reviewed-on: https://chromium-review.googlesource.com/234565
Tested-by: Stephen Barber <smbarber@chromium.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Commit-Queue: Stephen Barber <smbarber@chromium.org>
UPSTREAM: mnt: Correct permission checks in do_remount

While invesgiating the issue where in "mount --bind -oremount,ro ..."
would result in later "mount --bind -oremount,rw" succeeding even if
the mount started off locked I realized that there are several
additional mount flags that should be locked and are not.

In particular MNT_NOSUID, MNT_NODEV, MNT_NOEXEC, and the atime
flags in addition to MNT_READONLY should all be locked.  These
flags are all per superblock, can all be changed with MS_BIND,
and should not be changable if set by a more privileged user.

The following additions to the current logic are added in this patch.
- nosuid may not be clearable by a less privileged user.
- nodev  may not be clearable by a less privielged user.
- noexec may not be clearable by a less privileged user.
- atime flags may not be changeable by a less privileged user.

The logic with atime is that always setting atime on access is a
global policy and backup software and auditing software could break if
atime bits are not updated (when they are configured to be updated),
and serious performance degradation could result (DOS attack) if atime
updates happen when they have been explicitly disabled.  Therefore an
unprivileged user should not be able to mess with the atime bits set
by a more privileged user.

The additional restrictions are implemented with the addition of
MNT_LOCK_NOSUID, MNT_LOCK_NODEV, MNT_LOCK_NOEXEC, and MNT_LOCK_ATIME
mnt flags.

Taken together these changes and the fixes for MNT_LOCK_READONLY
should make it safe for an unprivileged user to create a user
namespace and to call "mount --bind -o remount,... ..." without
the danger of mount flags being changed maliciously.

Cc: stable@vger.kernel.org
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>

BUG=chromium:427072
TEST=kernel compiles and boots

(cherry picked from commit 9566d6742852c527bf5af38af5cbb878dad75705)
Signed-off-by: Stephen Barber <smbarber@chromium.org>

Change-Id: Ic7c815f5056b1f4d5d91bdafd24c54d6210c001d
Reviewed-on: https://chromium-review.googlesource.com/234566
Tested-by: Stephen Barber <smbarber@chromium.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Commit-Queue: Stephen Barber <smbarber@chromium.org>
UPSTREAM: net: ipv4: current group_info should be put after using.

Plug a group_info refcount leak in ping_init.
group_info is only needed during initialization and
the code failed to release the reference on exit.
While here move grabbing the reference to a place
where it is actually needed.

Signed-off-by: Chuansheng Liu <chuansheng.liu@intel.com>
Signed-off-by: Zhang Dongxing <dongxing.zhang@intel.com>
Signed-off-by: xiaoming wang <xiaoming.wang@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

BUG=chromium:427053
TEST=kernel compiles and boots

(cherry picked from commit b04c46190219a4f845e46a459e3102137b7f6cac)
Signed-off-by: Stephen Barber <smbarber@chromium.org>

Change-Id: If1baa25d5a724c11c9ba16eaf4e55dcb081bb167
Reviewed-on: https://chromium-review.googlesource.com/235472
Trybot-Ready: Stephen Barber <smbarber@chromium.org>
Tested-by: Stephen Barber <smbarber@chromium.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Commit-Queue: Stephen Barber <smbarber@chromium.org>
Merge branch 'chromeos-3.8' of https://chromium.googlesource.com/chromiumos/third_party/kernel into chromeos-3.8