SELinux: Fix kernel BUG on empty security contexts.

Setting an empty security context (length=0) on a file will
lead to incorrectly dereferencing the type and other fields
of the security context structure, yielding a kernel BUG.
As a zero-length security context is never valid, just reject
all such security contexts whether coming from userspace
via setxattr or coming from the filesystem upon a getxattr
request by SELinux.

Setting a security context value (empty or otherwise) unknown to
SELinux in the first place is only possible for a root process
(CAP_MAC_ADMIN), and, if running SELinux in enforcing mode, only
if the corresponding SELinux mac_admin permission is also granted
to the domain by policy.  In Fedora policies, this is only allowed for
specific domains such as livecd for setting down security contexts
that are not defined in the build host policy.

[On Android, this can only be set by root/CAP_MAC_ADMIN processes,
and if running SELinux in enforcing mode, only if mac_admin permission
is granted in policy.  In Android 4.4, this would only be allowed for
root/CAP_MAC_ADMIN processes that are also in unconfined domains. In current
AOSP master, mac_admin is not allowed for any domains except the recovery
console which has a legitimate need for it.  The other potential vector
is mounting a maliciously crafted filesystem for which SELinux fetches
xattrs (e.g. an ext4 filesystem on a SDcard).  However, the end result is
only a local denial-of-service (DOS) due to kernel BUG.  This fix is
queued for 3.14.]

Reproducer:
su
setenforce 0
touch foo
setfattr -n security.selinux foo

Caveat:
Relabeling or removing foo after doing the above may not be possible
without booting with SELinux disabled.  Any subsequent access to foo
after doing the above will also trigger the BUG.

BUG output from Matthew Thode:
[  473.893141] ------------[ cut here ]------------
[  473.962110] kernel BUG at security/selinux/ss/services.c:654!
[  473.995314] invalid opcode: 0000 [#6] SMP
[  474.027196] Modules linked in:
[  474.058118] CPU: 0 PID: 8138 Comm: ls Tainted: G      D   I
3.13.0-grsec #1
[  474.116637] Hardware name: Supermicro X8ST3/X8ST3, BIOS 2.0
07/29/10
[  474.149768] task: ffff8805f50cd010 ti: ffff8805f50cd488 task.ti:
ffff8805f50cd488
[  474.183707] RIP: 0010:[<ffffffff814681c7>]  [<ffffffff814681c7>]
context_struct_compute_av+0xce/0x308
[  474.219954] RSP: 0018:ffff8805c0ac3c38  EFLAGS: 00010246
[  474.252253] RAX: 0000000000000000 RBX: ffff8805c0ac3d94 RCX:
0000000000000100
[  474.287018] RDX: ffff8805e8aac000 RSI: 00000000ffffffff RDI:
ffff8805e8aaa000
[  474.321199] RBP: ffff8805c0ac3cb8 R08: 0000000000000010 R09:
0000000000000006
[  474.357446] R10: 0000000000000000 R11: ffff8805c567a000 R12:
0000000000000006
[  474.419191] R13: ffff8805c2b74e88 R14: 00000000000001da R15:
0000000000000000
[  474.453816] FS:  00007f2e75220800(0000) GS:ffff88061fc00000(0000)
knlGS:0000000000000000
[  474.489254] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  474.522215] CR2: 00007f2e74716090 CR3: 00000005c085e000 CR4:
00000000000207f0
[  474.556058] Stack:
[  474.584325]  ffff8805c0ac3c98 ffffffff811b549b ffff8805c0ac3c98
ffff8805f1190a40
[  474.618913]  ffff8805a6202f08 ffff8805c2b74e88 00068800d0464990
ffff8805e8aac860
[  474.653955]  ffff8805c0ac3cb8 000700068113833a ffff880606c75060
ffff8805c0ac3d94
[  474.690461] Call Trace:
[  474.723779]  [<ffffffff811b549b>] ? lookup_fast+0x1cd/0x22a
[  474.778049]  [<ffffffff81468824>] security_compute_av+0xf4/0x20b
[  474.811398]  [<ffffffff8196f419>] avc_compute_av+0x2a/0x179
[  474.843813]  [<ffffffff8145727b>] avc_has_perm+0x45/0xf4
[  474.875694]  [<ffffffff81457d0e>] inode_has_perm+0x2a/0x31
[  474.907370]  [<ffffffff81457e76>] selinux_inode_getattr+0x3c/0x3e
[  474.938726]  [<ffffffff81455cf6>] security_inode_getattr+0x1b/0x22
[  474.970036]  [<ffffffff811b057d>] vfs_getattr+0x19/0x2d
[  475.000618]  [<ffffffff811b05e5>] vfs_fstatat+0x54/0x91
[  475.030402]  [<ffffffff811b063b>] vfs_lstat+0x19/0x1b
[  475.061097]  [<ffffffff811b077e>] SyS_newlstat+0x15/0x30
[  475.094595]  [<ffffffff8113c5c1>] ? __audit_syscall_entry+0xa1/0xc3
[  475.148405]  [<ffffffff8197791e>] system_call_fastpath+0x16/0x1b
[  475.179201] Code: 00 48 85 c0 48 89 45 b8 75 02 0f 0b 48 8b 45 a0 48
8b 3d 45 d0 b6 00 8b 40 08 89 c6 ff ce e8 d1 b0 06 00 48 85 c0 49 89 c7
75 02 <0f> 0b 48 8b 45 b8 4c 8b 28 eb 1e 49 8d 7d 08 be 80 01 00 00 e8
[  475.255884] RIP  [<ffffffff814681c7>]
context_struct_compute_av+0xce/0x308
[  475.296120]  RSP <ffff8805c0ac3c38>
[  475.328734] ---[ end trace f076482e9d754adc ]---

[sds:  commit message edited to note Android implications and
to generate a unique Change-Id for gerrit]

Change-Id: I4d5389f0cfa72b5f59dada45081fa47e03805413
Reported-by:  Matthew Thode <mthode@mthode.org>
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Cc: stable@vger.kernel.org
Signed-off-by: Paul Moore <pmoore@redhat.com>
Signed-off-by: Sivasri Kumar Vanka <sivasri@codeaurora.org>
audio: Change to set the USB switch state correctly

 - Changes to set the USB switch after the stream is added and
the card is registered with the sound core.

Change-Id: I5ee4df25408f809051ac49c25662cebf283902b3
Signed-off-by: Shreyas Nagasandra Chandrasekhar <snagas@codeaurora.org>
cfg80211: fix possible circular lock on reg_regdb_search()

When call_crda() is called we kick off a witch hunt search
for the same regulatory domain on our internal regulatory
database and that work gets kicked off on a workqueue, this
is done while the cfg80211_mutex is held. If that workqueue
kicks off it will first lock reg_regdb_search_mutex and
later cfg80211_mutex but to ensure two CPUs will not contend
against cfg80211_mutex the right thing to do is to have the
reg_regdb_search() wait until the cfg80211_mutex is let go.

Change-Id: Ibb44a5325876d77f1549d3938d56d8fbd051b9ba
CRs-Fixed: 655287
Signed-off-by: Santhosh Kumar Padma <skpadma@codeaurora.org>
qseecom: Validate pointer offset in qseecom_send_modfd_cmd

Validate cmd_req_buf pointer offset in qseecom_send_modfy_cmd, and
make sure cmd buffer address to be within shared bufffer.

Signed-off-by: Zhen Kong <zkong@codeaurora.org>

Change-Id: I431511a92ab2cccbc2daebc0cf76cc3872689a97
Signed-off-by: Zhen Kong <zkong@codeaurora.org>
Signed-off-by: Vignesh Veeramani <quicvignes@codeaurora.org>
msm: Create shadow files under /sys/kernel/ipv4

The TCP delayed ack parameters can be configured from user space
application which runs with non-root credentials and does not have
direct write access to /proc entries. This commit creates shadow
files under /sys/kernel/ipv4 which maps to /proc/sys/net/ipv4.

CRs-Fixed: 628139
Change-Id: If9f5e8f1f5f31c39090555b7b0c40efcdf6ccd08
Signed-off-by: Ravi Joshi <ravij@codeaurora.org>
wcnss: Log debug registers when receives certain notification

If powering on a subsystem during restart fails, SSR framework will send
a "powerup failure" notification to the subsystem. Add support that
WCNSS platform driver will register to listen the notifications and if
receives "powerup failure" notification, it will log the debug registers.

Change-Id: I0ae8a5ee96122d71c7a86711044f6b07e400b62c
Signed-off-by: Yue Ma <yuem@codeaurora.org>
[smihir@codeaurora.org: removed powerup failure notification for riva]
Signed-off-by: Mihir Shete <smihir@codeaurora.org>
wcnss: add API to check if wcnss is undergoing an SSR

Wlan driver should not read registers from wcnss or
try to communicate with the chip when it is undergoing
a subsystem-restart. Added an API with the wcnss platform
driver to check if ssr is in progress, this API will be
used by the wlan driver to protect register access and
other prohibited operations.

Change-Id: Ia0d93e774af126d84dbaabf5c36a2c90fdbd58be
CRs-Fixed: 621974
Signed-off-by: Mihir Shete <smihir@codeaurora.org>
msm: kgsl: Setup a3xx protection in its start function

Setup the protection registers for a3xx towards the end of its
start function instead of doing it in generic ringbuffer start

Conflicts:
	drivers/gpu/msm/adreno_ringbuffer.c

Change-Id: I66df496afa5d1fdf7dea790306f5358c2098674d
Signed-off-by: Shubhraprakash Das <sadas@codeaurora.org>
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>
msm: kgsl: Enable protected register mode for A3XX

Turn on protected register mode for the A3XX GPU family and add 0x63
(RBBM_INT_0_MASK) to the list of protected registers.

Conflicts:
	drivers/gpu/msm/adreno.h
	drivers/gpu/msm/adreno_a3xx.c
	drivers/gpu/msm/adreno_ringbuffer.c

Change-Id: Ic0dedbad10ebfa6eb6d3d815b5aa9b6b6f0e8e35
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>
msm: kgsl: Protect SMMU registers from being written by the GPU

Put the SMMU register range in protected mode to shield them from
IB1/IB2 writes from userspace.

CRs-Fixed: 599971
Change-Id: Ic0dedbad8c03fc1c54ff73221231e2440d3c34dd
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>
msm: kgsl: Print the register that causes a protected mode error

When we get a protected mode error print out the register information
that caused the exception.

Change-Id: Ic0dedbad4f586c5715669226619b51665ef9681f
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>
Merge "msm: Create shadow files under /sys/kernel/ipv4"
msm: camera: Sanity check in ispif release
Add BUG_ON for ispif address and check ispif base address
validity in ispif release function.

CRs-Fixed: 642603

Change-Id: Ic4e672cb35fdd6eafe1c9fc081b2f86c570ceeb8
Signed-off-by: Ashok Raj Deenadayalan <adeena@codeaurora.org>
Merge "audio: Change to set the USB switch state correctly"
Merge "SELinux: Fix kernel BUG on empty security contexts."
msm: kgsl: Protect CP_STATE_DEBUG_INDEX

Put CP_STATE_DEBUG_INDEX and CP_STATE_DEBUG_DATA under protection
to keep it from being written from an IB1. Doing so however opens
up a subtle "feature" in the microcode: memory read opcodes turn off
protected mode in the microcode to do the read and then turns it
back on regardless of the initial state. This is a problem if the
memory read happens while protected mode is turned off and then we
try to access a protected register which then complains and goes boom.

To account for this irregularity explicitly turn back off protected
mode in all the places where we know this will be a problem.

Conflicts:
	drivers/gpu/msm/adreno.c
	drivers/gpu/msm/adreno_a3xx.c

Change-Id: Ic0dedbad1397ca9b80132241ac006560a615e042
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>
msm: kgsl: Mark the IOMMU setstate memory as read only

Mark the IOMMU setstate memory as read only in the pagetable.

Change-Id: Ic0dedbadb19e499c749cd744c3e89be3bcb4c2a2
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>
msm: msm_fb: Handle out of order msm_fb ioctls

Handle two cases when ioctls are received when they are not expected.
 - Writeback ioctls received when writeback (FB2) is not active.
 - Writeback ioctls received in random sequence when writeback (FB2)
   is active.

Change-Id: I54982e1aef09fd9c7df9354a139ac34219017951
Signed-off-by: Nirmal Abraham <nabrah@codeaurora.org>
msm: kgsl: Enable protected register mode for A2XX

Turn on protected register mode for the A2XX GPU family.

Change-Id: Iecf88d648c9f86faef4fa53e90c2ce81101c58fa
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>
'Revert "msm: camera: Enable interrupts before returning during Invalid Image mode."

This reverts commit e6f398d23b8a7ad154ad1f9a7e7c9ae4d6f0b22f.

Change-Id: Ib18e458055695322cf34c73da5e7113ec7ee6cbd
Signed-off-by: Vijaya Kumar T M <vtmuni@codeaurora.org>