SELinux: Fix kernel BUG on empty security contexts.

Setting an empty security context (length=0) on a file will
lead to incorrectly dereferencing the type and other fields
of the security context structure, yielding a kernel BUG.
As a zero-length security context is never valid, just reject
all such security contexts whether coming from userspace
via setxattr or coming from the filesystem upon a getxattr
request by SELinux.

Setting a security context value (empty or otherwise) unknown to
SELinux in the first place is only possible for a root process
(CAP_MAC_ADMIN), and, if running SELinux in enforcing mode, only
if the corresponding SELinux mac_admin permission is also granted
to the domain by policy.  In Fedora policies, this is only allowed for
specific domains such as livecd for setting down security contexts
that are not defined in the build host policy.

[On Android, this can only be set by root/CAP_MAC_ADMIN processes,
and if running SELinux in enforcing mode, only if mac_admin permission
is granted in policy.  In Android 4.4, this would only be allowed for
root/CAP_MAC_ADMIN processes that are also in unconfined domains. In current
AOSP master, mac_admin is not allowed for any domains except the recovery
console which has a legitimate need for it.  The other potential vector
is mounting a maliciously crafted filesystem for which SELinux fetches
xattrs (e.g. an ext4 filesystem on a SDcard).  However, the end result is
only a local denial-of-service (DOS) due to kernel BUG.  This fix is
queued for 3.14.]

Reproducer:
su
setenforce 0
touch foo
setfattr -n security.selinux foo

Caveat:
Relabeling or removing foo after doing the above may not be possible
without booting with SELinux disabled.  Any subsequent access to foo
after doing the above will also trigger the BUG.

BUG output from Matthew Thode:
[  473.893141] ------------[ cut here ]------------
[  473.962110] kernel BUG at security/selinux/ss/services.c:654!
[  473.995314] invalid opcode: 0000 [#6] SMP
[  474.027196] Modules linked in:
[  474.058118] CPU: 0 PID: 8138 Comm: ls Tainted: G      D   I
3.13.0-grsec #1
[  474.116637] Hardware name: Supermicro X8ST3/X8ST3, BIOS 2.0
07/29/10
[  474.149768] task: ffff8805f50cd010 ti: ffff8805f50cd488 task.ti:
ffff8805f50cd488
[  474.183707] RIP: 0010:[<ffffffff814681c7>]  [<ffffffff814681c7>]
context_struct_compute_av+0xce/0x308
[  474.219954] RSP: 0018:ffff8805c0ac3c38  EFLAGS: 00010246
[  474.252253] RAX: 0000000000000000 RBX: ffff8805c0ac3d94 RCX:
0000000000000100
[  474.287018] RDX: ffff8805e8aac000 RSI: 00000000ffffffff RDI:
ffff8805e8aaa000
[  474.321199] RBP: ffff8805c0ac3cb8 R08: 0000000000000010 R09:
0000000000000006
[  474.357446] R10: 0000000000000000 R11: ffff8805c567a000 R12:
0000000000000006
[  474.419191] R13: ffff8805c2b74e88 R14: 00000000000001da R15:
0000000000000000
[  474.453816] FS:  00007f2e75220800(0000) GS:ffff88061fc00000(0000)
knlGS:0000000000000000
[  474.489254] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  474.522215] CR2: 00007f2e74716090 CR3: 00000005c085e000 CR4:
00000000000207f0
[  474.556058] Stack:
[  474.584325]  ffff8805c0ac3c98 ffffffff811b549b ffff8805c0ac3c98
ffff8805f1190a40
[  474.618913]  ffff8805a6202f08 ffff8805c2b74e88 00068800d0464990
ffff8805e8aac860
[  474.653955]  ffff8805c0ac3cb8 000700068113833a ffff880606c75060
ffff8805c0ac3d94
[  474.690461] Call Trace:
[  474.723779]  [<ffffffff811b549b>] ? lookup_fast+0x1cd/0x22a
[  474.778049]  [<ffffffff81468824>] security_compute_av+0xf4/0x20b
[  474.811398]  [<ffffffff8196f419>] avc_compute_av+0x2a/0x179
[  474.843813]  [<ffffffff8145727b>] avc_has_perm+0x45/0xf4
[  474.875694]  [<ffffffff81457d0e>] inode_has_perm+0x2a/0x31
[  474.907370]  [<ffffffff81457e76>] selinux_inode_getattr+0x3c/0x3e
[  474.938726]  [<ffffffff81455cf6>] security_inode_getattr+0x1b/0x22
[  474.970036]  [<ffffffff811b057d>] vfs_getattr+0x19/0x2d
[  475.000618]  [<ffffffff811b05e5>] vfs_fstatat+0x54/0x91
[  475.030402]  [<ffffffff811b063b>] vfs_lstat+0x19/0x1b
[  475.061097]  [<ffffffff811b077e>] SyS_newlstat+0x15/0x30
[  475.094595]  [<ffffffff8113c5c1>] ? __audit_syscall_entry+0xa1/0xc3
[  475.148405]  [<ffffffff8197791e>] system_call_fastpath+0x16/0x1b
[  475.179201] Code: 00 48 85 c0 48 89 45 b8 75 02 0f 0b 48 8b 45 a0 48
8b 3d 45 d0 b6 00 8b 40 08 89 c6 ff ce e8 d1 b0 06 00 48 85 c0 49 89 c7
75 02 <0f> 0b 48 8b 45 b8 4c 8b 28 eb 1e 49 8d 7d 08 be 80 01 00 00 e8
[  475.255884] RIP  [<ffffffff814681c7>]
context_struct_compute_av+0xce/0x308
[  475.296120]  RSP <ffff8805c0ac3c38>
[  475.328734] ---[ end trace f076482e9d754adc ]---

[sds:  commit message edited to note Android implications and
to generate a unique Change-Id for gerrit]

Change-Id: I4d5389f0cfa72b5f59dada45081fa47e03805413
Reported-by:  Matthew Thode <mthode@mthode.org>
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Cc: stable@vger.kernel.org
Signed-off-by: Paul Moore <pmoore@redhat.com>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
msm: iommu: Check for NULL genpools during domain teardown

During domain creation, some of the genpools will be set to NULL if
there is not enough memory for creation. Check for these NULL
genpools during domain destruction to avoid NULL dereferences.

Change-Id: I60238c138b809ef5c13383f5b1752ab6c799707d
CRs-Fixed: 573612
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
msm: cachedump: Add cache maintenance for calls into TZ

The scm_call API is no longer providing implicit cache maintenance for
shared buffers. Add cache flushing for buffers heading towards TZ and
cache invalidation for buffers coming from TZ.

Change-Id: Iaafdc10ee49b43f462ba00dd751861a3b285a067
Signed-off-by: Mitchel Humpherys <mitchelh@codeaurora.org>
kernel: alarm: :fix the BUG that device automatically powers on

The value of alarm.time is invalid if we get it by:
    memset(&alarm, 0, sizeof(alarm)).
So function of rtc_set_alarm aborts before it really calls into:
    rtc->ops->set_alarm.
Then we can`t disable the RTC alarm by that. The result is some
alarms enabled by alarm_suspend are not disabled correctly during
alarm_resume. And device will automatically power on.

CRs-fixed: 524051
Change-Id: Ibc99e62878d17ad4f50325630bf0862207e2cf3f
Signed-off-by: Figo Wang <figow@codeaurora.org>
arm: msm: add alarm reboot reason

Add alarm reboot reason for power off charging.

Change-Id: If94d0e4a7ec250cfaa61bf578cae9324db05d32c
Signed-off-by: Maria Yu <aiquny@codeaurora.org>
mmc: core: Hold host resume status while card rescan is in progress

In case if a removable card is hot-plugged when the card and host
are runtime suspended then the mmc_rescan() tries to detect the card
status and removes the bus_ops. During card removal the Linux device
model calls pm_runtime_remove() of the corresponding "card" device,
which not only marks the device as suspended but also notifies the
parent so that it can be suspended if there are no children that are
holding resume. In case if the runtime suspend work of host is scheduled
before bus_ops are marked NULL in mmc_rescan(), the runtime suspend
of host fails with -ENOMEDIUM error. This error makes runtime PM framework
to permanently mark the host device in error and further runtime PM
operations are disallowed even when the card is re-inserted.

CRs-Fixed: 593475
Change-Id: Ie5e09f05ef26098c561b0c64b3954962d9d4c039
Signed-off-by: Sujit Reddy Thumma <sthumma@codeaurora.org>
msm: kgsl: Force the ME off before reading the microcode

On A3XX reading the microcode while the CP is running is dangerous
beyond words.  By setting the offset address for the read, we are
essentially changing the instruction pointer for the ME while it
is running causing opcode errors, gpu faults and/or system errors.

We do not want to stop the CP at the beginning of the snapshot
process beacuse doing so changes the RBBM status and the state of
the CP registers which may damage the debug effort.  But by the
time we get to the microcode read we no longer care about the state
of the registers so we can freely halt the ME just before starting
the read.

CRs-fixed: 585449
Change-Id: Ic0dedbad85d7ec26915f054dd597e226e8101a29
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
msm: kgsl: Panic if global timestamp wait fails in context detach

If we timeout while waiting for the last issued global timestamp for
a detaching context to expire (10 seconds!) then we are on a fast
train to crashville.  BUG_ON() so we can stand a chance of debugging
this very rare issue.

Change-Id: Ic0dedbaddb9cbc5681f9c872785ce26b7cf9b87b
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
mm: Don't use CMA pages for page cache

All layers of the page cache may take extra references to
pages to avoid migration. This is fine for general movable
pages but renders CMA pages useless as they cannot be
allocated for contiguous mode. Always omitting movable
pages completely has poor utilization of memory so attempt
with the given GFP flags first and if a CMA page is allocated,
free it and get a new non-movable page. This does have a minor
performance impact, but ultimately it's a tradeoff between
never using movable pages and taking the extra hit of a
free/realloc.

Change-Id: I4e9d7fc1c65306d6356492fd1a99935aa62ed2ec
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
sysctl: Don't scan for the leaks on headers

These header allocations have life cycle till the device goes
shutdown. So, considering them as leak is false positive. Remove
them by marking kmemleak_not_leak

CRs-Fixed: 466552
Change-Id: Id1571b78365e533ddfe866d45cef8f89b0b62bc7
Signed-off-by: Chintan Pandya <cpandya@codeaurora.org>
msm: msm_bus: Don't divide RPM BW requests

When sending bandwidth requests to slave don't divide the request by
the number of ports as this is done at the RPM driver.

CRs-Fixed: 611965
Change-Id: Ie6870b66d1621677d94e4441136aed89bbdb6595
Signed-off-by: Girish Mahadevan <girishm@codeaurora.org>