xt_IDLETIMER: Add new netlink msg type for IDLETIMER.

Squashed commit of the following:

commit 3cfe1023c0999bd7bf5b991e82f5f14a39454969
Author: Ashish Sharma <ashishsharma@google.com>
Date:   Wed Feb 5 01:50:50 2014 +0000

    netfilter: xt_IDLETIMER: Revert to retain the kernel API format.

    Reverted Change-Id: Iaeca5dd2d7878c0733923ae03309a2a7b86979ca

    Change-Id: I0e0a4f60ec14330d8d8d1c5a508fa058d9919e07
    Signed-off-by: Ashish Sharma <ashishsharma@google.com>

commit bf204ad9814c621ef28686d736c79a3c6c5506d3
Author: Ashish Sharma <ashishsharma@google.com>
Date:   Mon Aug 13 11:38:49 2012 -0700

    netfilter: xt_IDLETIMER: Rename INTERFACE to LABEL in netlink notification.

    Signed-off-by: Ashish Sharma <ashishsharma@google.com>

commit 70fa6a5d5019638d46406b29789284923b4bf89f
Author: JP Abgrall <jpa@google.com>
Date:   Fri May 4 14:26:57 2012 -0700

    netfilter: xt_IDLETIMER: Use uevent instead of new netlink msg type

    Send netlink message notifications using a uevent with
      subsystem=xt_idletimer
      INTERFACE=...
      STATE={active,inactive}
    instead of needing a new netlink message type.
    Revert the netlink.h change added by commit
      beb914e987cbbd368988d2b94a6661cb907c4d5a

    Change-Id: I6881936bf754f3367ff3c8f6c1e9661cec0357d4
    Signed-off-by: JP Abgrall <jpa@google.com>

commit 43c75b7d23b947539508c8e9deb026333194d444
Author: Ashish Sharma <ashishsharma@google.com>
Date:   Thu Mar 29 13:02:27 2012 -0700

    xt_IDLETIMER: Add new netlink msg type for IDLETIMER.

    Send notifications when the label becomes active after an idle period.
    Send netlink message notifications in addition to sysfs notifications.

    Change-Id: I31677ef00c94b5f82c8457e5bf9e5e584c23c523
    Signed-off-by: Ashish Sharma <ashishsharma@google.com>

Change-Id: I04d0258bc52b284c8d8b40c53a65994c7464d443
arm: endeavoru defconfig: Enable netfilter idletimer

Change-Id: I337cea1ed98d52d1428177926d068736d3010279
net: ipv6: Add IPv6 support to the ping socket.

Squashed commit of the following:

commit 09fdd03555b0c6ac3dd27fd116c2227d5ef7d6f3
Author: Lorenzo Colitti <lorenzo@google.com>
Date:   Thu Jul 4 00:12:40 2013 +0900

    net: ipv6: fix wrong ping_v6_sendmsg return value

    [net-next commit fbfe80c890a1dc521d0b629b870e32fcffff0da5]

    ping_v6_sendmsg currently returns 0 on success. It should return
    the number of bytes written instead.

    Bug: 9469865
    Change-Id: I82b7d3a37ba91ad24e6dbd97a4880745ce16ad31
    Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 3fcf8d4851e4eec508423d2c6cca3937368be7c3
Author: Lorenzo Colitti <lorenzo@google.com>
Date:   Thu Jul 4 00:52:49 2013 +0900

    net: ipv6: add missing lock in ping_v6_sendmsg

    [net-next commit a1bdc45580fc19e968b32ad27cd7e476a4aa58f6]

    Bug: 9469865
    Change-Id: I480f8ce95956dd8f17fbbb26dc60cc162f8ec933
    Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 036b819793cb3bcd30b8718dc240a5b4b377f6dc
Author: Cong Wang <amwang@redhat.com>
Date:   Sun Jun 2 22:43:52 2013 +0000

    ping: always initialize ->sin6_scope_id and ->sin6_flowinfo

    [net-next commit c26d6b46da3ee86fa8a864347331e5513ca84c2b]

    If we don't need scope id, we should initialize it to zero.
    Same for ->sin6_flowinfo.

    Change-Id: I28e4bc9593e76fc3434052182466fab4bb8ccf3a
    Cc: Lorenzo Colitti <lorenzo@google.com>
    Cc: David S. Miller <davem@davemloft.net>
    Signed-off-by: Cong Wang <amwang@redhat.com>
    Acked-by: Lorenzo Colitti <lorenzo@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 34f8ee7b67086c089898db3eca698541682d2748
Author: Lorenzo Colitti <lorenzo@google.com>
Date:   Wed Jan 16 22:09:49 2013 +0000

    net: ipv6: Add IPv6 support to the ping socket.

    [backport of net-next 6d0bfe22611602f36617bc7aa2ffa1bbb2f54c67]

    This adds the ability to send ICMPv6 echo requests without a
    raw socket. The equivalent ability for ICMPv4 was added in
    2011.

    Instead of having separate code paths for IPv4 and IPv6, make
    most of the code in net/ipv4/ping.c dual-stack and only add a
    few IPv6-specific bits (like the protocol definition) to a new
    net/ipv6/ping.c. Hopefully this will reduce divergence and/or
    duplication of bugs in the future.

    Caveats:

    - Setting options via ancillary data (e.g., using IPV6_PKTINFO
      to specify the outgoing interface) is not yet supported.
    - There are no separate security settings for IPv4 and IPv6;
      everything is controlled by /proc/net/ipv4/ping_group_range.
    - The proc interface does not yet display IPv6 ping sockets
      properly.

    Tested with a patched copy of ping6 and using raw socket calls.
    Compiles and works with all of CONFIG_IPV6={n,m,y}.

    Change-Id: Ia359af556021344fc7f890c21383aadf950b6498
    Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    [lorenzo@google.com: backported to 3.0]
    Signed-off-by: Lorenzo Colitti <lorenzo@google.com>

commit 19ea39e13d0ca712bc1b336a650ef7d942064d07
Author: Hannes Frederic Sowa <hannes@stressinduktion.org>
Date:   Fri Mar 8 02:07:16 2013 +0000

    ipv6: introdcue __ipv6_addr_needs_scope_id and ipv6_iface_scope_id helper functions

    [net-next commit b7ef213ef65256168df83ddfbb8131ed9adc10f9]

    __ipv6_addr_needs_scope_id checks if an ipv6 address needs to supply
    a 'sin6_scope_id != 0'. 'sin6_scope_id != 0' was enforced in case
    of link-local addresses. To support interface-local multicast these
    checks had to be enhanced and are now consolidated into these new helper
    functions.

    v2:
    a) migrated to struct ipv6_addr_props

    v3:
    a) reverted changes for ipv6_addr_props
    b) test for address type instead of comparing scope

    v4:
    a) unchanged

    Change-Id: Id6fc54cec61f967928e08a9eba4f857157d973a3
    Suggested-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
    Cc: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
    Acked-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
    Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
    Acked-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 77c3b0a7319b81a3906547351f461ec0c40c955f
Author: Li Wei <lw@cn.fujitsu.com>
Date:   Thu Feb 21 00:09:54 2013 +0000

    ipv4: fix a bug in ping_err().

    [ Upstream commit b531ed61a2a2a77eeb2f7c88b49aa5ec7d9880d8 ]

    We should get 'type' and 'code' from the outer ICMP header.

    Signed-off-by: Li Wei <lw@cn.fujitsu.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Change-Id: I24280b4bff802b5af7b08ef0ac856f6270fee712
SELinux: Fix possible NULL pointer dereference in selinux_inode_permission()

While running stress tests on adding and deleting ftrace instances I hit
this bug:

  BUG: unable to handle kernel NULL pointer dereference at 0000000000000020
  IP: selinux_inode_permission+0x85/0x160
  PGD 63681067 PUD 7ddbe067 PMD 0
  Oops: 0000 [#1] PREEMPT
  CPU: 0 PID: 5634 Comm: ftrace-test-mki Not tainted 3.13.0-rc4-test-00033-gd2a6dde-dirty #20
  Hardware name:                  /DG965MQ, BIOS MQ96510J.86A.0372.2006.0605.1717 06/05/2006
  task: ffff880078375800 ti: ffff88007ddb0000 task.ti: ffff88007ddb0000
  RIP: 0010:[<ffffffff812d8bc5>]  [<ffffffff812d8bc5>] selinux_inode_permission+0x85/0x160
  RSP: 0018:ffff88007ddb1c48  EFLAGS: 00010246
  RAX: 0000000000000000 RBX: 0000000000800000 RCX: ffff88006dd43840
  RDX: 0000000000000001 RSI: 0000000000000081 RDI: ffff88006ee46000
  RBP: ffff88007ddb1c88 R08: 0000000000000000 R09: ffff88007ddb1c54
  R10: 6e6576652f6f6f66 R11: 0000000000000003 R12: 0000000000000000
  R13: 0000000000000081 R14: ffff88006ee46000 R15: 0000000000000000
  FS:  00007f217b5b6700(0000) GS:ffffffff81e21000(0000) knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033^M
  CR2: 0000000000000020 CR3: 000000006a0fe000 CR4: 00000000000007f0
  Call Trace:
    security_inode_permission+0x1c/0x30
    __inode_permission+0x41/0xa0
    inode_permission+0x18/0x50
    link_path_walk+0x66/0x920
    path_openat+0xa6/0x6c0
    do_filp_open+0x43/0xa0
    do_sys_open+0x146/0x240
    SyS_open+0x1e/0x20
    system_call_fastpath+0x16/0x1b
  Code: 84 a1 00 00 00 81 e3 00 20 00 00 89 d8 83 c8 02 40 f6 c6 04 0f 45 d8 40 f6 c6 08 74 71 80 cf 02 49 8b 46 38 4c 8d 4d cc 45 31 c0 <0f> b7 50 20 8b 70 1c 48 8b 41 70 89 d9 8b 78 04 e8 36 cf ff ff
  RIP  selinux_inode_permission+0x85/0x160
  CR2: 0000000000000020

Investigating, I found that the inode->i_security was NULL, and the
dereference of it caused the oops.

in selinux_inode_permission():

	isec = inode->i_security;

	rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);

Note, the crash came from stressing the deletion and reading of debugfs
files.  I was not able to recreate this via normal files.  But I'm not
sure they are safe.  It may just be that the race window is much harder
to hit.

What seems to have happened (and what I have traced), is the file is
being opened at the same time the file or directory is being deleted.
As the dentry and inode locks are not held during the path walk, nor is
the inodes ref counts being incremented, there is nothing saving these
structures from being discarded except for an rcu_read_lock().

The rcu_read_lock() protects against freeing of the inode, but it does
not protect freeing of the inode_security_struct.  Now if the freeing of
the i_security happens with a call_rcu(), and the i_security field of
the inode is not changed (it gets freed as the inode gets freed) then
there will be no issue here.  (Linus Torvalds suggested not setting the
field to NULL such that we do not need to check if it is NULL in the
permission check).

Note, this is a hack, but it fixes the problem at hand.  A real fix is
to restructure the destroy_inode() to call all the destructor handlers
from the RCU callback.  But that is a major job to do, and requires a
lot of work.  For now, we just band-aid this bug with this fix (it
works), and work on a more maintainable solution in the future.

Link: http://lkml.kernel.org/r/20140109101932.0508dec7@gandalf.local.home
Link: http://lkml.kernel.org/r/20140109182756.17abaaa8@gandalf.local.home

Change-Id: I8bcbba7614f96403f1273390603cbb1e122a0525
Cc: stable@vger.kernel.org
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
SELinux: Fix kernel BUG on empty security contexts.

Setting an empty security context (length=0) on a file will
lead to incorrectly dereferencing the type and other fields
of the security context structure, yielding a kernel BUG.
As a zero-length security context is never valid, just reject
all such security contexts whether coming from userspace
via setxattr or coming from the filesystem upon a getxattr
request by SELinux.

Setting a security context value (empty or otherwise) unknown to
SELinux in the first place is only possible for a root process
(CAP_MAC_ADMIN), and, if running SELinux in enforcing mode, only
if the corresponding SELinux mac_admin permission is also granted
to the domain by policy.  In Fedora policies, this is only allowed for
specific domains such as livecd for setting down security contexts
that are not defined in the build host policy.

[On Android, this can only be set by root/CAP_MAC_ADMIN processes,
and if running SELinux in enforcing mode, only if mac_admin permission
is granted in policy.  In Android 4.4, this would only be allowed for
root/CAP_MAC_ADMIN processes that are also in unconfined domains. In current
AOSP master, mac_admin is not allowed for any domains except the recovery
console which has a legitimate need for it.  The other potential vector
is mounting a maliciously crafted filesystem for which SELinux fetches
xattrs (e.g. an ext4 filesystem on a SDcard).  However, the end result is
only a local denial-of-service (DOS) due to kernel BUG.  This fix is
queued for 3.14.]

Reproducer:
su
setenforce 0
touch foo
setfattr -n security.selinux foo

Caveat:
Relabeling or removing foo after doing the above may not be possible
without booting with SELinux disabled.  Any subsequent access to foo
after doing the above will also trigger the BUG.

BUG output from Matthew Thode:
[  473.893141] ------------[ cut here ]------------
[  473.962110] kernel BUG at security/selinux/ss/services.c:654!
[  473.995314] invalid opcode: 0000 [#6] SMP
[  474.027196] Modules linked in:
[  474.058118] CPU: 0 PID: 8138 Comm: ls Tainted: G      D   I
3.13.0-grsec #1
[  474.116637] Hardware name: Supermicro X8ST3/X8ST3, BIOS 2.0
07/29/10
[  474.149768] task: ffff8805f50cd010 ti: ffff8805f50cd488 task.ti:
ffff8805f50cd488
[  474.183707] RIP: 0010:[<ffffffff814681c7>]  [<ffffffff814681c7>]
context_struct_compute_av+0xce/0x308
[  474.219954] RSP: 0018:ffff8805c0ac3c38  EFLAGS: 00010246
[  474.252253] RAX: 0000000000000000 RBX: ffff8805c0ac3d94 RCX:
0000000000000100
[  474.287018] RDX: ffff8805e8aac000 RSI: 00000000ffffffff RDI:
ffff8805e8aaa000
[  474.321199] RBP: ffff8805c0ac3cb8 R08: 0000000000000010 R09:
0000000000000006
[  474.357446] R10: 0000000000000000 R11: ffff8805c567a000 R12:
0000000000000006
[  474.419191] R13: ffff8805c2b74e88 R14: 00000000000001da R15:
0000000000000000
[  474.453816] FS:  00007f2e75220800(0000) GS:ffff88061fc00000(0000)
knlGS:0000000000000000
[  474.489254] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  474.522215] CR2: 00007f2e74716090 CR3: 00000005c085e000 CR4:
00000000000207f0
[  474.556058] Stack:
[  474.584325]  ffff8805c0ac3c98 ffffffff811b549b ffff8805c0ac3c98
ffff8805f1190a40
[  474.618913]  ffff8805a6202f08 ffff8805c2b74e88 00068800d0464990
ffff8805e8aac860
[  474.653955]  ffff8805c0ac3cb8 000700068113833a ffff880606c75060
ffff8805c0ac3d94
[  474.690461] Call Trace:
[  474.723779]  [<ffffffff811b549b>] ? lookup_fast+0x1cd/0x22a
[  474.778049]  [<ffffffff81468824>] security_compute_av+0xf4/0x20b
[  474.811398]  [<ffffffff8196f419>] avc_compute_av+0x2a/0x179
[  474.843813]  [<ffffffff8145727b>] avc_has_perm+0x45/0xf4
[  474.875694]  [<ffffffff81457d0e>] inode_has_perm+0x2a/0x31
[  474.907370]  [<ffffffff81457e76>] selinux_inode_getattr+0x3c/0x3e
[  474.938726]  [<ffffffff81455cf6>] security_inode_getattr+0x1b/0x22
[  474.970036]  [<ffffffff811b057d>] vfs_getattr+0x19/0x2d
[  475.000618]  [<ffffffff811b05e5>] vfs_fstatat+0x54/0x91
[  475.030402]  [<ffffffff811b063b>] vfs_lstat+0x19/0x1b
[  475.061097]  [<ffffffff811b077e>] SyS_newlstat+0x15/0x30
[  475.094595]  [<ffffffff8113c5c1>] ? __audit_syscall_entry+0xa1/0xc3
[  475.148405]  [<ffffffff8197791e>] system_call_fastpath+0x16/0x1b
[  475.179201] Code: 00 48 85 c0 48 89 45 b8 75 02 0f 0b 48 8b 45 a0 48
8b 3d 45 d0 b6 00 8b 40 08 89 c6 ff ce e8 d1 b0 06 00 48 85 c0 49 89 c7
75 02 <0f> 0b 48 8b 45 b8 4c 8b 28 eb 1e 49 8d 7d 08 be 80 01 00 00 e8
[  475.255884] RIP  [<ffffffff814681c7>]
context_struct_compute_av+0xce/0x308
[  475.296120]  RSP <ffff8805c0ac3c38>
[  475.328734] ---[ end trace f076482e9d754adc ]---

[sds:  commit message edited to note Android implications and
to generate a unique Change-Id for gerrit]

Change-Id: I4d5389f0cfa72b5f59dada45081fa47e03805413
Reported-by:  Matthew Thode <mthode@mthode.org>
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Cc: stable@vger.kernel.org
Signed-off-by: Paul Moore <pmoore@redhat.com>
fix false disconnect due to a signal sent to the reading process

- In the current implementation, when a signal is sent to the reading process,
  read is cancelled by calling usb_ep_dequeue, which lead into calling
  acc_complete_out with ECONNRESET, but the current logic treats it as
  disconnection, which makes the device inaccessible until cable is actually
  disconnected.
- The fix calls disconnect only when ESHUTDOWN error is passed.
- If data has already arrived while trying cancelling, the data is marked
  as available, and it will be read out on the next read. This is necessary
  as USB bulk is assumed to guarantee no data loss.

Change-Id: Ic4b7b793682c7c3dc696f4d889884269216113d7
Signed-off-by: keunyoung <keunyoung@google.com>
arm: tegra: endeavoru: Call blue_pincfg functions after ti_st update

The functions were previously called from kim_probe, st_kim_start,
st_kim_stop and some rfkill switch. This should hopefully restore identical
behaviour.

This may fix our Bluetooth and GPS problems.

Change-Id: I641885d54b905c154b9876c45defa2c7718c50c7
Merge changes Ic4b7b793,I4d5389f0,I8bcbba76 into cm-11.0

* changes:
  fix false disconnect due to a signal sent to the reading process
  SELinux: Fix kernel BUG on empty security contexts.
  SELinux: Fix possible NULL pointer dereference in selinux_inode_permission()
Merge "xt_IDLETIMER: Add new netlink msg type for IDLETIMER." into cm-11.0
Merge "arm: endeavoru defconfig: Enable netfilter idletimer" into cm-11.0
Merge "net: ipv6: Add IPv6 support to the ping socket." into cm-11.0