SELinux: Fix kernel BUG on empty security contexts.

Setting an empty security context (length=0) on a file will
lead to incorrectly dereferencing the type and other fields
of the security context structure, yielding a kernel BUG.
As a zero-length security context is never valid, just reject
all such security contexts whether coming from userspace
via setxattr or coming from the filesystem upon a getxattr
request by SELinux.

Setting a security context value (empty or otherwise) unknown to
SELinux in the first place is only possible for a root process
(CAP_MAC_ADMIN), and, if running SELinux in enforcing mode, only
if the corresponding SELinux mac_admin permission is also granted
to the domain by policy.  In Fedora policies, this is only allowed for
specific domains such as livecd for setting down security contexts
that are not defined in the build host policy.

[On Android, this can only be set by root/CAP_MAC_ADMIN processes,
and if running SELinux in enforcing mode, only if mac_admin permission
is granted in policy.  In Android 4.4, this would only be allowed for
root/CAP_MAC_ADMIN processes that are also in unconfined domains. In current
AOSP master, mac_admin is not allowed for any domains except the recovery
console which has a legitimate need for it.  The other potential vector
is mounting a maliciously crafted filesystem for which SELinux fetches
xattrs (e.g. an ext4 filesystem on a SDcard).  However, the end result is
only a local denial-of-service (DOS) due to kernel BUG.  This fix is
queued for 3.14.]

Reproducer:
su
setenforce 0
touch foo
setfattr -n security.selinux foo

Caveat:
Relabeling or removing foo after doing the above may not be possible
without booting with SELinux disabled.  Any subsequent access to foo
after doing the above will also trigger the BUG.

BUG output from Matthew Thode:
[  473.893141] ------------[ cut here ]------------
[  473.962110] kernel BUG at security/selinux/ss/services.c:654!
[  473.995314] invalid opcode: 0000 [#6] SMP
[  474.027196] Modules linked in:
[  474.058118] CPU: 0 PID: 8138 Comm: ls Tainted: G      D   I
3.13.0-grsec #1
[  474.116637] Hardware name: Supermicro X8ST3/X8ST3, BIOS 2.0
07/29/10
[  474.149768] task: ffff8805f50cd010 ti: ffff8805f50cd488 task.ti:
ffff8805f50cd488
[  474.183707] RIP: 0010:[<ffffffff814681c7>]  [<ffffffff814681c7>]
context_struct_compute_av+0xce/0x308
[  474.219954] RSP: 0018:ffff8805c0ac3c38  EFLAGS: 00010246
[  474.252253] RAX: 0000000000000000 RBX: ffff8805c0ac3d94 RCX:
0000000000000100
[  474.287018] RDX: ffff8805e8aac000 RSI: 00000000ffffffff RDI:
ffff8805e8aaa000
[  474.321199] RBP: ffff8805c0ac3cb8 R08: 0000000000000010 R09:
0000000000000006
[  474.357446] R10: 0000000000000000 R11: ffff8805c567a000 R12:
0000000000000006
[  474.419191] R13: ffff8805c2b74e88 R14: 00000000000001da R15:
0000000000000000
[  474.453816] FS:  00007f2e75220800(0000) GS:ffff88061fc00000(0000)
knlGS:0000000000000000
[  474.489254] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  474.522215] CR2: 00007f2e74716090 CR3: 00000005c085e000 CR4:
00000000000207f0
[  474.556058] Stack:
[  474.584325]  ffff8805c0ac3c98 ffffffff811b549b ffff8805c0ac3c98
ffff8805f1190a40
[  474.618913]  ffff8805a6202f08 ffff8805c2b74e88 00068800d0464990
ffff8805e8aac860
[  474.653955]  ffff8805c0ac3cb8 000700068113833a ffff880606c75060
ffff8805c0ac3d94
[  474.690461] Call Trace:
[  474.723779]  [<ffffffff811b549b>] ? lookup_fast+0x1cd/0x22a
[  474.778049]  [<ffffffff81468824>] security_compute_av+0xf4/0x20b
[  474.811398]  [<ffffffff8196f419>] avc_compute_av+0x2a/0x179
[  474.843813]  [<ffffffff8145727b>] avc_has_perm+0x45/0xf4
[  474.875694]  [<ffffffff81457d0e>] inode_has_perm+0x2a/0x31
[  474.907370]  [<ffffffff81457e76>] selinux_inode_getattr+0x3c/0x3e
[  474.938726]  [<ffffffff81455cf6>] security_inode_getattr+0x1b/0x22
[  474.970036]  [<ffffffff811b057d>] vfs_getattr+0x19/0x2d
[  475.000618]  [<ffffffff811b05e5>] vfs_fstatat+0x54/0x91
[  475.030402]  [<ffffffff811b063b>] vfs_lstat+0x19/0x1b
[  475.061097]  [<ffffffff811b077e>] SyS_newlstat+0x15/0x30
[  475.094595]  [<ffffffff8113c5c1>] ? __audit_syscall_entry+0xa1/0xc3
[  475.148405]  [<ffffffff8197791e>] system_call_fastpath+0x16/0x1b
[  475.179201] Code: 00 48 85 c0 48 89 45 b8 75 02 0f 0b 48 8b 45 a0 48
8b 3d 45 d0 b6 00 8b 40 08 89 c6 ff ce e8 d1 b0 06 00 48 85 c0 49 89 c7
75 02 <0f> 0b 48 8b 45 b8 4c 8b 28 eb 1e 49 8d 7d 08 be 80 01 00 00 e8
[  475.255884] RIP  [<ffffffff814681c7>]
context_struct_compute_av+0xce/0x308
[  475.296120]  RSP <ffff8805c0ac3c38>
[  475.328734] ---[ end trace f076482e9d754adc ]---

[sds:  commit message edited to note Android implications and
to generate a unique Change-Id for gerrit]

Change-Id: I4d5389f0cfa72b5f59dada45081fa47e03805413
Reported-by:  Matthew Thode <mthode@mthode.org>
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Cc: stable@vger.kernel.org
Signed-off-by: Paul Moore <pmoore@redhat.com>
Signed-off-by: Sivasri Kumar Vanka <sivasri@codeaurora.org>
soc: qcom: smd: Validate read and write addresses

The address from which data has to be read and the address to which the
SMD data has to be written is calculated based on the head and tail
indices for that SMD FIFO. If the indices are corrupted, then the
calculated pointer may be outside of the FIFO and may even be outside of
the range of SMEM.

Validate the read and write addresses to be with in the limits of
receive and send FIFO limits respectively.

CRs-Fixed: 550527
Change-Id: Ie5578f6aee73ea2b1435fea7c2a0a6dda14bff82
Signed-off-by: Zaheerulla Meer <zmeer@codeaurora.org>
[PATCH] Staging: android: binder: More offset validation.

Make sure offsets don't point to overlapping flat_binder_object
structs.

Change-Id: I425ab0c46fbe2b00ed679c5becf9e8140395eb40
Signed-off-by: Arve HjÃ¸nnevÃ¥g <arve@android.com>
Merge "soc: qcom: smd: Validate read and write addresses"
n_tty: Fix n_tty_write crash when echoing in raw mode

The tty atomic_write_lock does not provide an exclusion guarantee for
the tty driver if the termios settings are LECHO & !OPOST. And since
it is unexpected and not allowed to call TTY buffer helpers like
tty_insert_flip_string concurrently, this may lead to crashes when
concurrect writers call pty_write. In that case the following two
writers:
* the ECHOing from a workqueue and
* pty_write from the process
race and can overflow the corresponding TTY buffer like follows.

If we look into tty_insert_flip_string_fixed_flag, there is:
  int space = __tty_buffer_request_room(port, goal, flags);
  struct tty_buffer *tb = port->buf.tail;
  ...
  memcpy(char_buf_ptr(tb, tb->used), chars, space);
  ...
  tb->used += space;

so the race of the two can result in something like this:
          A                             B
   __tty_buffer_request_room
                                  __tty_buffer_request_room
   memcpy(buf(tb->used), ...)
   tb->used += space;
                                 memcpy(buf(tb->used), ...) ->BOOM

B's memcpy is past the tty_buffer due to the previous A's tb->used
increment.

Since the N_TTY line discipline input processing can output
concurrently with a tty write, obtain the N_TTY ldisc output_lock to
serialize echo output with normal tty writes. This ensures the tty
buffer helper tty_insert_flip_string is not called concurrently and
everything is fine.

Note that this is nicely reproducible by an ordinary user using
forkpty and some setup around that (raw termios + ECHO). And it is
present in kernels at least after commit
d945cb9cce20ac7143c2de8d88b187f62db99bdc (pty: Rework the pty layer to
use the normal buffering logic) in 2.6.31-rc3.

js: add more info to the commit log
js: switch to bool
js: lock unconditionally
js: lock only the tty->ops->write call

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Change-Id: I9e235db6ec2bb950f26bd8a23f6145dab5dc0a15
Git-commit: 4291086b1f081b869c6d79e5b7441633dc3ace00
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Avijit Kanti Das <avijitnsec@codeaurora.org>
[rsiddoji@codeaurora.org: resolve trivial merge conflicts]
Signed-off-by: Ravi Kumar S <rsiddoji@codeaurora.org>
net: Zeroing the structure ethtool_wolinfo in ethtool_get_wol()

memset() the structure ethtool_wolinfo that has padded bytes
but the padded bytes have not been zeroed out.

Change-Id: If3fd2d872a1b1ab9521d937b86a29fc468a8bbfe
Signed-off-by: Avijit Kanti Das <avijitnsec@codeaurora.org>
arm: msm: acpuclock-8226:  Add support for 1.1GHz for 8610

Add a new frequency table for 1.1GHz parts for speed-bin 1.

Change-Id: I4df8ae9f14e0c1444f3a96d065c93f6cfcd0243b
Signed-off-by: Taniya Das <tdas@codeaurora.org>
ARM: msm: dts: Add efuse register base for 1.1GHz

New efuse base register has been added to support new speed bin of
1.1GHz.

Change-Id: I71d278d05a0f936baa70b0f5f41da7df83910bc7
Signed-off-by: Taniya Das <tdas@codeaurora.org>
msm: thermal: Add support for cpu temp limit recommendation for SoC

Add support in KTM to get SoC parts info by reading appropriate
efuse bits and recommend default cpu temperature limit based on
efuse value temperature map to userspace through sysfs interface
'/sys/module/msm_thermal/default_cpu_temp_limit'. Efuse data
to be read such as address, row number, starting bit number
of the row, number of bits for identifying parts etc, default core
temperature and efuse temperature value map are read from dt.
The default cpu temperature information is exported in the format
<temperature in degree celsius>.

Change-Id: Icbf43c3fd56e95d49a886d309e613d2fe146a506
Signed-off-by: Manaf Meethalavalappu Pallikunhi <manafm@codeaurora.org>
ARM: dts: msm: Add default cpu temp limit info entry for MSM8610

Add efuse data for identifying SoC parts and cpu temperature limit
information for different parts to thermal for MSM8610.

Change-Id: I1b50280c7c8092544165b26b95e235e5571a63d3
Signed-off-by: Manaf Meethalavalappu Pallikunhi <manafm@codeaurora.org>
msm: lpm_levels: remove rpm handshake in l2_gdhs mode

Remove rpm handshake in l2_gdhs mode and adjust the
latency, time overhead and energy overhead values for
l2_gdhs mode.

CRs-fixed: 604873
Change-Id: I9eeae5fada4f84ee2ca2eb9d67707dee1adf56ac
Signed-off-by: Anil kumar mamidala <amami@codeaurora.org>
ksm: Provide support to use deferred timers for scanner thread

KSM thread to scan pages is getting schedule on definite timeout.
That wakes up CPU from idle state and hence may affect the power
consumption. Provide an optional support to use deferred timer
which suites low-power use-cases.

To enable deferred timers,
$ echo 1 > /sys/kernel/mm/ksm/deferred_timer

Change-Id: I07fe199f97fe1f72f9a9e1b0b757a3ac533719e8
Signed-off-by: Chintan Pandya <cpandya@codeaurora.org>
ARM: dts: msm: Add pm-qos-latency to GPU dtsi

Currently the code has a fixed CPU latency vote from
the GPU driver. Some targets have different latency
requirements to allow various low latency PC modes.
Allow the CPU latency vote to be programmable based
on target. 701us PM QOS allows the A7 targets select
Low Power Mode which is better in terms of power.
This will help save static leakage of A7 during
graphics use cases.

Change-Id: I38a7ae76a4ebe0c4c98e6bc6d58353989e94c611
Signed-off-by: Prakash Kamliya <pkamliya@codeaurora.org>
Signed-off-by: Sunil Khatri <sunilkh@codeaurora.org>
msm: kgsl: get pm-qos-latency from device tree

pm-qos-latency parameter can be configured from
device tree as well. Will set to default value if
entry not found in target device tree.

Change-Id: I76271f4fdc26e191431e5dfe2a6de9e2b3ab426f
Signed-off-by: Sunil Khatri <sunilkh@codeaurora.org>
ARM: dts: msm: set cpu_dma_latency to 701 usec

Vote for 701 usec so as to allow the core to go to
stand-alone power collapse.

CRs-fixed: 636365
Change-Id: I456aa4936b2a8104f2146786fa819839500d73b7
Signed-off-by: Asutosh Das <asutoshd@codeaurora.org>
Merge "n_tty: Fix n_tty_write crash when echoing in raw mode"
Merge "net: Zeroing the structure ethtool_wolinfo in ethtool_get_wol()"
Revert "soc: qcom: smd: Validate read and write addresses"

This reverts commit 02bf25dbffd1059941781083e918d0f74319073f

Change-Id: I255f38e1e9820d956f9975b06dbe9a64cc671748
Merge "Revert "soc: qcom: smd: Validate read and write addresses""
Merge "ksm: Provide support to use deferred timers for scanner thread"