GitHub PushEvent at 2014-03-08 18:54:25
Repository: android_kernel_htc_endeavoru
Actor: teemodk
Payload: {"shas":[["d834da91f1ee661c381b72592f28afb7b469b6b4","09d47f559e0290641383a2672396688300765eb1@gmx.net","net: ipv6: Add IPv6 support to the ping socket.\n\nSquashed commit of the following:\n\ncommit 09fdd03555b0c6ac3dd27fd116c2227d5ef7d6f3\nAuthor: Lorenzo Colitti <lorenzo@google.com>\nDate:   Thu Jul 4 00:12:40 2013 +0900\n\n    net: ipv6: fix wrong ping_v6_sendmsg return value\n\n    [net-next commit fbfe80c890a1dc521d0b629b870e32fcffff0da5]\n\n    ping_v6_sendmsg currently returns 0 on success. It should return\n    the number of bytes written instead.\n\n    Bug: 9469865\n    Change-Id: I82b7d3a37ba91ad24e6dbd97a4880745ce16ad31\n    Signed-off-by: Lorenzo Colitti <lorenzo@google.com>\n    Signed-off-by: David S. Miller <davem@davemloft.net>\n\ncommit 3fcf8d4851e4eec508423d2c6cca3937368be7c3\nAuthor: Lorenzo Colitti <lorenzo@google.com>\nDate:   Thu Jul 4 00:52:49 2013 +0900\n\n    net: ipv6: add missing lock in ping_v6_sendmsg\n\n    [net-next commit a1bdc45580fc19e968b32ad27cd7e476a4aa58f6]\n\n    Bug: 9469865\n    Change-Id: I480f8ce95956dd8f17fbbb26dc60cc162f8ec933\n    Signed-off-by: Lorenzo Colitti <lorenzo@google.com>\n    Signed-off-by: David S. Miller <davem@davemloft.net>\n\ncommit 036b819793cb3bcd30b8718dc240a5b4b377f6dc\nAuthor: Cong Wang <amwang@redhat.com>\nDate:   Sun Jun 2 22:43:52 2013 +0000\n\n    ping: always initialize ->sin6_scope_id and ->sin6_flowinfo\n\n    [net-next commit c26d6b46da3ee86fa8a864347331e5513ca84c2b]\n\n    If we don't need scope id, we should initialize it to zero.\n    Same for ->sin6_flowinfo.\n\n    Change-Id: I28e4bc9593e76fc3434052182466fab4bb8ccf3a\n    Cc: Lorenzo Colitti <lorenzo@google.com>\n    Cc: David S. Miller <davem@davemloft.net>\n    Signed-off-by: Cong Wang <amwang@redhat.com>\n    Acked-by: Lorenzo Colitti <lorenzo@google.com>\n    Signed-off-by: David S. Miller <davem@davemloft.net>\n\ncommit 34f8ee7b67086c089898db3eca698541682d2748\nAuthor: Lorenzo Colitti <lorenzo@google.com>\nDate:   Wed Jan 16 22:09:49 2013 +0000\n\n    net: ipv6: Add IPv6 support to the ping socket.\n\n    [backport of net-next 6d0bfe22611602f36617bc7aa2ffa1bbb2f54c67]\n\n    This adds the ability to send ICMPv6 echo requests without a\n    raw socket. The equivalent ability for ICMPv4 was added in\n    2011.\n\n    Instead of having separate code paths for IPv4 and IPv6, make\n    most of the code in net/ipv4/ping.c dual-stack and only add a\n    few IPv6-specific bits (like the protocol definition) to a new\n    net/ipv6/ping.c. Hopefully this will reduce divergence and/or\n    duplication of bugs in the future.\n\n    Caveats:\n\n    - Setting options via ancillary data (e.g., using IPV6_PKTINFO\n      to specify the outgoing interface) is not yet supported.\n    - There are no separate security settings for IPv4 and IPv6;\n      everything is controlled by /proc/net/ipv4/ping_group_range.\n    - The proc interface does not yet display IPv6 ping sockets\n      properly.\n\n    Tested with a patched copy of ping6 and using raw socket calls.\n    Compiles and works with all of CONFIG_IPV6={n,m,y}.\n\n    Change-Id: Ia359af556021344fc7f890c21383aadf950b6498\n    Signed-off-by: Lorenzo Colitti <lorenzo@google.com>\n    Signed-off-by: David S. Miller <davem@davemloft.net>\n    [lorenzo@google.com: backported to 3.0]\n    Signed-off-by: Lorenzo Colitti <lorenzo@google.com>\n\ncommit 19ea39e13d0ca712bc1b336a650ef7d942064d07\nAuthor: Hannes Frederic Sowa <hannes@stressinduktion.org>\nDate:   Fri Mar 8 02:07:16 2013 +0000\n\n    ipv6: introdcue __ipv6_addr_needs_scope_id and ipv6_iface_scope_id helper functions\n\n    [net-next commit b7ef213ef65256168df83ddfbb8131ed9adc10f9]\n\n    __ipv6_addr_needs_scope_id checks if an ipv6 address needs to supply\n    a 'sin6_scope_id != 0'. 'sin6_scope_id != 0' was enforced in case\n    of link-local addresses. To support interface-local multicast these\n    checks had to be enhanced and are now consolidated into these new helper\n    functions.\n\n    v2:\n    a) migrated to struct ipv6_addr_props\n\n    v3:\n    a) reverted changes for ipv6_addr_props\n    b) test for address type instead of comparing scope\n\n    v4:\n    a) unchanged\n\n    Change-Id: Id6fc54cec61f967928e08a9eba4f857157d973a3\n    Suggested-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>\n    Cc: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>\n    Acked-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>\n    Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>\n    Acked-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>\n    Signed-off-by: David S. Miller <davem@davemloft.net>\n\ncommit 77c3b0a7319b81a3906547351f461ec0c40c955f\nAuthor: Li Wei <lw@cn.fujitsu.com>\nDate:   Thu Feb 21 00:09:54 2013 +0000\n\n    ipv4: fix a bug in ping_err().\n\n    [ Upstream commit b531ed61a2a2a77eeb2f7c88b49aa5ec7d9880d8 ]\n\n    We should get 'type' and 'code' from the outer ICMP header.\n\n    Signed-off-by: Li Wei <lw@cn.fujitsu.com>\n    Signed-off-by: David S. Miller <davem@davemloft.net>\n    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nChange-Id: I24280b4bff802b5af7b08ef0ac856f6270fee712","Thomas Wendt",true],["8efe5de3d3d75190e957d747e51522fdcdba345e","43232e92d70cc7aa53504ad0397085ee47bad87f@goodmis.org","SELinux: Fix possible NULL pointer dereference in selinux_inode_permission()\n\nWhile running stress tests on adding and deleting ftrace instances I hit\nthis bug:\n\n  BUG: unable to handle kernel NULL pointer dereference at 0000000000000020\n  IP: selinux_inode_permission+0x85/0x160\n  PGD 63681067 PUD 7ddbe067 PMD 0\n  Oops: 0000 [#1] PREEMPT\n  CPU: 0 PID: 5634 Comm: ftrace-test-mki Not tainted 3.13.0-rc4-test-00033-gd2a6dde-dirty #20\n  Hardware name:                  /DG965MQ, BIOS MQ96510J.86A.0372.2006.0605.1717 06/05/2006\n  task: ffff880078375800 ti: ffff88007ddb0000 task.ti: ffff88007ddb0000\n  RIP: 0010:[<ffffffff812d8bc5>]  [<ffffffff812d8bc5>] selinux_inode_permission+0x85/0x160\n  RSP: 0018:ffff88007ddb1c48  EFLAGS: 00010246\n  RAX: 0000000000000000 RBX: 0000000000800000 RCX: ffff88006dd43840\n  RDX: 0000000000000001 RSI: 0000000000000081 RDI: ffff88006ee46000\n  RBP: ffff88007ddb1c88 R08: 0000000000000000 R09: ffff88007ddb1c54\n  R10: 6e6576652f6f6f66 R11: 0000000000000003 R12: 0000000000000000\n  R13: 0000000000000081 R14: ffff88006ee46000 R15: 0000000000000000\n  FS:  00007f217b5b6700(0000) GS:ffffffff81e21000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033^M\n  CR2: 0000000000000020 CR3: 000000006a0fe000 CR4: 00000000000007f0\n  Call Trace:\n    security_inode_permission+0x1c/0x30\n    __inode_permission+0x41/0xa0\n    inode_permission+0x18/0x50\n    link_path_walk+0x66/0x920\n    path_openat+0xa6/0x6c0\n    do_filp_open+0x43/0xa0\n    do_sys_open+0x146/0x240\n    SyS_open+0x1e/0x20\n    system_call_fastpath+0x16/0x1b\n  Code: 84 a1 00 00 00 81 e3 00 20 00 00 89 d8 83 c8 02 40 f6 c6 04 0f 45 d8 40 f6 c6 08 74 71 80 cf 02 49 8b 46 38 4c 8d 4d cc 45 31 c0 <0f> b7 50 20 8b 70 1c 48 8b 41 70 89 d9 8b 78 04 e8 36 cf ff ff\n  RIP  selinux_inode_permission+0x85/0x160\n  CR2: 0000000000000020\n\nInvestigating, I found that the inode->i_security was NULL, and the\ndereference of it caused the oops.\n\nin selinux_inode_permission():\n\n\tisec = inode->i_security;\n\n\trc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);\n\nNote, the crash came from stressing the deletion and reading of debugfs\nfiles.  I was not able to recreate this via normal files.  But I'm not\nsure they are safe.  It may just be that the race window is much harder\nto hit.\n\nWhat seems to have happened (and what I have traced), is the file is\nbeing opened at the same time the file or directory is being deleted.\nAs the dentry and inode locks are not held during the path walk, nor is\nthe inodes ref counts being incremented, there is nothing saving these\nstructures from being discarded except for an rcu_read_lock().\n\nThe rcu_read_lock() protects against freeing of the inode, but it does\nnot protect freeing of the inode_security_struct.  Now if the freeing of\nthe i_security happens with a call_rcu(), and the i_security field of\nthe inode is not changed (it gets freed as the inode gets freed) then\nthere will be no issue here.  (Linus Torvalds suggested not setting the\nfield to NULL such that we do not need to check if it is NULL in the\npermission check).\n\nNote, this is a hack, but it fixes the problem at hand.  A real fix is\nto restructure the destroy_inode() to call all the destructor handlers\nfrom the RCU callback.  But that is a major job to do, and requires a\nlot of work.  For now, we just band-aid this bug with this fix (it\nworks), and work on a more maintainable solution in the future.\n\nLink: http://lkml.kernel.org/r/20140109101932.0508dec7@gandalf.local.home\nLink: http://lkml.kernel.org/r/20140109182756.17abaaa8@gandalf.local.home\n\nChange-Id: I8bcbba7614f96403f1273390603cbb1e122a0525\nCc: stable@vger.kernel.org\nSigned-off-by: Steven Rostedt <rostedt@goodmis.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>","Steven Rostedt",true],["78362f52b056ef56333923cc8f8421c5312a09e2","d6e1285e1c84d3d5885c2124fdacc780e9fc0a94@tycho.nsa.gov","SELinux: Fix kernel BUG on empty security contexts.\n\nSetting an empty security context (length=0) on a file will\nlead to incorrectly dereferencing the type and other fields\nof the security context structure, yielding a kernel BUG.\nAs a zero-length security context is never valid, just reject\nall such security contexts whether coming from userspace\nvia setxattr or coming from the filesystem upon a getxattr\nrequest by SELinux.\n\nSetting a security context value (empty or otherwise) unknown to\nSELinux in the first place is only possible for a root process\n(CAP_MAC_ADMIN), and, if running SELinux in enforcing mode, only\nif the corresponding SELinux mac_admin permission is also granted\nto the domain by policy.  In Fedora policies, this is only allowed for\nspecific domains such as livecd for setting down security contexts\nthat are not defined in the build host policy.\n\n[On Android, this can only be set by root/CAP_MAC_ADMIN processes,\nand if running SELinux in enforcing mode, only if mac_admin permission\nis granted in policy.  In Android 4.4, this would only be allowed for\nroot/CAP_MAC_ADMIN processes that are also in unconfined domains. In current\nAOSP master, mac_admin is not allowed for any domains except the recovery\nconsole which has a legitimate need for it.  The other potential vector\nis mounting a maliciously crafted filesystem for which SELinux fetches\nxattrs (e.g. an ext4 filesystem on a SDcard).  However, the end result is\nonly a local denial-of-service (DOS) due to kernel BUG.  This fix is\nqueued for 3.14.]\n\nReproducer:\nsu\nsetenforce 0\ntouch foo\nsetfattr -n security.selinux foo\n\nCaveat:\nRelabeling or removing foo after doing the above may not be possible\nwithout booting with SELinux disabled.  Any subsequent access to foo\nafter doing the above will also trigger the BUG.\n\nBUG output from Matthew Thode:\n[  473.893141] ------------[ cut here ]------------\n[  473.962110] kernel BUG at security/selinux/ss/services.c:654!\n[  473.995314] invalid opcode: 0000 [#6] SMP\n[  474.027196] Modules linked in:\n[  474.058118] CPU: 0 PID: 8138 Comm: ls Tainted: G      D   I\n3.13.0-grsec #1\n[  474.116637] Hardware name: Supermicro X8ST3/X8ST3, BIOS 2.0\n07/29/10\n[  474.149768] task: ffff8805f50cd010 ti: ffff8805f50cd488 task.ti:\nffff8805f50cd488\n[  474.183707] RIP: 0010:[<ffffffff814681c7>]  [<ffffffff814681c7>]\ncontext_struct_compute_av+0xce/0x308\n[  474.219954] RSP: 0018:ffff8805c0ac3c38  EFLAGS: 00010246\n[  474.252253] RAX: 0000000000000000 RBX: ffff8805c0ac3d94 RCX:\n0000000000000100\n[  474.287018] RDX: ffff8805e8aac000 RSI: 00000000ffffffff RDI:\nffff8805e8aaa000\n[  474.321199] RBP: ffff8805c0ac3cb8 R08: 0000000000000010 R09:\n0000000000000006\n[  474.357446] R10: 0000000000000000 R11: ffff8805c567a000 R12:\n0000000000000006\n[  474.419191] R13: ffff8805c2b74e88 R14: 00000000000001da R15:\n0000000000000000\n[  474.453816] FS:  00007f2e75220800(0000) GS:ffff88061fc00000(0000)\nknlGS:0000000000000000\n[  474.489254] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  474.522215] CR2: 00007f2e74716090 CR3: 00000005c085e000 CR4:\n00000000000207f0\n[  474.556058] Stack:\n[  474.584325]  ffff8805c0ac3c98 ffffffff811b549b ffff8805c0ac3c98\nffff8805f1190a40\n[  474.618913]  ffff8805a6202f08 ffff8805c2b74e88 00068800d0464990\nffff8805e8aac860\n[  474.653955]  ffff8805c0ac3cb8 000700068113833a ffff880606c75060\nffff8805c0ac3d94\n[  474.690461] Call Trace:\n[  474.723779]  [<ffffffff811b549b>] ? lookup_fast+0x1cd/0x22a\n[  474.778049]  [<ffffffff81468824>] security_compute_av+0xf4/0x20b\n[  474.811398]  [<ffffffff8196f419>] avc_compute_av+0x2a/0x179\n[  474.843813]  [<ffffffff8145727b>] avc_has_perm+0x45/0xf4\n[  474.875694]  [<ffffffff81457d0e>] inode_has_perm+0x2a/0x31\n[  474.907370]  [<ffffffff81457e76>] selinux_inode_getattr+0x3c/0x3e\n[  474.938726]  [<ffffffff81455cf6>] security_inode_getattr+0x1b/0x22\n[  474.970036]  [<ffffffff811b057d>] vfs_getattr+0x19/0x2d\n[  475.000618]  [<ffffffff811b05e5>] vfs_fstatat+0x54/0x91\n[  475.030402]  [<ffffffff811b063b>] vfs_lstat+0x19/0x1b\n[  475.061097]  [<ffffffff811b077e>] SyS_newlstat+0x15/0x30\n[  475.094595]  [<ffffffff8113c5c1>] ? __audit_syscall_entry+0xa1/0xc3\n[  475.148405]  [<ffffffff8197791e>] system_call_fastpath+0x16/0x1b\n[  475.179201] Code: 00 48 85 c0 48 89 45 b8 75 02 0f 0b 48 8b 45 a0 48\n8b 3d 45 d0 b6 00 8b 40 08 89 c6 ff ce e8 d1 b0 06 00 48 85 c0 49 89 c7\n75 02 <0f> 0b 48 8b 45 b8 4c 8b 28 eb 1e 49 8d 7d 08 be 80 01 00 00 e8\n[  475.255884] RIP  [<ffffffff814681c7>]\ncontext_struct_compute_av+0xce/0x308\n[  475.296120]  RSP <ffff8805c0ac3c38>\n[  475.328734] ---[ end trace f076482e9d754adc ]---\n\n[sds:  commit message edited to note Android implications and\nto generate a unique Change-Id for gerrit]\n\nChange-Id: I4d5389f0cfa72b5f59dada45081fa47e03805413\nReported-by:  Matthew Thode <mthode@mthode.org>\nSigned-off-by: Stephen Smalley <sds@tycho.nsa.gov>\nCc: stable@vger.kernel.org\nSigned-off-by: Paul Moore <pmoore@redhat.com>","Stephen Smalley",true],["a97ecbd81eb3c35115a5cc11e0754fdefa6bc0e1","66544194c33df2a4de1046b8bbb3228dcee9bb43@google.com","fix false disconnect due to a signal sent to the reading process\n\n- In the current implementation, when a signal is sent to the reading process,\n  read is cancelled by calling usb_ep_dequeue, which lead into calling\n  acc_complete_out with ECONNRESET, but the current logic treats it as\n  disconnection, which makes the device inaccessible until cable is actually\n  disconnected.\n- The fix calls disconnect only when ESHUTDOWN error is passed.\n- If data has already arrived while trying cancelling, the data is marked\n  as available, and it will be read out on the next read. This is necessary\n  as USB bulk is assumed to guarantee no data loss.\n\nChange-Id: Ic4b7b793682c7c3dc696f4d889884269216113d7\nSigned-off-by: keunyoung <keunyoung@google.com>","keunyoung",true]],"size":4,"ref":"refs/heads/kk4.4","head":"a97ecbd81eb3c35115a5cc11e0754fdefa6bc0e1"}