Eric Lee / smarc-fsl-linux-kernel

15 Jan, 2012

1 commit

  • c49c41a41   Merge branch 'for-linus' of git://selinuxproject.org/~jmorris/linux-security ... Browse Code »

    * 'for-linus' of git://selinuxproject.org/~jmorris/linux-security:
    capabilities: remove __cap_full_set definition
    security: remove the security_netlink_recv hook as it is equivalent to capable()
    ptrace: do not audit capability check when outputing /proc/pid/stat
    capabilities: remove task_ns_* functions
    capabitlies: ns_capable can use the cap helpers rather than lsm call
    capabilities: style only - move capable below ns_capable
    capabilites: introduce new has_ns_capabilities_noaudit
    capabilities: call has_ns_capability from has_capability
    capabilities: remove all _real_ interfaces
    capabilities: introduce security_capable_noaudit
    capabilities: reverse arguments to security_capable
    capabilities: remove the task from capable LSM hook entirely
    selinux: sparse fix: fix several warnings in the security server cod
    selinux: sparse fix: fix warnings in netlink code
    selinux: sparse fix: eliminate warnings for selinuxfs
    selinux: sparse fix: declare selinux_disable() in security.h
    selinux: sparse fix: move selinux_complete_init
    selinux: sparse fix: make selinux_secmark_refcount static
    SELinux: Fix RCU deref check warning in sel_netport_insert()

    Manually fix up a semantic mis-merge wrt security_netlink_recv():

    - the interface was removed in commit fd7784615248 ("security: remove
    the security_netlink_recv hook as it is equivalent to capable()")

    - a new user of it appeared in commit a38f7907b926 ("crypto: Add
    userspace configuration API")

    causing no automatic merge conflict, but Eric Paris pointed out the
    issue.

    Linus Torvalds
     

09 Jan, 2012

1 commit

  • 98793265b   Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial ... Browse Code »

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial: (53 commits)
    Kconfig: acpi: Fix typo in comment.
    misc latin1 to utf8 conversions
    devres: Fix a typo in devm_kfree comment
    btrfs: free-space-cache.c: remove extra semicolon.
    fat: Spelling s/obsolate/obsolete/g
    SCSI, pmcraid: Fix spelling error in a pmcraid_err() call
    tools/power turbostat: update fields in manpage
    mac80211: drop spelling fix
    types.h: fix comment spelling for 'architectures'
    typo fixes: aera -> area, exntension -> extension
    devices.txt: Fix typo of 'VMware'.
    sis900: Fix enum typo 'sis900_rx_bufer_status'
    decompress_bunzip2: remove invalid vi modeline
    treewide: Fix comment and string typo 'bufer'
    hyper-v: Update MAINTAINERS
    treewide: Fix typos in various parts of the kernel, and fix some comments.
    clockevents: drop unknown Kconfig symbol GENERIC_CLOCKEVENTS_MIGR
    gpio: Kconfig: drop unknown symbol 'CS5535_GPIO'
    leds: Kconfig: Fix typo 'D2NET_V2'
    sound: Kconfig: drop unknown symbol ARCH_CLPS7500
    ...

    Fix up trivial conflicts in arch/powerpc/platforms/40x/Kconfig (some new
    kconfig additions, close to removed commented-out old ones)

    Linus Torvalds
     

06 Jan, 2012

1 commit

28 Dec, 2011

2 commits

25 Dec, 2011

1 commit

23 Dec, 2011

7 commits

20 Dec, 2011

1 commit

  • eb9399220   module_param: make bool parameters really bool (net & drivers/net) ... Browse Code »

    module_param(bool) used to counter-intuitively take an int. In
    fddd5201 (mid-2009) we allowed bool or int/unsigned int using a messy
    trick.

    It's time to remove the int/unsigned int option. For this version
    it'll simply give a warning, but it'll break next kernel version.

    (Thanks to Joe Perches for suggesting coccinelle for 0/1 -> true/false).

    Cc: "David S. Miller"
    Cc: netdev@vger.kernel.org
    Signed-off-by: Rusty Russell
    Signed-off-by: David S. Miller

    Rusty Russell
     

09 Dec, 2011

1 commit

05 Dec, 2011

1 commit

  • 8f97339d3   netfilter: add ipv4 reverse path filter match ... Browse Code »

    This tries to do the same thing as fib_validate_source(), but differs
    in several aspects.

    The most important difference is that the reverse path filter built into
    fib_validate_source uses the oif as iif when performing the reverse
    lookup. We do not do this, as the oif is not yet known by the time the
    PREROUTING hook is invoked.

    We can't wait until FORWARD chain because by the time FORWARD is invoked
    ipv4 forward path may have already sent icmp messages is response
    to to-be-discarded-via-rpfilter packets.

    To avoid the such an additional lookup in PREROUTING, Patrick McHardy
    suggested to attach the path information directly in the match
    (i.e., just do what the standard ipv4 path does a bit earlier in PREROUTING).

    This works, but it also has a few caveats. Most importantly, when using
    marks in PREROUTING to re-route traffic based on the nfmark, -m rpfilter
    would have to be used after the nfmark has been set; otherwise the nfmark
    would have no effect (because the route is already attached).

    Another problem would be interaction with -j TPROXY, as this target sets an
    nfmark and uses ACCEPT instead of continue, i.e. such a version of
    -m rpfilter cannot be used for the initial to-be-intercepted packets.

    In case in turns out that the oif is required, we can add Patricks
    suggestion with a new match option (e.g. --rpf-use-oif) to keep ruleset
    compatibility.

    Another difference to current builtin ipv4 rpfilter is that packets subject to ipsec
    transformation are not automatically excluded. If you want this, simply
    combine -m rpfilter with the policy match.

    Packets arriving on loopback interfaces always match.

    Signed-off-by: Florian Westphal
    Acked-by: David S. Miller
    Signed-off-by: Pablo Neira Ayuso

    Florian Westphal
     

29 Nov, 2011

1 commit

  • b90e5794c   net: dont call jump_label_dec from irq context ... Browse Code »

    Igor Maravic reported an error caused by jump_label_dec() being called
    from IRQ context :

    BUG: sleeping function called from invalid context at kernel/mutex.c:271
    in_atomic(): 1, irqs_disabled(): 0, pid: 0, name: swapper
    1 lock held by swapper/0:
    #0: (&n->timer){+.-...}, at: [] call_timer_fn+0x0/0x340
    Pid: 0, comm: swapper Not tainted 3.2.0-rc2-net-next-mpls+ #1
    Call Trace:
    [] __might_sleep+0x137/0x1f0
    [] mutex_lock_nested+0x2f/0x370
    [] ? trace_hardirqs_off+0xd/0x10
    [] ? local_clock+0x6f/0x80
    [] ? lock_release_holdtime.part.22+0x15/0x1a0
    [] ? sock_def_write_space+0x59/0x160
    [] ? arp_error_report+0x3e/0x90
    [] atomic_dec_and_mutex_lock+0x5d/0x80
    [] jump_label_dec+0x1d/0x50
    [] net_disable_timestamp+0x15/0x20
    [] sock_disable_timestamp+0x45/0x50
    [] __sk_free+0x80/0x200
    [] ? sk_send_sigurg+0x70/0x70
    [] ? arp_error_report+0x3e/0x90
    [] sock_wfree+0x3a/0x70
    [] skb_release_head_state+0x70/0x120
    [] __kfree_skb+0x16/0x30
    [] kfree_skb+0x49/0x170
    [] arp_error_report+0x3e/0x90
    [] neigh_invalidate+0x89/0xc0
    [] neigh_timer_handler+0x9e/0x2a0
    [] ? neigh_update+0x640/0x640
    [] __do_softirq+0xc8/0x3a0

    Since jump_label_{inc|dec} must be called from process context only,
    we must defer jump_label_dec() if net_disable_timestamp() is called
    from interrupt context.

    Reported-by: Igor Maravic
    Signed-off-by: Eric Dumazet
    Signed-off-by: David S. Miller

    Eric Dumazet
     

24 Nov, 2011

1 commit

07 Nov, 2011

1 commit

  • 32aaeffbd   Merge branch 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux ... Browse Code »

    * 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux: (230 commits)
    Revert "tracing: Include module.h in define_trace.h"
    irq: don't put module.h into irq.h for tracking irqgen modules.
    bluetooth: macroize two small inlines to avoid module.h
    ip_vs.h: fix implicit use of module_get/module_put from module.h
    nf_conntrack.h: fix up fallout from implicit moduleparam.h presence
    include: replace linux/module.h with "struct module" wherever possible
    include: convert various register fcns to macros to avoid include chaining
    crypto.h: remove unused crypto_tfm_alg_modname() inline
    uwb.h: fix implicit use of asm/page.h for PAGE_SIZE
    pm_runtime.h: explicitly requires notifier.h
    linux/dmaengine.h: fix implicit use of bitmap.h and asm/page.h
    miscdevice.h: fix up implicit use of lists and types
    stop_machine.h: fix implicit use of smp.h for smp_processor_id
    of: fix implicit use of errno.h in include/linux/of.h
    of_platform.h: delete needless include
    acpi: remove module.h include from platform/aclinux.h
    miscdevice.h: delete unnecessary inclusion of module.h
    device_cgroup.h: delete needless include
    net: sch_generic remove redundant use of
    net: inet_timewait_sock doesnt need
    ...

    Fix up trivial conflicts (other header files, and removal of the ab3550 mfd driver) in
    - drivers/media/dvb/frontends/dibx000_common.c
    - drivers/media/video/{mt9m111.c,ov6650.c}
    - drivers/mfd/ab3550-core.c
    - include/linux/dmaengine.h

    Linus Torvalds
     

01 Nov, 2011

3 commits

22 Sep, 2011

1 commit

  • 8decf8687   Merge branch 'master' of github.com:davem330/net ... Browse Code »

    Conflicts:
    MAINTAINERS
    drivers/net/Kconfig
    drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
    drivers/net/ethernet/broadcom/tg3.c
    drivers/net/wireless/iwlwifi/iwl-pci.c
    drivers/net/wireless/iwlwifi/iwl-trans-tx-pcie.c
    drivers/net/wireless/rt2x00/rt2800usb.c
    drivers/net/wireless/wl12xx/main.c

    David S. Miller
     

31 Aug, 2011

1 commit

30 Aug, 2011

1 commit

  • c6675233f   netfilter: nf_queue: reject NF_STOLEN verdicts from userspace ... Browse Code »

    A userspace listener may send (bogus) NF_STOLEN verdict, which causes skb leak.

    This problem was previously fixed via
    64507fdbc29c3a622180378210ecea8659b14e40 (netfilter:
    nf_queue: fix NF_STOLEN skb leak) but this had to be reverted because
    NF_STOLEN can also be returned by a netfilter hook when iterating the
    rules in nf_reinject.

    Reject userspace NF_STOLEN verdict, as suggested by Michal Miroslaw.

    This is complementary to commit fad54440438a7c231a6ae347738423cbabc936d9
    (netfilter: avoid double free in nf_reinject).

    Cc: Julian Anastasov
    Cc: Eric Dumazet
    Signed-off-by: Florian Westphal
    Signed-off-by: Patrick McHardy

    Florian Westphal
     

08 Aug, 2011

1 commit

07 Aug, 2011

1 commit

  • 6e5714eaf   net: Compute protocol sequence numbers and fragment IDs using MD5. ... Browse Code »

    Computers have become a lot faster since we compromised on the
    partial MD4 hash which we use currently for performance reasons.

    MD5 is a much safer choice, and is inline with both RFC1948 and
    other ISS generators (OpenBSD, Solaris, etc.)

    Furthermore, only having 24-bits of the sequence number be truly
    unpredictable is a very serious limitation. So the periodic
    regeneration and 8-bit counter have been removed. We compute and
    use a full 32-bit sequence number.

    For ipv6, DCCP was found to use a 32-bit truncated initial sequence
    number (it needs 43-bits) and that is fixed here as well.

    Reported-by: Dan Kaminsky
    Tested-by: Willy Tarreau
    Signed-off-by: David S. Miller

    David S. Miller
     

02 Aug, 2011

1 commit

  • a9b3cd7f3   rcu: convert uses of rcu_assign_pointer(x, NULL) to RCU_INIT_POINTER ... Browse Code »

    When assigning a NULL value to an RCU protected pointer, no barrier
    is needed. The rcu_assign_pointer, used to handle that but will soon
    change to not handle the special case.

    Convert all rcu_assign_pointer of NULL value.

    //smpl
    @@ expression P; @@

    - rcu_assign_pointer(P, NULL)
    + RCU_INIT_POINTER(P, NULL)

    //

    Signed-off-by: Stephen Hemminger
    Acked-by: Paul E. McKenney
    Signed-off-by: David S. Miller

    Stephen Hemminger
     

29 Jul, 2011

1 commit

  • 91c66c689   netfilter: ip_queue: Fix small leak in ipq_build_packet_message() ... Browse Code »

    ipq_build_packet_message() in net/ipv4/netfilter/ip_queue.c and
    net/ipv6/netfilter/ip6_queue.c contain a small potential mem leak as
    far as I can tell.

    We allocate memory for 'skb' with alloc_skb() annd then call
    nlh = NLMSG_PUT(skb, 0, 0, IPQM_PACKET, size - sizeof(*nlh));

    NLMSG_PUT is a macro
    NLMSG_PUT(skb, pid, seq, type, len) \
    NLMSG_NEW(skb, pid, seq, type, len, 0)

    that expands to NLMSG_NEW, which is also a macro which expands to:
    NLMSG_NEW(skb, pid, seq, type, len, flags) \
    ({ if (unlikely(skb_tailroom(skb) < (int)NLMSG_SPACE(len))) \
    goto nlmsg_failure; \
    __nlmsg_put(skb, pid, seq, type, len, flags); })

    If we take the true branch of the 'if' statement and 'goto
    nlmsg_failure', then we'll, at that point, return from
    ipq_build_packet_message() without having assigned 'skb' to anything
    and we'll leak the memory we allocated for it when it goes out of
    scope.

    Fix this by placing a 'kfree(skb)' at 'nlmsg_failure'.

    I admit that I do not know how likely this to actually happen or even
    if there's something that guarantees that it will never happen - I'm
    not that familiar with this code, but if that is so, I've not been
    able to spot it.

    Signed-off-by: Jesper Juhl
    Signed-off-by: Patrick McHardy

    Jesper Juhl
     

06 Jul, 2011

1 commit

02 Jul, 2011

1 commit

  • 181b1e9ce   netfilter: Reduce switch/case indent ... Browse Code »

    Make the case labels the same indent as the switch.

    git diff -w shows miscellaneous 80 column wrapping,
    comment reflowing and a comment for a useless gcc
    warning for an otherwise unused default: case.

    Signed-off-by: Joe Perches
    Signed-off-by: David S. Miller

    Joe Perches
     

29 Jun, 2011

1 commit

  • ed6e4ef83   netfilter: Fix ip_route_me_harder triggering ip_rt_bug ... Browse Code »

    Avoid creating input routes with ip_route_me_harder.
    It does not work for locally generated packets. Instead,
    restrict sockets to provide valid saddr for output route (or
    unicast saddr for transparent proxy). For other traffic
    allow saddr to be unicast or local but if callers forget
    to check saddr type use 0 for the output route.

    The resulting handling should be:

    - REJECT TCP:
    - in INPUT we can provide addr_type = RTN_LOCAL but
    better allow rejecting traffic delivered with
    local route (no IP address => use RTN_UNSPEC to
    allow also RTN_UNICAST).
    - FORWARD: RTN_UNSPEC => allow RTN_LOCAL/RTN_UNICAST
    saddr, add fix to ignore RTN_BROADCAST and RTN_MULTICAST
    - OUTPUT: RTN_UNSPEC

    - NAT, mangle, ip_queue, nf_ip_reroute: RTN_UNSPEC in LOCAL_OUT

    - IPVS:
    - use RTN_LOCAL in LOCAL_OUT and FORWARD after SNAT
    to restrict saddr to be local

    Signed-off-by: Julian Anastasov
    Signed-off-by: David S. Miller

    Julian Anastasov
     

22 Jun, 2011

1 commit

16 Jun, 2011

5 commits

06 Jun, 2011

2 commits