kernel.git/arch/um/drivers, branch linux-3.18.y

um: Stop abusing KERNEL

2018-02-07T19:07:53Z

commit 298e20ba8c197e8d429a6c8671550c41c7919033 upstream. Currently UML is abusing __KERNEL__ to distinguish between kernel and host code (os-Linux). It is better to use a custom define such that existing users of __KERNEL__ don't get confused. Signed-off-by: Richard Weinberger Cc: Greg Hackmann Cc: Bernie Innocenti Cc: Lorenzo Colitti Signed-off-by: Greg Kroah-Hartman

fs/coredump: prevent fsuid=0 dumps into user-controlled directories

2016-04-18T12:49:38Z

[ Upstream commit 378c6520e7d29280f400ef2ceaf155c86f05a71a ] This commit fixes the following security hole affecting systems where all of the following conditions are fulfilled: - The fs.suid_dumpable sysctl is set to 2. - The kernel.core_pattern sysctl's value starts with "/". (Systems where kernel.core_pattern starts with "|/" are not affected.) - Unprivileged user namespace creation is permitted. (This is true on Linux >=3.8, but some distributions disallow it by default using a distro patch.) Under these conditions, if a program executes under secure exec rules, causing it to run with the SUID_DUMP_ROOT flag, then unshares its user namespace, changes its root directory and crashes, the coredump will be written using fsuid=0 and a path derived from kernel.core_pattern - but this path is interpreted relative to the root directory of the process, allowing the attacker to control where a coredump will be written with root privileges. To fix the security issue, always interpret core_pattern for dumps that are written under SUID_DUMP_ROOT relative to the root directory of init. Signed-off-by: Jann Horn Acked-by: Kees Cook Cc: Al Viro Cc: "Eric W. Biederman" Cc: Andy Lutomirski Cc: Oleg Nesterov Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Sasha Levin

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/uml

2014-10-14T01:49:02Z

Pull UML update from Richard Weinberger: "Besides of fixes this contains also support for CONFIG_STACKTRACE by Daniel Walter" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/uml: um: net: Eliminate NULL test after alloc_bootmem um: Add support for CONFIG_STACKTRACE um: ubd: Fix for processes stuck in D state forever um: delete unnecessary bootmem struct page array um: remove csum_partial_copy_generic_i386 to clean up exception table

um: net: Eliminate NULL test after alloc_bootmem

2014-10-13T19:46:26Z

alloc_bootmem and related functions never return NULL. Thus a NULL test or memset after calls to these functions is unnecessary. The following Coccinelle semantic patch was used for making the change: @@ expression E; statement S; @@ E = \(alloc_bootmem\|alloc_bootmem_low\|alloc_bootmem_pages\|alloc_bootmem_low_pages\)(...) ... when != E - if (E == NULL) S Signed-off-by: Himangi Saraogi Acked-by: Julia Lawall Signed-off-by: Richard Weinberger

um: ubd: Fix for processes stuck in D state forever

2014-10-13T19:45:55Z

Starting with Linux 3.12 processes get stuck in D state forever in UserModeLinux under sync heavy workloads. This bug was introduced by commit 805f11a0d5 (um: ubd: Add REQ_FLUSH suppport). Fix bug by adding a check if FLUSH request was successfully submitted to the I/O thread and keeping the FLUSH request on the request queue on submission failures. Fixes: 805f11a0d5 (um: ubd: Add REQ_FLUSH suppport) Signed-off-by: Thorsten Knabe Cc: stable@kernel.org # >= 3.12 Signed-off-by: Richard Weinberger

sched, cleanup, treewide: Remove set_current_state(TASK_RUNNING) after schedule()

2014-09-19T10:35:17Z

schedule(), io_schedule() and schedule_timeout() always return with TASK_RUNNING state set, so one more setting is unnecessary. (All places in patch are visible good, only exception is kiblnd_scheduler() from: drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c Its schedule() is one line above standard 3 lines of unified diff) No places where set_current_state() is used for mb(). Signed-off-by: Kirill Tkhai Signed-off-by: Peter Zijlstra (Intel) Link: http://lkml.kernel.org/r/1410529254.3569.23.camel@tkhai Cc: Alasdair Kergon Cc: Anil Belur Cc: Arnd Bergmann Cc: Dave Kleikamp Cc: David Airlie Cc: David Howells Cc: Dmitry Eremin Cc: Frank Blaschka Cc: Greg Kroah-Hartman Cc: Heiko Carstens Cc: Helge Deller Cc: Isaac Huang Cc: James E.J. Bottomley Cc: James E.J. Bottomley Cc: J. Bruce Fields Cc: Jeff Dike Cc: Jesper Nilsson Cc: Jiri Slaby Cc: Laura Abbott Cc: Liang Zhen Cc: Linus Torvalds Cc: Martin Schwidefsky Cc: Masaru Nomura Cc: Michael Opdenacker Cc: Mikael Starvik Cc: Mike Snitzer Cc: Neil Brown Cc: Oleg Drokin Cc: Peng Tao Cc: Richard Weinberger Cc: Robert Love Cc: Steven Rostedt Cc: Trond Myklebust Cc: Ursula Braun Cc: Zi Shen Lim Cc: devel@driverdev.osuosl.org Cc: dm-devel@redhat.com Cc: dri-devel@lists.freedesktop.org Cc: fcoe-devel@open-fcoe.org Cc: jfs-discussion@lists.sourceforge.net Cc: linux390@de.ibm.com Cc: linux-afs@lists.infradead.org Cc: linux-cris-kernel@axis.com Cc: linux-kernel@vger.kernel.org Cc: linux-nfs@vger.kernel.org Cc: linux-parisc@vger.kernel.org Cc: linux-raid@vger.kernel.org Cc: linux-s390@vger.kernel.org Cc: linux-scsi@vger.kernel.org Cc: qla2xxx-upstream@qlogic.com Cc: user-mode-linux-devel@lists.sourceforge.net Cc: user-mode-linux-user@lists.sourceforge.net Signed-off-by: Ingo Molnar

uml/net_kern: Call dev_consume_skb_any instead of dev_kfree_skb.

2014-03-24T22:13:35Z

Replace dev_kfree_skb with dev_consume_skb_any in uml_net_start_xmit as it can be called in hard irq and other contexts. dev_consume_skb_any is used as uml_net_start_xmit typically consumes (not drops) packets. Signed-off-by: "Eric W. Biederman"

um: Get rid of thread_struct->saved_task

2013-11-17T10:27:35Z

As we have a sane show_stack() now, we can drop the ->saved_task hack. Signed-off-by: Richard Weinberger

um: Cleanup SIGTERM handling

2013-09-07T08:56:58Z

Richard reported that some UML processes survive if the UML main process receives a SIGTERM. This issue was caused by a wrongly placed signal(SIGTERM, SIG_DFL) in init_new_thread_signals(). It disabled the UML exit handler accidently for some processes. The correct solution is to disable the fatal handler for all UML helper threads/processes. Such that last_ditch_exit() does not get called multiple times and all processes can exit due to SIGTERM. Reported-and-tested-by: Richard W.M. Jones Signed-off-by: Richard Weinberger

um: ubd: Introduce submit_request()

2013-09-07T08:56:55Z

Just a clean-up patch to remove the open coded variants and to ensure that all requests are submitted the same way. Signed-off-by: Richard Weinberger