1. 09 Sep, 2015 2 commits
  2. 26 Aug, 2015 3 commits
    • Russell King's avatar
      ARM: software-based priviledged-no-access support · a5e090ac
      Russell King authored
      Provide a software-based implementation of the priviledged no access
      support found in ARMv8.1.
      
      Userspace pages are mapped using a different domain number from the
      kernel and IO mappings.  If we switch the user domain to "no access"
      when we enter the kernel, we can prevent the kernel from touching
      userspace.
      
      However, the kernel needs to be able to access userspace via the
      various user accessor functions.  With the wrapping in the previous
      patch, we can temporarily enable access when the kernel needs user
      access, and re-disable it afterwards.
      
      This allows us to trap non-intended accesses to userspace, eg, caused
      by an inadvertent dereference of the LIST_POISON* values, which, with
      appropriate user mappings setup, can be made to succeed.  This in turn
      can allow use-after-free bugs to be further exploited than would
      otherwise be possible.
      Signed-off-by: default avatarRussell King <rmk+kernel@arm.linux.org.uk>
      a5e090ac
    • Russell King's avatar
      ARM: entry: provide uaccess assembly macro hooks · 2190fed6
      Russell King authored
      Provide hooks into the kernel entry and exit paths to permit control
      of userspace visibility to the kernel.  The intended use is:
      
      - on entry to kernel from user, uaccess_disable will be called to
        disable userspace visibility
      - on exit from kernel to user, uaccess_enable will be called to
        enable userspace visibility
      - on entry from a kernel exception, uaccess_save_and_disable will be
        called to save the current userspace visibility setting, and disable
        access
      - on exit from a kernel exception, uaccess_restore will be called to
        restore the userspace visibility as it was before the exception
        occurred.
      
      These hooks allows us to keep userspace visibility disabled for the
      vast majority of the kernel, except for localised regions where we
      want to explicitly access userspace.
      Signed-off-by: default avatarRussell King <rmk+kernel@arm.linux.org.uk>
      2190fed6
    • Russell King's avatar
      ARM: entry: get rid of multiple macro definitions · aa06e5c1
      Russell King authored
      The following structure is just asking for trouble:
      
       #ifdef CONFIG_symbol
      	.macro foo
      	...
      	.endm
      	.macro bar
      	...
      	.endm
      	.macro baz
      	...
      	.endm
       #else
      	.macro foo
      	...
      	.endm
      	.macro bar
      	...
      	.endm
       #ifdef CONFIG_symbol2
      	.macro baz
      	...
      	.endm
       #else
      	.macro baz
      	...
      	.endm
       #endif
       #endif
      
      such as one defintion being updated, but the other definitions miss out.
      Where the contents of a macro needs to be conditional, the hint is in
      the first clause of this very sentence.  "contents" "conditional".  Not
      multiple separate definitions, especially not when much of the macro
      is the same between different configs.
      
      This patch fixes this bad style, which had caused the Thumb2 code to
      miss-out on the uaccess updates.
      Signed-off-by: default avatarRussell King <rmk+kernel@arm.linux.org.uk>
      aa06e5c1
  3. 25 Aug, 2015 2 commits
  4. 21 Aug, 2015 6 commits
  5. 05 Jul, 2015 4 commits
    • Linus Torvalds's avatar
      Linux 4.2-rc1 · d770e558
      Linus Torvalds authored
      d770e558
    • Linus Torvalds's avatar
      Merge tag 'platform-drivers-x86-v4.2-2' of... · a585d2b7
      Linus Torvalds authored
      Merge tag 'platform-drivers-x86-v4.2-2' of git://git.infradead.org/users/dvhart/linux-platform-drivers-x86
      
      Pull late x86 platform driver updates from Darren Hart:
       "The following came in a bit later and I wanted them to bake in next a
        few more days before submitting, thus the second pull.
      
        A new intel_pmc_ipc driver, a symmetrical allocation and free fix in
        dell-laptop, a couple minor fixes, and some updated documentation in
        the dell-laptop comments.
      
        intel_pmc_ipc:
         - Add Intel Apollo Lake PMC IPC driver
      
        tc1100-wmi:
         - Delete an unnecessary check before the function call "kfree"
      
        dell-laptop:
         - Fix allocating & freeing SMI buffer page
         - Show info about WiGig and UWB in debugfs
         - Update information about wireless control"
      
      * tag 'platform-drivers-x86-v4.2-2' of git://git.infradead.org/users/dvhart/linux-platform-drivers-x86:
        intel_pmc_ipc: Add Intel Apollo Lake PMC IPC driver
        tc1100-wmi: Delete an unnecessary check before the function call "kfree"
        dell-laptop: Fix allocating & freeing SMI buffer page
        dell-laptop: Show info about WiGig and UWB in debugfs
        dell-laptop: Update information about wireless control
      a585d2b7
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · 1dc51b82
      Linus Torvalds authored
      Pull more vfs updates from Al Viro:
       "Assorted VFS fixes and related cleanups (IMO the most interesting in
        that part are f_path-related things and Eric's descriptor-related
        stuff).  UFS regression fixes (it got broken last cycle).  9P fixes.
        fs-cache series, DAX patches, Jan's file_remove_suid() work"
      
      [ I'd say this is much more than "fixes and related cleanups".  The
        file_table locking rule change by Eric Dumazet is a rather big and
        fundamental update even if the patch isn't huge.   - Linus ]
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (49 commits)
        9p: cope with bogus responses from server in p9_client_{read,write}
        p9_client_write(): avoid double p9_free_req()
        9p: forgetting to cancel request on interrupted zero-copy RPC
        dax: bdev_direct_access() may sleep
        block: Add support for DAX reads/writes to block devices
        dax: Use copy_from_iter_nocache
        dax: Add block size note to documentation
        fs/file.c: __fget() and dup2() atomicity rules
        fs/file.c: don't acquire files->file_lock in fd_install()
        fs:super:get_anon_bdev: fix race condition could cause dev exceed its upper limitation
        vfs: avoid creation of inode number 0 in get_next_ino
        namei: make set_root_rcu() return void
        make simple_positive() public
        ufs: use dir_pages instead of ufs_dir_pages()
        pagemap.h: move dir_pages() over there
        remove the pointless include of lglock.h
        fs: cleanup slight list_entry abuse
        xfs: Correctly lock inode when removing suid and file capabilities
        fs: Call security_ops->inode_killpriv on truncate
        fs: Provide function telling whether file_remove_privs() will do anything
        ...
      1dc51b82
    • Linus Torvalds's avatar
      bluetooth: fix list handling · 9b284cbd
      Linus Torvalds authored
      Commit 835a6a2f ("Bluetooth: Stop sabotaging list poisoning")
      thought that the code was sabotaging the list poisoning when NULL'ing
      out the list pointers and removed it.
      
      But what was going on was that the bluetooth code was using NULL
      pointers for the list as a way to mark it empty, and that commit just
      broke it (and replaced the test with NULL with a "list_empty()" test on
      a uninitialized list instead, breaking things even further).
      
      So fix it all up to use the regular and real list_empty() handling
      (which does not use NULL, but a pointer to itself), also making sure to
      initialize the list properly (the previous NULL case was initialized
      implicitly by the session being allocated with kzalloc())
      
      This is a combination of patches by Marcel Holtmann and Tedd Ho-Jeong
      An.
      
      [ I would normally expect to get this through the bt tree, but I'm going
        to release -rc1, so I'm just committing this directly   - Linus ]
      Reported-and-tested-by: default avatarJörg Otte <jrg.otte@gmail.com>
      Cc: Alexey Dobriyan <adobriyan@gmail.com>
      Original-by: default avatarTedd Ho-Jeong An <tedd.an@intel.com>
      Original-by: Marcel Holtmann <marcel@holtmann.org>:
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      9b284cbd
  6. 04 Jul, 2015 23 commits