From: Roland McGrath <roland@redhat.com>

The posix-timers implementation associates timers with the creating thread
and destroys timers when their creator thread dies.  POSIX clearly
specifies that these timers are per-process, and a timer should not be torn
down when the thread that created it exits.  I hope there won't be any
controversy on what the correct semantics are here, since POSIX is clear
and the Linux feature is called "posix-timers".

The attached program built with NPTL -lrt -lpthread demonstrates the bug.
The program is correct by POSIX, but fails on Linux.  Note that a until
just the other day, NPTL had a trivial bug that always disabled its use of
kernel timer syscalls (check strace for lack of timer_create/SYS_259).  So
unless you have built your own NPTL libs very recently, you probably won't
see the kernel calls actually used by this program.

Also attached is my patch to fix this.  It (you guessed it) moves the
posix_timers field from task_struct to signal_struct.  Access is now
governed by the siglock instead of the task lock.  exit_itimers is called
from __exit_signal, i.e.  only on the death of the last thread in the
group, rather than from do_exit for every thread.  Timers' it_process
fields store the group leader's pointer, which won't die.  For the case of
SIGEV_THREAD_ID, I hold a ref on the task_struct for it_process to stay
robust in case the target thread dies; the ref is released and the dangling
pointer cleared when the timer fires and the target thread is dead.  (This
should only come up in a buggy user program, so noone cares exactly how the
kernel handles that case.  But I think what I did is robust and sensical.)

/* Test for bogus per-thread deletion of timers.  */

#include <stdio.h>
#include <error.h>
#include <time.h>
#include <signal.h>
#include <stdint.h>
#include <sys/time.h>
#include <sys/resource.h>
#include <unistd.h>
#include <pthread.h>

/* Creating timers in another thread should work too.  */
static void *do_timer_create(void *arg)
{
	struct sigevent *const sigev = arg;
	timer_t *const timerId = sigev->sigev_value.sival_ptr;
	if (timer_create(CLOCK_REALTIME, sigev, timerId) < 0) {
		perror("timer_create");
		return NULL;
	}
	return timerId;
}

int main(void)
{
	int i, res;
	timer_t timerId;
	struct itimerspec itval;
	struct sigevent sigev;

	itval.it_interval.tv_sec = 2;
	itval.it_interval.tv_nsec = 0;
	itval.it_value.tv_sec = 2;
	itval.it_value.tv_nsec = 0;

	sigev.sigev_notify = SIGEV_SIGNAL;
	sigev.sigev_signo = SIGALRM;
	sigev.sigev_value.sival_ptr = (void *)&timerId;

	for (i = 0; i < 100; i++) {
		printf("cnt = %d\n", i);

		pthread_t thr;
		res = pthread_create(&thr, NULL, &do_timer_create, &sigev);
		if (res) {
			error(0, res, "pthread_create");
			continue;
		}
		void *val;
		res = pthread_join(thr, &val);
		if (res) {
			error(0, res, "pthread_join");
			continue;
		}
		if (val == NULL)
			continue;

		res = timer_settime(timerId, 0, &itval, NULL);
		if (res < 0)
			perror("timer_settime");

		res = timer_delete(timerId);
		if (res < 0)
			perror("timer_delete");
	}

	return 0;
}

From: Yoshinori Sato <ysato@users.sourceforge.jp>

- add Kconfig depends H8300
- H8/300 support compile error fixed.

From: Yoshinori Sato <ysato@users.sourceforge.jp>

- fix any error/warning
- fix {request,freee}_irq interrupt control fix
- add dump_stack
- fix show_trace_task
- fix typo

From: Yoshinori Sato <ysato@users.sourceforge.jp>

- use new serial driver (drivers/serial/sh-sci.[ch])
- typo fix
- add message level

From: Yoshinori Sato <ysato@users.sourceforge.jp>

- cleanup define

From: Yoshinori Sato <ysato@users.sourceforge.jp>

- fix PTRACE_SIGLESTEP bug.
- separate to CPU depend.

From: "Randy.Dunlap" <rddunlap@osdl.org>

Use x86 EFLAGS defines in place of hardwired constants.

From: Arjan van de Ven <arjanv@redhat.com>

isdn: dynamically allocate big structures

From: Arjan van de Ven <arjanv@redhat.com>

ide.c: constant array of strings can be static

From: Arjan van de Ven <arjanv@redhat.com>

ide-cd: a few 512 byte scratch buffers can be static; they are just for
putting "padding" sectors in that aren't used.

(acked by Jens)

From: Julie DeWandel <jdewand@redhat.com>

A problem exists where a 32-bit application can have a huge bss, one that
is so large that an overflow of the TASK_SIZE happens.  But in this case,
the overflow is not detected in load_elf_binary().  Instead, because
arithmetic is being done using 32-bit containers, a truncation occurs and
the program gets loaded when it shouldn't have been.  Subsequent execution
yields unpredictable results.

The attached patch fixes this problem by checking for the overflow
condition and sending a SIGKILL to the application if the overflow is
detected.  This problem can in theory exist when loading the elf
interpreter as well, so a similar check was added there.

From: Fabian Frederick <Fabian.Frederick@skynet.be>

Here's a trivial patch to avoid definition redundancy in es1688.

- Don't leak a pathname ref on error

- Don't do putname() on a nameidata.

From: Brian Gerst <bgerst@didntduck.org>

- Move empty_zero_page and swapper_pg_dir to BSS.  This requires that BSS
  is cleared earlier, but reclaims over 3k that was lost due to page
  alignment.

- Move stack_start, ready, and int_msg, boot_gdt_descr, idt_descr, and
  cpu_gdt_descr to .data.  They were interfering with disassembly while in
  .text.

unmap_vmas() will cause scheduling latency when tearing down really big vmas
on !CONFIG_PREEMPT.  That's a bit unkind to the non-preempt case, so let's do
a cond_resched() after zapping 1024 pages.

From: Bernhard Rosenkraenzer <bero@arklinux.org>

mixart.h uses tasklet_struct without including linux/interrupt.h -- fix
attached.

From: Stephen Smalley <sds@epoch.ncsc.mil>

This patch drops the ratelimit code from the SELinux avc, as this can now
be handled by the audit framework.  Enabling and setting the ratelimit is
then left to userspace.

From: Stephen Smalley <sds@epoch.ncsc.mil>

This patch changes an error message printk'd by security_compute_sid to use
the audit framework instead.  These errors reflect situations where a
security transition would normally occur due to policy, but the resulting
security context is not valid.  The patch also changes the code to always
call the audit framework rather than only doing so when permissive as this
was causing problems with testing policy, and does some code cleanup.

From: James Morris <jmorris@redhat.com>

This patch makes the IPv6 code work with the audit framework, following the
merge of both.

From: Rik Faith <faith@redhat.com>

This patch provides a low-overhead system-call auditing framework for Linux
that is usable by LSM components (e.g., SELinux).  This is an update of the
patch discussed in this thread:

    http://marc.theaimsgroup.com/?t=107815888100001&r=1&w=2

In brief, it provides for netlink-based logging of audit records that have
been generated in other parts of the kernel (e.g., SELinux) as well as the
ability to audit system calls, either independently (using simple
filtering) or as a compliment to the audit record that another part of the
kernel generated.

The main goals were to provide system call auditing with 1) as low overhead
as possible, and 2) without duplicating functionality that is already
provided by SELinux (and/or other security infrastructures).  This
framework will work "stand-alone", but is not designed to provide, e.g.,
CAPP functionality without another security component in place.

This updated patch includes changes from feedback I have received,
including the ability to compile without CONFIG_NET (and better use of
tabs, so use -w if you diff against the older patch).

Please see http://people.redhat.com/faith/audit/ for an early example
user-space client (auditd-0.4.tar.gz) and instructions on how to try it.

My future intentions at the kernel level include improving filtering (e.g.,
syscall personality/exit codes) and syscall support for more architectures.
 First, though, I'm going to work on documentation, a (real) audit daemon,
and patches for other user-space tools so that people can play with the
framework and understand how it can be used with and without SELinux.


Update:

Light-weight Auditing Framework receive filter fixes
From: Rik Faith <faith@redhat.com>

Since audit_receive_filter() is only called with audit_netlink_sem held, it
cannot race with either audit_del_rule() or audit_add_rule(), so the
list_for_each_entry_rcu()s may be replaced by list_for_each_entry()s, and
the rcu_read_{un,}lock()s removed.  A fix for this is part of the attached
patch.

Other features of the attached patch are:

1) generalized the ability to test for inequality

2) added syscall exit status reporting and testing

3) added ability to report and test first 4 syscall arguments (this adds
   a large amount of flexibility for little cost; not implemented or tested
   on ppc64)

4) added ability to report and test personality

User-space demo program enhanced for new fields and inequality testing:
http://people.redhat.com/faith/audit/auditd-0.5.tar.gz

This patch removes a harmless duplicate assignment from the IPv6 code.

From: James Morris <jmorris@redhat.com>

The patch below adds explicit IPv6 support to SELinux.

Brief description of changes:

o IPv6 networking is now subject to the same controls as IPv4 (in
  addition to the generic socket permissions which cover all protocols),
  namely: bind to local node address; bind to local port; send & receive
  TCP/UDP and raw IP packets based on local network interface and remote
  node address.

o Packet parsing has been extended to IPv6 packets for logging and
  control, and simplified for IPv4.

o Support for logging of IPv6 addresses has also been added.

o The kernel policy database code has been modified to support IPv6, and
  reworked to provide generic security policy version handling so that
  older policy versions will still work, making upgrading simpler.

Corresponding userspace patches are available at
<http://people.redhat.com/jmorris/selinux/ipv6/>, although current
userspace tools will continue to function normally (but without explicit
IPv6 support).

For more details at the security management level, see
<http://marc.theaimsgroup.com/?l=selinux&m=108068187630948&w=2>

This code has been under testing and review for several weeks.

From: Chris Mason <mason@suse.com>

reiserfs-writepage-ordered-race needs a minor update to include your latest
__block_write_full_page fixes for the direct_read_under bug Daniel was
hitting.

fs/reiserfs/journal.c: In function `reiserfs_end_persistent_transaction':
fs/reiserfs/journal.c:2616: warning: unused variable `s'

Make the functions static inline so that typechecking is enabled if
!CONFIG_REISERFS_CHECK.

From: Chris Mason <mason@suse.com>

block_write_full_page() might see and lock clean metadata buffers, which leads
to journal-1777 messages.  Change the message to ignore bh locked.

From: Chris Mason <mason@suse.com>

Some latency improvements for the reiserfs data=ordered code from Takashi.

From: Chris Mason <mason@suse.com>

reiserfs_unmap_buffer should clean and wait on all buffers.  This fixes a
leak under fsx workloads.

From: Chris Mason <mason@suse.com>

Add reiserfs support for laptop mode.

From: Chris Mason <mason@suse.com>

reiserfs_file_write makes a hole one block too large if it is the first thing
in the file.

From: Chris Mason <mason@suse.com>

Fix reiserfs_writepage so it doesn't race with data=ordered writes.  This
still has a pending fix to redirty the page when it finds a locked buffer. 
Waiting for Andrew to finish sorting that out on ext3 first.

From: Chris Mason <mason@suse.com>

Repacking a tail might leave a journal handle attached to an unmapped buffer.
 If that buffer gets dirtied again (via mmap for example), the reiserfs
data=ordered code might try to write the dirty unmapped buffer to disk.

The fix is to make sure we remove the journal handle when we unmap buffers.

From: Chris Mason <mason@suse.com>

Enable preallocation for reiserfs_file_write when the write size is smaller
than the default preallocation size.

From: Chris Mason <mason@suse.com>

Make sure to hold the BKL while ending a transaction in the error path or
reiserfs_prepare_write.

From: Chris Mason <mason@suse.com>

reiserfs data=ordered support.

From: Chris Mason <mason@suse.com>

reiserfs logging rework, making things much faster for small transactions. 
metadata buffers are dirtied when they are safe to write, so normal kernel
mechanisms can contribute to log cleaning.

From: Chris Mason <mason@suse.com>

reiserfs cleanup, get rid of old debugging code.

From: Chris Mason <mason@suse.com>

reiserfs support for nested transactions.  This originally came from Peter
Braam for 2.4.x and was ported forward by Jeff Mahoney.

ext3 transaction batching has been ineffective since the scheduler changes
forced us to replace the yield() with a schedule().

Using schedule_timeout(1) fixes it up again.  Benchmarking is positive with
wither a 1 or 10 millisecond delay in there, so there appears to be no need
to play around with HZ.

From: Kurt Garloff <garloff@suse.de>

A patch to parse the elf binaries for a PT_GNU_STACK section to set the stack
non-executable if possible.  Most parts have been shamelessly stolen from
Ingo Molnar's more ambitious stackshield
http://people.redhat.com/mingo/exec-shield/exec-shield-2.6.4-C9

The toolchain has meanwhile support for marking the binaries with a
PT_GNU_STACK section wwithout x bit as needed.

If no such section is found, we leave the stack to whatever the arch defaults
to.  If there is one, we explicitly disabled the VM_EXEC bit if no x bit is
found, otherwise explicitly enable.

- s/__inline__/inline/

- Remove lots of extraneous andi-was-here trailing whitespace