)]}' { "log": [ { "commit": "3eaded86ac3e7f00fb3eeb8162d89e9a34e42fb0", "tree": "4c48b9f1739dcb034186956bf39908803b524154", "parents": [ "527d1511310a89650000081869260394e20c7013", "9175c9d2aed528800175ef81c90569d00d23f9be" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Nov 21 19:18:14 2013 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Nov 21 19:18:14 2013 -0800" }, "message": "Merge git://git.infradead.org/users/eparis/audit\n\nPull audit updates from Eric Paris:\n \"Nothing amazing. Formatting, small bug fixes, couple of fixes where\n we didn\u0027t get records due to some old VFS changes, and a change to how\n we collect execve info...\"\n\nFixed conflict in fs/exec.c as per Eric and linux-next.\n\n* git://git.infradead.org/users/eparis/audit: (28 commits)\n audit: fix type of sessionid in audit_set_loginuid()\n audit: call audit_bprm() only once to add AUDIT_EXECVE information\n audit: move audit_aux_data_execve contents into audit_context union\n audit: remove unused envc member of audit_aux_data_execve\n audit: Kill the unused struct audit_aux_data_capset\n audit: do not reject all AUDIT_INODE filter types\n audit: suppress stock memalloc failure warnings since already managed\n audit: log the audit_names record type\n audit: add child record before the create to handle case where create fails\n audit: use given values in tty_audit enable api\n audit: use nlmsg_len() to get message payload length\n audit: use memset instead of trying to initialize field by field\n audit: fix info leak in AUDIT_GET requests\n audit: update AUDIT_INODE filter rule to comparator function\n audit: audit feature to set loginuid immutable\n audit: audit feature to only allow unsetting the loginuid\n audit: allow unsetting the loginuid (with priv)\n audit: remove CONFIG_AUDIT_LOGINUID_IMMUTABLE\n audit: loginuid functions coding style\n selinux: apply selinux checks on new audit message types\n ...\n" }, { "commit": "5cbb3d216e2041700231bcfc383ee5f8b7fc8b74", "tree": "a738fa82dbcefa9bd283c08bc67f38827be63937", "parents": [ "9bc9ccd7db1c9f043f75380b5a5b94912046a60e", "4e9b45a19241354daec281d7a785739829b52359" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Nov 13 15:45:43 2013 +0900" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Nov 13 15:45:43 2013 +0900" }, "message": "Merge branch \u0027akpm\u0027 (patches from Andrew Morton)\n\nMerge first patch-bomb from Andrew Morton:\n \"Quite a lot of other stuff is banked up awaiting further\n next-\u003emainline merging, but this batch contains:\n\n - Lots of random misc patches\n - OCFS2\n - Most of MM\n - backlight updates\n - lib/ updates\n - printk updates\n - checkpatch updates\n - epoll tweaking\n - rtc updates\n - hfs\n - hfsplus\n - documentation\n - procfs\n - update gcov to gcc-4.7 format\n - IPC\"\n\n* emailed patches from Andrew Morton \u003cakpm@linux-foundation.org\u003e: (269 commits)\n ipc, msg: fix message length check for negative values\n ipc/util.c: remove unnecessary work pending test\n devpts: plug the memory leak in kill_sb\n ./Makefile: export initial ramdisk compression config option\n init/Kconfig: add option to disable kernel compression\n drivers: w1: make w1_slave::flags long to avoid memory corruption\n drivers/w1/masters/ds1wm.cuse dev_get_platdata()\n drivers/memstick/core/ms_block.c: fix unreachable state in h_msb_read_page()\n drivers/memstick/core/mspro_block.c: fix attributes array allocation\n drivers/pps/clients/pps-gpio.c: remove redundant of_match_ptr\n kernel/panic.c: reduce 1 byte usage for print tainted buffer\n gcov: reuse kbasename helper\n kernel/gcov/fs.c: use pr_warn()\n kernel/module.c: use pr_foo()\n gcov: compile specific gcov implementation based on gcc version\n gcov: add support for gcc 4.7 gcov format\n gcov: move gcov structs definitions to a gcc version specific file\n kernel/taskstats.c: return -ENOMEM when alloc memory fails in add_del_listener()\n kernel/taskstats.c: add nla_nest_cancel() for failure processing between nla_nest_start() and nla_nest_end()\n kernel/sysctl_binary.c: use scnprintf() instead of snprintf()\n ...\n" }, { "commit": "9bc9ccd7db1c9f043f75380b5a5b94912046a60e", "tree": "dd0a1b3396ae9414f668b0110cc39d11268ad3ed", "parents": [ "f0230294271f511b41797305b685365a9e569a09", "bdd3536618443809d18868563eeafa63b9d29603" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Nov 13 15:34:18 2013 +0900" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Nov 13 15:34:18 2013 +0900" }, "message": "Merge branch \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs\n\nPull vfs updates from Al Viro:\n \"All kinds of stuff this time around; some more notable parts:\n\n - RCU\u0027d vfsmounts handling\n - new primitives for coredump handling\n - files_lock is gone\n - Bruce\u0027s delegations handling series\n - exportfs fixes\n\n plus misc stuff all over the place\"\n\n* \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (101 commits)\n ecryptfs: -\u003ef_op is never NULL\n locks: break delegations on any attribute modification\n locks: break delegations on link\n locks: break delegations on rename\n locks: helper functions for delegation breaking\n locks: break delegations on unlink\n namei: minor vfs_unlink cleanup\n locks: implement delegations\n locks: introduce new FL_DELEG lock flag\n vfs: take i_mutex on renamed file\n vfs: rename I_MUTEX_QUOTA now that it\u0027s not used for quotas\n vfs: don\u0027t use PARENT/CHILD lock classes for non-directories\n vfs: pull ext4\u0027s double-i_mutex-locking into common code\n exportfs: fix quadratic behavior in filehandle lookup\n exportfs: better variable name\n exportfs: move most of reconnect_path to helper function\n exportfs: eliminate unused \"noprogress\" counter\n exportfs: stop retrying once we race with rename/remove\n exportfs: clear DISCONNECTED on all parents sooner\n exportfs: more detailed comment for path_reconnect\n ...\n" }, { "commit": "d049f74f2dbe71354d43d393ac3a188947811348", "tree": "7d3b6d88824a0584ae3c8d86782d69bf331d6cef", "parents": [ "1c3fc3e5cc8a81d21b199cb739d5d9c51f3688f4" ], "author": { "name": "Kees Cook", "email": "keescook@chromium.org", "time": "Tue Nov 12 15:11:17 2013 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Nov 13 12:09:33 2013 +0900" }, "message": "exec/ptrace: fix get_dumpable() incorrect tests\n\nThe get_dumpable() return value is not boolean. Most users of the\nfunction actually want to be testing for non-SUID_DUMP_USER(1) rather than\nSUID_DUMP_DISABLE(0). The SUID_DUMP_ROOT(2) is also considered a\nprotected state. Almost all places did this correctly, excepting the two\nplaces fixed in this patch.\n\nWrong logic:\n if (dumpable \u003d\u003d SUID_DUMP_DISABLE) { /* be protective */ }\n or\n if (dumpable \u003d\u003d 0) { /* be protective */ }\n or\n if (!dumpable) { /* be protective */ }\n\nCorrect logic:\n if (dumpable !\u003d SUID_DUMP_USER) { /* be protective */ }\n or\n if (dumpable !\u003d 1) { /* be protective */ }\n\nWithout this patch, if the system had set the sysctl fs/suid_dumpable\u003d2, a\nuser was able to ptrace attach to processes that had dropped privileges to\nthat user. (This may have been partially mitigated if Yama was enabled.)\n\nThe macros have been moved into the file that declares get/set_dumpable(),\nwhich means things like the ia64 code can see them too.\n\nCVE-2013-2929\n\nReported-by: Vasily Kulikov \u003csegoon@openwall.com\u003e\nSigned-off-by: Kees Cook \u003ckeescook@chromium.org\u003e\nCc: \"Luck, Tony\" \u003ctony.luck@intel.com\u003e\nCc: Oleg Nesterov \u003coleg@redhat.com\u003e\nCc: \"Eric W. Biederman\" \u003cebiederm@xmission.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "9410d228a4cf434305306746bb799fb7acdd8648", "tree": "93dc6f756af3c2557f2e1377bad52582fdd9fe19", "parents": [ "d9cfea91e97d5d19f9d69beaa844f5fe56a6adc6" ], "author": { "name": "Richard Guy Briggs", "email": "rgb@redhat.com", "time": "Wed Oct 30 18:05:24 2013 -0400" }, "committer": { "name": "Eric Paris", "email": "eparis@redhat.com", "time": "Tue Nov 05 11:15:03 2013 -0500" }, "message": "audit: call audit_bprm() only once to add AUDIT_EXECVE information\n\nMove the audit_bprm() call from search_binary_handler() to exec_binprm(). This\nallows us to get rid of the mm member of struct audit_aux_data_execve since\nbprm-\u003emm will equal current-\u003emm.\n\nThis also mitigates the issue that -\u003eargc could be modified by the\nload_binary() call in search_binary_handler().\n\naudit_bprm() was being called to add an AUDIT_EXECVE record to the audit\ncontext every time search_binary_handler() was recursively called. Only one\nreference is necessary.\n\nReported-by: Oleg Nesterov \u003conestero@redhat.com\u003e\nCc: Eric Paris \u003ceparis@redhat.com\u003e\nSigned-off-by: Richard Guy Briggs \u003crgb@redhat.com\u003e\nSigned-off-by: Eric Paris \u003ceparis@redhat.com\u003e\n---\nThis patch is against 3.11, but was developed on Oleg\u0027s post-3.11 patches that\nintroduce exec_binprm().\n" }, { "commit": "72c2d53192004845cbc19cd8a30b3212a9288140", "tree": "31fcd924438f03d5aa09d13ffd813fb153da37c3", "parents": [ "22bd002ee76aa7d7a3393f39d977f6c106153c60" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Sun Sep 22 16:27:52 2013 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Thu Oct 24 23:34:54 2013 -0400" }, "message": "file-\u003ef_op is never NULL...\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "82727018b0d33d188e9916bcf76f18387484cb04", "tree": "429e0db98c4512f714a668ae9ef9d3bb6e85ce0f", "parents": [ "83e1d2cd9eabec5164afea295ff06b941ae8e4a9" ], "author": { "name": "Rik van Riel", "email": "riel@redhat.com", "time": "Mon Oct 07 11:29:28 2013 +0100" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Wed Oct 09 14:48:00 2013 +0200" }, "message": "sched/numa: Call task_numa_free() from do_execve()\n\nIt is possible for a task in a numa group to call exec, and\nhave the new (unrelated) executable inherit the numa group\nassociation from its former self.\n\nThis has the potential to break numa grouping, and is trivial\nto fix.\n\nSigned-off-by: Rik van Riel \u003criel@redhat.com\u003e\nSigned-off-by: Mel Gorman \u003cmgorman@suse.de\u003e\nCc: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: Johannes Weiner \u003channes@cmpxchg.org\u003e\nCc: Srikar Dronamraju \u003csrikar@linux.vnet.ibm.com\u003e\nSigned-off-by: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nLink: http://lkml.kernel.org/r/1381141781-10992-51-git-send-email-mgorman@suse.de\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\n" }, { "commit": "6b3c538f5b2cfc53cb6803ec5001bbcf8f18a98e", "tree": "5a3dd78b655c93d7248facb2377be2630435b1fc", "parents": [ "4e0621a07ea58a0dc15859be3b743bdeb194a51b" ], "author": { "name": "Oleg Nesterov", "email": "oleg@redhat.com", "time": "Wed Sep 11 14:24:46 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Sep 11 15:59:09 2013 -0700" }, "message": "exec: cleanup the error handling in search_binary_handler()\n\nThe error hanling and ret-from-loop look confusing and inconsistent.\n\n- \"retval \u003e\u003d 0\" simply returns\n\n- \"!bprm-\u003efile\" returns too but with read_unlock() because\n binfmt_lock was already re-acquired\n\n- \"retval !\u003d -ENOEXEC || bprm-\u003emm \u003d\u003d NULL\" does \"break\" and\n relies on the same check after the main loop\n\nConsolidate these checks into a single if/return statement.\n\nneed_retry still checks \"retval \u003d\u003d -ENOEXEC\", but this and -ENOENT before\nthe main loop are not needed. This is only for pathological and\nimpossible list_empty(\u0026formats) case.\n\nIt is not clear why do we check \"bprm-\u003emm \u003d\u003d NULL\", probably this\nshould be removed.\n\nSigned-off-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nAcked-by: Kees Cook \u003ckeescook@chromium.org\u003e\nCc: Al Viro \u003cviro@ZenIV.linux.org.uk\u003e\nCc: Evgeniy Polyakov \u003czbr@ioremap.net\u003e\nCc: Zach Levis \u003czml@linux.vnet.ibm.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "4e0621a07ea58a0dc15859be3b743bdeb194a51b", "tree": "954721cb1776b325b74a48b1858d1b0ac6ff580b", "parents": [ "cb7b6b1cbc20a970c7124efae1c2478155604b54" ], "author": { "name": "Oleg Nesterov", "email": "oleg@redhat.com", "time": "Wed Sep 11 14:24:45 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Sep 11 15:59:07 2013 -0700" }, "message": "exec: don\u0027t retry if request_module() fails\n\nA separate one-liner for better documentation.\n\nIt doesn\u0027t make sense to retry if request_module() fails to exec\n/sbin/modprobe, add the additional \"request_module() \u003c 0\" check.\n\nHowever, this logic still doesn\u0027t look exactly right:\n\n1. It would be better to check \"request_module() !\u003d 0\", the user\n space modprobe process should report the correct exit code.\n But I didn\u0027t dare to add the user-visible change.\n\n2. The whole ENOEXEC logic looks suboptimal. Suppose that we try\n to exec a \"#!path-to-unsupported-binary\" script. In this case\n request_module() + \"retry\" will be done twice: first by the\n \"depth \u003d\u003d 1\" code, and then again by the \"depth \u003d\u003d 0\" caller\n which doesn\u0027t make sense.\n\n3. And note that in the case above bprm-\u003ebuf was already changed\n by load_script()-\u003eprepare_binprm(), so this looks even more\n ugly.\n\nSigned-off-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nAcked-by: Kees Cook \u003ckeescook@chromium.org\u003e\nCc: Al Viro \u003cviro@ZenIV.linux.org.uk\u003e\nCc: Evgeniy Polyakov \u003czbr@ioremap.net\u003e\nCc: Zach Levis \u003czml@linux.vnet.ibm.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "cb7b6b1cbc20a970c7124efae1c2478155604b54", "tree": "ef0e867017f0a6fea23ebdcd87753174a4c75a25", "parents": [ "92eaa565add62d56b90987f58ea9feafc5a7c183" ], "author": { "name": "Oleg Nesterov", "email": "oleg@redhat.com", "time": "Wed Sep 11 14:24:44 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Sep 11 15:59:05 2013 -0700" }, "message": "exec: cleanup the CONFIG_MODULES logic\n\nsearch_binary_handler() uses \"for (try\u003d0; try\u003c2; try++)\" to avoid \"goto\"\nbut the code looks too complicated and horrible imho. We still need to\ncheck \"try \u003d\u003d 0\" before request_module() and add the additional \"break\"\nfor !CONFIG_MODULES case.\n\nKill this loop and use a simple \"bool need_retry\" + \"goto retry\". The\ncode looks much simpler and we do not even need ifdef\u0027s, gcc can optimize\nout the \"if (need_retry)\" block if !IS_ENABLED().\n\nSigned-off-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nAcked-by: Kees Cook \u003ckeescook@chromium.org\u003e\nCc: Al Viro \u003cviro@ZenIV.linux.org.uk\u003e\nCc: Evgeniy Polyakov \u003czbr@ioremap.net\u003e\nCc: Zach Levis \u003czml@linux.vnet.ibm.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "92eaa565add62d56b90987f58ea9feafc5a7c183", "tree": "78f7bfaa0b99b2b2f5b554bc883b67ac68412e21", "parents": [ "52f14282bb0c3d3e5ba2a9eaacb12ff37a033e7e" ], "author": { "name": "Oleg Nesterov", "email": "oleg@redhat.com", "time": "Wed Sep 11 14:24:42 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Sep 11 15:59:05 2013 -0700" }, "message": "exec: kill -\u003eload_binary !\u003d NULL check in search_binary_handler()\n\nsearch_binary_handler() checks -\u003eload_binary !\u003d NULL for no reason, this\nmethod should be always defined. Turn this check into WARN_ON() and move\nit into __register_binfmt().\n\nAlso, kill the function pointer. The current code looks confusing, as if\n-\u003eload_binary can go away after read_unlock(\u0026binfmt_lock). But we rely on\nmodule_get(fmt-\u003emodule), this fmt can\u0027t be changed or unregistered,\notherwise this code is buggy anyway.\n\nSigned-off-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nAcked-by: Kees Cook \u003ckeescook@chromium.org\u003e\nCc: Al Viro \u003cviro@ZenIV.linux.org.uk\u003e\nCc: Evgeniy Polyakov \u003czbr@ioremap.net\u003e\nCc: Zach Levis \u003czml@linux.vnet.ibm.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "52f14282bb0c3d3e5ba2a9eaacb12ff37a033e7e", "tree": "c0f02056772e53e294784388b4202e94271c46e6", "parents": [ "9beb266f2d7e5362c5bb9f999255aa1af5318aef" ], "author": { "name": "Oleg Nesterov", "email": "oleg@redhat.com", "time": "Wed Sep 11 14:24:41 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Sep 11 15:59:05 2013 -0700" }, "message": "exec: move allow_write_access/fput to exec_binprm()\n\nWhen search_binary_handler() succeeds it does allow_write_access() and\nfput(), then it clears bprm-\u003efile to ensure the caller will not do the\nsame.\n\nWe can simply move this code to exec_binprm() which is called only once.\nIn fact we could move this to free_bprm() and remove the same code in\ndo_execve_common\u0027s error path.\n\nSigned-off-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nAcked-by: Kees Cook \u003ckeescook@chromium.org\u003e\nCc: Al Viro \u003cviro@ZenIV.linux.org.uk\u003e\nCc: Evgeniy Polyakov \u003czbr@ioremap.net\u003e\nCc: Zach Levis \u003czml@linux.vnet.ibm.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "9beb266f2d7e5362c5bb9f999255aa1af5318aef", "tree": "96ba701872c5b66b1801f785a6a50b6d3b74e2b1", "parents": [ "131b2f9f1214f338f0bf7c0d9760019f2b1d0c20" ], "author": { "name": "Oleg Nesterov", "email": "oleg@redhat.com", "time": "Wed Sep 11 14:24:40 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Sep 11 15:59:05 2013 -0700" }, "message": "exec: proc_exec_connector() should be called only once\n\nA separate one-liner with the minor fix.\n\nPROC_EVENT_EXEC reports the \"exec\" event, but this message is sent at\nleast twice if search_binary_handler() is called by -\u003eload_binary()\nrecursively, say, load_script().\n\nMove it to exec_binprm(), this is \"depth \u003d\u003d 0\" code too.\n\nSigned-off-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nAcked-by: Kees Cook \u003ckeescook@chromium.org\u003e\nCc: Al Viro \u003cviro@ZenIV.linux.org.uk\u003e\nCc: Evgeniy Polyakov \u003czbr@ioremap.net\u003e\nCc: Zach Levis \u003czml@linux.vnet.ibm.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "131b2f9f1214f338f0bf7c0d9760019f2b1d0c20", "tree": "b60a498414e259fe4e81f210378538f90ada9224", "parents": [ "5d1baf3b63bfc8c709dc44df85ff1475c7ef489d" ], "author": { "name": "Oleg Nesterov", "email": "oleg@redhat.com", "time": "Wed Sep 11 14:24:39 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Sep 11 15:59:04 2013 -0700" }, "message": "exec: kill \"int depth\" in search_binary_handler()\n\nNobody except search_binary_handler() should touch -\u003erecursion_depth, \"int\ndepth\" buys nothing but complicates the code, kill it.\n\nProbably we should also kill \"fn\" and the !NULL check, -\u003eload_binary\nshould be always defined. And it can not go away after read_unlock() or\nthis code is buggy anyway.\n\nSigned-off-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nAcked-by: Kees Cook \u003ckeescook@chromium.org\u003e\nCc: Al Viro \u003cviro@ZenIV.linux.org.uk\u003e\nCc: Evgeniy Polyakov \u003czbr@ioremap.net\u003e\nCc: Zach Levis \u003czml@linux.vnet.ibm.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "5d1baf3b63bfc8c709dc44df85ff1475c7ef489d", "tree": "c22cad96687d70a544674f7eb823026aecf4ceeb", "parents": [ "96d0df79f2644fc823f26c06491e182d87a90c2a" ], "author": { "name": "Oleg Nesterov", "email": "oleg@redhat.com", "time": "Wed Sep 11 14:24:38 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Sep 11 15:59:03 2013 -0700" }, "message": "exec: introduce exec_binprm() for \"depth \u003d\u003d 0\" code\n\ntask_pid_nr_ns() and trace/ptrace code in the middle of the recursive\nsearch_binary_handler() looks confusing and imho annoying. We only need\nthis code if \"depth \u003d\u003d 0\", lets add a simple helper which calls\nsearch_binary_handler() and does trace_sched_process_exec() +\nptrace_event().\n\nThe patch also moves the setting of task-\u003edid_exec, we need to do this\nonly once.\n\nNote: we can kill either task-\u003edid_exec or PF_FORKNOEXEC.\n\nSigned-off-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nAcked-by: Kees Cook \u003ckeescook@chromium.org\u003e\nCc: Al Viro \u003cviro@ZenIV.linux.org.uk\u003e\nCc: Evgeniy Polyakov \u003czbr@ioremap.net\u003e\nCc: Zach Levis \u003czml@linux.vnet.ibm.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "d9104d1ca9662498339c0de975b4666c30485f4e", "tree": "cb95c72dde19930ca985b9834d604958ef4eecde", "parents": [ "3b11f0aaae830f0f569cb8fb7fd26f4133ebdabd" ], "author": { "name": "Cyrill Gorcunov", "email": "gorcunov@gmail.com", "time": "Wed Sep 11 14:22:24 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Sep 11 15:57:56 2013 -0700" }, "message": "mm: track vma changes with VM_SOFTDIRTY bit\n\nPavel reported that in case if vma area get unmapped and then mapped (or\nexpanded) in-place, the soft dirty tracker won\u0027t be able to recognize this\nsituation since it works on pte level and ptes are get zapped on unmap,\nloosing soft dirty bit of course.\n\nSo to resolve this situation we need to track actions on vma level, there\nVM_SOFTDIRTY flag comes in. When new vma area created (or old expanded)\nwe set this bit, and keep it here until application calls for clearing\nsoft dirty bit.\n\nThus when user space application track memory changes now it can detect if\nvma area is renewed.\n\nReported-by: Pavel Emelyanov \u003cxemul@parallels.com\u003e\nSigned-off-by: Cyrill Gorcunov \u003cgorcunov@openvz.org\u003e\nCc: Andy Lutomirski \u003cluto@amacapital.net\u003e\nCc: Matt Mackall \u003cmpm@selenic.com\u003e\nCc: Xiao Guangrong \u003cxiaoguangrong@linux.vnet.ibm.com\u003e\nCc: Marcelo Tosatti \u003cmtosatti@redhat.com\u003e\nCc: KOSAKI Motohiro \u003ckosaki.motohiro@gmail.com\u003e\nCc: Stephen Rothwell \u003csfr@canb.auug.org.au\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: \"Aneesh Kumar K.V\" \u003caneesh.kumar@linux.vnet.ibm.com\u003e\nCc: Rob Landley \u003crob@landley.net\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "2b047252d087be7f2ba088b4933cd904f92e6fce", "tree": "b240af27ca0530f7b26f1314968f01140a72a5f8", "parents": [ "f1d6e17f540af37bb1891480143669ba7636c4cf" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Aug 15 11:42:25 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 16 08:52:46 2013 -0700" }, "message": "Fix TLB gather virtual address range invalidation corner cases\n\nBen Tebulin reported:\n\n \"Since v3.7.2 on two independent machines a very specific Git\n repository fails in 9/10 cases on git-fsck due to an SHA1/memory\n failures. This only occurs on a very specific repository and can be\n reproduced stably on two independent laptops. Git mailing list ran\n out of ideas and for me this looks like some very exotic kernel issue\"\n\nand bisected the failure to the backport of commit 53a59fc67f97 (\"mm:\nlimit mmu_gather batching to fix soft lockups on !CONFIG_PREEMPT\").\n\nThat commit itself is not actually buggy, but what it does is to make it\nmuch more likely to hit the partial TLB invalidation case, since it\nintroduces a new case in tlb_next_batch() that previously only ever\nhappened when running out of memory.\n\nThe real bug is that the TLB gather virtual memory range setup is subtly\nbuggered. It was introduced in commit 597e1c3580b7 (\"mm/mmu_gather:\nenable tlb flush range in generic mmu_gather\"), and the range handling\nwas already fixed at least once in commit e6c495a96ce0 (\"mm: fix the TLB\nrange flushed when __tlb_remove_page() runs out of slots\"), but that fix\nwas not complete.\n\nThe problem with the TLB gather virtual address range is that it isn\u0027t\nset up by the initial tlb_gather_mmu() initialization (which didn\u0027t get\nthe TLB range information), but it is set up ad-hoc later by the\nfunctions that actually flush the TLB. And so any such case that forgot\nto update the TLB range entries would potentially miss TLB invalidates.\n\nRather than try to figure out exactly which particular ad-hoc range\nsetup was missing (I personally suspect it\u0027s the hugetlb case in\nzap_huge_pmd(), which didn\u0027t have the same logic as zap_pte_range()\ndid), this patch just gets rid of the problem at the source: make the\nTLB range information available to tlb_gather_mmu(), and initialize it\nwhen initializing all the other tlb gather fields.\n\nThis makes the patch larger, but conceptually much simpler. And the end\nresult is much more understandable; even if you want to play games with\npartial ranges when invalidating the TLB contents in chunks, now the\nrange information is always there, and anybody who doesn\u0027t want to\nbother with it won\u0027t introduce subtle bugs.\n\nBen verified that this fixes his problem.\n\nReported-bisected-and-tested-by: Ben Tebulin \u003ctebulin@googlemail.com\u003e\nBuild-testing-by: Stephen Rothwell \u003csfr@canb.auug.org.au\u003e\nBuild-testing-by: Richard Weinberger \u003crichard.weinberger@gmail.com\u003e\nReviewed-by: Michal Hocko \u003cmhocko@suse.cz\u003e\nAcked-by: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "266b7a021f7dcc4d4531961a47f4ef74c3c4ab6b", "tree": "b7c5a2ada9b2b4cbab15b23b5b3b6922e2fd1f4b", "parents": [ "bd9d43f47d6944019918a801398c587ee86c4b52" ], "author": { "name": "Oleg Nesterov", "email": "oleg@redhat.com", "time": "Wed Jul 03 15:08:35 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Jul 03 16:08:03 2013 -0700" }, "message": "fs/exec.c:de_thread: mt-exec should update -\u003ereal_start_time\n\n924b42d5 (\"Use boot based time for process start time and boot time in\n/proc\") updated copy_process/do_task_stat but forgot about de_thread().\nThis breaks \"ps axOT\" if a sub-thread execs.\n\nNote: I think that task-\u003estart_time should die.\n\nSigned-off-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nCc: \"Eric W. Biederman\" \u003cebiederm@xmission.com\u003e\nAcked-by: John Stultz \u003cjohnstul@us.ibm.com\u003e\nCc: Tomas Janousek \u003ctjanouse@redhat.com\u003e\nCc: Tomas Smetana \u003ctsmetana@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "bd9d43f47d6944019918a801398c587ee86c4b52", "tree": "56e2f0df4307e5562793b67a8efe7261f168acef", "parents": [ "18c830df771f2ba8b4699fea9af1492275ae627b" ], "author": { "name": "Oleg Nesterov", "email": "oleg@redhat.com", "time": "Wed Jul 03 15:08:34 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Jul 03 16:08:03 2013 -0700" }, "message": "fs/exec.c: do_execve_common(): use current_user()\n\nTrivial cleanup. do_execve_common() can use current_user() and avoid the\nunnecessary \"struct cred *cred\" var.\n\nSigned-off-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nCc: Vasiliy Kulikov \u003csegoon@openwall.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "3f4185483832ccf3d2977923db576fa689c2abce", "tree": "b977552009147be3c15097405f58f0519d29184a", "parents": [ "888ffc5923e4343a78575918ab781e85fa22d244" ], "author": { "name": "Oleg Nesterov", "email": "oleg@redhat.com", "time": "Wed Jul 03 15:08:25 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Jul 03 16:08:02 2013 -0700" }, "message": "fs/exec.c:de_thread(): use change_pid() rather than detach_pid/attach_pid\n\nde_thread() can use change_pid() instead of detach + attach. This looks\nbetter and this ensures that, say, next_thread() can never see a task with\n-\u003epid \u003d\u003d NULL.\n\nSigned-off-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nAcked-by: \"Eric W. Biederman\" \u003cebiederm@xmission.com\u003e\nCc: Michal Hocko \u003cmhocko@suse.cz\u003e\nCc: Pavel Emelyanov \u003cxemul@parallels.com\u003e\nCc: Sergey Dyasly \u003cdserrg@gmail.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "790eac5640abf7a57fa3a644386df330e18c11b0", "tree": "08de20bde44f59e51b91ff473a71047c2957e8c9", "parents": [ "0b0585c3e192967cb2ef0ac0816eb8a8c8d99840", "48bde8d3620f5f3c6ae9ff599eb404055ae51664" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Jul 03 09:10:19 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Jul 03 09:10:19 2013 -0700" }, "message": "Merge branch \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs\n\nPull second set of VFS changes from Al Viro:\n \"Assorted f_pos race fixes, making do_splice_direct() safe to call with\n i_mutex on parent, O_TMPFILE support, Jeff\u0027s locks.c series,\n -\u003ed_hash/-\u003ed_compare calling conventions changes from Linus, misc\n stuff all over the place.\"\n\n* \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (63 commits)\n Document -\u003etmpfile()\n ext4: -\u003etmpfile() support\n vfs: export lseek_execute() to modules\n lseek_execute() doesn\u0027t need an inode passed to it\n block_dev: switch to fixed_size_llseek()\n cpqphp_sysfs: switch to fixed_size_llseek()\n tile-srom: switch to fixed_size_llseek()\n proc_powerpc: switch to fixed_size_llseek()\n ubi/cdev: switch to fixed_size_llseek()\n pci/proc: switch to fixed_size_llseek()\n isapnp: switch to fixed_size_llseek()\n lpfc: switch to fixed_size_llseek()\n locks: give the blocked_hash its own spinlock\n locks: add a new \"lm_owner_key\" lock operation\n locks: turn the blocked_list into a hashtable\n locks: convert fl_link to a hlist_node\n locks: avoid taking global lock if possible when waking up blocked waiters\n locks: protect most of the file_lock handling with i_lock\n locks: encapsulate the fl_link list handling\n locks: make \"added\" in __posix_lock_file a bool\n ...\n" }, { "commit": "f9652e10c12b43d9bb957269745cf2fa5682fa92", "tree": "fd358891b9778f7bdd8764163aa2029d01efcf9c", "parents": [ "50cd2c577668a170750b15f9a88f022f681ce3c7" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Tue Jun 11 08:23:01 2013 +0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Sat Jun 29 12:57:09 2013 +0400" }, "message": "allow build_open_flags() to return an error\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "2976b10f05bd7f6dab9f9e7524451ddfed656a89", "tree": "91db780e26c85a060e10db9641f09aecd0cf79d3", "parents": [ "c790b0ad23f427c7522ffed264706238c57c007e" ], "author": { "name": "Stephane Eranian", "email": "eranian@google.com", "time": "Thu Jun 20 11:36:28 2013 +0200" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Wed Jun 26 11:40:18 2013 +0200" }, "message": "perf: Disable monitoring on setuid processes for regular users\n\nThere was a a bug in setup_new_exec(), whereby\nthe test to disabled perf monitoring was not\ncorrect because the new credentials for the\nprocess were not yet committed and therefore\nthe get_dumpable() test was never firing.\n\nThe patch fixes the problem by moving the\nperf_event test until after the credentials\nare committed.\n\nSigned-off-by: Stephane Eranian \u003ceranian@google.com\u003e\nTested-by: Jiri Olsa \u003cjolsa@redhat.com\u003e\nAcked-by: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nCc: \u003cstable@kernel.org\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\n" }, { "commit": "20b4fb485227404329e41ad15588afad3df23050", "tree": "f3e099f0ab3da8a93b447203e294d2bb22f6dc05", "parents": [ "b9394d8a657cd3c064fa432aa0905c1b58b38fe9", "ac3e3c5b1164397656df81b9e9ab4991184d3236" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed May 01 17:51:54 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed May 01 17:51:54 2013 -0700" }, "message": "Merge branch \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs\n\nPull VFS updates from Al Viro,\n\nMisc cleanups all over the place, mainly wrt /proc interfaces (switch\ncreate_proc_entry to proc_create(), get rid of the deprecated\ncreate_proc_read_entry() in favor of using proc_create_data() and\nseq_file etc).\n\n7kloc removed.\n\n* \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (204 commits)\n don\u0027t bother with deferred freeing of fdtables\n proc: Move non-public stuff from linux/proc_fs.h to fs/proc/internal.h\n proc: Make the PROC_I() and PDE() macros internal to procfs\n proc: Supply a function to remove a proc entry by PDE\n take cgroup_open() and cpuset_open() to fs/proc/base.c\n ppc: Clean up scanlog\n ppc: Clean up rtas_flash driver somewhat\n hostap: proc: Use remove_proc_subtree()\n drm: proc: Use remove_proc_subtree()\n drm: proc: Use minor-\u003eindex to label things, not PDE-\u003ename\n drm: Constify drm_proc_list[]\n zoran: Don\u0027t print proc_dir_entry data in debug\n reiserfs: Don\u0027t access the proc_dir_entry in r_open(), r_start() r_show()\n proc: Supply an accessor for getting the data from a PDE\u0027s parent\n airo: Use remove_proc_subtree()\n rtl8192u: Don\u0027t need to save device proc dir PDE\n rtl8187se: Use a dir under /proc/net/r8180/\n proc: Add proc_mkdir_data()\n proc: Move some bits from linux/proc_fs.h to linux/{of.h,signal.h,tty.h}\n proc: Move PDE_NET() to fs/proc/proc_net.c\n ...\n" }, { "commit": "e56fb2874015370e3b7f8d85051f6dce26051df9", "tree": "0820c06eb4a25daf65734412af139e98ac1649c8", "parents": [ "12eaaf309a798973d215f7f21aa5a67a760ed7c8" ], "author": { "name": "Oleg Nesterov", "email": "oleg@redhat.com", "time": "Tue Apr 30 15:28:20 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Apr 30 17:04:07 2013 -0700" }, "message": "exec: do not abuse -\u003ecred_guard_mutex in threadgroup_lock()\n\nthreadgroup_lock() takes signal-\u003ecred_guard_mutex to ensure that\nthread_group_leader() is stable. This doesn\u0027t look nice, the scope of\nthis lock in do_execve() is huge.\n\nAnd as Dave pointed out this can lead to deadlock, we have the\nfollowing dependencies:\n\n\tdo_execve:\t\tcred_guard_mutex -\u003e i_mutex\n\tcgroup_mount:\t\ti_mutex -\u003e cgroup_mutex\n\tattach_task_by_pid:\tcgroup_mutex -\u003e cred_guard_mutex\n\nChange de_thread() to take threadgroup_change_begin() around the\nswitch-the-leader code and change threadgroup_lock() to avoid\n-\u003ecred_guard_mutex.\n\nNote that de_thread() can\u0027t sleep with -\u003egroup_rwsem held, this can\nobviously deadlock with the exiting leader if the writer is active, so it\ndoes threadgroup_change_end() before schedule().\n\nReported-by: Dave Jones \u003cdavej@redhat.com\u003e\nAcked-by: Tejun Heo \u003ctj@kernel.org\u003e\nAcked-by: Li Zefan \u003clizefan@huawei.com\u003e\nSigned-off-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "12eaaf309a798973d215f7f21aa5a67a760ed7c8", "tree": "6be40c0ec42f7cf8eb5d09c31e1f36cc21499720", "parents": [ "830e0fc967a7ee5013d5d1cf6a3cea71a8868466" ], "author": { "name": "Oleg Nesterov", "email": "oleg@redhat.com", "time": "Tue Apr 30 15:28:19 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Apr 30 17:04:07 2013 -0700" }, "message": "set_task_comm: kill the pointless memset() + wmb()\n\nset_task_comm() does memset() + wmb() before strlcpy(). This buys\nnothing and to add to the confusion, the comment is wrong.\n\n- We do not need memset() to be \"safe from non-terminating string\n reads\", the final char is always zero and we never change it.\n\n- wmb() is paired with nothing, it cannot prevent from printing\n the mixture of the old/new data unless the reader takes the lock.\n\nSigned-off-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nCc: Andi Kleen \u003candi@firstfloor.org\u003e\nCc: John Stultz \u003cjohnstul@us.ibm.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "6ee8630e02be6dd89926ca0fbc21af68b23dc087", "tree": "04c4cb8546541d59dac8d92ac1c7d7ee03ddc362", "parents": [ "acb6d558f4c8fbacc8e774c9d7737220a3777882" ], "author": { "name": "Hugh Dickins", "email": "hughd@google.com", "time": "Mon Apr 29 15:07:44 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Apr 29 15:54:34 2013 -0700" }, "message": "mm: allow arch code to control the user page table ceiling\n\nOn architectures where a pgd entry may be shared between user and kernel\n(e.g. ARM+LPAE), freeing page tables needs a ceiling other than 0.\nThis patch introduces a generic USER_PGTABLES_CEILING that arch code can\noverride. It is the responsibility of the arch code setting the ceiling\nto ensure the complete freeing of the page tables (usually in\npgd_free()).\n\n[catalin.marinas@arm.com: commit log; shift_arg_pages(), asm-generic/pgtables.h changes]\nSigned-off-by: Hugh Dickins \u003chughd@google.com\u003e\nSigned-off-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\nCc: Russell King \u003clinux@arm.linux.org.uk\u003e\nCc: \u003cstable@vger.kernel.org\u003e\t[3.3+]\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "3dc20cb282ec03cc4c997130d680c800011ed479", "tree": "d8374e58a433a144c571e193cb0b024374ee0b6a", "parents": [ "3af0761307d04f6b9a4626fb80011a22c143d75e" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Sat Apr 13 20:31:37 2013 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Mon Apr 29 15:40:23 2013 -0400" }, "message": "new helper: read_code()\n\nswitch binfmts that use -\u003eread() to that (and to kernel_read()\nin several cases in binfmt_flat - sure, it\u0027s nommu, but still,\ndoing -\u003eread() into kmalloc\u0027ed buffer...)\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "e579d2c259be42b6f29458327e5153b22414b031", "tree": "ac3babd0f075ddfeb5e6fa083651852b34a0a79f", "parents": [ "5d1fadc1472396d602f0eeb10d37519e2a14e8bc" ], "author": { "name": "Kees Cook", "email": "keescook@chromium.org", "time": "Wed Feb 27 17:03:15 2013 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Feb 27 19:10:11 2013 -0800" }, "message": "coredump: remove redundant defines for dumpable states\n\nThe existing SUID_DUMP_* defines duplicate the newer SUID_DUMPABLE_*\ndefines introduced in 54b501992dd2 (\"coredump: warn about unsafe\nsuid_dumpable / core_pattern combo\"). Remove the new ones, and use the\nprior values instead.\n\nSigned-off-by: Kees Cook \u003ckeescook@chromium.org\u003e\nReported-by: Chen Gang \u003cgang.chen@asianux.com\u003e\nCc: Alexander Viro \u003cviro@zeniv.linux.org.uk\u003e\nCc: Alan Cox \u003calan@linux.intel.com\u003e\nCc: \"Eric W. Biederman\" \u003cebiederm@xmission.com\u003e\nCc: Doug Ledford \u003cdledford@redhat.com\u003e\nCc: Serge Hallyn \u003cserge.hallyn@canonical.com\u003e\nCc: James Morris \u003cjames.l.morris@oracle.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "9cc64ceaa8b8e8c874519caee79e18cb35d3ce3e", "tree": "dcd8bfe08da03fa4d5620cd637989caa305c9d04", "parents": [ "b24ae0b54be4e46bb88398f29c5f79c5dad2a602" ], "author": { "name": "Yuanhan Liu", "email": "yuanhan.liu@linux.intel.com", "time": "Wed Feb 20 13:16:01 2013 +1100" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Tue Feb 26 02:46:13 2013 -0500" }, "message": "fs/exec.c: make bprm_mm_init() static\n\nThere is only one user of bprm_mm_init, and it\u0027s inside the same file.\n\nSigned-off-by: Yuanhan Liu \u003cyuanhan.liu@linux.intel.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "496ad9aa8ef448058e36ca7a787c61f2e63f0f54", "tree": "8f4abde793cd7db5bb8fde6d27ebcacd0e54379a", "parents": [ "57eccb830f1cc93d4b506ba306d8dfa685e0c88f" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Wed Jan 23 17:07:38 2013 -0500" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Fri Feb 22 23:31:31 2013 -0500" }, "message": "new helper: file_inode(file)\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "6d92d4f6a74766cc885b18218268e0c47fbca399", "tree": "9feb7c205f8062ffc1982948d2ffc446cbf94a6b", "parents": [ "7964c06d66c76507d8b6b662bffea770c29ef0ce" ], "author": { "name": "Xi Wang", "email": "xi.wang@gmail.com", "time": "Fri Jan 11 14:31:48 2013 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jan 11 14:54:55 2013 -0800" }, "message": "fs/exec.c: work around icc miscompilation\n\nThe tricky problem is this check:\n\n\tif (i++ \u003e\u003d max)\n\nicc (mis)optimizes this check as:\n\n\tif (++i \u003e max)\n\nThe check now becomes a no-op since max is MAX_ARG_STRINGS (0x7FFFFFFF).\n\nThis is \"allowed\" by the C standard, assuming i++ never overflows,\nbecause signed integer overflow is undefined behavior. This\noptimization effectively reverts the previous commit 362e6663ef23\n(\"exec.c, compat.c: fix count(), compat_count() bounds checking\") that\ntries to fix the check.\n\nThis patch simply moves ++ after the check.\n\nSigned-off-by: Xi Wang \u003cxi.wang@gmail.com\u003e\nCc: Jason Baron \u003cjbaron@redhat.com\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "4c9a44aebeaef35570a67aed17b72a2cf8d0b219", "tree": "abb874fe7f50671627b282f6c7fb58db5e75a2e3", "parents": [ "1f0377ff088ed2971c57debc9b0c3b846ec431fd", "cfde819088422503b5c69e03ab7bb90f87121d4d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Dec 20 20:00:43 2012 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Dec 20 20:00:43 2012 -0800" }, "message": "Merge branch \u0027akpm\u0027 (Andrew\u0027s patch-bomb)\n\nMerge the rest of Andrew\u0027s patches for -rc1:\n \"A bunch of fixes and misc missed-out-on things.\n\n That\u0027ll do for -rc1. I still have a batch of IPC patches which still\n have a possible bug report which I\u0027m chasing down.\"\n\n* emailed patches from Andrew Morton \u003cakpm@linux-foundation.org\u003e: (25 commits)\n keys: use keyring_alloc() to create module signing keyring\n keys: fix unreachable code\n sendfile: allows bypassing of notifier events\n SGI-XP: handle non-fatal traps\n fat: fix incorrect function comment\n Documentation: ABI: remove testing/sysfs-devices-node\n proc: fix inconsistent lock state\n linux/kernel.h: fix DIV_ROUND_CLOSEST with unsigned divisors\n memcg: don\u0027t register hotcpu notifier from -\u003ecss_alloc()\n checkpatch: warn on uapi #includes that #include \u003cuapi/...\n revert \"rtc: recycle id when unloading a rtc driver\"\n mm: clean up transparent hugepage sysfs error messages\n hfsplus: add error message for the case of failure of sync fs in delayed_sync_fs() method\n hfsplus: rework processing of hfs_btree_write() returned error\n hfsplus: rework processing errors in hfsplus_free_extents()\n hfsplus: avoid crash on failed block map free\n kcmp: include linux/ptrace.h\n drivers/rtc/rtc-imxdi.c: must include \u003clinux/spinlock.h\u003e\n mm: cma: WARN if freed memory is still in use\n exec: do not leave bprm-\u003einterp on stack\n ...\n" }, { "commit": "54d46ea993744c5408e39ce0cb4851e13cbea716", "tree": "8e38fa92cc2ae72e0353c44e1e68be9bf5a7a058", "parents": [ "f59dc2bb5a50b26ea751f9eac1c81e4cc7de5257", "50ececcfa7d1acee085b2c518cad495062db6379" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Dec 20 18:05:28 2012 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Dec 20 18:05:28 2012 -0800" }, "message": "Merge branch \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/viro/signal\n\nPull signal handling cleanups from Al Viro:\n \"sigaltstack infrastructure + conversion for x86, alpha and um,\n COMPAT_SYSCALL_DEFINE infrastructure.\n\n Note that there are several conflicts between \"unify\n SS_ONSTACK/SS_DISABLE definitions\" and UAPI patches in mainline;\n resolution is trivial - just remove definitions of SS_ONSTACK and\n SS_DISABLED from arch/*/uapi/asm/signal.h; they are all identical and\n include/uapi/linux/signal.h contains the unified variant.\"\n\nFixed up conflicts as per Al.\n\n* \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/viro/signal:\n alpha: switch to generic sigaltstack\n new helpers: __save_altstack/__compat_save_altstack, switch x86 and um to those\n generic compat_sys_sigaltstack()\n introduce generic sys_sigaltstack(), switch x86 and um to it\n new helper: compat_user_stack_pointer()\n new helper: restore_altstack()\n unify SS_ONSTACK/SS_DISABLE definitions\n new helper: current_user_stack_pointer()\n missing user_stack_pointer() instances\n Bury the conditionals from kernel_thread/kernel_execve series\n COMPAT_SYSCALL_DEFINE: infrastructure\n" }, { "commit": "b66c5984017533316fd1951770302649baf1aa33", "tree": "78d1e5fc82a057c62699734602c8e5f7ca86b7a2", "parents": [ "9f9c9cbb60576a1518d0bf93fb8e499cffccf377" ], "author": { "name": "Kees Cook", "email": "keescook@chromium.org", "time": "Thu Dec 20 15:05:16 2012 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Dec 20 17:40:19 2012 -0800" }, "message": "exec: do not leave bprm-\u003einterp on stack\n\nIf a series of scripts are executed, each triggering module loading via\nunprintable bytes in the script header, kernel stack contents can leak\ninto the command line.\n\nNormally execution of binfmt_script and binfmt_misc happens recursively.\nHowever, when modules are enabled, and unprintable bytes exist in the\nbprm-\u003ebuf, execution will restart after attempting to load matching\nbinfmt modules. Unfortunately, the logic in binfmt_script and\nbinfmt_misc does not expect to get restarted. They leave bprm-\u003einterp\npointing to their local stack. This means on restart bprm-\u003einterp is\nleft pointing into unused stack memory which can then be copied into the\nuserspace argv areas.\n\nAfter additional study, it seems that both recursion and restart remains\nthe desirable way to handle exec with scripts, misc, and modules. As\nsuch, we need to protect the changes to interp.\n\nThis changes the logic to require allocation for any changes to the\nbprm-\u003einterp. To avoid adding a new kmalloc to every exec, the default\nvalue is left as-is. Only when passing through binfmt_script or\nbinfmt_misc does an allocation take place.\n\nFor a proof of concept, see DoTest.sh from:\n\n http://www.halfdog.net/Security/2012/LinuxKernelBinfmtScriptStackDataDisclosure/\n\nSigned-off-by: Kees Cook \u003ckeescook@chromium.org\u003e\nCc: halfdog \u003cme@halfdog.net\u003e\nCc: P J P \u003cppandit@redhat.com\u003e\nCc: Alexander Viro \u003cviro@zeniv.linux.org.uk\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "ae903caae267154de7cf8576b130ff474630596b", "tree": "a39d238d7fd1742f7f20cacbd24a4d1b4957176e", "parents": [ "468366138850f20543f1d4878028900672b23dae" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Fri Dec 14 12:44:11 2012 -0500" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Wed Dec 19 18:07:38 2012 -0500" }, "message": "Bury the conditionals from kernel_thread/kernel_execve series\n\nAll architectures have\n\tCONFIG_GENERIC_KERNEL_THREAD\n\tCONFIG_GENERIC_KERNEL_EXECVE\n\t__ARCH_WANT_SYS_EXECVE\nNone of them have __ARCH_WANT_KERNEL_EXECVE and there are only two callers\nof kernel_execve() (which is a trivial wrapper for do_execve() now) left.\nKill the conditionals and make both callers use do_execve().\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "848b81415c42ff3dc9a4204749087b015c37ef66", "tree": "391da3a73aea48632248220d2d6b8d45a88f7eae", "parents": [ "992956189de58cae9f2be40585bc25105cd7c5ad", "6fd59a83b9261fa53eaf98fb5514abba504a3ea3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Dec 17 20:58:12 2012 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Dec 17 20:58:12 2012 -0800" }, "message": "Merge branch \u0027akpm\u0027 (Andrew\u0027s patch-bomb)\n\nMerge misc patches from Andrew Morton:\n \"Incoming:\n\n - lots of misc stuff\n\n - backlight tree updates\n\n - lib/ updates\n\n - Oleg\u0027s percpu-rwsem changes\n\n - checkpatch\n\n - rtc\n\n - aoe\n\n - more checkpoint/restart support\n\n I still have a pile of MM stuff pending - Pekka should be merging\n later today after which that is good to go. A number of other things\n are twiddling thumbs awaiting maintainer merges.\"\n\n* emailed patches from Andrew Morton \u003cakpm@linux-foundation.org\u003e: (180 commits)\n scatterlist: don\u0027t BUG when we can trivially return a proper error.\n docs: update documentation about /proc/\u003cpid\u003e/fdinfo/\u003cfd\u003e fanotify output\n fs, fanotify: add @mflags field to fanotify output\n docs: add documentation about /proc/\u003cpid\u003e/fdinfo/\u003cfd\u003e output\n fs, notify: add procfs fdinfo helper\n fs, exportfs: add exportfs_encode_inode_fh() helper\n fs, exportfs: escape nil dereference if no s_export_op present\n fs, epoll: add procfs fdinfo helper\n fs, eventfd: add procfs fdinfo helper\n procfs: add ability to plug in auxiliary fdinfo providers\n tools/testing/selftests/kcmp/kcmp_test.c: print reason for failure in kcmp_test\n breakpoint selftests: print failure status instead of cause make error\n kcmp selftests: print fail status instead of cause make error\n kcmp selftests: make run_tests fix\n mem-hotplug selftests: print failure status instead of cause make error\n cpu-hotplug selftests: print failure status instead of cause make error\n mqueue selftests: print failure status instead of cause make error\n vm selftests: print failure status instead of cause make error\n ubifs: use prandom_bytes\n mtd: nandsim: use prandom_bytes\n ...\n" }, { "commit": "d740269867021faf4ce38a449353d2b986c34a67", "tree": "e0476e1be1dfb6e852adbaa8fb72ecea87bdb088", "parents": [ "8d238027b87e654be552eabdf492042a34c5c300" ], "author": { "name": "Kees Cook", "email": "keescook@chromium.org", "time": "Mon Dec 17 16:03:20 2012 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Dec 17 17:15:23 2012 -0800" }, "message": "exec: use -ELOOP for max recursion depth\n\nTo avoid an explosion of request_module calls on a chain of abusive\nscripts, fail maximum recursion with -ELOOP instead of -ENOEXEC. As soon\nas maximum recursion depth is hit, the error will fail all the way back\nup the chain, aborting immediately.\n\nThis also has the side-effect of stopping the user\u0027s shell from attempting\nto reexecute the top-level file as a shell script. As seen in the\ndash source:\n\n if (cmd !\u003d path_bshell \u0026\u0026 errno \u003d\u003d ENOEXEC) {\n *argv-- \u003d cmd;\n *argv \u003d cmd \u003d path_bshell;\n goto repeat;\n }\n\nThe above logic was designed for running scripts automatically that lacked\nthe \"#!\" header, not to re-try failed recursion. On a legitimate -ENOEXEC,\nthings continue to behave as the shell expects.\n\nAdditionally, when tracking recursion, the binfmt handlers should not be\ninvolved. The recursion being tracked is the depth of calls through\nsearch_binary_handler(), so that function should be exclusively responsible\nfor tracking the depth.\n\nSigned-off-by: Kees Cook \u003ckeescook@chromium.org\u003e\nCc: halfdog \u003cme@halfdog.net\u003e\nCc: P J P \u003cppandit@redhat.com\u003e\nCc: Alexander Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "6a2b60b17b3e48a418695a94bd2420f6ab32e519", "tree": "54b7792fa68b8890f710fa6398b6ba8626a039a8", "parents": [ "9228ff90387e276ad67b10c0eb525c9d6a57d5e9", "98f842e675f96ffac96e6c50315790912b2812be" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Dec 17 15:44:47 2012 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Dec 17 15:44:47 2012 -0800" }, "message": "Merge branch \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace\n\nPull user namespace changes from Eric Biederman:\n \"While small this set of changes is very significant with respect to\n containers in general and user namespaces in particular. The user\n space interface is now complete.\n\n This set of changes adds support for unprivileged users to create user\n namespaces and as a user namespace root to create other namespaces.\n The tyranny of supporting suid root preventing unprivileged users from\n using cool new kernel features is broken.\n\n This set of changes completes the work on setns, adding support for\n the pid, user, mount namespaces.\n\n This set of changes includes a bunch of basic pid namespace\n cleanups/simplifications. Of particular significance is the rework of\n the pid namespace cleanup so it no longer requires sending out\n tendrils into all kinds of unexpected cleanup paths for operation. At\n least one case of broken error handling is fixed by this cleanup.\n\n The files under /proc/\u003cpid\u003e/ns/ have been converted from regular files\n to magic symlinks which prevents incorrect caching by the VFS,\n ensuring the files always refer to the namespace the process is\n currently using and ensuring that the ptrace_mayaccess permission\n checks are always applied.\n\n The files under /proc/\u003cpid\u003e/ns/ have been given stable inode numbers\n so it is now possible to see if different processes share the same\n namespaces.\n\n Through the David Miller\u0027s net tree are changes to relax many of the\n permission checks in the networking stack to allowing the user\n namespace root to usefully use the networking stack. Similar changes\n for the mount namespace and the pid namespace are coming through my\n tree.\n\n Two small changes to add user namespace support were commited here adn\n in David Miller\u0027s -net tree so that I could complete the work on the\n /proc/\u003cpid\u003e/ns/ files in this tree.\n\n Work remains to make it safe to build user namespaces and 9p, afs,\n ceph, cifs, coda, gfs2, ncpfs, nfs, nfsd, ocfs2, and xfs so the\n Kconfig guard remains in place preventing that user namespaces from\n being built when any of those filesystems are enabled.\n\n Future design work remains to allow root users outside of the initial\n user namespace to mount more than just /proc and /sys.\"\n\n* \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace: (38 commits)\n proc: Usable inode numbers for the namespace file descriptors.\n proc: Fix the namespace inode permission checks.\n proc: Generalize proc inode allocation\n userns: Allow unprivilged mounts of proc and sysfs\n userns: For /proc/self/{uid,gid}_map derive the lower userns from the struct file\n procfs: Print task uids and gids in the userns that opened the proc file\n userns: Implement unshare of the user namespace\n userns: Implent proc namespace operations\n userns: Kill task_user_ns\n userns: Make create_new_namespaces take a user_ns parameter\n userns: Allow unprivileged use of setns.\n userns: Allow unprivileged users to create new namespaces\n userns: Allow setting a userns mapping to your current uid.\n userns: Allow chown and setgid preservation\n userns: Allow unprivileged users to create user namespaces.\n userns: Ignore suid and sgid on binaries if the uid or gid can not be mapped\n userns: fix return value on mntns_install() failure\n vfs: Allow unprivileged manipulation of the mount namespace.\n vfs: Only support slave subtrees across different user namespaces\n vfs: Add a user namespace reference from struct mnt_namespace\n ...\n" }, { "commit": "71613c3b871c5a9f27cc48f124251bcd3aa23be1", "tree": "792635fc67cb3397c66e4988d5ca92660efcdc6e", "parents": [ "3c456bfc4ba66e9cda210da7bc4fb0ba9fcc6972" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Sat Oct 20 22:00:48 2012 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Wed Nov 28 21:53:38 2012 -0500" }, "message": "get rid of pt_regs argument of -\u003eload_binary()\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "3c456bfc4ba66e9cda210da7bc4fb0ba9fcc6972", "tree": "486f15c6415f5c13ad141d0fbe125495b4400252", "parents": [ "835ab32dff6b437e74c266468b83c4abb69041dc" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Sat Oct 20 21:53:31 2012 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Wed Nov 28 21:53:38 2012 -0500" }, "message": "get rid of pt_regs argument of search_binary_handler()\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "835ab32dff6b437e74c266468b83c4abb69041dc", "tree": "e32ab73caa7235afc3635a7f2439a427e70cbbd2", "parents": [ "da3d4c5fa56236dd924d77ffc4f982356816b93b" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Sat Oct 20 21:50:59 2012 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Wed Nov 28 21:53:37 2012 -0500" }, "message": "get rid of pt_regs argument of do_execve_common()\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "da3d4c5fa56236dd924d77ffc4f982356816b93b", "tree": "37cbc90820ef0e5474801db00c968e2da7c455aa", "parents": [ "d03d26e58fde2ec99478e26aab47b55755189b08" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Sat Oct 20 21:49:33 2012 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Wed Nov 28 21:53:37 2012 -0500" }, "message": "get rid of pt_regs argument of do_execve()\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "d03d26e58fde2ec99478e26aab47b55755189b08", "tree": "025a102a36e62b21a139bcc5ca7abf2c250cd209", "parents": [ "910cdc553a324d3df56b73c84cdef20836817d52" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Sat Oct 20 21:46:25 2012 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Wed Nov 28 21:53:37 2012 -0500" }, "message": "make compat_do_execve() static, lose pt_regs argument\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "3cdf5b45ffbac294bcdfac0393df72f7687c01e8", "tree": "8f6d5339dc7fc40107aecd11612617dbff63134e", "parents": [ "ae11e0f18482bfe0cd83b9b61434ea7e0bd94e25" ], "author": { "name": "Eric W. Biederman", "email": "ebiederm@xmission.com", "time": "Mon Nov 21 16:40:54 2011 -0800" }, "committer": { "name": "Eric W. Biederman", "email": "ebiederm@xmission.com", "time": "Mon Nov 19 05:59:23 2012 -0800" }, "message": "userns: Ignore suid and sgid on binaries if the uid or gid can not be mapped\n\nWhen performing an exec where the binary lives in one user namespace and\nthe execing process lives in another usre namespace there is the possibility\nthat the target uids can not be represented.\n\nInstead of failing the exec simply ignore the suid/sgid bits and run\nthe binary with lower privileges. We already do this in the case\nof MNT_NOSUID so this should be a well tested code path.\n\nAs the user and group are not changed this should not introduce any\nsecurity issues.\n\nAcked-by: Serge Hallyn \u003cserge.hallyn@canonical.com\u003e\nSigned-off-by: Eric W. Biederman \u003cebiederm@xmission.com\u003e\n" }, { "commit": "b40a79591ca918e7b91b0d9b6abd5d00f2e88c19", "tree": "c02916f789723f6479e55aa46cd01bf36238dea1", "parents": [ "e37736777254ce1abc85493a5cacbefe5983b896" ], "author": { "name": "Oleg Nesterov", "email": "oleg@redhat.com", "time": "Thu Oct 25 22:28:12 2012 +0200" }, "committer": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Thu Oct 25 22:28:12 2012 +0200" }, "message": "freezer: exec should clear PF_NOFREEZE along with PF_KTHREAD\n\nflush_old_exec() clears PF_KTHREAD but forgets about PF_NOFREEZE.\n\nSigned-off-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nAcked-by: Tejun Heo \u003ctj@kernel.org\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Rafael J. Wysocki \u003crafael.j.wysocki@intel.com\u003e\n" }, { "commit": "669abf4e5539c8aa48bf28c965be05c0a7b58a27", "tree": "5b8e9e17c4f03ddd719c9c2089d829e2a040854a", "parents": [ "873f1eedc1b983d772283279192c4ca2f60e8482" ], "author": { "name": "Jeff Layton", "email": "jlayton@redhat.com", "time": "Wed Oct 10 16:43:10 2012 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Fri Oct 12 20:15:09 2012 -0400" }, "message": "vfs: make path_openat take a struct filename pointer\n\n...and fix up the callers. For do_file_open_root, just declare a\nstruct filename on the stack and fill out the .name field. For\ndo_filp_open, make it also take a struct filename pointer, and fix up its\ncallers to call it appropriately.\n\nFor filp_open, add a variant that takes a struct filename pointer and turn\nfilp_open into a wrapper around it.\n\nSigned-off-by: Jeff Layton \u003cjlayton@redhat.com\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "91a27b2a756784714e924e5e854b919273082d26", "tree": "3913246b7d6e62703ec915f481e3a7159393f0f0", "parents": [ "8e377d15078a501c4da98471f56396343c407d92" ], "author": { "name": "Jeff Layton", "email": "jlayton@redhat.com", "time": "Wed Oct 10 15:25:28 2012 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Fri Oct 12 20:14:55 2012 -0400" }, "message": "vfs: define struct filename and have getname() return it\n\ngetname() is intended to copy pathname strings from userspace into a\nkernel buffer. The result is just a string in kernel space. It would\nhowever be quite helpful to be able to attach some ancillary info to\nthe string.\n\nFor instance, we could attach some audit-related info to reduce the\namount of audit-related processing needed. When auditing is enabled,\nwe could also call getname() on the string more than once and not\nneed to recopy it from userspace.\n\nThis patchset converts the getname()/putname() interfaces to return\na struct instead of a string. For now, the struct just tracks the\nstring in kernel space and the original userland pointer for it.\n\nLater, we\u0027ll add other information to the struct as it becomes\nconvenient.\n\nSigned-off-by: Jeff Layton \u003cjlayton@redhat.com\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "42859eea96ba6beabfb0369a1eeffa3c7d2bd9cb", "tree": "fa38aeda0d6e7a4c48a882b166b8643594a1ad50", "parents": [ "f59b51fe3d3092c08d7d554ecb40db24011b2ebc", "f322220d6159455da2b5a8a596d802c8695fed30" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Oct 10 12:02:25 2012 +0900" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Oct 10 12:02:25 2012 +0900" }, "message": "Merge branch \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/viro/signal\n\nPull generic execve() changes from Al Viro:\n \"This introduces the generic kernel_thread() and kernel_execve()\n functions, and switches x86, arm, alpha, um and s390 over to them.\"\n\n* \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/viro/signal: (26 commits)\n s390: convert to generic kernel_execve()\n s390: switch to generic kernel_thread()\n s390: fold kernel_thread_helper() into ret_from_fork()\n s390: fold execve_tail() into start_thread(), convert to generic sys_execve()\n um: switch to generic kernel_thread()\n x86, um/x86: switch to generic sys_execve and kernel_execve\n x86: split ret_from_fork\n alpha: introduce ret_from_kernel_execve(), switch to generic kernel_execve()\n alpha: switch to generic kernel_thread()\n alpha: switch to generic sys_execve()\n arm: get rid of execve wrapper, switch to generic execve() implementation\n arm: optimized current_pt_regs()\n arm: introduce ret_from_kernel_execve(), switch to generic kernel_execve()\n arm: split ret_from_fork, simplify kernel_thread() [based on patch by rmk]\n generic sys_execve()\n generic kernel_execve()\n new helper: current_pt_regs()\n preparation for generic kernel_thread()\n um: kill thread-\u003eforking\n um: let signal_delivered() do SIGTRAP on singlestepping into handler\n ...\n" }, { "commit": "38a76013ad809beb0b52f60d365c960d035bd83c", "tree": "c63ba707ab17dd1ff1e90650faf74570daa3cf9f", "parents": [ "523d4e2008fd4a68b1a164e63e8c75b7b20f07e0" ], "author": { "name": "Michel Lespinasse", "email": "walken@google.com", "time": "Mon Oct 08 16:31:50 2012 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Oct 09 16:22:42 2012 +0900" }, "message": "mm: avoid taking rmap locks in move_ptes()\n\nDuring mremap(), the destination VMA is generally placed after the\noriginal vma in rmap traversal order: in move_vma(), we always have\nnew_pgoff \u003e\u003d vma-\u003evm_pgoff, and as a result new_vma-\u003evm_pgoff \u003e\u003d\nvma-\u003evm_pgoff unless vma_merge() merged the new vma with an adjacent one.\n\nWhen the destination VMA is placed after the original in rmap traversal\norder, we can avoid taking the rmap locks in move_ptes().\n\nEssentially, this reintroduces the optimization that had been disabled in\n\"mm anon rmap: remove anon_vma_moveto_tail\". The difference is that we\ndon\u0027t try to impose the rmap traversal order; instead we just rely on\nthings being in the desired order in the common case and fall back to\ntaking locks in the uncommon case. Also we skip the i_mmap_mutex in\naddition to the anon_vma lock: in both cases, the vmas are traversed in\nincreasing vm_pgoff order with ties resolved in tree insertion order.\n\nSigned-off-by: Michel Lespinasse \u003cwalken@google.com\u003e\nCc: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nCc: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nCc: Daniel Santos \u003cdaniel.santos@pobox.com\u003e\nCc: Hugh Dickins \u003chughd@google.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "d5bbd43d5f450c3fca058f5b85f3dfb4e8cc88c9", "tree": "9ee712ea3c2768dc9934e1e6003680793f303a00", "parents": [ "b5356a19ced273ef8a941be226f4dfdb95c23073" ], "author": { "name": "Oleg Nesterov", "email": "oleg@redhat.com", "time": "Mon Oct 08 19:13:01 2012 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Oct 09 06:53:20 2012 +0900" }, "message": "exec: make de_thread() killable\n\nChange de_thread() to use KILLABLE rather than UNINTERRUPTIBLE while\nwaiting for other threads. The only complication is that we should\nclear -\u003egroup_exit_task and -\u003enotify_count before we return, and we\nshould do this under tasklist_lock. -EAGAIN is used to match the\ninitial signal_group_exit() check/return, it doesn\u0027t really matter.\n\nThis fixes the (unlikely) race with coredump. de_thread() checks\nsignal_group_exit() before it starts to kill the subthreads, but this\ncan\u0027t help if another CLONE_VM (but non CLONE_THREAD) task starts the\ncoredumping after de_thread() unlocks -\u003esiglock. In this case the\nkilled sub-thread can block in exit_mm() waiting for coredump_finish(),\nexecing thread waits for that sub-thead, and the coredumping thread\nwaits for execing thread. Deadlock.\n\nSigned-off-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "0f4cfb2e4e7a7e4e97a3e90e2ba1062f07fb2cb1", "tree": "25fa36bc342f624c46b39fa41bb4815397413338", "parents": [ "12a2b4b2241e318b4f6df31228e4272d2c2968a1" ], "author": { "name": "Oleg Nesterov", "email": "oleg@redhat.com", "time": "Thu Oct 04 17:15:27 2012 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 06 03:05:16 2012 +0900" }, "message": "coredump: use SUID_DUMPABLE_ENABLED rather than hardcoded 1\n\nCosmetic. Change setup_new_exec() and task_dumpable() to use\nSUID_DUMPABLE_ENABLED for /bin/grep.\n\n[akpm@linux-foundation.org: checkpatch fixes]\nSigned-off-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "179899fd5dc780fe3bcd44d0eb7823e3d855c855", "tree": "a2e7bf0098162e1fa940cad56bb1e99ec10440ca", "parents": [ "046d662f481830e652ac34cd112249adde16452a" ], "author": { "name": "Alex Kelly", "email": "alex.page.kelly@gmail.com", "time": "Thu Oct 04 17:15:24 2012 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 06 03:05:15 2012 +0900" }, "message": "coredump: update coredump-related headers\n\nCreate a new header file, fs/coredump.h, which contains functions only\nused by the new coredump.c. It also moves do_coredump to the\ninclude/linux/coredump.h header file, for consistency.\n\nSigned-off-by: Alex Kelly \u003calex.page.kelly@gmail.com\u003e\nReviewed-by: Josh Triplett \u003cjosh@joshtriplett.org\u003e\nAcked-by: Serge Hallyn \u003cserge.hallyn@canonical.com\u003e\nAcked-by: Kees Cook \u003ckeescook@chromium.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "10c28d937e2cca577c2d804106b50dd0562fb062", "tree": "249f1c487bf8a9cc32912e20bf9f274c650f58e9", "parents": [ "f34f9d186df35e5c39163444c43b4fc6255e39c5" ], "author": { "name": "Alex Kelly", "email": "alex.page.kelly@gmail.com", "time": "Wed Sep 26 21:52:08 2012 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Tue Oct 02 21:35:55 2012 -0400" }, "message": "coredump: move core dump functionality into its own file\n\nThis prepares for making core dump functionality optional.\n\nThe variable \"suid_dumpable\" and associated functions are left in fs/exec.c\nbecause they\u0027re used elsewhere, such as in ptrace.\n\nSigned-off-by: Alex Kelly \u003calex.page.kelly@gmail.com\u003e\nReviewed-by: Josh Triplett \u003cjosh@joshtriplett.org\u003e\nAcked-by: Serge Hallyn \u003cserge.hallyn@canonical.com\u003e\nAcked-by: Kees Cook \u003ckeescook@chromium.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "38b983b3461e7d3c64a981e2338bb34605c46f30", "tree": "fb7dc311ba4d175746fb693530cf63db9ddb8616", "parents": [ "282124d18626379a20b41d25e0c580f290cd09d4" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Sun Sep 30 13:38:55 2012 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Sun Sep 30 22:20:51 2012 -0400" }, "message": "generic sys_execve()\n\nSelected by __ARCH_WANT_SYS_EXECVE in unistd.h. Requires\n\t* working current_pt_regs()\n\t* *NOT* doing a syscall-in-kernel kind of kernel_execve()\nimplementation. Using generic kernel_execve() is fine.\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "282124d18626379a20b41d25e0c580f290cd09d4", "tree": "48adb982843cbb133c8079f06abad2911e019f12", "parents": [ "a3460a59747cfddfa7be4758e5ef08bf5d751d59" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Sun Sep 30 13:20:09 2012 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Sun Sep 30 13:36:39 2012 -0400" }, "message": "generic kernel_execve()\n\nbased mostly on arm and alpha versions. Architectures can define\n__ARCH_WANT_KERNEL_EXECVE and use it, provided that\n\t* they have working current_pt_regs(), even for kernel threads.\n\t* kernel_thread-spawned threads do have space for pt_regs\nin the normal location. Normally that\u0027s as simple as switching to\ngeneric kernel_thread() and making sure that kernel threads do *not*\ngo through return from syscall path; call the payload from equivalent\nof ret_from_fork if we are in a kernel thread (or just have separate\nret_from_kernel_thread and make copy_thread() use it instead of\nret_from_fork in kernel thread case).\n\t* they have ret_from_kernel_execve(); it is called after\nsuccessful do_execve() done by kernel_execve() and gets normal\npt_regs location passed to it as argument. It\u0027s essentially\na longjmp() analog - it should set sp, etc. to the situation\nexpected at the return for syscall and go there. Eventually\nthe need for that sucker will disappear, but that\u0027ll take some\nsurgery on kernel_thread() payloads.\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "179e037fc1370288188cb1f90b81156d75a3cb2d", "tree": "6dcc6fc5a2b2bc9e17258a178798475c95f40544", "parents": [ "c3c073f808b22dfae15ef8412b6f7b998644139a" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Tue Aug 21 22:43:47 2012 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Wed Sep 26 21:09:59 2012 -0400" }, "message": "do_coredump(): make sure that descriptor table isn\u0027t shared\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "8280d16172243702ed43432f826ca6130edb4086", "tree": "020dff359c5b717a110432159bcc3ec1acf6594e", "parents": [ "fe17f22d7fd0e344ef6447238f799bb49f670c6f" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Tue Aug 21 12:11:46 2012 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Wed Sep 26 21:09:57 2012 -0400" }, "message": "new helper: replace_fd()\n\nanalog of dup2(), except that it takes struct file * as source.\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "6a6d27de340c89c5323565b49f7851362619925d", "tree": "b9b4ab23b43bd330584521917c9b2855c4a4e0cd", "parents": [ "723a1d77431b0c568730ffac4dd0bcbbd3400031" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Tue Aug 21 09:56:33 2012 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Wed Sep 26 21:09:56 2012 -0400" }, "message": "take close-on-exec logics to fs/file.c, clean it up a bit\n\n... and add cond_resched() there, while we are at it. We can\nget large latencies as is...\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "826eba4db0c643cc0e705c8365902c63fac2b7ee", "tree": "e1407d7f4ce93df18772ea7618d6884ce2ff6f0c", "parents": [ "ddd03a1f7591827906d63dbe3ee003f832bb584f" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Fri Aug 03 12:14:44 2012 +0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Thu Sep 20 09:51:13 2012 -0400" }, "message": "the only place that needs to include asm/exec.h is linux/binfmts.h\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "a0e881b7c189fa2bd76c024dbff91e79511c971d", "tree": "0c801918565b08921d21aceee5b326f64d998f5f", "parents": [ "eff0d13f3823f35d70228cd151d2a2c89288ff32", "dbc6e0222d79e78925fe20733844a796a4b72cf9" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Aug 01 10:26:23 2012 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Aug 01 10:26:23 2012 -0700" }, "message": "Merge branch \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs\n\nPull second vfs pile from Al Viro:\n \"The stuff in there: fsfreeze deadlock fixes by Jan (essentially, the\n deadlock reproduced by xfstests 068), symlink and hardlink restriction\n patches, plus assorted cleanups and fixes.\n\n Note that another fsfreeze deadlock (emergency thaw one) is *not*\n dealt with - the series by Fernando conflicts a lot with Jan\u0027s, breaks\n userland ABI (FIFREEZE semantics gets changed) and trades the deadlock\n for massive vfsmount leak; this is going to be handled next cycle.\n There probably will be another pull request, but that stuff won\u0027t be\n in it.\"\n\nFix up trivial conflicts due to unrelated changes next to each other in\ndrivers/{staging/gdm72xx/usb_boot.c, usb/gadget/storage_common.c}\n\n* \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (54 commits)\n delousing target_core_file a bit\n Documentation: Correct s_umount state for freeze_fs/unfreeze_fs\n fs: Remove old freezing mechanism\n ext2: Implement freezing\n btrfs: Convert to new freezing mechanism\n nilfs2: Convert to new freezing mechanism\n ntfs: Convert to new freezing mechanism\n fuse: Convert to new freezing mechanism\n gfs2: Convert to new freezing mechanism\n ocfs2: Convert to new freezing mechanism\n xfs: Convert to new freezing code\n ext4: Convert to new freezing mechanism\n fs: Protect write paths by sb_start_write - sb_end_write\n fs: Skip atime update on frozen filesystem\n fs: Add freezing handling to mnt_want_write() / mnt_drop_write()\n fs: Improve filesystem freezing handling\n switch the protection of percpu_counter list to spinlock\n nfsd: Push mnt_want_write() outside of i_mutex\n btrfs: Push mnt_want_write() outside of i_mutex\n fat: Push mnt_want_write() outside of i_mutex\n ...\n" }, { "commit": "108ceeb020bb3558fe175a3fc8b60fd6c1a2a279", "tree": "26b99cdd883b88e9a9dfba20e4f4481de72c046f", "parents": [ "0f20784d4ba3f88ca33b703b23372d8ccf6dbd42" ], "author": { "name": "Jovi Zhang", "email": "bookjovi@gmail.com", "time": "Mon Jul 30 14:42:23 2012 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jul 30 17:25:20 2012 -0700" }, "message": "coredump: fix wrong comments on core limits of pipe coredump case\n\nIn commit 898b374af6f7 (\"exec: replace call_usermodehelper_pipe with use\nof umh init function and resolve limit\"), the core limits recursive\ncheck value was changed from 0 to 1, but the corresponding comments were\nnot updated.\n\nSigned-off-by: Jovi Zhang \u003cbookjovi@gmail.com\u003e\nCc: Oleg Nesterov \u003coleg@redhat.com\u003e\nCc: Neil Horman \u003cnhorman@tuxdriver.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "54b501992dd2a839e94e76aa392c392b55080ce8", "tree": "6d174fb95516f01e385d31d5ef87a248d8740fd2", "parents": [ "9520628e8ceb69fa9a4aee6b57f22675d9e1b709" ], "author": { "name": "Kees Cook", "email": "keescook@chromium.org", "time": "Mon Jul 30 14:39:18 2012 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jul 30 17:25:11 2012 -0700" }, "message": "coredump: warn about unsafe suid_dumpable / core_pattern combo\n\nWhen suid_dumpable\u003d2, detect unsafe core_pattern settings and warn when\nthey are seen.\n\nSigned-off-by: Kees Cook \u003ckeescook@chromium.org\u003e\nSuggested-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nCc: Alexander Viro \u003cviro@zeniv.linux.org.uk\u003e\nCc: Alan Cox \u003calan@linux.intel.com\u003e\nCc: \"Eric W. Biederman\" \u003cebiederm@xmission.com\u003e\nCc: Doug Ledford \u003cdledford@redhat.com\u003e\nCc: Serge Hallyn \u003cserge.hallyn@canonical.com\u003e\nCc: James Morris \u003cjames.l.morris@oracle.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "9520628e8ceb69fa9a4aee6b57f22675d9e1b709", "tree": "c8e1dbd5820e818eef930cf55cbd94dec941eb44", "parents": [ "779302e67835fe9a6b74327e54969ba59cb3478a" ], "author": { "name": "Kees Cook", "email": "keescook@chromium.org", "time": "Mon Jul 30 14:39:15 2012 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jul 30 17:25:11 2012 -0700" }, "message": "fs: make dumpable\u003d2 require fully qualified path\n\nWhen the suid_dumpable sysctl is set to \"2\", and there is no core dump\npipe defined in the core_pattern sysctl, a local user can cause core files\nto be written to root-writable directories, potentially with\nuser-controlled content.\n\nThis means an admin can unknowningly reintroduce a variation of\nCVE-2006-2451, allowing local users to gain root privileges.\n\n $ cat /proc/sys/fs/suid_dumpable\n 2\n $ cat /proc/sys/kernel/core_pattern\n core\n $ ulimit -c unlimited\n $ cd /\n $ ls -l core\n ls: cannot access core: No such file or directory\n $ touch core\n touch: cannot touch `core\u0027: Permission denied\n $ OHAI\u003d\"evil-string-here\" ping localhost \u003e/dev/null 2\u003e\u00261 \u0026\n $ pid\u003d$!\n $ sleep 1\n $ kill -SEGV $pid\n $ ls -l core\n -rw------- 1 root kees 458752 Jun 21 11:35 core\n $ sudo strings core | grep evil\n OHAI\u003devil-string-here\n\nWhile cron has been fixed to abort reading a file when there is any\nparse error, there are still other sensitive directories that will read\nany file present and skip unparsable lines.\n\nInstead of introducing a suid_dumpable\u003d3 mode and breaking all users of\nmode 2, this only disables the unsafe portion of mode 2 (writing to disk\nvia relative path). Most users of mode 2 (e.g. Chrome OS) already use\na core dump pipe handler, so this change will not break them. For the\nsituations where a pipe handler is not defined but mode 2 is still\nactive, crash dumps will only be written to fully qualified paths. If a\nrelative path is defined (e.g. the default \"core\" pattern), dump\nattempts will trigger a printk yelling about the lack of a fully\nqualified path.\n\nSigned-off-by: Kees Cook \u003ckeescook@chromium.org\u003e\nCc: Alexander Viro \u003cviro@zeniv.linux.org.uk\u003e\nCc: Alan Cox \u003calan@linux.intel.com\u003e\nCc: \"Eric W. Biederman\" \u003cebiederm@xmission.com\u003e\nCc: Doug Ledford \u003cdledford@redhat.com\u003e\nCc: Serge Hallyn \u003cserge.hallyn@canonical.com\u003e\nCc: James Morris \u003cjames.l.morris@oracle.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "e4fad8e5d220e3dfb1050eee752ee5058f29a232", "tree": "b56356fda1d1f4f47e1da63aa24080db999dafc1", "parents": [ "b5bcdda32736b94a7d178d156d80a69f536ad468" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Sat Jul 21 15:33:25 2012 +0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Sun Jul 29 21:24:19 2012 +0400" }, "message": "consolidate pipe file creation\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "8ded2bbc1845e19c771eb55209aab166ef011243", "tree": "9ab400cdd407a9426fdfcc3432d7c0e19a0607ed", "parents": [ "4cb38750d49010ae72e718d46605ac9ba5a851b4" ], "author": { "name": "Josh Boyer", "email": "jwboyer@redhat.com", "time": "Wed Jul 25 10:40:34 2012 -0400" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jul 26 13:36:43 2012 -0700" }, "message": "posix_types.h: Cleanup stale __NFDBITS and related definitions\n\nRecently, glibc made a change to suppress sign-conversion warnings in\nFD_SET (glibc commit ceb9e56b3d1). This uncovered an issue with the\nkernel\u0027s definition of __NFDBITS if applications #include\n\u003clinux/types.h\u003e after including \u003csys/select.h\u003e. A build failure would\nbe seen when passing the -Werror\u003dsign-compare and -D_FORTIFY_SOURCE\u003d2\nflags to gcc.\n\nIt was suggested that the kernel should either match the glibc\ndefinition of __NFDBITS or remove that entirely. The current in-kernel\nuses of __NFDBITS can be replaced with BITS_PER_LONG, and there are no\nuses of the related __FDELT and __FDMASK defines. Given that, we\u0027ll\ncontinue the cleanup that was started with commit 8b3d1cda4f5f\n(\"posix_types: Remove fd_set macros\") and drop the remaining unused\nmacros.\n\nAdditionally, linux/time.h has similar macros defined that expand to\nnothing so we\u0027ll remove those at the same time.\n\nReported-by: Jeff Law \u003claw@redhat.com\u003e\nSuggested-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCC: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Josh Boyer \u003cjwboyer@redhat.com\u003e\n[ .. and fix up whitespace as per akpm ]\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "4fe7efdbdfb1c7e7a7f31decfd831c0f31d37091", "tree": "5d8fdf353ba3791ef10031ade2d93aa87aa179d3", "parents": [ "e0897d75f0b22e8c3a7287a48548c5686ef73447" ], "author": { "name": "Konstantin Khlebnikov", "email": "khlebnikov@openvz.org", "time": "Wed Jun 20 12:53:01 2012 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Jun 20 14:39:36 2012 -0700" }, "message": "mm: correctly synchronize rss-counters at exit/exec\n\ndo_exit() and exec_mmap() call sync_mm_rss() before mm_release() does\nput_user(clear_child_tid) which can update task-\u003erss_stat and thus make\nmm-\u003erss_stat inconsistent. This triggers the \"BUG:\" printk in check_mm().\n\nLet\u0027s fix this bug in the safest way, and optimize/cleanup this later.\n\nReported-by: Markus Trippelsdorf \u003cmarkus@trippelsdorf.de\u003e\nSigned-off-by: Konstantin Khlebnikov \u003ckhlebnikov@openvz.org\u003e\nCc: Oleg Nesterov \u003coleg@redhat.com\u003e\nCc: KAMEZAWA Hiroyuki \u003ckamezawa.hiroyu@jp.fujitsu.com\u003e\nCc: Hugh Dickins \u003chughd@google.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "48d212a2eecaca2e1875925837ad27b2f43f48a3", "tree": "fbd83c7b15856971f6d7297e1d23dc862ba2989c", "parents": [ "46edaedaf3842164281d0f86c41bc152f4b4d32e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jun 07 17:54:07 2012 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jun 07 17:54:07 2012 -0700" }, "message": "Revert \"mm: correctly synchronize rss-counters at exit/exec\"\n\nThis reverts commit 40af1bbdca47e5c8a2044039bb78ca8fd8b20f94.\n\nIt\u0027s horribly and utterly broken for at least the following reasons:\n\n - calling sync_mm_rss() from mmput() is fundamentally wrong, because\n there\u0027s absolutely no reason to believe that the task that does the\n mmput() always does it on its own VM. Example: fork, ptrace, /proc -\n you name it.\n\n - calling it *after* having done mmdrop() on it is doubly insane, since\n the mm struct may well be gone now.\n\n - testing mm against NULL before you call it is insane too, since a\nNULL mm there would have caused oopses long before.\n\n.. and those are just the three bugs I found before I decided to give up\nlooking for me and revert it asap. I should have caught it before I\neven took it, but I trusted Andrew too much.\n\nCc: Konstantin Khlebnikov \u003ckhlebnikov@openvz.org\u003e\nCc: Markus Trippelsdorf \u003cmarkus@trippelsdorf.de\u003e\nCc: Hugh Dickins \u003chughd@google.com\u003e\nCc: KAMEZAWA Hiroyuki \u003ckamezawa.hiroyu@jp.fujitsu.com\u003e\nCc: Oleg Nesterov \u003coleg@redhat.com\u003e\nCc: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "40af1bbdca47e5c8a2044039bb78ca8fd8b20f94", "tree": "70b5a21579f8b0137c09e54d523246d84be93430", "parents": [ "39caa0916ef27cf1da5026eb708a2b8413156f75" ], "author": { "name": "Konstantin Khlebnikov", "email": "khlebnikov@openvz.org", "time": "Thu Jun 07 14:21:14 2012 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jun 07 14:43:55 2012 -0700" }, "message": "mm: correctly synchronize rss-counters at exit/exec\n\nmm-\u003erss_stat counters have per-task delta: task-\u003erss_stat. Before\nchanging task-\u003emm pointer the kernel must flush this delta with\nsync_mm_rss().\n\ndo_exit() already calls sync_mm_rss() to flush the rss-counters before\ncommitting the rss statistics into task-\u003esignal-\u003emaxrss, taskstats,\naudit and other stuff. Unfortunately the kernel does this before\ncalling mm_release(), which can call put_user() for processing\ntask-\u003eclear_child_tid. So at this point we can trigger page-faults and\ntask-\u003erss_stat becomes non-zero again. As a result mm-\u003erss_stat becomes\ninconsistent and check_mm() will print something like this:\n\n| BUG: Bad rss-counter state mm:ffff88020813c380 idx:1 val:-1\n| BUG: Bad rss-counter state mm:ffff88020813c380 idx:2 val:1\n\nThis patch moves sync_mm_rss() into mm_release(), and moves mm_release()\nout of do_exit() and calls it earlier. After mm_release() there should\nbe no pagefaults.\n\n[akpm@linux-foundation.org: tweak comment]\nSigned-off-by: Konstantin Khlebnikov \u003ckhlebnikov@openvz.org\u003e\nReported-by: Markus Trippelsdorf \u003cmarkus@trippelsdorf.de\u003e\nCc: Hugh Dickins \u003chughd@google.com\u003e\nCc: KAMEZAWA Hiroyuki \u003ckamezawa.hiroyu@jp.fujitsu.com\u003e\nCc: Oleg Nesterov \u003coleg@redhat.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\t\t[3.4.x]\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "e5467859f7f79b69fc49004403009dfdba3bec53", "tree": "73b011daf79eeddd61bbcaf65cd197b5e5f6f149", "parents": [ "d007794a182bc072a7b7479909dbd0d67ba341be" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Wed May 30 13:30:51 2012 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Thu May 31 13:11:54 2012 -0400" }, "message": "split -\u003efile_mmap() into -\u003emmap_addr()/-\u003emmap_file()\n\n... i.e. file-dependent and address-dependent checks.\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "644473e9c60c1ff4f6351fed637a6e5551e3dce7", "tree": "10316518bedc735a2c6552886658d69dfd9f1eb0", "parents": [ "fb827ec68446c83e9e8754fa9b55aed27ecc4661", "4b06a81f1daee668fbd6de85557bfb36dd36078f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed May 23 17:42:39 2012 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed May 23 17:42:39 2012 -0700" }, "message": "Merge branch \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace\n\nPull user namespace enhancements from Eric Biederman:\n \"This is a course correction for the user namespace, so that we can\n reach an inexpensive, maintainable, and reasonably complete\n implementation.\n\n Highlights:\n - Config guards make it impossible to enable the user namespace and\n code that has not been converted to be user namespace safe.\n\n - Use of the new kuid_t type ensures the if you somehow get past the\n config guards the kernel will encounter type errors if you enable\n user namespaces and attempt to compile in code whose permission\n checks have not been updated to be user namespace safe.\n\n - All uids from child user namespaces are mapped into the initial\n user namespace before they are processed. Removing the need to add\n an additional check to see if the user namespace of the compared\n uids remains the same.\n\n - With the user namespaces compiled out the performance is as good or\n better than it is today.\n\n - For most operations absolutely nothing changes performance or\n operationally with the user namespace enabled.\n\n - The worst case performance I could come up with was timing 1\n billion cache cold stat operations with the user namespace code\n enabled. This went from 156s to 164s on my laptop (or 156ns to\n 164ns per stat operation).\n\n - (uid_t)-1 and (gid_t)-1 are reserved as an internal error value.\n Most uid/gid setting system calls treat these value specially\n anyway so attempting to use -1 as a uid would likely cause\n entertaining failures in userspace.\n\n - If setuid is called with a uid that can not be mapped setuid fails.\n I have looked at sendmail, login, ssh and every other program I\n could think of that would call setuid and they all check for and\n handle the case where setuid fails.\n\n - If stat or a similar system call is called from a context in which\n we can not map a uid we lie and return overflowuid. The LFS\n experience suggests not lying and returning an error code might be\n better, but the historical precedent with uids is different and I\n can not think of anything that would break by lying about a uid we\n can\u0027t map.\n\n - Capabilities are localized to the current user namespace making it\n safe to give the initial user in a user namespace all capabilities.\n\n My git tree covers all of the modifications needed to convert the core\n kernel and enough changes to make a system bootable to runlevel 1.\"\n\nFix up trivial conflicts due to nearby independent changes in fs/stat.c\n\n* \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace: (46 commits)\n userns: Silence silly gcc warning.\n cred: use correct cred accessor with regards to rcu read lock\n userns: Convert the move_pages, and migrate_pages permission checks to use uid_eq\n userns: Convert cgroup permission checks to use uid_eq\n userns: Convert tmpfs to use kuid and kgid where appropriate\n userns: Convert sysfs to use kgid/kuid where appropriate\n userns: Convert sysctl permission checks to use kuid and kgids.\n userns: Convert proc to use kuid/kgid where appropriate\n userns: Convert ext4 to user kuid/kgid where appropriate\n userns: Convert ext3 to use kuid/kgid where appropriate\n userns: Convert ext2 to use kuid/kgid where appropriate.\n userns: Convert devpts to use kuid/kgid where appropriate\n userns: Convert binary formats to use kuid/kgid where appropriate\n userns: Add negative depends on entries to avoid building code that is userns unsafe\n userns: signal remove unnecessary map_cred_ns\n userns: Teach inode_capable to understand inodes whose uids map to other namespaces.\n userns: Fail exec for suid and sgid binaries with ids outside our user namespace.\n userns: Convert stat to return values mapped from kuids and kgids\n userns: Convert user specfied uids and gids in chown into kuids and kgid\n userns: Use uid_eq gid_eq helpers when comparing kuids and kgids in the vfs\n ...\n" }, { "commit": "ec0d7f18ab7b5097d7c0c8f3d909ca1031b9d5cd", "tree": "7d62c924592145f819ecaa5d60460a05a10dfdbd", "parents": [ "269af9a1a08d368b46d72e74126564d04c354f7e", "1dcc8d7ba235a316a056f993e88f0d18b92c60d9" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed May 23 10:59:07 2012 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed May 23 10:59:07 2012 -0700" }, "message": "Merge branch \u0027x86-fpu-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull fpu state cleanups from Ingo Molnar:\n \"This tree streamlines further aspects of FPU handling by eliminating\n the prepare_to_copy() complication and moving that logic to\n arch_dup_task_struct().\n\n It also fixes the FPU dumps in threaded core dumps, removes and old\n (and now invalid) assumption plus micro-optimizes the exit path by\n avoiding an FPU save for dead tasks.\"\n\nFixed up trivial add-add conflict in arch/sh/kernel/process.c that came\nin because we now do the FPU handling in arch_dup_task_struct() rather\nthan the legacy (and now gone) prepare_to_copy().\n\n* \u0027x86-fpu-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n x86, fpu: drop the fpu state during thread exit\n x86, xsave: remove thread_has_fpu() bug check in __sanitize_i387_state()\n coredump: ensure the fpu state is flushed for proper multi-threaded core dump\n fork: move the real prepare_to_copy() users to arch_dup_task_struct()\n" }, { "commit": "11aeca0b3a083a457f5c34fe8c677d5e86a0c6b3", "tree": "8d71ab524aa13aa8fd2bf10d7bbf3ddfa89ac4f7", "parents": [ "55ccf3fe3f9a3441731aa79cf42a628fc4ecace9" ], "author": { "name": "Suresh Siddha", "email": "suresh.b.siddha@intel.com", "time": "Wed May 16 15:03:52 2012 -0700" }, "committer": { "name": "H. Peter Anvin", "email": "hpa@linux.intel.com", "time": "Wed May 16 15:16:48 2012 -0700" }, "message": "coredump: ensure the fpu state is flushed for proper multi-threaded core dump\n\nNalluru reported hitting the BUG_ON(__thread_has_fpu(tsk)) in\narch/x86/kernel/xsave.c:__sanitize_i387_state() during the coredump\nof a multi-threaded application.\n\nA look at the exit seqeuence shows that other threads can still be on the\nrunqueue potentially at the below shown exit_mm() code snippet:\n\n\t\tif (atomic_dec_and_test(\u0026core_state-\u003enr_threads))\n\t\t\tcomplete(\u0026core_state-\u003estartup);\n\n\u003d\u003d\u003d\u003e other threads can still be active here, but we notify the thread\n\u003d\u003d\u003d\u003e dumping core to wakeup from the coredump_wait() after the last thread\n\u003d\u003d\u003d\u003e joins this point. Core dumping thread will continue dumping\n\u003d\u003d\u003d\u003e all the threads state to the core file.\n\n\t\tfor (;;) {\n\t\t\tset_task_state(tsk, TASK_UNINTERRUPTIBLE);\n\t\t\tif (!self.task) /* see coredump_finish() */\n\t\t\t\tbreak;\n\t\t\tschedule();\n\t\t}\n\nAs some of those threads are on the runqueue and didn\u0027t call schedule() yet,\ntheir fpu state is still active in the live registers and the thread\nproceeding with the coredump will hit the above mentioned BUG_ON while\ntrying to dump other threads fpustate to the coredump file.\n\nBUG_ON() in arch/x86/kernel/xsave.c:__sanitize_i387_state() is\nin the code paths for processors supporting xsaveopt. With or without\nxsaveopt, multi-threaded coredump is broken and maynot contain\nthe correct fpustate at the time of exit.\n\nIn coredump_wait(), wait for all the threads to be come inactive, so\nthat we are sure all the extended register state is flushed to\nthe memory, so that it can be reliably copied to the core file.\n\nReported-by: Suresh Nalluru \u003csuresh@aristanetworks.com\u003e\nSigned-off-by: Suresh Siddha \u003csuresh.b.siddha@intel.com\u003e\nLink: http://lkml.kernel.org/r/1336692811-30576-2-git-send-email-suresh.b.siddha@intel.com\nAcked-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nSigned-off-by: H. Peter Anvin \u003chpa@linux.intel.com\u003e\n" }, { "commit": "9e4a36ece652908276bc4abb4324ec56292453e1", "tree": "ec267b9350f9e06aa510e35fbd6858ba3b9d602c", "parents": [ "a7c1938e22c02b008655524c766d185ae99d9d53" ], "author": { "name": "Eric W. Biederman", "email": "ebiederm@xmission.com", "time": "Wed Nov 16 23:37:59 2011 -0800" }, "committer": { "name": "Eric W. Biederman", "email": "ebiederm@xmission.com", "time": "Tue May 15 14:59:23 2012 -0700" }, "message": "userns: Fail exec for suid and sgid binaries with ids outside our user namespace.\n\nAcked-by: Serge Hallyn \u003cserge.hallyn@canonical.com\u003e\nSigned-off-by: Eric W. Biederman \u003cebiederm@xmission.com\u003e\n" }, { "commit": "8e96e3b7b8407be794ab1fd8e4b332818a358e78", "tree": "f27756bb2ec49e586221ac669ea00c68e8a2ee58", "parents": [ "72cda3d1ef24ab0a9a89c15e9776ca737b75f45a" ], "author": { "name": "Eric W. Biederman", "email": "ebiederm@xmission.com", "time": "Sat Mar 03 21:17:15 2012 -0800" }, "committer": { "name": "Eric W. Biederman", "email": "ebiederm@xmission.com", "time": "Thu May 03 03:29:34 2012 -0700" }, "message": "userns: Use uid_eq gid_eq helpers when comparing kuids and kgids in the vfs\n\nAcked-by: Serge Hallyn \u003cserge.hallyn@canonical.com\u003e\nSigned-off-by: Eric W. Biederman \u003cebiederm@xmission.com\u003e\n" }, { "commit": "259e5e6c75a910f3b5e656151dc602f53f9d7548", "tree": "4405fdf68238f2e33f27b04e8c37c9e29a2493d8", "parents": [ "9ccf010f8172b699ea80178860e8ea228f7dce56" ], "author": { "name": "Andy Lutomirski", "email": "luto@amacapital.net", "time": "Thu Apr 12 16:47:50 2012 -0500" }, "committer": { "name": "James Morris", "email": "james.l.morris@oracle.com", "time": "Sat Apr 14 11:13:18 2012 +1000" }, "message": "Add PR_{GET,SET}_NO_NEW_PRIVS to prevent execve from granting privs\n\nWith this change, calling\n prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)\ndisables privilege granting operations at execve-time. For example, a\nprocess will not be able to execute a setuid binary to change their uid\nor gid if this bit is set. The same is true for file capabilities.\n\nAdditionally, LSM_UNSAFE_NO_NEW_PRIVS is defined to ensure that\nLSMs respect the requested behavior.\n\nTo determine if the NO_NEW_PRIVS bit is set, a task may call\n prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0);\nIt returns 1 if set and 0 if it is not set. If any of the arguments are\nnon-zero, it will return -1 and set errno to -EINVAL.\n(PR_SET_NO_NEW_PRIVS behaves similarly.)\n\nThis functionality is desired for the proposed seccomp filter patch\nseries. By using PR_SET_NO_NEW_PRIVS, it allows a task to modify the\nsystem call behavior for itself and its child tasks without being\nable to impact the behavior of a more privileged task.\n\nAnother potential use is making certain privileged operations\nunprivileged. For example, chroot may be considered \"safe\" if it cannot\naffect privileged tasks.\n\nNote, this patch causes execve to fail when PR_SET_NO_NEW_PRIVS is\nset and AppArmor is in use. It is fixed in a subsequent patch.\n\nSigned-off-by: Andy Lutomirski \u003cluto@amacapital.net\u003e\nSigned-off-by: Will Drewry \u003cwad@chromium.org\u003e\nAcked-by: Eric Paris \u003ceparis@redhat.com\u003e\nAcked-by: Kees Cook \u003ckeescook@chromium.org\u003e\n\nv18: updated change desc\nv17: using new define values as per 3.4\nSigned-off-by: James Morris \u003cjames.l.morris@oracle.com\u003e\n" }, { "commit": "66cfb32772495068fbb5627b2dc88649ad66c3e5", "tree": "4ce3537afdbd9be92a7a3e6ef4e8e8519ee11543", "parents": [ "6742259866d03d5bc19815441ba928e8378343dc", "7b8e6da46b921d30ac1553cac56d8fb74f0b431d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Apr 04 10:04:42 2012 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Apr 04 10:04:42 2012 -0700" }, "message": "Merge branch \u0027perf-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull perf fixes from Ingo Molnar.\n\n* \u0027perf-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n perf/x86/p4: Add format attributes\n tracing, sched, vfs: Fix \u0027old_pid\u0027 usage in trace_sched_process_exec()\n" }, { "commit": "6308191f6f55d3629c7dbe72dfb856ad9fa560fd", "tree": "d3f073b0e522fc7dbee52ca6c25d92f28059f2fd", "parents": [ "8ebfdf2babcda5a3b06cc67523bca1f9aed46009" ], "author": { "name": "Oleg Nesterov", "email": "oleg@redhat.com", "time": "Fri Mar 30 18:26:36 2012 +0200" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Sat Mar 31 11:53:22 2012 +0200" }, "message": "tracing, sched, vfs: Fix \u0027old_pid\u0027 usage in trace_sched_process_exec()\n\n1. TRACE_EVENT(sched_process_exec) forgets to actually use the\n old pid argument, it sets -\u003eold_pid \u003d p-\u003epid.\n\n2. search_binary_handler() uses the wrong pid number. tracepoint\n needs the global pid_t from the root namespace, while old_pid\n is the virtual pid number as it seen by the tracer/parent.\n\nWith this patch we have two pid_t\u0027s in search_binary_handler(),\nnot really nice. Perhaps we should switch to \"struct pid*\", but\nin this case it would be better to cleanup the current code\nfirst and move the \"depth \u003d\u003d 0\" code outside.\n\nSigned-off-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nCc: David Smith \u003cdsmith@redhat.com\u003e\nCc: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nCc: Steven Rostedt \u003crostedt@goodmis.org\u003e\nCc: Denys Vlasenko \u003cdvlasenk@redhat.com\u003e\nLink: http://lkml.kernel.org/r/20120330162636.GA4857@redhat.com\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\n" }, { "commit": "a591afc01d9e48affbacb365558a31e53c85af45", "tree": "9bb91f4eb94ec69fc4706c4944788ec5f3586063", "parents": [ "820d41cf0cd0e94a5661e093821e2e5c6b36a9d8", "31796ac4e8f0e88f5c10f1ad6dab8f19bebe44a4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 29 18:12:23 2012 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 29 18:12:23 2012 -0700" }, "message": "Merge branch \u0027x86-x32-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull x32 support for x86-64 from Ingo Molnar:\n \"This tree introduces the X32 binary format and execution mode for x86:\n 32-bit data space binaries using 64-bit instructions and 64-bit kernel\n syscalls.\n\n This allows applications whose working set fits into a 32 bits address\n space to make use of 64-bit instructions while using a 32-bit address\n space with shorter pointers, more compressed data structures, etc.\"\n\nFix up trivial context conflicts in arch/x86/{Kconfig,vdso/vma.c}\n\n* \u0027x86-x32-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (71 commits)\n x32: Fix alignment fail in struct compat_siginfo\n x32: Fix stupid ia32/x32 inversion in the siginfo format\n x32: Add ptrace for x32\n x32: Switch to a 64-bit clock_t\n x32: Provide separate is_ia32_task() and is_x32_task() predicates\n x86, mtrr: Use explicit sizing and padding for the 64-bit ioctls\n x86/x32: Fix the binutils auto-detect\n x32: Warn and disable rather than error if binutils too old\n x32: Only clear TIF_X32 flag once\n x32: Make sure TS_COMPAT is cleared for x32 tasks\n fs: Remove missed -\u003efds_bits from cessation use of fd_set structs internally\n fs: Fix close_on_exec pointer in alloc_fdtable\n x32: Drop non-__vdso weak symbols from the x32 VDSO\n x32: Fix coding style violations in the x32 VDSO code\n x32: Add x32 VDSO support\n x32: Allow x32 to be configured\n x32: If configured, add x32 system calls to system call tables\n x32: Handle process creation\n x32: Signal-related system calls\n x86: Add #ifdef CONFIG_COMPAT to \u003casm/sys_ia32.h\u003e\n ...\n" }, { "commit": "96f951edb1f1bdbbc99b0cd458f9808bb83d58ae", "tree": "c109d45d3fb8ccad461cfe6d9a4aa4d6005b38e1", "parents": [ "49a7f04a4b9d45cd794741ce3d5d66524b37bdd0" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Wed Mar 28 18:30:03 2012 +0100" }, "committer": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Wed Mar 28 18:30:03 2012 +0100" }, "message": "Add #includes needed to permit the removal of asm/system.h\n\nasm/system.h is a cause of circular dependency problems because it contains\ncommonly used primitive stuff like barrier definitions and uncommonly used\nstuff like switch_to() that might require MMU definitions.\n\nasm/system.h has been disintegrated by this point on all arches into the\nfollowing common segments:\n\n (1) asm/barrier.h\n\n Moved memory barrier definitions here.\n\n (2) asm/cmpxchg.h\n\n Moved xchg() and cmpxchg() here. #included in asm/atomic.h.\n\n (3) asm/bug.h\n\n Moved die() and similar here.\n\n (4) asm/exec.h\n\n Moved arch_align_stack() here.\n\n (5) asm/elf.h\n\n Moved AT_VECTOR_SIZE_ARCH here.\n\n (6) asm/switch_to.h\n\n Moved switch_to() here.\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\n" }, { "commit": "95211279c5ad00a317c98221d7e4365e02f20836", "tree": "2ddc8625378d2915b8c96392f3cf6663b705ed55", "parents": [ "5375871d432ae9fc581014ac117b96aaee3cd0c7", "12724850e8064f64b6223d26d78c0597c742c65a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 22 09:04:48 2012 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 22 09:04:48 2012 -0700" }, "message": "Merge branch \u0027akpm\u0027 (Andrew\u0027s patch-bomb)\n\nMerge first batch of patches from Andrew Morton:\n \"A few misc things and all the MM queue\"\n\n* emailed from Andrew Morton \u003cakpm@linux-foundation.org\u003e: (92 commits)\n memcg: avoid THP split in task migration\n thp: add HPAGE_PMD_* definitions for !CONFIG_TRANSPARENT_HUGEPAGE\n memcg: clean up existing move charge code\n mm/memcontrol.c: remove unnecessary \u0027break\u0027 in mem_cgroup_read()\n mm/memcontrol.c: remove redundant BUG_ON() in mem_cgroup_usage_unregister_event()\n mm/memcontrol.c: s/stealed/stolen/\n memcg: fix performance of mem_cgroup_begin_update_page_stat()\n memcg: remove PCG_FILE_MAPPED\n memcg: use new logic for page stat accounting\n memcg: remove PCG_MOVE_LOCK flag from page_cgroup\n memcg: simplify move_account() check\n memcg: remove EXPORT_SYMBOL(mem_cgroup_update_page_stat)\n memcg: kill dead prev_priority stubs\n memcg: remove PCG_CACHE page_cgroup flag\n memcg: let css_get_next() rely upon rcu_read_lock()\n cgroup: revert ss_id_lock to spinlock\n idr: make idr_get_next() good for rcu_read_lock()\n memcg: remove unnecessary thp check in page stat accounting\n memcg: remove redundant returns\n memcg: enum lru_list lru\n ...\n" }, { "commit": "05af2e104a0c282dcd9303431e1360750ba76de6", "tree": "cdd5876f2d17b26cc3ded7ef85d04d0e853e9b7e", "parents": [ "90481622d75715bfcb68501280a917dbfe516029" ], "author": { "name": "David Rientjes", "email": "rientjes@google.com", "time": "Wed Mar 21 16:34:13 2012 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Mar 21 17:54:59 2012 -0700" }, "message": "mm, counters: remove task argument to sync_mm_rss() and __sync_task_rss_stat()\n\nsync_mm_rss() can only be used for current to avoid race conditions in\niterating and clearing its per-task counters. Remove the task argument\nfor it and its helper function, __sync_task_rss_stat(), to avoid thinking\nit can be used safely for anything other than current.\n\nSigned-off-by: David Rientjes \u003crientjes@google.com\u003e\nAcked-by: KAMEZAWA Hiroyuki \u003ckamezawa.hiroyu@jp.fujitsu.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "e2a0883e4071237d09b604a342c28b96b44a04b3", "tree": "aa56f4d376b5eb1c32358c19c2669c2a94e0e1fd", "parents": [ "3a990a52f9f25f45469e272017a31e7a3fda60ed", "07c0c5d8b8c122b2f2df9ee574ac3083daefc981" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Mar 21 13:36:41 2012 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Mar 21 13:36:41 2012 -0700" }, "message": "Merge branch \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs\n\nPull vfs pile 1 from Al Viro:\n \"This is _not_ all; in particular, Miklos\u0027 and Jan\u0027s stuff is not there\n yet.\"\n\n* \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (64 commits)\n ext4: initialization of ext4_li_mtx needs to be done earlier\n debugfs-related mode_t whack-a-mole\n hfsplus: add an ioctl to bless files\n hfsplus: change finder_info to u32\n hfsplus: initialise userflags\n qnx4: new helper - try_extent()\n qnx4: get rid of qnx4_bread/qnx4_getblk\n take removal of PF_FORKNOEXEC to flush_old_exec()\n trim includes in inode.c\n um: uml_dup_mmap() relies on -\u003emmap_sem being held, but activate_mm() doesn\u0027t hold it\n um: embed -\u003estub_pages[] into mmu_context\n gadgetfs: list_for_each_safe() misuse\n ocfs2: fix leaks on failure exits in module_init\n ecryptfs: make register_filesystem() the last potential failure exit\n ntfs: forgets to unregister sysctls on register_filesystem() failure\n logfs: missing cleanup on register_filesystem() failure\n jfs: mising cleanup on register_filesystem() failure\n make configfs_pin_fs() return root dentry on success\n configfs: configfs_create_dir() has parent dentry in dentry-\u003ed_parent\n configfs: sanitize configfs_create()\n ...\n" }, { "commit": "9f3938346a5c1fa504647670edb5fea5756cfb00", "tree": "7cf6d24d6b076c8db8571494984924cac03703a2", "parents": [ "69a7aebcf019ab3ff5764525ad6858fbe23bb86d", "317b6e128247f75976b0fc2b9fd8d2c20ef13b3a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Mar 21 09:40:26 2012 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Mar 21 09:40:26 2012 -0700" }, "message": "Merge branch \u0027kmap_atomic\u0027 of git://github.com/congwang/linux\n\nPull kmap_atomic cleanup from Cong Wang.\n\nIt\u0027s been in -next for a long time, and it gets rid of the (no longer\nused) second argument to k[un]map_atomic().\n\nFix up a few trivial conflicts in various drivers, and do an \"evil\nmerge\" to catch some new uses that have come in since Cong\u0027s tree.\n\n* \u0027kmap_atomic\u0027 of git://github.com/congwang/linux: (59 commits)\n feature-removal-schedule.txt: schedule the deprecated form of kmap_atomic() for removal\n highmem: kill all __kmap_atomic() [swarren@nvidia.com: highmem: Fix ARM build break due to __kmap_atomic rename]\n drbd: remove the second argument of k[un]map_atomic()\n zcache: remove the second argument of k[un]map_atomic()\n gma500: remove the second argument of k[un]map_atomic()\n dm: remove the second argument of k[un]map_atomic()\n tomoyo: remove the second argument of k[un]map_atomic()\n sunrpc: remove the second argument of k[un]map_atomic()\n rds: remove the second argument of k[un]map_atomic()\n net: remove the second argument of k[un]map_atomic()\n mm: remove the second argument of k[un]map_atomic()\n lib: remove the second argument of k[un]map_atomic()\n power: remove the second argument of k[un]map_atomic()\n kdb: remove the second argument of k[un]map_atomic()\n udf: remove the second argument of k[un]map_atomic()\n ubifs: remove the second argument of k[un]map_atomic()\n squashfs: remove the second argument of k[un]map_atomic()\n reiserfs: remove the second argument of k[un]map_atomic()\n ocfs2: remove the second argument of k[un]map_atomic()\n ntfs: remove the second argument of k[un]map_atomic()\n ...\n" }, { "commit": "19e5109fef2c368ab3f8a5157270f87f4a7c0326", "tree": "31142f922de19cedfe45f0caa660a6d58674d8cc", "parents": [ "e59cc473cc603d562f2c80c12c943ef2a8cde6b2" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Thu Feb 23 22:29:17 2012 -0500" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Tue Mar 20 21:29:51 2012 -0400" }, "message": "take removal of PF_FORKNOEXEC to flush_old_exec()\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "8fc3dc5a3a17aa2b353886422bd89420619af211", "tree": "74a3290ad9621ff1c225b772df2c529c8feb5f43", "parents": [ "54bf586e1f51018ba7624c851e7aa14cee0548d2" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Sat Mar 17 03:05:16 2012 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Tue Mar 20 21:29:46 2012 -0400" }, "message": "__register_binfmt() made void\n\nJust don\u0027t pass NULL to it - nobody does, anyway.\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "701085b219016d38f105b031381b9cee6200253a", "tree": "5111f137c507c8537d5d2c8e4203f0e6e4942bcb", "parents": [ "b6e238dceed36891cc633167afe7151f1f3d83c5" ], "author": { "name": "Oleg Nesterov", "email": "oleg@redhat.com", "time": "Mon Mar 19 17:04:01 2012 +0100" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Mar 20 14:16:50 2012 -0700" }, "message": "exec: move de_thread()-\u003esetmax_mm_hiwater_rss() into exec_mmap()\n\nMinor cleanup. de_thread()-\u003esetmax_mm_hiwater_rss() looks a bit\nstrange, move it into exec_mmap() which plays with old_mm.\n\nSigned-off-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "e636825346b36a07ccfc8e30946d52855e21f681", "tree": "128c37b3102223a95ce03b856766c33e4d077114", "parents": [ "5f8aadd8b9966d71a77bba52b9d499cc2f38269f" ], "author": { "name": "Oleg Nesterov", "email": "oleg@redhat.com", "time": "Mon Mar 19 17:03:22 2012 +0100" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Mar 20 14:16:50 2012 -0700" }, "message": "exit_signal: simplify the \"we have changed execution domain\" logic\n\nexit_notify() checks \"tsk-\u003eself_exec_id !\u003d tsk-\u003eparent_exec_id\"\nto handle the \"we have changed execution domain\" case.\n\nWe can change do_thread() to always set -\u003eexit_signal \u003d SIGCHLD\nand remove this check to simplify the code.\n\nWe could change setup_new_exec() instead, this looks more logical\nbecause it increments -\u003eself_exec_id. But note that de_thread()\nalready resets -\u003eexit_signal if it changes the leader, let\u0027s keep\nboth changes close to each other.\n\nNote that we change -\u003eexit_signal lockless, this changes the rules.\nThereafter -\u003eexit_signal is not stable under tasklist but this is\nfine, the only possible change is OLDSIG -\u003e SIGCHLD. This can race\nwith eligible_child() but the race is harmless. We can race with\nreparent_leader() which changes our -\u003eexit_signal in parallel, but\nit does the same change to SIGCHLD.\n\nThe noticeable user-visible change is that the execing task is not\n\"visible\" to do_wait()-\u003eeligible_child(__WCLONE) right after exec.\nTo me this looks more logical, and this is consistent with mt case.\n\nSigned-off-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "e8e3c3d66fd9d1ee2250f68d778cc48c1346d228", "tree": "2d69e1bb0cefe36bbfc4b75ddfa6cec8e72bcb98", "parents": [ "c6daa7ffa834c850b3dbb38af6980415caef680d" ], "author": { "name": "Cong Wang", "email": "amwang@redhat.com", "time": "Fri Nov 25 23:14:27 2011 +0800" }, "committer": { "name": "Cong Wang", "email": "xiyou.wangcong@gmail.com", "time": "Tue Mar 20 21:48:21 2012 +0800" }, "message": "fs: remove the second argument of k[un]map_atomic()\n\nAcked-by: Benjamin LaHaise \u003cbcrl@kvack.org\u003e\nSigned-off-by: Cong Wang \u003camwang@redhat.com\u003e\n" }, { "commit": "35239e23c66f1614c76739b62a299c3c92d6eb68", "tree": "7b1e068df888ec9a00b43c1dd7517a6490da6a94", "parents": [ "3f33ab1c0c741bfab2138c14ba1918a7905a1e8b", "87e24f4b67e68d9fd8df16e0bf9c66d1ad2a2533" ], "author": { "name": "Ingo Molnar", "email": "mingo@elte.hu", "time": "Mon Mar 12 20:44:07 2012 +0100" }, "committer": { "name": "Ingo Molnar", "email": "mingo@elte.hu", "time": "Mon Mar 12 20:44:11 2012 +0100" }, "message": "Merge branch \u0027perf/urgent\u0027 into perf/core\n\nMerge reason: We are going to queue up a dependent patch.\n\nSigned-off-by: Ingo Molnar \u003cmingo@elte.hu\u003e\n" }, { "commit": "57b59c4a1400fa6c34764eab2e35a8762dc05a09", "tree": "e50e6a6f9f7fcd897856e5cdaca3d3caa18377d6", "parents": [ "d68b46fe16ad59b3a5f51ec73daaa5dc06753798" ], "author": { "name": "Oleg Nesterov", "email": "oleg@redhat.com", "time": "Mon Mar 05 14:59:13 2012 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Mar 05 15:49:42 2012 -0800" }, "message": "coredump_wait: don\u0027t call complete_vfork_done()\n\nNow that CLONE_VFORK is killable, coredump_wait() no longer needs\ncomplete_vfork_done(). zap_threads() should find and kill all tasks with\nthe same -\u003emm, this includes our parent if -\u003evfork_done is set.\n\nmm_release() becomes the only caller, unexport complete_vfork_done().\n\nSigned-off-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nAcked-by: Tejun Heo \u003ctj@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "c415c3b47ea2754659d915cca387a20999044163", "tree": "c2cb1134f139702e06ade8aecbeff70be7ea727c", "parents": [ "880641bb9da2473e9ecf6c708d993b29928c1b3c" ], "author": { "name": "Oleg Nesterov", "email": "oleg@redhat.com", "time": "Mon Mar 05 14:59:13 2012 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Mar 05 15:49:42 2012 -0800" }, "message": "vfork: introduce complete_vfork_done()\n\nNo functional changes.\n\nMove the clear-and-complete-vfork_done code into the new trivial helper,\ncomplete_vfork_done().\n\nSigned-off-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nAcked-by: Tejun Heo \u003ctj@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "737f24bda723fdf89ecaacb99fa2bf5683c32799", "tree": "35495fff3e9956679cb5468e74e6814c8e44ee66", "parents": [ "8eedce996556d7d06522cd3a0e6069141c8dffe0", "b7c924274c456499264d1cfa3d44063bb11eb5db" ], "author": { "name": "Ingo Molnar", "email": "mingo@elte.hu", "time": "Mon Mar 05 09:20:08 2012 +0100" }, "committer": { "name": "Ingo Molnar", "email": "mingo@elte.hu", "time": "Mon Mar 05 09:20:08 2012 +0100" }, "message": "Merge branch \u0027perf/urgent\u0027 into perf/core\n\nConflicts:\n\ttools/perf/builtin-record.c\n\ttools/perf/builtin-top.c\n\ttools/perf/perf.h\n\ttools/perf/util/top.h\n\nMerge reason: resolve these cherry-picking conflicts.\n\nSigned-off-by: Ingo Molnar \u003cmingo@elte.hu\u003e\n" }, { "commit": "4ff16c25e2cc48cbe6956e356c38a25ac063a64d", "tree": "27ff21500ab5559497126e6a25e65bcf96d44c59", "parents": [ "034d150a44a2b428e273e69889397c01f63eaf14" ], "author": { "name": "David Smith", "email": "dsmith@redhat.com", "time": "Tue Feb 07 10:11:05 2012 -0600" }, "committer": { "name": "Ingo Molnar", "email": "mingo@elte.hu", "time": "Thu Feb 23 09:28:06 2012 +0100" }, "message": "tracepoint, vfs, sched: Add exec() tracepoint\n\nAdded a minimal exec tracepoint. Exec is an important major event\nin the life of a task, like fork(), clone() or exit(), all of\nwhich we already trace.\n\n[ We also do scheduling re-balancing during exec() - so it\u0027s useful\n from a scheduler instrumentation POV as well. ]\n\nIf you want to watch a task start up, when it gets exec\u0027ed is a good place\nto start. With the addition of this tracepoint, exec\u0027s can be monitored\nand better picture of general system activity can be obtained. This\ntracepoint will also enable better process life tracking, allowing you to\nanswer questions like \"what process keeps starting up binary X?\".\n\nThis tracepoint can also be useful in ftrace filtering and trigger\nconditions: i.e. starting or stopping filtering when exec is called.\n\nSigned-off-by: David Smith \u003cdsmith@redhat.com\u003e\nSigned-off-by: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nCc: Steven Rostedt \u003crostedt@goodmis.org\u003e\nCc: Christoph Hellwig \u003chch@infradead.org\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nCc: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nCc: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nLink: http://lkml.kernel.org/r/4F314D19.7030504@redhat.com\nSigned-off-by: Ingo Molnar \u003cmingo@elte.hu\u003e\n" }, { "commit": "1fd36adcd98c14d2fd97f545293c488775cb2823", "tree": "c13ab1934a15aebe0d81601d910ce5a3c6fa2c6f", "parents": [ "1dce27c5aa6770e9d195f2bb7db1db3d4dde5591" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Thu Feb 16 17:49:54 2012 +0000" }, "committer": { "name": "H. Peter Anvin", "email": "hpa@zytor.com", "time": "Sun Feb 19 10:30:57 2012 -0800" }, "message": "Replace the fd_sets in struct fdtable with an array of unsigned longs\n\nReplace the fd_sets in struct fdtable with an array of unsigned longs and then\nuse the standard non-atomic bit operations rather than the FD_* macros.\n\nThis:\n\n (1) Removes the abuses of struct fd_set:\n\n (a) Since we don\u0027t want to allocate a full fd_set the vast majority of the\n \t time, we actually, in effect, just allocate a just-big-enough array of\n \t unsigned longs and cast it to an fd_set type - so why bother with the\n \t fd_set at all?\n\n (b) Some places outside of the core fdtable handling code (such as\n \t SELinux) want to look inside the array of unsigned longs hidden inside\n \t the fd_set struct for more efficient iteration over the entire set.\n\n (2) Eliminates the use of FD_*() macros in the kernel completely.\n\n (3) Permits the __FD_*() macros to be deleted entirely where not exposed to\n userspace.\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nLink: http://lkml.kernel.org/r/20120216174954.23314.48147.stgit@warthog.procyon.org.uk\nSigned-off-by: H. Peter Anvin \u003chpa@zytor.com\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "1dce27c5aa6770e9d195f2bb7db1db3d4dde5591", "tree": "4ad3ffeee95cb5b10e047b7cb9bdbb48cfc734e0", "parents": [ "8b3d1cda4f5ff0d7c2ae910ea8fd03493996912f" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Thu Feb 16 17:49:42 2012 +0000" }, "committer": { "name": "H. Peter Anvin", "email": "hpa@zytor.com", "time": "Sun Feb 19 10:30:52 2012 -0800" }, "message": "Wrap accesses to the fd_sets in struct fdtable\n\nWrap accesses to the fd_sets in struct fdtable (for recording open files and\nclose-on-exec flags) so that we can move away from using fd_sets since we\nabuse the fd_set structs by not allocating the full-sized structure under\nnormal circumstances and by non-core code looking at the internals of the\nfd_sets.\n\nThe first abuse means that use of FD_ZERO() on these fd_sets is not permitted,\nsince that cannot be told about their abnormal lengths.\n\nThis introduces six wrapper functions for setting, clearing and testing\nclose-on-exec flags and fd-is-open flags:\n\n\tvoid __set_close_on_exec(int fd, struct fdtable *fdt);\n\tvoid __clear_close_on_exec(int fd, struct fdtable *fdt);\n\tbool close_on_exec(int fd, const struct fdtable *fdt);\n\tvoid __set_open_fd(int fd, struct fdtable *fdt);\n\tvoid __clear_open_fd(int fd, struct fdtable *fdt);\n\tbool fd_is_open(int fd, const struct fdtable *fdt);\n\nNote that I\u0027ve prepended \u0027__\u0027 to the names of the set/clear functions because\nthey require the caller to hold a lock to use them.\n\nNote also that I haven\u0027t added wrappers for looking behind the scenes at the\nthe array. Possibly that should exist too.\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nLink: http://lkml.kernel.org/r/20120216174942.23314.1364.stgit@warthog.procyon.org.uk\nSigned-off-by: H. Peter Anvin \u003chpa@zytor.com\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "96e02d1586782eadf051fa3d6bc4132d2447ac2c", "tree": "dd40e6302d2770d3c51cced64cfd3b8cf1355da4", "parents": [ "23783f817bceedd6d4e549385e3f400ea64059e5" ], "author": { "name": "Heiko Carstens", "email": "heiko.carstens@de.ibm.com", "time": "Sat Feb 04 10:47:10 2012 +0100" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Feb 06 15:15:20 2012 -0800" }, "message": "exec: fix use-after-free bug in setup_new_exec()\n\nSetting the task name is done within setup_new_exec() by accessing\nbprm-\u003efilename. However this happens after flush_old_exec().\nThis may result in a use after free bug, flush_old_exec() may\n\"complete\" vfork_done, which will wake up the parent which in turn\nmay free the passed in filename.\nTo fix this add a new tcomm field in struct linux_binprm which\ncontains the now early generated task name until it is used.\n\nFixes this bug on s390:\n\n Unable to handle kernel pointer dereference at virtual kernel address 0000000039768000\n Process kworker/u:3 (pid: 245, task: 000000003a3dc840, ksp: 0000000039453818)\n Krnl PSW : 0704000180000000 0000000000282e94 (setup_new_exec+0xa0/0x374)\n Call Trace:\n ([\u003c0000000000282e2c\u003e] setup_new_exec+0x38/0x374)\n [\u003c00000000002dd12e\u003e] load_elf_binary+0x402/0x1bf4\n [\u003c0000000000280a42\u003e] search_binary_handler+0x38e/0x5bc\n [\u003c0000000000282b6c\u003e] do_execve_common+0x410/0x514\n [\u003c0000000000282cb6\u003e] do_execve+0x46/0x58\n [\u003c00000000005bce58\u003e] kernel_execve+0x28/0x70\n [\u003c000000000014ba2e\u003e] ____call_usermodehelper+0x102/0x140\n [\u003c00000000005bc8da\u003e] kernel_thread_starter+0x6/0xc\n [\u003c00000000005bc8d4\u003e] kernel_thread_starter+0x0/0xc\n Last Breaking-Event-Address:\n [\u003c00000000002830f0\u003e] setup_new_exec+0x2fc/0x374\n\n Kernel panic - not syncing: Fatal exception: panic_on_oops\n\nReported-by: Sebastian Ott \u003csebott@linux.vnet.ibm.com\u003e\nSigned-off-by: Heiko Carstens \u003cheiko.carstens@de.ibm.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "43d2b113241d6797b890318767e0af78e313414b", "tree": "6f25647f2660f8fca63cc8355b70ad643993dab8", "parents": [ "6bd4837de96e7d9f9bf33e59117c24fc230862ac" ], "author": { "name": "KAMEZAWA Hiroyuki", "email": "kamezawa.hiroyu@jp.fujitsu.com", "time": "Tue Jan 10 15:08:09 2012 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jan 10 16:30:44 2012 -0800" }, "message": "tracepoint: add tracepoints for debugging oom_score_adj\n\noom_score_adj is used for guarding processes from OOM-Killer. One of\nproblem is that it\u0027s inherited at fork(). When a daemon set oom_score_adj\nand make children, it\u0027s hard to know where the value is set.\n\nThis patch adds some tracepoints useful for debugging. This patch adds\n3 trace points.\n - creating new task\n - renaming a task (exec)\n - set oom_score_adj\n\nTo debug, users need to enable some trace pointer. Maybe filtering is useful as\n\n# EVENT\u003d/sys/kernel/debug/tracing/events/task/\n# echo \"oom_score_adj !\u003d 0\" \u003e $EVENT/task_newtask/filter\n# echo \"oom_score_adj !\u003d 0\" \u003e $EVENT/task_rename/filter\n# echo 1 \u003e $EVENT/enable\n# EVENT\u003d/sys/kernel/debug/tracing/events/oom/\n# echo 1 \u003e $EVENT/enable\n\noutput will be like this.\n# grep oom /sys/kernel/debug/tracing/trace\nbash-7699 [007] d..3 5140.744510: oom_score_adj_update: pid\u003d7699 comm\u003dbash oom_score_adj\u003d-1000\nbash-7699 [007] ...1 5151.818022: task_newtask: pid\u003d7729 comm\u003dbash clone_flags\u003d1200011 oom_score_adj\u003d-1000\nls-7729 [003] ...2 5151.818504: task_rename: pid\u003d7729 oldcomm\u003dbash newcomm\u003dls oom_score_adj\u003d-1000\nbash-7699 [002] ...1 5175.701468: task_newtask: pid\u003d7730 comm\u003dbash clone_flags\u003d1200011 oom_score_adj\u003d-1000\ngrep-7730 [007] ...2 5175.701993: task_rename: pid\u003d7730 oldcomm\u003dbash newcomm\u003dgrep oom_score_adj\u003d-1000\n\nSigned-off-by: KAMEZAWA Hiroyuki \u003ckamezawa.hiroyu@jp.fujitsu.com\u003e\nCc: KOSAKI Motohiro \u003ckosaki.motohiro@jp.fujitsu.com\u003e\nAcked-by: David Rientjes \u003crientjes@google.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "f47ec3f28354795f000c14bf18ed967ec81a3ec3", "tree": "662d479706bd948963ad3f9f00c2e6caedbe5a92", "parents": [ "5ede7b1cfa8201418fb35e12f770e9e7c2559a4d" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Mon Nov 21 21:15:42 2011 -0500" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Tue Jan 03 22:52:35 2012 -0500" }, "message": "trim fs/internal.h\n\nsome stuff in there can actually become static; some belongs to pnode.h\nas it\u0027s a private interface between namespace.c and pnode.c...\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "c9f01245b6a7d77d17deaa71af10f6aca14fa24e", "tree": "13ffde591a5bcefba39cb6393f09b27f1ebc1a30", "parents": [ "7b0d44fa49b1dcfdcf4897f12ddd12ddeab1a9d7" ], "author": { "name": "David Rientjes", "email": "rientjes@google.com", "time": "Mon Oct 31 17:07:15 2011 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Oct 31 17:30:45 2011 -0700" }, "message": "oom: remove oom_disable_count\n\nThis removes mm-\u003eoom_disable_count entirely since it\u0027s unnecessary and\ncurrently buggy. The counter was intended to be per-process but it\u0027s\ncurrently decremented in the exit path for each thread that exits, causing\nit to underflow.\n\nThe count was originally intended to prevent oom killing threads that\nshare memory with threads that cannot be killed since it doesn\u0027t lead to\nfuture memory freeing. The counter could be fixed to represent all\nthreads sharing the same mm, but it\u0027s better to remove the count since:\n\n - it is possible that the OOM_DISABLE thread sharing memory with the\n victim is waiting on that thread to exit and will actually cause\n future memory freeing, and\n\n - there is no guarantee that a thread is disabled from oom killing just\n because another thread sharing its mm is oom disabled.\n\nSigned-off-by: David Rientjes \u003crientjes@google.com\u003e\nReported-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nReviewed-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nCc: Ying Han \u003cyinghan@google.com\u003e\nCc: KOSAKI Motohiro \u003ckosaki.motohiro@jp.fujitsu.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" } ], "next": "72fa59970f8698023045ab0713d66f3f4f96945c" }