1. 13 Nov, 2007 29 commits
  2. 12 Nov, 2007 11 commits
    • J. Bruce Fields's avatar
      nfsd4: recheck for secure ports in fh_verify · 6fa02839
      J. Bruce Fields authored
      As with commit 7fc90ec9 ("knfsd: nfsd:
      call nfsd_setuser() on fh_compose(), fix nfsd4 permissions problem")
      this is a case where we need to redo a security check in fh_verify()
      even though the filehandle already has an associated dentry--if the
      filehandle was created by fh_compose() in an earlier operation of the
      nfsv4 compound, then we may not have done these checks yet.
      
      Without this fix it is possible, for example, to traverse from an export
      without the secure ports requirement to one with it in a single
      compound, and bypass the secure port check on the new export.
      
      While we're here, fix up some minor style problems and change a printk()
      to a dprintk(), to make it harder for random unprivileged users to spam
      the logs.
      Signed-off-by: default avatarJ. Bruce Fields <bfields@citi.umich.edu>
      Reviewed-By: default avatarNeilBrown <neilb@suse.de>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      6fa02839
    • J. Bruce Fields's avatar
      knfsd: fix spurious EINVAL errors on first access of new filesystem · ac8587dc
      J. Bruce Fields authored
      The v2/v3 acl code in nfsd is translating any return from fh_verify() to
      nfserr_inval.  This is particularly unfortunate in the case of an
      nfserr_dropit return, which is an internal error meant to indicate to
      callers that this request has been deferred and should just be dropped
      pending the results of an upcall to mountd.
      
      Thanks to Roland <devzero@web.de> for bug report and data collection.
      
      Cc: Roland <devzero@web.de>
      Acked-by: default avatarAndreas Gruenbacher <agruen@suse.de>
      Signed-off-by: default avatarJ. Bruce Fields <bfields@citi.umich.edu>
      Reviewed-By: default avatarNeilBrown <neilb@suse.de>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      ac8587dc
    • Linus Torvalds's avatar
      Revert "Bias the placement of kernel pages at lower PFNs" · 44048d70
      Linus Torvalds authored
      This reverts commit 5adc5be7.
      
      Alexey Dobriyan reports that it causes huge slowdowns under some loads,
      in his case a "mkfs.ext2" on a 30G partition.  With the placement bias,
      the mkfs took over four minutes, with it reverted it's back to about ten
      seconds for Alexey.
      Reported-and-tested-by: default avatarAlexey Dobriyan <adobriyan@gmail.com>
      Cc: Mel Gorman <mel@csn.ul.ie>
      Cc: Andrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      44048d70
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/avi/kvm · e6a5c27f
      Linus Torvalds authored
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/avi/kvm:
        KVM: SVM: Intercept the 'invd' and 'wbinvd' instructions
        KVM: x86 emulator: invd instruction
        KVM: SVM: Defer nmi processing until switch to host state is complete
        KVM: SVM: Fix SMP with kernel apic
        KVM: x86 emulator: fix 'push imm8' emulation
      e6a5c27f
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux-2.6-virtio · 05f3f415
      Linus Torvalds authored
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux-2.6-virtio:
        virtio: Force use of power-of-two for descriptor ring sizes
        lguest: Fix lguest virtio-blk backend size computation
        virtio: Fix used_idx wrap-around
        virtio: more fallout from scatterlist changes.
        virtio: fix vring_init for 64 bits
      05f3f415
    • Linus Torvalds's avatar
      Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 · e697b8d1
      Linus Torvalds authored
      * 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (39 commits)
        [INET]: Small possible memory leak in FIB rules
        [NETNS]: init dev_base_lock only once
        [UNIX]: The unix_nr_socks limit can be exceeded
        [AF_UNIX]: Convert socks to unix_socks in scan_inflight, not in callbacks
        [AF_UNIX]: Make unix_tot_inflight counter non-atomic
        [AF_PACKET]: Allow multicast traffic to be caught by ORIGDEV when bonded
        ssb: Fix PCMCIA-host lowlevel bus access
        mac80211: fix MAC80211_RCSIMPLE Kconfig
        mac80211: make "decrypt failed" messages conditional upon MAC80211_DEBUG
        mac80211: use IW_AUTH_PRIVACY_INVOKED rather than IW_AUTH_KEY_MGMT
        mac80211: remove unused driver ops
        mac80211: remove ieee80211_common.h
        softmac: MAINTAINERS update
        rfkill: Fix sparse warning
        rfkill: Use mutex_lock() at register and add sanity check
        iwlwifi: select proper rate control algorithm
        mac80211: allow driver to ask for a rate control algorithm
        mac80211: don't allow registering the same rate control twice
        rfkill: Use subsys_initcall
        mac80211: make simple rate control algorithm built-in
        ...
      e697b8d1
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6 · 46015977
      Linus Torvalds authored
      * git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6: (21 commits)
        [CIFS] fix oops on second mount to same server when null auth is used
        [CIFS] Fix stale mode after readdir when cifsacl specified
        [CIFS] add mode to acl conversion helper function
        [CIFS] Fix incorrect mode when ACL had deny access control entries
        [CIFS] Add uid to key description so krb can handle user mounts
        [CIFS] Fix walking out end of cifs dacl
        [CIFS] Add upcall files for cifs to use spnego/kerberos
        [CIFS] add OIDs for KRB5 and MSKRB5 to ASN1 parsing routines
        [CIFS] Register and unregister cifs_spnego_key_type on module init/exit
        [CIFS] implement upcalls for SPNEGO blob via keyctl API
        [CIFS] allow cifs_calc_signature2 to deal with a zero length iovec
        [CIFS] If no Access Control Entries, set mode perm bits to zero
        [CIFS] when mount helper missing fix slash wrong direction in share
        [CIFS] Don't request too much permission when reading an ACL
        [CIFS] enable get mode from ACL when cifsacl mount option specified
        [CIFS] ACL support part 8
        [CIFS] acl support part 7
        [CIFS] acl support part 6
        [CIFS] acl support part 6
        [CIFS] remove unused funtion compile warning when experimental off
        ...
      46015977
    • Siddha, Suresh B's avatar
      x86: fix taking DNA during 64bit sigreturn · 92d140e2
      Siddha, Suresh B authored
      restore sigcontext is taking a DNA exception while restoring FP context
      from the user stack, during the sigreturn.  Appended patch fixes it by
      doing clts() if the app doesn't touch FP during the signal handler
      execution.  This will stop generating a DNA, during the fxrstor in the
      sigreturn.
      
      This improves 64-bit lat_sig numbers by ~30% on my core2 platform.
      Signed-off-by: default avatarSuresh Siddha <suresh.b.siddha@intel.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      92d140e2
    • Denis Cheng's avatar
      SLUB: killed the unused "end" variable · efe44183
      Denis Cheng authored
      Since the macro "for_each_object" introduced, the "end" variable becomes unused anymore.
      Signed-off-by: default avatarDenis Cheng <crquan@gmail.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      efe44183
    • Roland McGrath's avatar
      core dump: remain dumpable · 00ec99da
      Roland McGrath authored
      The coredump code always calls set_dumpable(0) when it starts (even
      if RLIMIT_CORE prevents any core from being dumped).  The effect of
      this (via task_dumpable) is to make /proc/pid/* files owned by root
      instead of the user, so the user can no longer examine his own
      process--in a case where there was never any privileged data to
      protect.  This affects e.g. auxv, environ, fd; in Fedora (execshield)
      kernels, also maps.  In practice, you can only notice this when a
      debugger has requested PTRACE_EVENT_EXIT tracing.
      
      set_dumpable was only used in do_coredump for synchronization and not
      intended for any security purpose.  (It doesn't secure anything that wasn't
      already unsecured when a process dies by SIGTERM instead of SIGQUIT.)
      
      This changes do_coredump to check the core_waiters count as the means of
      synchronization, which is sufficient.  Now we leave the "dumpable" bits alone.
      Signed-off-by: default avatarRoland McGrath <roland@redhat.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      00ec99da
    • Jesper Juhl's avatar
      Fix memory leak in discard case of sctp_sf_abort_violation() · 9abed245
      Jesper Juhl authored
      In net/sctp/sm_statefuns.c::sctp_sf_abort_violation() we may leak
      the storage allocated for 'abort' by returning from the function
      without using or freeing it. This happens in case
      "sctp_auth_recv_cid(SCTP_CID_ABORT, asoc)" is true and we jump to
      the 'discard' label.
      Spotted by the Coverity checker.
      
      The simple fix is to simply move the creation of the "abort chunk"
      to after the possible jump to the 'discard' label. This way we don't
      even have to allocate the memory at all in the problem case.
      Signed-off-by: default avatarJesper Juhl <jesper.juhl@gmail.com>
      Signed-off-by: default avatarVlad Yasevich <vladislav.yasevich@hp.com>
      9abed245