22940 Commits

Author SHA1 Message Date
Wang, Xiaoming
d813dde69e net: ipv4: current group_info should be put after using.
Plug a group_info refcount leak in ping_init.
group_info is only needed during initialization and
the code failed to release the reference on exit.
While here move grabbing the reference to a place
where it is actually needed.

Signed-off-by: Chuansheng Liu <chuansheng.liu@intel.com>
Signed-off-by: Zhang Dongxing <dongxing.zhang@intel.com>
Signed-off-by: xiaoming wang <xiaoming.wang@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
(backported from commit b04c46190219a4f845e46a459e3102137b7f6cac)
Conflicts:
	net/ipv4/ping.c
CVE-2014-2851
BugLink: http://bugs.launchpad.net/bugs/1312994
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Signed-off-by: Andy Whitcroft <apw@canonical.com>
2015-01-27 18:18:02 +00:00
Sasha Levin
0dc303299d net/l2tp: don't fall back on UDP [get|set]sockopt
The l2tp [get|set]sockopt() code has fallen back to the UDP functions
for socket option levels != SOL_PPPOL2TP since day one, but that has
never actually worked, since the l2tp socket isn't an inet socket.

As David Miller points out:

  "If we wanted this to work, it'd have to look up the tunnel and then
   use tunnel->sk, but I wonder how useful that would be"

Since this can never have worked so nobody could possibly have depended
on that functionality, just remove the broken code and return -EINVAL.

Reported-by: Sasha Levin <sasha.levin@oracle.com>
Acked-by: James Chapman <jchapman@katalix.com>
Acked-by: David Miller <davem@davemloft.net>
Cc: Phil Turnbull <phil.turnbull@oracle.com>
Cc: Vegard Nossum <vegard.nossum@oracle.com>
Cc: Willy Tarreau <w@1wt.eu>
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
(cherry picked from commit 3cf521f7dc87c031617fd47e4b7aa2593c2f3daf)
CVE-2014-4943
BugLink: http://bugs.launchpad.net/bugs/1341472
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
2014-09-03 12:22:10 -07:00
Linus Torvalds
d665c750d6 net: fix incorrect credentials passing
CVE-2013-1979

[ Upstream commit 83f1b4ba917db5dc5a061a44b3403ddb6e783494 ]

Commit 257b5358b3 ("scm: Capture the full credentials of the scm
sender") changed the credentials passing code to pass in the effective
uid/gid instead of the real uid/gid.

Obviously this doesn't matter most of the time (since normally they are
the same), but it results in differences for suid binaries when the wrong
uid/gid ends up being used.

This just undoes that (presumably unintentional) part of the commit.

Reported-by: Andy Lutomirski <luto@amacapital.net>
Cc: Eric W. Biederman <ebiederm@xmission.com>
Cc: Serge E. Hallyn <serge@hallyn.com>
Cc: David S. Miller <davem@davemloft.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Acked-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
2014-06-26 13:29:01 -06:00
Syam Sidhardhan
40048d87b7 Bluetooth: Remove unused hci_le_ltk_reply()
In this API, we were using sizeof operator for an array
given as function argument, which is invalid.
However this API is not used anywhere.

Signed-off-by: Syam Sidhardhan <s.syam@samsung.com>
Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
(cherry picked from commit e10b9969f217c948c5523045f44eba4d3a758ff0)
2014-01-09 07:43:43 -07:00
Eric Dumazet
db8bac7934 net-fixes: flow_dissector: prevent an infinite loop (CVE-2013-4348)
Jason Wang found that a malicious packet could make skb_flow_dissect()
loop forever. We must check that IP header has a valid ihl to avoid
this loop. It involves IPIP encapsulation and ihl = 0 to trigger.

Given this bug is critical, I cooked a patch before having
a fix in upstream kernel.

Tested:

 Compiled/booted
 Ran some tests on bnx2x and explicitely disabled hardware provided rxhash
 ethtool -K eth1 rxhash off
 ethtool -K eth2 rxhash off

Google-Bug-Id: 11465355
Effort: net-fixes
Change-Id: I813e4dc48cecb05f8edfa218304e1f13fd764323
Signed-off-by: Ed Tam <etam@google.com>
2013-11-14 20:55:00 -08:00
Mathias Krause
17a3bd594f sock_diag: Fix out-of-bounds access to sock_diag_handlers[]
Userland can send a netlink message requesting SOCK_DIAG_BY_FAMILY
with a family greater or equal then AF_MAX -- the array size of
sock_diag_handlers[]. The current code does not test for this
condition therefore is vulnerable to an out-of-bound access opening
doors for a privilege escalation.

Signed-off-by: Mathias Krause <minipli <at> googlemail.com>
2013-09-25 17:01:53 +00:00
Eric Dumazet
eb5636bdf3 net: defer net_secret[] initialization
Instead of feeding net_secret[] at boot time, defer the init
at the point first socket is created.

This permits some platforms to use better entropy sources than
the ones available at boot time.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-09-25 17:01:47 +00:00
Eric Dumazet
ef60c1db56 ipv6: use a stronger hash for tcp
It looks like its possible to open thousands of TCP IPv6
sessions on a server, all landing in a single slot of TCP hash
table. Incoming packets have to lookup sockets in a very
long list.

We should hash all bits from foreign IPv6 addresses, using
a salt and hash mix, not a simple XOR.

inet6_ehashfn() can also separately use the ports, instead
of xoring them.

Reported-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Yuchung Cheng <ycheng@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Iliyan Malchev <malchev@google.com>

Conflicts:
	include/net/ipv6.h
2013-09-25 17:01:33 +00:00
Theodore Ts'o
448f4ec006 net: feed /dev/random with the MAC address when registering a device
commit 7bf2357524408b97fec58344caf7397f8140c3fd upstream.

Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Cc: David Miller <davem@davemloft.net>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ed Tam <etam@google.com>
2013-09-09 17:00:49 -07:00
Mahesh Palivela
06e1b2e84f ieee80211: Rename VHT cap struct
Rename struct ieee80211_vht_capabilities to ieee80211_vht_cap
and renamed its member vht_capabilities_info to vht_cap_info.

Change-Id: I2cfee9b9fa558a9c742d6f8a3827c21d443e9156
CRs-fixed: 452921

Signed-off-by: Mahesh Palivela <maheshp@posedge.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2013-09-04 12:43:32 -07:00
Mahesh Palivela
06be3c8e8b mac80211: VHT (11ac) association
Insert VHT IEs into association frames to allow
mac80211 to connect as a VHT client.

Change-Id: Ifc54bdbe49be3d8b499a764107b30cf3136adf9f
CRs-fixed: 452921

Signed-off-by: Mahesh Palivela <maheshp@posedge.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2013-09-04 12:43:31 -07:00
Mahesh Palivela
3ec3f6584f mac80211: include VHT capability IE in probe requests
Insert the VHT capability IE into probe requests.

Change-Id: I75620090969b46701f1c760baf9c6559a4a1ac2c
CRs-fixed: 452921

Signed-off-by: Mahesh Palivela <maheshp@posedge.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2013-09-04 12:43:31 -07:00
Jouni Malinen
3758e0d5b9 cfg80211: fix VHT TDLS peer AID verification
I (Johannes) accidentally applied the first version of the patch
("Allow TDLS peer AID to be configured for VHT"). Now apply just
the changes between v1 and v2 to get the AID verification and
prefer the new attribute over the old one.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Git-commit: 3d124ea27ae2fc895f81725f0b4c7f3d9c733df4
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-testing.git
Change-Id: I72b465fff381f7c3f6faa3731a5c43375887077c
CRs-fixed: 483290
Signed-off-by: Sunil Dutt <duttus@codeaurora.org>
2013-09-04 12:43:30 -07:00
Jouni Malinen
6eee28bb12 cfg80211: Allow TDLS peer AID to be configured for VHT
VHT uses peer AID in the PARTIAL_AID field in TDLS frames. The
current design for TDLS is to first add a dummy STA entry before
completing TDLS Setup and then update information on this STA
entry based on what was received from the peer during the setup
exchange.

In theory, this could use NL80211_ATTR_STA_AID to set
the peer AID just like this is used in AP mode to set the AID
of an association station. However, existing cfg80211 validation
rules prevent this attribute from being used with set_station
operation. To avoid interoperability issues between different
kernel and user space version combinations, introduce a new
nl80211 attribute for the purpose of setting TDLS peer AID.
This attribute can be used in both the new_station and set_station
operations. It is not supposed to be allowed to change the AID
value during the lifetime of the STA entry, but that validation
is left for drivers to do in the change_station callback.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Git-commit: 5e4b6f5698421d94226cc2f80eae6d613c9acef8
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-testing.git
Change-Id: I1d2f6d2f5a291f91858b45ad004de66a0080f1d2
CRs-fixed: 483290
[duttus@codeaurora.org: backport to 3.4-This commit includes the
changes from following commits in include/linux/nl80211.h to compile
for msm-3.4.
5de17984898c5758fc6ebe08eccea9f4b6548914 :
cfg80211: introduce critical protocol indication from user-space.]
Signed-off-by: Sunil Dutt <duttus@codeaurora.org>
2013-09-04 12:43:29 -07:00
Vasanthakumar Thiagarajan
649820b4c4 cfg80211/nl80211: add API for MAC address ACLs
Add API to enable drivers to implement MAC address based
access control in AP/P2P GO mode. Capable drivers advertise
this capability by setting the maximum number of MAC
addresses in such a list in wiphy->max_acl_mac_addrs.

An initial ACL may be given to the NL80211_CMD_START_AP
command and/or changed later with NL80211_CMD_SET_MAC_ACL.

Black- and whitelists are supported, but not simultaneously.

Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
[rewrite commit log, many cleanups]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Git-commit: 77765eaf5cfb6b8dd98ec8b54b411d74ff6095f1
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
CRs-fixed: 487410
Change-Id: I9593b887941be5efa5e96546ad92cd6c6bf8fb87
[duttus@codeaurora.org: resolved 3.4 backport issues]
Signed-off-by: Sunil Dutt <duttus@codeaurora.org>
2013-09-04 12:43:29 -07:00
Jouni Malinen
9cc28cf8a5 cfg80211: Extend support for IEEE 802.11r Fast BSS Transition
Add NL80211_CMD_UPDATE_FT_IES to support update of FT IEs to the
WLAN driver and NL80211_CMD_FT_EVENT to send FT events from the
WLAN driver. This will carry the target AP's MAC address along
cfg80211: Extend support for IEEE 802.11r Fast BSS Transition

Add NL80211_CMD_UPDATE_FT_IES to support update of FT IEs to the
WLAN driver and NL80211_CMD_FT_EVENT to send FT events from the
WLAN driver. This will carry the target AP's MAC address along
with the relevant Information Elements. This event is used to
report received FT IEs (MDIE, FTIE, RSN IE, TIE, RICIE). These
changes allow FT to be supported with drivers that use an internal
SME instead of user space option (like FT implementation in
wpa_supplicant with mac80211-based drivers).

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Git-commit: 355199e02b831fd4f652c34d6c7673d973da1369
Git-repo: http://git.kernel.org/cgit/linux/kernel/git/linville/
wireless-testing.git/
Change-Id: I439155b3d7bf4df9c45087a4deb6ec0cd7577225
CRs-fixed: 434525
[duttus@codeaurora.org: backport to 3.4-This commit includes the
changes from following commits to compile for jb_2.5.
5314526b1743e8e8614293db7d86e480b4fe9824 : cfg80211: add channel
switch notify event
98104fdeda63d57631c9f89e90a7b83b58fcee40 : cfg80211: add P2P
Device abstraction
f4e583c8935c6f52f9385ee7cfbea8f65c66a737 : nl/cfg80211: add the
NL80211_CMD_SET_MCAST_RATE command
ed44a951c72ab409f932b1c15914488308e86da2 : cfg80211/nl80211: Notify
connection request failure in AP mode
77765eaf5cfb6b8dd98ec8b54b411d74ff6095f1 : cfg80211/nl80211: add
API for MAC address ACLs.
04f39047af2a6df64b763ea5a271db24879d0391 : nl80211/cfg80211: add
radar detection command/event.
3713b4e364effef4b170c97d54528b1cdb16aa6b : nl80211: allow splitting
wiphy information in dumps.
ee2aca343c9aa64d277a75a5df043299dc84cfd9 : cfg80211: add ability
to override VHT capabilities.
355199e02b831fd4f652c34d6c7673d973da1369 : cfg80211: Extend
support for IEEE 802.11r Fast BSS Transition.]
Signed-off-by: Sunil Dutt <duttus@codeaurora.org>
2013-09-04 12:43:28 -07:00
Johannes Berg
08287438fc cfg80211: enable TDLS on P2P client interfaces
There's no reason TDLS should be prevented on P2P client
interfaces, and most of the code already handles it, so
allow adding stations for it.

CRs-fixed: 458139
Change-Id: Id5bdde87aa6988731c91176cb5d54ffde975577c

Reported-by: Jouni Malinen <j@w1.fi>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2013-09-04 12:43:27 -07:00
Johannes Berg
5a3a0420bd cfg80211: fix station change if TDLS isn't supported
Larry noticed (and bisected) that commit df881293c6ba9a12868491a717b25
"cfg80211: Pass TDLS peer's QoS/HT/VHT information during set_station"
broke secure connections. This is is the case only for drivers that
don't support TDLS, where any kind of change, even just the change of
authorized flag that is required for normal operation, was rejected
now. To fix this, remove the checks. I have some patches that will add
proper verification for all the different cases later.

Change-Id: Ieaf0f8a8ab922d42bccdb4957c55b8c3d9463a3f
CRs-fixed: 452921

Cc: Jouni Malinen <j@w1.fi>
Bisected-by: Larry Finger <Larry.Finger@lwfinger.net>
Tested-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2013-09-04 12:43:27 -07:00
Jouni Malinen
8b314df0f1 cfg80211: Pass TDLS peer's QoS/HT/VHT information during set_station
The information of the peer's capabilities is required for the driver
to perform TDLS Peer UAPSD operations. This information of the peer is
passed by the supplicant using NL80211_CMD_SET_STATION command. This
commit enhances the function nl80211_set_station to pass this
information of the peer to the driver in case this command is used
with the TDLS peer STA.

In addition, make the HT/VHT capability configuration handled more
consistently for other STA cases (reject both instead of just HT).

Change-Id: I08635df14f49711b04dfdad0daf8f874a340b5b7
CRs-fixed: 452921

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2013-09-04 12:43:26 -07:00
Jouni Malinen
3f913934a5 cfg80211: Pass station (extended) capability info to kernel
The information of the peer's capabilities and extended capabilities are
required for the driver to perform TDLS Peer UAPSD operations and off
channel operations. This information of the peer is passed from user space
using NL80211_CMD_SET_STATION command. This commit enhances
the function nl80211_set_station to pass the capability information of
the peer to the driver.

Similarly, there may be need for capability information for other modes,
so allow this to be provided with both add_station and change_station.

Change-Id: I1e626512a0f849ae05bbbd24c4e262d303b8f8ea
CRs-fixed: 452921

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2013-09-04 12:43:26 -07:00
Mahesh Palivela
b672fbac86 {nl,cfg}80211: Peer STA VHT caps
To save STAs VHT caps in AP mode

Change-Id: I1930ec05a3e079733c00837c93bda615289fceda
CRs-fixed: 452921

Signed-off-by: Mahesh Palivela <maheshp@posedge.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2013-09-04 12:43:25 -07:00
Mahesh Palivela
0ad86a6a16 cfg80211: allow advertising VHT capabilities
Allow drivers to advertise their VHT capabilities
and export them to userspace via nl80211.

Change-Id: I2d2825a09dfddccca1bd3edacd7fc382d765bea5
CRs-fixed: 452921

Signed-off-by: Mahesh Palivela <maheshp@posedge.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2013-09-04 12:43:25 -07:00
Lorenzo Colitti
29311abbe5 net: ipv6: fix wrong ping_v6_sendmsg return value
[msm/android-3.4 commit 5f0fd6105f491b8b435863e98f7e96d617e3da84]

ping_v6_sendmsg currently returns 0 on success. It should return
the number of bytes written instead.

Bug: 9469865
Change-Id: If1eba8445f207b25ac8c868cbe9814554cdec8df
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-08-21 13:38:13 +09:00
Lorenzo Colitti
8335183246 net: ipv6: add missing lock in ping_v6_sendmsg
[msm/android-3.4 commit 3a018d2e8fc2910e5fb2077cde81cad659e2c7f9]

Bug: 9469865
Change-Id: I5ca9624d68fcbddf6469e5124a14b6fceedb7398
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-08-21 13:37:51 +09:00
Cong Wang
04ca4bbc96 ping: always initialize ->sin6_scope_id and ->sin6_flowinfo
[msm/android-3.4 commit 14e41a18688ec8d52ea3163f7898455b52365854]

If we don't need scope id, we should initialize it to zero.
Same for ->sin6_flowinfo.

Bug: 9469865
Change-Id: I9061c2ee0ffa444f4a7de3d3686b9004053a5760
Cc: Lorenzo Colitti <lorenzo@google.com>
Cc: David S. Miller <davem@davemloft.net>
Signed-off-by: Cong Wang <amwang@redhat.com>
Acked-by: Lorenzo Colitti <lorenzo@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
2013-08-21 13:34:43 +09:00
Lorenzo Colitti
b3044d1e59 net: ipv6: Add IPv6 support to the ping socket.
[msm/android-3.4 commit 1f0675844e3b63a765e5bd32bc5af051ccd951c0]

This adds the ability to send ICMPv6 echo requests without a
raw socket. The equivalent ability for ICMPv4 was added in
2011.

Instead of having separate code paths for IPv4 and IPv6, make
most of the code in net/ipv4/ping.c dual-stack and only add a
few IPv6-specific bits (like the protocol definition) to a new
net/ipv6/ping.c. Hopefully this will reduce divergence and/or
duplication of bugs in the future.

Caveats:

- Setting options via ancillary data (e.g., using IPV6_PKTINFO
  to specify the outgoing interface) is not yet supported.
- There are no separate security settings for IPv4 and IPv6;
  everything is controlled by /proc/net/ipv4/ping_group_range.
- The proc interface does not yet display IPv6 ping sockets
  properly.

Tested with a patched copy of ping6 and using raw socket calls.
Compiles and works with all of CONFIG_IPV6={n,m,y}.

Conflicts:
	net/ipv4/ping.c

Bug: 9469865
Change-Id: I752190e680c009c371d177d8f84af242d3990813
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[lorenzo@google.com: backported to 3.4]
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
[lorenzo@google.com: include export.h to fix missing THIS_MODULE]
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
2013-08-21 13:34:09 +09:00
Pontus Fuchs
4f9f2034ed netfilter: qtaguid: Don't BUG_ON if create_if_tag_stat fails
If create_if_tag_stat fails to allocate memory (GFP_ATOMIC) the
following will happen:

qtaguid: iface_stat: tag stat alloc failed
...
kernel BUG at xt_qtaguid.c:1482!

Signed-off-by: Pontus Fuchs <pontus.fuchs@gmail.com>
2013-08-14 21:45:08 +00:00
JP Abgrall
f5662ac331 netfilter: xt_qtaguid: fix error exit that would keep a spinlock.
qtudev_open() could return with a uid_tag_data_tree_lock held
when an kzalloc(..., GFP_ATOMIC) would fail.
Very unlikely to get triggered AND survive the mayhem of running out of mem.

Signed-off-by: JP Abgrall <jpa@google.com>
2013-08-14 21:44:36 +00:00
JP Abgrall
21481a0b1b netfilter: xt_qtaguid: report only uid tags to non-privileged processes
In the past, a process could only see its own stats (uid-based summary,
and details).
Now we allow any process to see other UIDs uid-based stats, but still
hide the detailed stats.

Change-Id: I7666961ed244ac1d9359c339b048799e5db9facc
Signed-off-by: JP Abgrall <jpa@google.com>
2013-08-14 21:44:11 +00:00
Colin Cross
498b0851c2 af_unix: use freezable blocking calls in read
Avoid waking up every thread sleeping in read call on an AF_UNIX
socket during suspend and resume by calling a freezable blocking
call.  Previous patches modified the freezer to avoid sending
wakeups to threads that are blocked in freezable blocking calls.

This call was selected to be converted to a freezable call because
it doesn't hold any locks or release any resources when interrupted
that might be needed by another freezing task or a kernel driver
during suspend, and is a common site where idle userspace tasks are
blocked.

Change-Id: I788246a76780ea892659526e70be018b18f646c4
Acked-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Colin Cross <ccross@android.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2013-07-12 14:22:59 -07:00
Colin Cross
ac88fa1646 freezer: add unsafe versions of freezable helpers for NFS
NFS calls the freezable helpers with locks held, which is unsafe
and will cause lockdep warnings when 6aa9707 "lockdep: check
that no locks held at freeze time" is reapplied (it was reverted
in dbf520a).  NFS shouldn't be doing this, but it has
long-running syscalls that must hold a lock but also shouldn't
block suspend.  Until NFS freeze handling is rewritten to use a
signal to exit out of the critical section, add new *_unsafe
versions of the helpers that will not run the lockdep test when
6aa9707 is reapplied, and call them from NFS.

In practice the likley result of holding the lock while freezing
is that a second task blocked on the lock will never freeze,
aborting suspend, but it is possible to manufacture a case using
the cgroup freezer, the lock, and the suspend freezer to create
a deadlock.  Silencing the lockdep warning here will allow
problems to be found in other drivers that may have a more
serious deadlock risk, and prevent new problems from being added.

Change-Id: Ia17d32cdd013a6517bdd5759da900970a4427170
Signed-off-by: Colin Cross <ccross@android.com>
Acked-by: Pavel Machek <pavel@ucw.cz>
Acked-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2013-07-12 14:22:55 -07:00
Hannes Frederic Sowa
c8c4d13e41 netlink: validate addr_len on bind
Otherwise an out of bounds read could happen.

Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ed Tam <etam@google.com>
2013-07-03 10:34:22 -07:00
Eric Dumazet
e309be1169 tcp: fix FIONREAD/SIOCINQ
tcp_ioctl() tries to take into account if tcp socket received a FIN
to report correct number bytes in receive queue.

But its flaky because if the application ate the last skb,
we return 1 instead of 0.

Correct way to detect that FIN was received is to test SOCK_DONE.

Reported-by: Elliot Hughes <enh@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Neal Cardwell <ncardwell@google.com>
Cc: Tom Herbert <therbert@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-05-29 12:43:30 -07:00
Iliyan Malchev
0153c38c46 update net/wireless/db.txt
http://git.kernel.org/cgit/linux/kernel/git/linville/wireless-regdb.git

	commit bb99560ff69c44c30e47416501639e37014689c3
	Author: John W. Linville <linville@tuxdriver.com>
	Date:   Wed Feb 13 14:36:58 2013 -0500
	    wireless-regdb: update regulatory.bin based on preceding changes.

Signed-off-by: Iliyan Malchev <malchev@google.com>
2013-05-16 15:16:13 -07:00
Sameer Thalappil
1fd2476da5 nl80211/cfg80211: add VHT MCS support
Add support for reporting and calculating VHT MCSes.

Note that I'm not completely sure that the bitrate
calculations are correct, nor that they can't be
simplified.

Change-Id: Id4c132850a85ff59f0fc16396763ed717689bec0
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Git-commit: db9c64cf8d9d3fcbc34b09d037f266d1fc9f928c
Git-repo:
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Sameer Thalappil <sameert@codeaurora.org>
2013-04-18 16:09:30 -07:00
JP Abgrall
99a0ea958a netfilter: qtaguid: rate limit some of the printks
Some of the printks are in the packet handling path.
We now ratelimit the very unlikely errors to avoid
kmsg spamming.

Signed-off-by: JP Abgrall <jpa@google.com>
2013-04-18 16:08:43 -07:00
JP Abgrall
f8f399c01c netfilter: xt_qtaguid: Allow tracking loopback
In the past it would always ignore interfaces with loopback addresses.
Now we just treat them like any other.
This also helps with writing tests that check for the presence
of the qtaguid module.

Signed-off-by: JP Abgrall <jpa@google.com>
2013-04-18 16:08:43 -07:00
Lorenzo Colitti
8440676a47 net: ipv6: Don't purge default router if accept_ra=2
Setting net.ipv6.conf.<interface>.accept_ra=2 causes the kernel
to accept RAs even when forwarding is enabled. However, enabling
forwarding purges all default routes on the system, breaking
connectivity until the next RA is received. Fix this by not
purging default routes on interfaces that have accept_ra=2.

Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
Acked-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Iliyan Malchev <malchev@google.com>
2013-04-18 16:08:06 -07:00
Devin Kim
18c94962dc Fix build for GCC 4.7
Change-Id: I4e9265369174d82b55fd435bc47887972f99c9d4
2013-03-15 17:13:02 -07:00
JP Abgrall
4eff119584 netfilter: xt_qtaguid: extend iface stat to report protocols
In the past the iface_stat_fmt would only show global bytes/packets
for the skb-based numbers.
For stall detection in userspace, distinguishing tcp vs other protocols
makes it easier.
Now we report
  ifname total_skb_rx_bytes total_skb_rx_packets total_skb_tx_bytes
  total_skb_tx_packets {rx,tx}_{tcp,udp,ohter}_{bytes,packets}

Bug: 6818637
Signed-off-by: JP Abgrall <jpa@google.com>
2013-03-15 17:09:47 -07:00
JP Abgrall
997fd7c03d netfilter: xt_qtaguid: remove AID_* dependency for access control
qtaguid limits what can be done with /ctrl and /stats based on group
membership.
This changes removes AID_NET_BW_STATS and AID_NET_BW_ACCT, and picks
up the groups from the gid of the matching proc entry files.

Signed-off-by: JP Abgrall <jpa@google.com>
Change-Id: I42e477adde78a12ed5eb58fbc0b277cdaadb6f94
2013-03-15 17:09:46 -07:00
Bhakthavatsala Raghavendra
30c3f2ef61 Revert "Bluetooth: Avoid re-authentication for secure high connections"
This reverts commit 45c9e8141e54a691180c55ed9e242302a74224a8.

Change-Id: Iee644f37c2108013654e99d82f63101db3da009e
Signed-off-by: Bhakthavatsala Raghavendra <braghave@codeaurora.org>
2013-03-15 17:08:19 -07:00
Bhakthavatsala Raghavendra
296f7ed251 Bluetooth: Introduce new security level
Define new security level BT_SECURITY_VERY_HIGH
for BT-SAP secuirty requirements

Change-Id: Iee1f60def34d64174c71934ecf55319cee087c13
Signed-off-by: Bhakthavatsala Raghavendra <braghave@codeaurora.org>
2013-03-15 17:08:18 -07:00
Duy Truong
04e554807c Update copyright to The Linux Foundation
Change-Id: Ibead64ce2e901dede2ddd1b86088b88f2350ce92
Signed-off-by: Duy Truong <dtruong@codeaurora.org>
2013-03-15 17:07:39 -07:00
Bhakthavatsala Raghavendra
92386d1c63 Bluetooth: Validate the hci connection before data transfer
Avoid the possible crash due to Bluetooth connection loss while data
trasfer is in progress. Bluetooth connection loss might happen due to
turn off of Bluetooth or reset of device when there is an active data
transfer over Bluetooth.

Change-Id: Ib15a9ac2df3a250d279774d6e45f1e37c9ea1cc0
CRs-fixed: 375238
Signed-off-by: Bhakthavatsala Raghavendra <braghave@codeaurora.org>
Signed-off-by: Mallikarjuna GB <gbmalli@codeaurora.org>
2013-03-15 17:06:41 -07:00
Mallikarjuna GB
74db0bf24d Bluetooth: GAP: Read the clock offset on ACL connection complete
Keep the Clock offset valid for one Hour and read it again after
connection complete so that we have most recent value. This helps
for faster ACL connections.

CRs-fixed: 430132
Change-Id: I1526878a7365f9cc0c654e0af6c4dd214fac4cd8
Signed-off-by: Mallikarjuna GB <gbmalli@codeaurora.org>
2013-03-15 17:06:41 -07:00
Archana Ramachandran
f028fff7fe Bluetooth: Fix for LE cancel Create Connection not working
Added management method to send LE cancel create connection
HCI command

CRs-fixed: 366284
Change-Id: I17a75ecf4ecaa32cab7e3a4cb8beb8cc4b4580c4
Signed-off-by: Archana Ramachandran <archanar@codeaurora.org>
Signed-off-by: Mallikarjuna GB <gbmalli@codeaurora.org>
2013-03-15 17:06:40 -07:00
Srinivas Krovvidi
441322338e Bluetooth: Avoid re-authentication for secure high connections
The re-authentication code changes are added to mandate 16 digit
PIN Key for SECURE_HIGH connections. But only SAP profile needs
16 digit key, not all the profiles that register with SECURITY
HIGH. Avoid the code to mandate 16 digit key.

Change-Id: Iffc02841e52b8c0b2f6e2495b27df26869e72999
Signed-off-by: Srinivas Krovvidi <skrovvid@codeaurora.org>
Signed-off-by: Ram Mohan Korukonda <rkorukon@codeaurora.org>
Signed-off-by: Mallikarjuna GB <gbmalli@codeaurora.org>
2013-03-15 17:06:40 -07:00
Mallikarjuna GB
dd30df71f5 Bluetooth: GAP: Dont allow role switch when there is another ACL
The scatternet scenarios are difficult to be handled in SOC. This
change not to allow role switch during outgoing ACL connections
will avoid scatternet scenarios.

CRs-fixed: 392836
Change-Id: I5769b71879ea951755e115424fb2b5b504e95784
Signed-off-by: Mallikarjuna GB <gbmalli@codeaurora.org>
2013-03-15 17:06:39 -07:00
Sumit Bajpai
505bdc3bd1 Bluetooth: hidp: safely acquire hci connection
Claim device lock to safely enumerate hci connection list and bump
hci connection proxy device ref count simultaneously.

Also it prevents kernel crash due to null pointer
conn->hdev in deleting conn entry from sysfs.

CRs-Fixed: 446403
Change-Id: I5ec4283d359f95e47711dff171d0619b15263349
Signed-off-by: Sumit Bajpai <sbajpai@codeaurora.org>
Signed-off-by: Mallikarjuna GB <gbmalli@codeaurora.org>
2013-03-15 17:05:33 -07:00