linux-toradex.git/net/netlink, branch v3.0.3

net: convert %p usage to %pK

2011-05-24T05:13:12+00:00

The %pK format specifier is designed to hide exposed kernel pointers,
specifically via /proc interfaces.  Exposing these pointers provides an
easy target for kernel write vulnerabilities, since they reveal the
locations of writable structures containing easily triggerable function
pointers.  The behavior of %pK depends on the kptr_restrict sysctl.

If kptr_restrict is set to 0, no deviation from the standard %p behavior
occurs.  If kptr_restrict is set to 1, the default, if the current user
(intended to be a reader via seq_printf(), etc.) does not have CAP_SYSLOG
(currently in the LSM tree), kernel pointers using %pK are printed as 0's.
 If kptr_restrict is set to 2, kernel pointers using %pK are printed as
0's regardless of privileges.  Replacing with 0's was chosen over the
default "(null)", which cannot be parsed by userland %p, which expects
"(nil)".

The supporting code for kptr_restrict and %pK are currently in the -mm
tree.  This patch converts users of %p in net/ to %pK.  Cases of printing
pointers to the syslog are not covered, since this would eliminate useful
information for postmortem debugging and the reading of the syslog is
already optionally protected by the dmesg_restrict sysctl.

Signed-off-by: Dan Rosenberg 
Cc: James Morris 
Cc: Eric Dumazet 
Cc: Thomas Graf 
Cc: Eugene Teo 
Cc: Kees Cook 
Cc: Ingo Molnar 
Cc: David S. Miller 
Cc: Peter Zijlstra 
Cc: Eric Paris 
Signed-off-by: Andrew Morton 
Signed-off-by: David S. Miller

net,rcu: convert call_rcu(listeners_free_rcu) to kfree_rcu()

2011-05-08T05:50:51+00:00

The rcu callback listeners_free_rcu() just calls a kfree(),
so we use kfree_rcu() instead of the call_rcu(listeners_free_rcu).

Signed-off-by: Lai Jiangshan 
Acked-by: David S. Miller 
Signed-off-by: Paul E. McKenney 
Reviewed-by: Josh Triplett

Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

2011-03-04T05:27:42+00:00

Conflicts:
	drivers/net/bnx2x/bnx2x.h

netlink: kill eff_cap from struct netlink_skb_parms

2011-03-03T21:32:07+00:00

Netlink message processing in the kernel is synchronous these days,
capabilities can be checked directly in security_netlink_recv() from
the current process.

Signed-off-by: Patrick McHardy 
Reviewed-by: James Morris 
[chrisw: update to include pohmelfs and uvesafb]
Signed-off-by: Chris Wright 
Signed-off-by: David S. Miller

netlink: kill loginuid/sessionid/sid members from struct netlink_skb_parms

2011-03-03T18:55:40+00:00

Netlink message processing in the kernel is synchronous these days, the
session information can be collected when needed.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

netlink: handle errors from netlink_dump()

2011-02-28T20:18:12+00:00

netlink_dump() may failed, but nobody handle its error.
It generates output data, when a previous portion has been returned to
user space. This mechanism works when all data isn't go in skb. If we
enter in netlink_recvmsg() and skb is absent in the recv queue, the
netlink_dump() will not been executed. So if netlink_dump() is failed
one time, the new data never appear and the reader will sleep forever.

netlink_dump() is called from two places:

1. from netlink_sendmsg->...->netlink_dump_start().
   In this place we can report error directly and it will be returned
   by sendmsg().

2. from netlink_recvmsg
   There we can't report error directly, because we have a portion of
   valid output data and call netlink_dump() for prepare the next portion.
   If netlink_dump() is failed, the socket will be mark as error and the
   next recvmsg will be failed.

Signed-off-by: Andrey Vagin 
Signed-off-by: David S. Miller

Revert "netlink: test for all flags of the NLM_F_DUMP composite"

2011-01-19T21:34:20+00:00

This reverts commit 0ab03c2b1478f2438d2c80204f7fef65b1bca9cf.

It breaks several things including the avahi daemon.

Signed-off-by: David S. Miller

netlink: test for all flags of the NLM_F_DUMP composite

2011-01-10T00:25:03+00:00

Due to NLM_F_DUMP is composed of two bits, NLM_F_ROOT | NLM_F_MATCH,
when doing "if (x & NLM_F_DUMP)", it tests for _either_ of the bits
being set. Because NLM_F_MATCH's value overlaps with NLM_F_EXCL,
non-dump requests with NLM_F_EXCL set are mistaken as dump requests.

Substitute the condition to test for _all_ bits being set.

Signed-off-by: Jan Engelhardt 
Acked-by: Pablo Neira Ayuso 
Signed-off-by: David S. Miller

netlink: fix netlink_change_ngroups()

2010-10-24T23:25:39+00:00

commit 6c04bb18ddd633 (netlink: use call_rcu for netlink_change_ngroups)
used a somewhat convoluted and racy way to perform call_rcu().

The old block of memory is freed after a grace period, but the rcu_head
used to track it is located in new block.

This can clash if we call two times or more netlink_change_ngroups(),
and a block is freed before another. call_rcu() called on different cpus
makes no guarantee in order of callbacks.

Fix this using a more standard way of handling this : Each block of
memory contains its own rcu_head, so that no 'use after free' can
happens.

Signed-off-by: Eric Dumazet 
CC: Johannes Berg 
CC: Paul E. McKenney 
Signed-off-by: David S. Miller

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next-2.6 into for-davem

2010-10-08T19:39:28+00:00

Conflicts:
	Documentation/feature-removal-schedule.txt
	drivers/net/wireless/ipw2x00/ipw2200.c