Linux kernel stable tree (mirror) https://git.radix-linux.su/kernel/linux.git/atom?h=v3.2.15 2012-01-26T00:13:19+00:00 2012-01-26T00:13:19+00:00 Ian Campbell Ian.Campbell@citrix.com 2012-01-04T09:34:49+00:00 urn:sha1:ee1f334f2f580ff09f7c1f83be46aa2bbb4d5f6a commit 9e7860cee18241633eddb36a4c34c7b61d8cecbc upstream. Haogang Chen found out that: There is a potential integer overflow in process_msg() that could result in cross-domain attack. body = kmalloc(msg->hdr.len + 1, GFP_NOIO | __GFP_HIGH); When a malicious guest passes 0xffffffff in msg->hdr.len, the subsequent call to xb_read() would write to a zero-length buffer. The other end of this connection is always the xenstore backend daemon so there is no guest (malicious or otherwise) which can do this. The xenstore daemon is a trusted component in the system. However this seem like a reasonable robustness improvement so we should have it. And Ian when read the API docs found that: The payload length (len field of the header) is limited to 4096 (XENSTORE_PAYLOAD_MAX) in both directions. If a client exceeds the limit, its xenstored connection will be immediately killed by xenstored, which is usually catastrophic from the client's point of view. Clients (particularly domains, which cannot just reconnect) should avoid this. so this patch checks against that instead. This also avoids a potential integer overflow pointed out by Haogang Chen. Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Cc: Haogang Chen <haogangchen@gmail.com> Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> 2011-12-19T14:30:35+00:00 Konrad Rzeszutek Wilk konrad.wilk@oracle.com 2011-12-19T14:30:35+00:00 urn:sha1:12275dd4b747f5d87fa36229774d76bca8e63068 This reverts commit ddacf5ef684a655abe2bb50c4b2a5b72ae0d5e05. As when booting the kernel under Amazon EC2 as an HVM guest it ends up hanging during startup. Reverting this we loose the fix for kexec booting to the crash kernels. Fixes Canonical BZ #901305 (http://bugs.launchpad.net/bugs/901305) Tested-by: Alessandro Salvatori <sandr8@gmail.com> Reported-by: Stefan Bader <stefan.bader@canonical.com> Acked-by: Ian Campbell <Ian.Campbell@citrix.com> Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> 2011-11-16T17:13:42+00:00 Daniel De Graaf dgdegra@tycho.nsa.gov 2011-10-19T22:05:27+00:00 urn:sha1:5f76d7078ce784916d55fc4e1bb0a42985f085a6 In 5fbdc10395cd500d6ff844825a918c4e6f38de37 the XEN_PLATFORM_PCI config option was removed, but references in header files remained. Clean up those references. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> 2011-11-07T04:15:05+00:00 Linus Torvalds torvalds@linux-foundation.org 2011-11-07T04:15:05+00:00 urn:sha1:403299a8515c56db58454c57712f4dc96d6c1fde * 'upstream/xen-settime' of git://git.kernel.org/pub/scm/linux/kernel/git/jeremy/xen: xen/dom0: set wallclock time in Xen xen: add dom0_op hypercall xen/acpi: Domain0 acpi parser related platform hypercall 2011-11-07T03:44:47+00:00 Linus Torvalds torvalds@linux-foundation.org 2011-11-07T03:44:47+00:00 urn:sha1:32aaeffbd4a7457bf2f7448b33b5946ff2a960eb * 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux: (230 commits) Revert "tracing: Include module.h in define_trace.h" irq: don't put module.h into irq.h for tracking irqgen modules. bluetooth: macroize two small inlines to avoid module.h ip_vs.h: fix implicit use of module_get/module_put from module.h nf_conntrack.h: fix up fallout from implicit moduleparam.h presence include: replace linux/module.h with "struct module" wherever possible include: convert various register fcns to macros to avoid include chaining crypto.h: remove unused crypto_tfm_alg_modname() inline uwb.h: fix implicit use of asm/page.h for PAGE_SIZE pm_runtime.h: explicitly requires notifier.h linux/dmaengine.h: fix implicit use of bitmap.h and asm/page.h miscdevice.h: fix up implicit use of lists and types stop_machine.h: fix implicit use of smp.h for smp_processor_id of: fix implicit use of errno.h in include/linux/of.h of_platform.h: delete needless include <linux/module.h> acpi: remove module.h include from platform/aclinux.h miscdevice.h: delete unnecessary inclusion of module.h device_cgroup.h: delete needless include <linux/module.h> net: sch_generic remove redundant use of <linux/module.h> net: inet_timewait_sock doesnt need <linux/module.h> ... Fix up trivial conflicts (other header files, and removal of the ab3550 mfd driver) in - drivers/media/dvb/frontends/dibx000_common.c - drivers/media/video/{mt9m111.c,ov6650.c} - drivers/mfd/ab3550-core.c - include/linux/dmaengine.h 2011-11-07T02:31:36+00:00 Linus Torvalds torvalds@linux-foundation.org 2011-11-07T02:31:36+00:00 urn:sha1:06d381484fe8fb1ba2996c22e89595a273e3634c * 'stable/vmalloc-3.2' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen: net: xen-netback: use API provided by xenbus module to map rings block: xen-blkback: use API provided by xenbus module to map rings xen: use generic functions instead of xen_{alloc, free}_vm_area() 2011-11-05T00:22:14+00:00 Linus Torvalds torvalds@linux-foundation.org 2011-11-05T00:22:14+00:00 urn:sha1:3d0a8d10cfb4cc3d1877c29a866ee7d8a46aa2fa * 'for-3.2/drivers' of git://git.kernel.dk/linux-block: (30 commits) virtio-blk: use ida to allocate disk index hpsa: add small delay when using PCI Power Management to reset for kump cciss: add small delay when using PCI Power Management to reset for kump xen/blkback: Fix two races in the handling of barrier requests. xen/blkback: Check for proper operation. xen/blkback: Fix the inhibition to map pages when discarding sector ranges. xen/blkback: Report VBD_WSECT (wr_sect) properly. xen/blkback: Support 'feature-barrier' aka old-style BARRIER requests. xen-blkfront: plug device number leak in xlblk_init() error path xen-blkfront: If no barrier or flush is supported, use invalid operation. xen-blkback: use kzalloc() in favor of kmalloc()+memset() xen-blkback: fixed indentation and comments xen-blkfront: fix a deadlock while handling discard response xen-blkfront: Handle discard requests. xen-blkback: Implement discard requests ('feature-discard') xen-blkfront: add BLKIF_OP_DISCARD and discard request struct drivers/block/loop.c: remove unnecessary bdev argument from loop_clr_fd() drivers/block/loop.c: emit uevent on auto release drivers/block/cpqarray.c: use pci_dev->revision loop: always allow userspace partitions and optionally support automatic scanning ... Fic up trivial header file includsion conflict in drivers/block/loop.c 2011-11-01T00:30:54+00:00 Joe Perches joe@perches.com 2011-11-01T00:11:33+00:00 urn:sha1:b9075fa968a0a4347aef35e235e2995c0e57dddd Standardize the style for compiler based printf format verification. Standardized the location of __printf too. Done via script and a little typing. $ grep -rPl --include=*.[ch] -w "__attribute__" * | \ grep -vP "^(tools|scripts|include/linux/compiler-gcc.h)" | \ xargs perl -n -i -e 'local $/; while (<>) { s/\b__attribute__\s*\(\s*\(\s*format\s*\(\s*printf\s*,\s*(.+)\s*,\s*(.+)\s*\)\s*\)\s*\)/__printf($1, $2)/g ; print; }' [akpm@linux-foundation.org: revert arch bits] Signed-off-by: Joe Perches <joe@perches.com> Cc: "Kirill A. Shutemov" <kirill@shutemov.name> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> 2011-10-31T23:32:11+00:00 Paul Gortmaker paul.gortmaker@windriver.com 2011-07-10T17:22:07+00:00 urn:sha1:63c9744b9a53b8113b6d33ca361452b28f2ec391 Things like THIS_MODULE and EXPORT_SYMBOL were simply everywhere because module.h was also everywhere. But we are fixing the latter. So we need to call out the real users in advance. Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> 2011-10-25T07:19:36+00:00 Linus Torvalds torvalds@linux-foundation.org 2011-10-25T07:19:36+00:00 urn:sha1:04a8752485e450124f92c9b931d268b48d75650a * 'stable/drivers-3.2' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen: xenbus: don't rely on xen_initial_domain to detect local xenstore xenbus: Fix loopback event channel assuming domain 0 xen/pv-on-hvm:kexec: Fix implicit declaration of function 'xen_hvm_domain' xen/pv-on-hvm kexec: add xs_reset_watches to shutdown watches from old kernel xen/pv-on-hvm kexec: update xs_wire.h:xsd_sockmsg_type from xen-unstable xen/pv-on-hvm kexec+kdump: reset PV devices in kexec or crash kernel xen/pv-on-hvm kexec: rebind virqs to existing eventchannel ports xen/pv-on-hvm kexec: prevent crash in xenwatch_thread() when stale watch events arrive * 'stable/drivers.bugfixes-3.2' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen: xen/pciback: Check if the device is found instead of blindly assuming so. xen/pciback: Do not dereference psdev during printk when it is NULL. xen: remove XEN_PLATFORM_PCI config option xen: XEN_PVHVM depends on PCI xen/pciback: double lock typo xen/pciback: use mutex rather than spinlock in vpci backend xen/pciback: Use mutexes when working with Xenbus state transitions. xen/pciback: miscellaneous adjustments xen/pciback: use mutex rather than spinlock in passthrough backend xen/pciback: use resource_size() * 'stable/pci.fixes-3.2' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen: xen/pci: support multi-segment systems xen-swiotlb: When doing coherent alloc/dealloc check before swizzling the MFNs. xen/pci: make bus notifier handler return sane values xen-swiotlb: fix printk and panic args xen-swiotlb: Fix wrong panic. xen-swiotlb: Retry up three times to allocate Xen-SWIOTLB xen-pcifront: Update warning comment to use 'e820_host' option.