Commit Graph

39553 Commits

Author SHA1 Message Date
Franck Bui-Huu
99a10a60ba [PATCH] Fix up mmap_kmem
vma->vm_pgoff is an pfn _offset_ relatif to the begining
of the memory start. The previous code was doing at first:

	vma->vm_pgoff << PAGE_SHIFT

which results into a wrong physical address since some
platforms have a physical mem start that can be different
from 0. After that the previous call __pa() on this
wrong physical address, however __pa() is used to convert
a _virtual_ address into a physical one.

This patch rewrites this convertion. It calculates the
pfn of PAGE_OFFSET which is the pfn of the mem start
then it adds the vma->vm_pgoff to it.

It also uses virt_to_phys() instead of __pa() since the
latter shouldn't be used by drivers.

Signed-off-by: Franck Bui-Huu <fbuihuu@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-10-13 08:35:38 -07:00
Linus Torvalds
a5344a9555 Merge git://git.kernel.org/pub/scm/linux/kernel/git/steve/gfs2-2.6-fixes
* git://git.kernel.org/pub/scm/linux/kernel/git/steve/gfs2-2.6-fixes:
  [GFS2] Update git tree name/location
  [DLM] fix iovec length in recvmsg
  [GFS2] Pass the correct value to kunmap_atomic
  [GFS2] Fix bug where lock not held
  [DLM] Kconfig: don't show an empty DLM menu
  [GFS2] Fix uninitialised variable
  [GFS2] Fix a size calculation error
2006-10-13 08:30:33 -07:00
Linus Torvalds
411fdc1a71 Merge master.kernel.org:/pub/scm/linux/kernel/git/jejb/voyager-2.6
* master.kernel.org:/pub/scm/linux/kernel/git/jejb/voyager-2.6:
  [VOYAGER] fix up ptregs removal mess
  [VOYAGER] fix up attribute packed specifiers in voyager.h
  [VOYAGER] fix genirq mess
2006-10-13 08:14:41 -07:00
Petr Vandrovec
7f14daa19e [PATCH] Get core dump code to work...
The file based core dump code was broken by pipe changes - a relative
llseek returns the absolute file position on success, not the relative
one, so dump_seek() always failed when invoked with non-zero current
position.

Only success/failure can be tested with relative lseek, we have to trust
kernel that on success we've got right file offset.  With this fix in
place I have finally real core files instead of 1KB fragments...

Signed-off-by: Petr Vandrovec <petr@vandrovec.name>
[ Cleaned it up a bit while here - use SEEK_CUR instead of hardcoding 1 ]
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-10-13 08:13:34 -07:00
Linus Torvalds
12e36b2f41 Merge git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6
* git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6: (27 commits)
  [CIFS] Missing flags2 for DFS
  [CIFS] Workaround incomplete byte length returned by some
  [CIFS] cifs Kconfig: don't select CONNECTOR
  [CIFS] Level 1 QPathInfo needed for proper OS2 support
  [CIFS] fix typo in previous patch
  [CIFS] Fix old DOS time conversion to handle timezone
  [CIFS] Do not need to adjust for Jan/Feb for leap day
  [CIFS] Fix leaps year calculation for years after 2100
  [CIFS] readdir (ffirst) enablement of accurate timestamps from legacy servers
  [CIFS] Fix compiler warning with previous patch
  [CIFS] Fix typo
  [CIFS] Allow for 15 minute TZs (e.g. Nepal) and be more explicit about
  [CIFS] Fix readdir of large directories for backlevel servers
  [CIFS] Allow LANMAN21 support even in both POSIX non-POSIX path
  [CIFS] Make use of newer QFSInfo dependent on capability bit instead of
  [CIFS] Do not send newer QFSInfo to legacy servers which can not support it
  [CIFS] Fix typo in name of new cifs_show_stats
  [CIFS] Rename server time zone field
  [CIFS] Handle legacy servers which return undefined time zone
  [CIFS] CIFS support for /proc/<pid>/mountstats part 1
  ...

Manual conflict resolution in fs/cifs/connect.c
2006-10-13 08:09:29 -07:00
James Bottomley
81c06b10bc [VOYAGER] fix up ptregs removal mess
Apparently whoever converted voyager never actually checked that the
patch would compile ...

Remove as much of the pt_regs references as possible and move the
remaining ones into line with what's in x86 generic.

Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2006-10-12 22:25:03 -05:00
James Bottomley
58f07943b0 [VOYAGER] fix up attribute packed specifiers in voyager.h
The old style (attribute on each structure entry) never really worked.
Move it to an attribute per structure

Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2006-10-12 22:23:18 -05:00
James Bottomley
c771746ef6 [VOYAGER] fix genirq mess
The implementation of genirq in x86 completely broke voyager (and
presumably visws).  Since it's plugged into so much of the x86
infrastructure, you can't expect it to work unconverted.

This patch introduces a voyager IRQ handler type and switches voyager
to the genirq infrastructure.

Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2006-10-12 22:21:16 -05:00
Steve French
1a4e15a04e [CIFS] Missing flags2 for DFS
Partly suggested by Igor Mammedov

Signed-off-by: Steve French <sfrench@us.ibm.com>
2006-10-12 21:33:51 +00:00
Steven Whitehouse
370298e2e6 [GFS2] Update git tree name/location
The plan is to have two trees. One for bug fixes to be sent on a
regular basis (-fixes) and another called -nmw which will contain items
queued for the next merge window (hence the name). The -nmw tree
will come & go according to need.

Signed-off-by: Steven Whitehouse <swhiteho@redhat.com>
2006-10-12 17:11:53 -04:00
Patrick Caulfield
4c5e1b1a8c [DLM] fix iovec length in recvmsg
The DLM always passes the iovec length as 1, this is wrong when the circular
buffer wraps round.

Signed-Off-By: Patrick Caulfield <pcaulfie@redhat.com>
Signed-off-by: Steven Whitehouse <swhiteho@redhat.com>
2006-10-12 17:11:33 -04:00
Russell Cattelan
c312c4fdc8 [GFS2] Pass the correct value to kunmap_atomic
Pass kaddr rather than (incorrect) struct page to kunmap_atomic.

Signed-off-by: Russell Cattelan <cattelan@redhat.com>
Signed-off-by: Steven Whitehouse <swhiteho@redhat.com>
2006-10-12 17:11:13 -04:00
Steven Whitehouse
fe1a698ffe [GFS2] Fix bug where lock not held
The log lock needs to be held when manipulating the counter
for the number of free journal blocks.

Signed-off-by: Steven Whitehouse <swhiteho@redhat.com>
2006-10-12 17:10:55 -04:00
Adrian Bunk
1ee48af22e [DLM] Kconfig: don't show an empty DLM menu
Don't show an empty "Distributed Lock Manager" menu if IP_SCTP=n.

Reported by Dmytro Bagrii in kernel Bugzilla #7268.

Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: David Teigland <teigland@redhat.com>
Signed-off-by: Patrick Caulfield <pcaulfie@redhat.com>
Signed-off-by: Steven Whitehouse <swhiteho@redhat.com>
2006-10-12 17:10:35 -04:00
Steven Whitehouse
f5c54804d9 [GFS2] Fix uninitialised variable
This fixes a bug where, in certain cases an uninitialised variable
could cause a dereference of a NULL pointer in gfs2_commit_write().
Also a typo in a comment is fixed at the same time.

Signed-off-by: Steven Whitehouse <swhiteho@redhat.com>
2006-10-12 17:10:15 -04:00
Russell Cattelan
52ae7b7935 [GFS2] Fix a size calculation error
Fix a size calculation error.
The size was incorrect being computed as a
negative length and then being passed to an
unsigned parameter.

This in turn would cause the allocator to
think it needed enough meta data to store
a gigabyte file for every file created.

Signed-off-by: Russell Cattelan <cattelan@redhat.com>
Signed-off-by: Steven Whitehouse <swhiteho@redhat.com>
2006-10-12 17:09:54 -04:00
Al Viro
1baaf0b424 [PATCH] more kernel_execve() fallout (sbus)
drivers/sbus/char stuff using kernel_execve() needs linux/syscalls.h
now; includes trimmed, while we are at it.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-10-12 12:36:55 -07:00
Ravikiran Thirumalai
734c4c6739 [PATCH] Fix build breakage with CONFIG_X86_VSMP
Kernel build breaks with CONFIG_X86_VSMP.  Probably due to some header
file cleanups in 2.6.19-rc1.

Signed-off-by: Ravikiran Thirumalai <kiran@scalex86.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-10-12 12:25:27 -07:00
Al Viro
78b93f2db1 [PATCH] fixing includes in alpha_ksyms.c
kernel_execve() fallout

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-10-12 12:25:27 -07:00
Steve French
d103e164be [CIFS] Workaround incomplete byte length returned by some
servers on small SMB responses

Signed-off-by: Steve French <sfrench@us.ibm.com>
2006-10-12 17:49:24 +00:00
Linus Torvalds
9eb2007488 Merge master.kernel.org:/pub/scm/linux/kernel/git/lethal/sh-2.6
* master.kernel.org:/pub/scm/linux/kernel/git/lethal/sh-2.6:
  sh: SH-4A UBC support
  sh: interrupt exception handling rework
  sh: Default enable R7780RP IRQs.
  sh: Zero-out coherent buffer in consistent_alloc().
  sh: Convert IPR-IRQ to IRQ chip.
  sh: Convert INTC2 IRQ handler to irq_chip.
  sh: Fix pr_debug statements for sh4
  sh: Convert r7780rp IRQ handler to IRQ chip.
  sh: Updates for IRQ handler changes.
  sh: Kill off timer_ops get_frequency().
  sh: First step at generic timeofday support.
2006-10-12 08:33:23 -07:00
Jens Axboe
8770c018da [PATCH] ide-cd: one more missing REQ_TYPE_CMD_ATA check
Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
2006-10-12 17:24:52 +02:00
Andrew Morton
230a03950e [CIFS] cifs Kconfig: don't select CONNECTOR
`select' is a bit obnoxious: the option keeps on coming back
and it's hard to work out what to do to make it go away again.
The use of `depends on' is preferred (although it has
usability problems too..)

Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Steve French <sfrench@us.ibm.com>
2006-10-12 15:07:55 +00:00
Linus Torvalds
da79cbae39 Merge branch 'for-linus' of git://brick.kernel.dk/data/git/linux-2.6-block
* 'for-linus' of git://brick.kernel.dk/data/git/linux-2.6-block:
  [PATCH] block layer: ioprio_best function fix
  [PATCH] ide-cd: fix breakage with internally queued commands
  [PATCH] block layer: elv_iosched_show should get elv_list_lock
  [PATCH] splice: fix pipe_to_file() ->prepare_write() error path
  [PATCH] block layer: elevator_find function cleanup
  [PATCH] elevator: elevator_type member not used
2006-10-12 07:49:46 -07:00
Linus Torvalds
9ff4680e99 Merge master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6
* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
  [PKT_SCHED] sch_htb: use rb_first() cleanup
  [RTNETLINK]: Fix use of wrong skb in do_getlink()
  [DECNET]: Fix sfuzz hanging on 2.6.18
  [NET]: Do not memcmp() over pad bytes of struct flowi.
  [NET]: Introduce protocol-specific destructor for time-wait sockets.
  [NET]: Use typesafe inet_twsk() inline function instead of cast.
  [NET]: Use hton{l,s}() for non-initializers.
  [TCP]: Use TCPOLEN_TSTAMP_ALIGNED macro instead of magic number.
  [IPV6]: Seperate sit driver to extra module (addrconf.c changes)
  [IPV6]: Seperate sit driver to extra module
  [NET]: File descriptor loss while receiving SCM_RIGHTS
  [SCTP]: Fix the RX queue size shown in /proc/net/sctp/assocs output.
  [SCTP]: Fix receive buffer accounting.
  SELinux: Bug fix in polidydb_destroy
  IPsec: fix handling of errors for socket policies
  IPsec: correct semantics for SELinux policy matching
  IPsec: propagate security module errors up from flow_cache_lookup
  NetLabel: use SECINITSID_UNLABELED for a base SID
  NetLabel: fix a cache race condition
2006-10-12 07:38:59 -07:00
Linus Torvalds
83d3d3c524 Merge master.kernel.org:/pub/scm/linux/kernel/git/davem/sparc-2.6
* master.kernel.org:/pub/scm/linux/kernel/git/davem/sparc-2.6:
  [SPARC32]: Fix sparc32 modpost warnings.
  [SPARC32]: Fix sparc32 modpost warnings with sunzilog
  [SPARC32]: Mark srmmu_nocache_init as __init.
  [SPARC32]: pcic.c needs asm/irq_regs.h
2006-10-12 07:37:59 -07:00
Eric W. Biederman
994bd4f9f5 [PATCH] x86_64 irq: Properly update vector_irq
This patch fixes my one line thinko where I was clearing
the vector_irq entries on the wrong cpus.

Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-10-12 07:37:30 -07:00
Vasily Tarasov
d58cdfb89c [PATCH] block layer: ioprio_best function fix
Currently ioprio_best function first checks wethere aioprio or bioprio equals
IOPRIO_CLASS_NONE (ioprio_valid() macros does that) and if it is so it returns
bioprio/aioprio appropriately. Thus the next four lines, that set aclass/bclass
to IOPRIO_CLASS_BE, if aclass/bclass == IOPRIO_CLASS_NONE, are never executed.

The second problem: if aioprio from class IOPRIO_CLASS_NONE and bioprio from
class IOPRIO_CLASS_IDLE are passed to ioprio_best function, it will return
IOPRIO_CLASS_IDLE. It means that during __make_request we can merge two
requests and set the priority of merged request to IDLE, while one of
the initial requests originates from a process with NONE (default) priority.
So we can get a situation when a process with default ioprio will experience
IO starvation, while there is no process from real-time class in the system.

Just removing ioprio_valid check should correct situation.

Signed-off-by: Vasily Tarasov <vtaras@openvz.org>
Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
2006-10-12 15:09:51 +02:00
Jens Axboe
cea2885a2e [PATCH] ide-cd: fix breakage with internally queued commands
We still need to maintain a private PC style command, since it
isn't completely unified with REQ_TYPE_BLOCK_PC yet.

Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
2006-10-12 15:08:51 +02:00
Vasily Tarasov
c584164224 [PATCH] block layer: elv_iosched_show should get elv_list_lock
elv_iosched_show function iterates other elv_list, hence
elv_list_lock should be got.

Signed-off-by: Vasily Tarasov <vtaras@openvz.org>
Signed-off-by: Vasily Tarasov <jens.axboe@oracle.com>
2006-10-12 15:08:51 +02:00
Jens Axboe
e6e80f294c [PATCH] splice: fix pipe_to_file() ->prepare_write() error path
Don't jump to the unlock+release path, we already did that.

Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
2006-10-12 15:08:51 +02:00
Vasily Tarasov
a22b169df1 [PATCH] block layer: elevator_find function cleanup
We can easily produce search through the elevator list
without introducing additional elevator_type variable.

Signed-off-by: Vasily Tarasov <vtaras@openvz.org>
Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
2006-10-12 15:08:51 +02:00
Jens Axboe
2b1191af68 [PATCH] elevator: elevator_type member not used
elevator_type field in elevator_type structure is useless:
it isn't used anywhere in kernel sources.

Signed-off-by: Vasily Tarasov <vtaras@openvz.org>
Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
2006-10-12 15:08:51 +02:00
Akinbou Mita
30bdbe397b [PKT_SCHED] sch_htb: use rb_first() cleanup
Use rb_first() to get first entry in rb tree.

Signed-off-by: Akinbou Mita <akinobu.mita@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-10-12 01:52:05 -07:00
Patrick McHardy
b974179abe [RTNETLINK]: Fix use of wrong skb in do_getlink()
skb is the netlink query, nskb is the reply message.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-10-12 01:50:30 -07:00
Patrick McHardy
52c41a3224 [DECNET]: Fix sfuzz hanging on 2.6.18
Dave Jones wrote:
> sfuzz         D 724EF62A  2828 28717  28691                     (NOTLB)
>        cd69fe98 00000082 0000012d 724ef62a 0001971a 00000010 00000007 df6d22b0 
>        dfd81080 725bbc5e 0001971a 000cc634 00000001 df6d23bc c140e260 00000202 
>        de1d5ba0 cd69fea0 de1d5ba0 00000000 00000000 de1d5b60 de1d5b8c de1d5ba0 
> Call Trace:
>  [<c05b1708>] lock_sock+0x75/0xa6
>  [<e0b0b604>] dn_getname+0x18/0x5f [decnet]
>  [<c05b083b>] sys_getsockname+0x5c/0xb0
>  [<c05b0b46>] sys_socketcall+0xef/0x261
>  [<c0403f97>] syscall_call+0x7/0xb
> DWARF2 unwinder stuck at syscall_call+0x7/0xb
> 
> I wonder if the plethora of lockdep related changes inadvertantly broke something?

Looks like unbalanced locking.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-10-12 01:48:20 -07:00
David S. Miller
8238b218ec [NET]: Do not memcmp() over pad bytes of struct flowi.
They are not necessarily initialized to zero by the compiler,
for example when using run-time initializers of automatic
on-stack variables.

Noticed by Eric Dumazet and Patrick McHardy.

Signed-off-by: David S. Miller <davem@davemloft.net>
2006-10-12 00:49:15 -07:00
YOSHIFUJI Hideaki
42b6785eeb [NET]: Introduce protocol-specific destructor for time-wait sockets.
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-10-12 00:00:00 -07:00
YOSHIFUJI Hideaki
9469c7b4aa [NET]: Use typesafe inet_twsk() inline function instead of cast.
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-10-11 23:59:58 -07:00
YOSHIFUJI Hideaki
496c98dff8 [NET]: Use hton{l,s}() for non-initializers.
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-10-11 23:59:56 -07:00
YOSHIFUJI Hideaki
4244f8a9f8 [TCP]: Use TCPOLEN_TSTAMP_ALIGNED macro instead of magic number.
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-10-11 23:59:54 -07:00
Joerg Roedel
0be669bb37 [IPV6]: Seperate sit driver to extra module (addrconf.c changes)
This patch contains the changes to net/ipv6/addrconf.c to remove sit
specific code if the sit driver is not selected.

Signed-off-by: Joerg Roedel <joro-lkml@zlug.org>
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-10-11 23:59:52 -07:00
Joerg Roedel
989e5b96e1 [IPV6]: Seperate sit driver to extra module
This patch removes the driver of the IPv6-in-IPv4 tunnel driver (sit)
from the IPv6 module. It adds an option to Kconfig which makes it
possible to compile it as a seperate module.

Signed-off-by: Joerg Roedel <joro-lkml@zlug.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-10-11 23:59:50 -07:00
Miklos Szeredi
effee6a000 [NET]: File descriptor loss while receiving SCM_RIGHTS
If more than one file descriptor was sent with an SCM_RIGHTS message,
and on the receiving end, after installing a nonzero (but not all)
file descritpors the process runs out of fds, then the already
installed fds will be lost (userspace will have no way of knowing
about them).

The following patch makes sure, that at least the already installed
fds are sent to userspace.  It doesn't solve the issue of losing file
descriptors in case of an EFAULT on the userspace buffer.

Signed-off-by: Miklos Szeredi <miklos@szeredi.hu>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-10-11 23:59:48 -07:00
Vlad Yasevich
6aa2551cf1 [SCTP]: Fix the RX queue size shown in /proc/net/sctp/assocs output.
Show the true receive buffer usage.

Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
Signed-off-by: Sridhar Samudrala <sri@us.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-10-11 23:59:46 -07:00
Vlad Yasevich
331c4ee7fa [SCTP]: Fix receive buffer accounting.
When doing receiver buffer accounting, we always used skb->truesize.
This is problematic when processing bundled DATA chunks because for
every DATA chunk that could be small part of one large skb, we would
charge the size of the entire skb.  The new approach is to store the
size of the DATA chunk we are accounting for in the sctp_ulpevent
structure and use that stored value for accounting.

Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
Signed-off-by: Sridhar Samudrala <sri@us.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-10-11 23:59:44 -07:00
Chad Sellers
6e8c751e07 SELinux: Bug fix in polidydb_destroy
This patch fixes two bugs in policydb_destroy. Two list pointers
(policydb.ocontexts[i] and policydb.genfs) were not being reset to NULL when
the lists they pointed to were being freed. This caused a problem when the
initial policy load failed, as the policydb being destroyed was not a
temporary new policydb that was thrown away, but rather was the global
(active) policydb. Consequently, later functions, particularly
sys_bind->selinux_socket_bind->security_node_sid and
do_rw_proc->selinux_sysctl->selinux_proc_get_sid->security_genfs_sid tried
to dereference memory that had previously been freed.

Signed-off-by: Chad Sellers <csellers@tresys.com>
Signed-off-by: James Morris <jmorris@namei.org>
2006-10-11 23:59:41 -07:00
Venkat Yekkirala
3bccfbc7a7 IPsec: fix handling of errors for socket policies
This treats the security errors encountered in the case of
socket policy matching, the same as how these are treated in
the case of main/sub policies, which is to return a full lookup
failure.

Signed-off-by: Venkat Yekkirala <vyekkirala@TrustedCS.com>
Signed-off-by: James Morris <jmorris@namei.org>
2006-10-11 23:59:39 -07:00
Venkat Yekkirala
5b368e61c2 IPsec: correct semantics for SELinux policy matching
Currently when an IPSec policy rule doesn't specify a security
context, it is assumed to be "unlabeled" by SELinux, and so
the IPSec policy rule fails to match to a flow that it would
otherwise match to, unless one has explicitly added an SELinux
policy rule allowing the flow to "polmatch" to the "unlabeled"
IPSec policy rules. In the absence of such an explicitly added
SELinux policy rule, the IPSec policy rule fails to match and
so the packet(s) flow in clear text without the otherwise applicable
xfrm(s) applied.

The above SELinux behavior violates the SELinux security notion of
"deny by default" which should actually translate to "encrypt by
default" in the above case.

This was first reported by Evgeniy Polyakov and the way James Morris
was seeing the problem was when connecting via IPsec to a
confined service on an SELinux box (vsftpd), which did not have the
appropriate SELinux policy permissions to send packets via IPsec.

With this patch applied, SELinux "polmatching" of flows Vs. IPSec
policy rules will only come into play when there's a explicit context
specified for the IPSec policy rule (which also means there's corresponding
SELinux policy allowing appropriate domains/flows to polmatch to this context).

Secondly, when a security module is loaded (in this case, SELinux), the
security_xfrm_policy_lookup() hook can return errors other than access denied,
such as -EINVAL.  We were not handling that correctly, and in fact
inverting the return logic and propagating a false "ok" back up to
xfrm_lookup(), which then allowed packets to pass as if they were not
associated with an xfrm policy.

The solution for this is to first ensure that errno values are
correctly propagated all the way back up through the various call chains
from security_xfrm_policy_lookup(), and handled correctly.

Then, flow_cache_lookup() is modified, so that if the policy resolver
fails (typically a permission denied via the security module), the flow
cache entry is killed rather than having a null policy assigned (which
indicates that the packet can pass freely).  This also forces any future
lookups for the same flow to consult the security module (e.g. SELinux)
for current security policy (rather than, say, caching the error on the
flow cache entry).

This patch: Fix the selinux side of things.

This makes sure SELinux polmatching of flow contexts to IPSec policy
rules comes into play only when an explicit context is associated
with the IPSec policy rule.

Also, this no longer defaults the context of a socket policy to
the context of the socket since the "no explicit context" case
is now handled properly.

Signed-off-by: Venkat Yekkirala <vyekkirala@TrustedCS.com>
Signed-off-by: James Morris <jmorris@namei.org>
2006-10-11 23:59:37 -07:00
James Morris
134b0fc544 IPsec: propagate security module errors up from flow_cache_lookup
When a security module is loaded (in this case, SELinux), the
security_xfrm_policy_lookup() hook can return an access denied permission
(or other error).  We were not handling that correctly, and in fact
inverting the return logic and propagating a false "ok" back up to
xfrm_lookup(), which then allowed packets to pass as if they were not
associated with an xfrm policy.

The way I was seeing the problem was when connecting via IPsec to a
confined service on an SELinux box (vsftpd), which did not have the
appropriate SELinux policy permissions to send packets via IPsec.

The first SYNACK would be blocked, because of an uncached lookup via
flow_cache_lookup(), which would fail to resolve an xfrm policy because
the SELinux policy is checked at that point via the resolver.

However, retransmitted SYNACKs would then find a cached flow entry when
calling into flow_cache_lookup() with a null xfrm policy, which is
interpreted by xfrm_lookup() as the packet not having any associated
policy and similarly to the first case, allowing it to pass without
transformation.

The solution presented here is to first ensure that errno values are
correctly propagated all the way back up through the various call chains
from security_xfrm_policy_lookup(), and handled correctly.

Then, flow_cache_lookup() is modified, so that if the policy resolver
fails (typically a permission denied via the security module), the flow
cache entry is killed rather than having a null policy assigned (which
indicates that the packet can pass freely).  This also forces any future
lookups for the same flow to consult the security module (e.g. SELinux)
for current security policy (rather than, say, caching the error on the
flow cache entry).

Signed-off-by: James Morris <jmorris@namei.org>
2006-10-11 23:59:34 -07:00