mirror of
https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git
synced 2026-10-28 10:41:38 -04:00
Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security
Pull security subsystem updates from James Morris:
"Highlights:
- TPM core and driver updates/fixes
- IPv6 security labeling (CALIPSO)
- Lots of Apparmor fixes
- Seccomp: remove 2-phase API, close hole where ptrace can change
syscall #"
* 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: (156 commits)
apparmor: fix SECURITY_APPARMOR_HASH_DEFAULT parameter handling
tpm: Add TPM 2.0 support to the Nuvoton i2c driver (NPCT6xx family)
tpm: Factor out common startup code
tpm: use devm_add_action_or_reset
tpm2_i2c_nuvoton: add irq validity check
tpm: read burstcount from TPM_STS in one 32-bit transaction
tpm: fix byte-order for the value read by tpm2_get_tpm_pt
tpm_tis_core: convert max timeouts from msec to jiffies
apparmor: fix arg_size computation for when setprocattr is null terminated
apparmor: fix oops, validate buffer size in apparmor_setprocattr()
apparmor: do not expose kernel stack
apparmor: fix module parameters can be changed after policy is locked
apparmor: fix oops in profile_unpack() when policy_db is not present
apparmor: don't check for vmalloc_addr if kvzalloc() failed
apparmor: add missing id bounds check on dfa verification
apparmor: allow SYS_CAP_RESOURCE to be sufficient to prlimit another task
apparmor: use list_next_entry instead of list_entry_next
apparmor: fix refcount race when finding a child profile
apparmor: fix ref count leak when profile sha1 hash is read
apparmor: check that xindex is in trans_table bounds
...
This commit is contained in:
Linus Torvalds
commit
7a1e8b80fb
126 changed files with 7281 additions and 2131 deletions
|
|
@ -134,76 +134,6 @@ int cipso_v4_rbm_strictvalid = 1;
|
|||
* Helper Functions
|
||||
*/
|
||||
|
||||
/**
|
||||
* cipso_v4_bitmap_walk - Walk a bitmap looking for a bit
|
||||
* @bitmap: the bitmap
|
||||
* @bitmap_len: length in bits
|
||||
* @offset: starting offset
|
||||
* @state: if non-zero, look for a set (1) bit else look for a cleared (0) bit
|
||||
*
|
||||
* Description:
|
||||
* Starting at @offset, walk the bitmap from left to right until either the
|
||||
* desired bit is found or we reach the end. Return the bit offset, -1 if
|
||||
* not found, or -2 if error.
|
||||
*/
|
||||
static int cipso_v4_bitmap_walk(const unsigned char *bitmap,
|
||||
u32 bitmap_len,
|
||||
u32 offset,
|
||||
u8 state)
|
||||
{
|
||||
u32 bit_spot;
|
||||
u32 byte_offset;
|
||||
unsigned char bitmask;
|
||||
unsigned char byte;
|
||||
|
||||
/* gcc always rounds to zero when doing integer division */
|
||||
byte_offset = offset / 8;
|
||||
byte = bitmap[byte_offset];
|
||||
bit_spot = offset;
|
||||
bitmask = 0x80 >> (offset % 8);
|
||||
|
||||
while (bit_spot < bitmap_len) {
|
||||
if ((state && (byte & bitmask) == bitmask) ||
|
||||
(state == 0 && (byte & bitmask) == 0))
|
||||
return bit_spot;
|
||||
|
||||
bit_spot++;
|
||||
bitmask >>= 1;
|
||||
if (bitmask == 0) {
|
||||
byte = bitmap[++byte_offset];
|
||||
bitmask = 0x80;
|
||||
}
|
||||
}
|
||||
|
||||
return -1;
|
||||
}
|
||||
|
||||
/**
|
||||
* cipso_v4_bitmap_setbit - Sets a single bit in a bitmap
|
||||
* @bitmap: the bitmap
|
||||
* @bit: the bit
|
||||
* @state: if non-zero, set the bit (1) else clear the bit (0)
|
||||
*
|
||||
* Description:
|
||||
* Set a single bit in the bitmask. Returns zero on success, negative values
|
||||
* on error.
|
||||
*/
|
||||
static void cipso_v4_bitmap_setbit(unsigned char *bitmap,
|
||||
u32 bit,
|
||||
u8 state)
|
||||
{
|
||||
u32 byte_spot;
|
||||
u8 bitmask;
|
||||
|
||||
/* gcc always rounds to zero when doing integer division */
|
||||
byte_spot = bit / 8;
|
||||
bitmask = 0x80 >> (bit % 8);
|
||||
if (state)
|
||||
bitmap[byte_spot] |= bitmask;
|
||||
else
|
||||
bitmap[byte_spot] &= ~bitmask;
|
||||
}
|
||||
|
||||
/**
|
||||
* cipso_v4_cache_entry_free - Frees a cache entry
|
||||
* @entry: the entry to free
|
||||
|
|
@ -840,10 +770,10 @@ static int cipso_v4_map_cat_rbm_valid(const struct cipso_v4_doi *doi_def,
|
|||
cipso_cat_size = doi_def->map.std->cat.cipso_size;
|
||||
cipso_array = doi_def->map.std->cat.cipso;
|
||||
for (;;) {
|
||||
cat = cipso_v4_bitmap_walk(bitmap,
|
||||
bitmap_len_bits,
|
||||
cat + 1,
|
||||
1);
|
||||
cat = netlbl_bitmap_walk(bitmap,
|
||||
bitmap_len_bits,
|
||||
cat + 1,
|
||||
1);
|
||||
if (cat < 0)
|
||||
break;
|
||||
if (cat >= cipso_cat_size ||
|
||||
|
|
@ -909,7 +839,7 @@ static int cipso_v4_map_cat_rbm_hton(const struct cipso_v4_doi *doi_def,
|
|||
}
|
||||
if (net_spot >= net_clen_bits)
|
||||
return -ENOSPC;
|
||||
cipso_v4_bitmap_setbit(net_cat, net_spot, 1);
|
||||
netlbl_bitmap_setbit(net_cat, net_spot, 1);
|
||||
|
||||
if (net_spot > net_spot_max)
|
||||
net_spot_max = net_spot;
|
||||
|
|
@ -951,10 +881,10 @@ static int cipso_v4_map_cat_rbm_ntoh(const struct cipso_v4_doi *doi_def,
|
|||
}
|
||||
|
||||
for (;;) {
|
||||
net_spot = cipso_v4_bitmap_walk(net_cat,
|
||||
net_clen_bits,
|
||||
net_spot + 1,
|
||||
1);
|
||||
net_spot = netlbl_bitmap_walk(net_cat,
|
||||
net_clen_bits,
|
||||
net_spot + 1,
|
||||
1);
|
||||
if (net_spot < 0) {
|
||||
if (net_spot == -2)
|
||||
return -EFAULT;
|
||||
|
|
|
|||
|
|
@ -6147,6 +6147,9 @@ struct request_sock *inet_reqsk_alloc(const struct request_sock_ops *ops,
|
|||
|
||||
kmemcheck_annotate_bitfield(ireq, flags);
|
||||
ireq->opt = NULL;
|
||||
#if IS_ENABLED(CONFIG_IPV6)
|
||||
ireq->pktopts = NULL;
|
||||
#endif
|
||||
atomic64_set(&ireq->ir_cookie, 0);
|
||||
ireq->ireq_state = TCP_NEW_SYN_RECV;
|
||||
write_pnet(&ireq->ireq_net, sock_net(sk_listener));
|
||||
|
|
|
|||
Loading…
Reference in a new issue