Apply k4412 kernel from HardKernel for ODROID-X.

5 files changed, 111 insertions, 27 deletions

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index be29337ea39..8a4bf719c25 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -828,12 +828,13 @@ static int ipv6_create_tempaddr(struct inet6_ifaddr *ifp, struct inet6_ifaddr *i
 {
         struct inet6_dev *idev = ifp->idev;
         struct in6_addr addr, *tmpaddr;
-        unsigned long tmp_prefered_lft, tmp_valid_lft, tmp_cstamp, tmp_tstamp, age;
+        unsigned long tmp_prefered_lft, tmp_valid_lft, tmp_tstamp, age;
         unsigned long regen_advance;
         int tmp_plen;
         int ret = 0;
         int max_addresses;
         u32 addr_flags;
+        unsigned long now = jiffies;
 
         write_lock(&idev->lock);
         if (ift) {
@@ -878,7 +879,7 @@ retry:
                 goto out;
         }
         memcpy(&addr.s6_addr[8], idev->rndid, 8);
-        age = (jiffies - ifp->tstamp) / HZ;
+        age = (now - ifp->tstamp) / HZ;
         tmp_valid_lft = min_t(__u32,
                               ifp->valid_lft,
                               idev->cnf.temp_valid_lft + age);
@@ -888,7 +889,6 @@ retry:
                                  idev->cnf.max_desync_factor);
         tmp_plen = ifp->prefix_len;
         max_addresses = idev->cnf.max_addresses;
-        tmp_cstamp = ifp->cstamp;
         tmp_tstamp = ifp->tstamp;
         spin_unlock_bh(&ifp->lock);
 
@@ -933,7 +933,7 @@ retry:
         ift->ifpub = ifp;
         ift->valid_lft = tmp_valid_lft;
         ift->prefered_lft = tmp_prefered_lft;
-        ift->cstamp = tmp_cstamp;
+        ift->cstamp = now;
         ift->tstamp = tmp_tstamp;
         spin_unlock_bh(&ift->lock);
 
@@ -1992,25 +1992,50 @@ ok:
 #ifdef CONFIG_IPV6_PRIVACY
                         read_lock_bh(&in6_dev->lock);
                         /* update all temporary addresses in the list */
-                        list_for_each_entry(ift, &in6_dev->tempaddr_list, tmp_list) {
-                                /*
-                                 * When adjusting the lifetimes of an existing
-                                 * temporary address, only lower the lifetimes.
-                                 * Implementations must not increase the
-                                 * lifetimes of an existing temporary address
-                                 * when processing a Prefix Information Option.
-                                 */
+                        list_for_each_entry(ift, &in6_dev->tempaddr_list,
+                                            tmp_list) {
+                                int age, max_valid, max_prefered;
+
                                 if (ifp != ift->ifpub)
                                         continue;
 
+                                /*
+                                 * RFC 4941 section 3.3:
+                                 * If a received option will extend the lifetime
+                                 * of a public address, the lifetimes of
+                                 * temporary addresses should be extended,
+                                 * subject to the overall constraint that no
+                                 * temporary addresses should ever remain
+                                 * "valid" or "preferred" for a time longer than
+                                 * (TEMP_VALID_LIFETIME) or
+                                 * (TEMP_PREFERRED_LIFETIME - DESYNC_FACTOR),
+                                 * respectively.
+                                 */
+                                age = (now - ift->cstamp) / HZ;
+                                max_valid = in6_dev->cnf.temp_valid_lft - age;
+                                if (max_valid < 0)
+                                        max_valid = 0;
+
+                                max_prefered = in6_dev->cnf.temp_prefered_lft -
+                                               in6_dev->cnf.max_desync_factor -
+                                               age;
+                                if (max_prefered < 0)
+                                        max_prefered = 0;
+
+                                if (valid_lft > max_valid)
+                                        valid_lft = max_valid;
+
+                                if (prefered_lft > max_prefered)
+                                        prefered_lft = max_prefered;
+
                                 spin_lock(&ift->lock);
                                 flags = ift->flags;
-                                if (ift->valid_lft > valid_lft &&
-                                    ift->valid_lft - valid_lft > (jiffies - ift->tstamp) / HZ)
-                                        ift->valid_lft = valid_lft + (jiffies - ift->tstamp) / HZ;
-                                if (ift->prefered_lft > prefered_lft &&
-                                    ift->prefered_lft - prefered_lft > (jiffies - ift->tstamp) / HZ)
-                                        ift->prefered_lft = prefered_lft + (jiffies - ift->tstamp) / HZ;
+                                ift->valid_lft = valid_lft;
+                                ift->prefered_lft = prefered_lft;
+                                ift->tstamp = now;
+                                if (prefered_lft > 0)
+                                        ift->flags &= ~IFA_F_DEPRECATED;
+
                                 spin_unlock(&ift->lock);
                                 if (!(flags&IFA_F_TENTATIVE))
                                         ipv6_ifa_notify(0, ift);
@@ -2018,9 +2043,11 @@ ok:
 
                         if ((create || list_empty(&in6_dev->tempaddr_list)) && in6_dev->cnf.use_tempaddr > 0) {
                                 /*
-                                 * When a new public address is created as described in [ADDRCONF],
-                                 * also create a new temporary address. Also create a temporary
-                                 * address if it's enabled but no temporary address currently exists.
+                                 * When a new public address is created as
+                                 * described in [ADDRCONF], also create a new
+                                 * temporary address. Also create a temporary
+                                 * address if it's enabled but no temporary
+                                 * address currently exists.
                                  */
                                 read_unlock_bh(&in6_dev->lock);
                                 ipv6_create_tempaddr(ifp, NULL);
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 559123644e5..7e8340ef5a2 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -63,6 +63,20 @@
 #include <asm/system.h>
 #include <linux/mroute6.h>
 
+#ifdef CONFIG_ANDROID_PARANOID_NETWORK
+#include <linux/android_aid.h>
+
+static inline int current_has_network(void)
+{
+        return in_egroup_p(AID_INET) || capable(CAP_NET_RAW);
+}
+#else
+static inline int current_has_network(void)
+{
+        return 1;
+}
+#endif
+
 MODULE_AUTHOR("Cast of dozens");
 MODULE_DESCRIPTION("IPv6 protocol stack for Linux");
 MODULE_LICENSE("GPL");
@@ -109,6 +123,9 @@ static int inet6_create(struct net *net, struct socket *sock, int protocol,
         int try_loading_module = 0;
         int err;
 
+        if (!current_has_network())
+                return -EACCES;
+
         if (sock->type != SOCK_RAW &&
             sock->type != SOCK_DGRAM &&
             !inet_ehash_secret)
@@ -477,6 +494,21 @@ int inet6_getname(struct socket *sock, struct sockaddr *uaddr,
 
 EXPORT_SYMBOL(inet6_getname);
 
+int inet6_killaddr_ioctl(struct net *net, void __user *arg) {
+        struct in6_ifreq ireq;
+        struct sockaddr_in6 sin6;
+
+        if (!capable(CAP_NET_ADMIN))
+                return -EACCES;
+
+        if (copy_from_user(&ireq, arg, sizeof(struct in6_ifreq)))
+                return -EFAULT;
+
+        sin6.sin6_family = AF_INET6;
+        ipv6_addr_copy(&sin6.sin6_addr, &ireq.ifr6_addr);
+        return tcp_nuke_addr(net, (struct sockaddr *) &sin6);
+}
+
 int inet6_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 {
         struct sock *sk = sock->sk;
@@ -501,6 +533,8 @@ int inet6_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
                 return addrconf_del_ifaddr(net, (void __user *) arg);
         case SIOCSIFDSTADDR:
                 return addrconf_set_dstaddr(net, (void __user *) arg);
+        case SIOCKILLADDR:
+                return inet6_killaddr_ioctl(net, (void __user *) arg);
         default:
                 if (!sk->sk_prot->ioctl)
                         return -ENOIOCTLCMD;
diff --git a/net/ipv6/netfilter/Kconfig b/net/ipv6/netfilter/Kconfig
index 448464844a2..5bbf5316920 100644
--- a/net/ipv6/netfilter/Kconfig
+++ b/net/ipv6/netfilter/Kconfig
@@ -174,6 +174,18 @@ config IP6_NF_TARGET_REJECT
 
           To compile it as a module, choose M here.  If unsure, say N.
 
+config IP6_NF_TARGET_REJECT_SKERR
+        bool "Force socket error when rejecting with icmp*"
+        depends on IP6_NF_TARGET_REJECT
+        default n
+        help
+          This option enables turning a "--reject-with icmp*" into a matching
+          socket error also.
+          The REJECT target normally allows sending an ICMP message. But it
+          leaves the local socket unaware of any ingress rejects.
+
+          If unsure, say N.
+
 config IP6_NF_MANGLE
         tristate "Packet mangling"
         default m if NETFILTER_ADVANCED=n
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 94874b0bdcd..14cb310064f 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -2292,16 +2292,15 @@ static void __exit ip6_tables_fini(void)
  * "No next header".
  *
  * If target header is found, its offset is set in *offset and return protocol
- * number. Otherwise, return -1.
+ * number. Otherwise, return -ENOENT or -EBADMSG.
  *
  * If the first fragment doesn't contain the final protocol header or
  * NEXTHDR_NONE it is considered invalid.
  *
  * Note that non-1st fragment is special case that "the protocol number
  * of last header" is "next header" field in Fragment header. In this case,
- * *offset is meaningless and fragment offset is stored in *fragoff if fragoff
- * isn't NULL.
- *
+ * *offset is meaningless. If fragoff is not NULL, the fragment offset is
+ * stored in *fragoff; if it is NULL, return -EINVAL.
  */
 int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
                   int target, unsigned short *fragoff)
@@ -2342,9 +2341,12 @@ int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
                                 if (target < 0 &&
                                     ((!ipv6_ext_hdr(hp->nexthdr)) ||
                                      hp->nexthdr == NEXTHDR_NONE)) {
-                                        if (fragoff)
+                                        if (fragoff) {
                                                 *fragoff = _frag_off;
-                                        return hp->nexthdr;
+                                                return hp->nexthdr;
+                                        } else {
+                                                return -EINVAL;
+                                        }
                                 }
                                 return -ENOENT;
                         }
diff --git a/net/ipv6/netfilter/ip6t_REJECT.c b/net/ipv6/netfilter/ip6t_REJECT.c
index a5a4c5dd539..09d30498c92 100644
--- a/net/ipv6/netfilter/ip6t_REJECT.c
+++ b/net/ipv6/netfilter/ip6t_REJECT.c
@@ -177,6 +177,15 @@ send_unreach(struct net *net, struct sk_buff *skb_in, unsigned char code,
                 skb_in->dev = net->loopback_dev;
 
         icmpv6_send(skb_in, ICMPV6_DEST_UNREACH, code, 0);
+#ifdef CONFIG_IP6_NF_TARGET_REJECT_SKERR
+        if (skb_in->sk) {
+                icmpv6_err_convert(ICMPV6_DEST_UNREACH, code,
+                                   &skb_in->sk->sk_err);
+                skb_in->sk->sk_error_report(skb_in->sk);
+                pr_debug("ip6t_REJECT: sk_err=%d for skb=%p sk=%p\n",
+                        skb_in->sk->sk_err, skb_in, skb_in->sk);
+        }
+#endif
 }
 
 static unsigned int