10 files changed, 154 insertions, 68 deletions

diff --git a/kernel/audit.c b/kernel/audit.c
index d417ca1db79b..0a36091ed712 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -690,9 +690,7 @@ static const struct inotify_operations audit_inotify_ops = {
 /* Initialize audit support at boot time. */
 static int __init audit_init(void)
 {
-#ifdef CONFIG_AUDITSYSCALL
         int i;
-#endif
 
         printk(KERN_INFO "audit: initializing netlink socket (%s)\n",
                audit_default ? "enabled" : "disabled");
@@ -717,10 +715,10 @@ static int __init audit_init(void)
         audit_ih = inotify_init(&audit_inotify_ops);
         if (IS_ERR(audit_ih))
                 audit_panic("cannot initialize inotify handle");
+#endif
 
         for (i = 0; i < AUDIT_INODE_BUCKETS; i++)
                 INIT_LIST_HEAD(&audit_inode_hash[i]);
-#endif
 
         return 0;
 }
diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c
index 5b4e16276ca0..6a9a5c5a4e7d 100644
--- a/kernel/auditfilter.c
+++ b/kernel/auditfilter.c
@@ -442,6 +442,7 @@ static struct audit_entry *audit_rule_to_entry(struct audit_rule *rule)
                 case AUDIT_EQUAL:
                         break;
                 default:
+                        err = -EINVAL;
                         goto exit_free;
                 }
         }
@@ -579,6 +580,7 @@ static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data,
                 case AUDIT_EQUAL:
                         break;
                 default:
+                        err = -EINVAL;
                         goto exit_free;
                 }
         }
@@ -1134,6 +1136,14 @@ static inline int audit_add_rule(struct audit_entry *entry,
         struct audit_watch *watch = entry->rule.watch;
         struct nameidata *ndp, *ndw;
         int h, err, putnd_needed = 0;
+#ifdef CONFIG_AUDITSYSCALL
+        int dont_count = 0;
+
+        /* If either of these, don't count towards total */
+        if (entry->rule.listnr == AUDIT_FILTER_USER ||
+                entry->rule.listnr == AUDIT_FILTER_TYPE)
+                dont_count = 1;
+#endif
 
         if (inode_f) {
                 h = audit_hash_ino(inode_f->val);
@@ -1174,6 +1184,10 @@ static inline int audit_add_rule(struct audit_entry *entry,
         } else {
                 list_add_tail_rcu(&entry->list, list);
         }
+#ifdef CONFIG_AUDITSYSCALL
+        if (!dont_count)
+                audit_n_rules++;
+#endif
         mutex_unlock(&audit_filter_mutex);
 
         if (putnd_needed)
@@ -1198,6 +1212,14 @@ static inline int audit_del_rule(struct audit_entry *entry,
         struct audit_watch *watch, *tmp_watch = entry->rule.watch;
         LIST_HEAD(inotify_list);
         int h, ret = 0;
+#ifdef CONFIG_AUDITSYSCALL
+        int dont_count = 0;
+
+        /* If either of these, don't count towards total */
+        if (entry->rule.listnr == AUDIT_FILTER_USER ||
+                entry->rule.listnr == AUDIT_FILTER_TYPE)
+                dont_count = 1;
+#endif
 
         if (inode_f) {
                 h = audit_hash_ino(inode_f->val);
@@ -1235,6 +1257,10 @@ static inline int audit_del_rule(struct audit_entry *entry,
         list_del_rcu(&e->list);
         call_rcu(&e->rcu, audit_free_rule_rcu);
 
+#ifdef CONFIG_AUDITSYSCALL
+        if (!dont_count)
+                audit_n_rules--;
+#endif
         mutex_unlock(&audit_filter_mutex);
 
         if (!list_empty(&inotify_list))
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index ae40ac8c39e7..efc1b74bebf3 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -85,6 +85,9 @@ extern int audit_enabled;
 /* Indicates that audit should log the full pathname. */
 #define AUDIT_NAME_FULL -1
 
+/* number of audit rules */
+int audit_n_rules;
+
 /* When fs/namei.c:getname() is called, we store the pointer in name and
  * we don't let putname() free it (instead we free all of the saved
  * pointers at syscall exit time).
@@ -174,6 +177,7 @@ struct audit_aux_data_path {
 
 /* The per-task audit context. */
 struct audit_context {
+        int                 dummy;      /* must be the first element */
         int                 in_syscall; /* 1 if task is in a syscall */
         enum audit_state    state;
         unsigned int        serial;     /* serial number for record */
@@ -514,7 +518,7 @@ static inline struct audit_context *audit_get_context(struct task_struct *tsk,
         context->return_valid = return_valid;
         context->return_code  = return_code;
 
-        if (context->in_syscall && !context->auditable) {
+        if (context->in_syscall && !context->dummy && !context->auditable) {
                 enum audit_state state;
 
                 state = audit_filter_syscall(tsk, context, &audit_filter_list[AUDIT_FILTER_EXIT]);
@@ -530,17 +534,7 @@ static inline struct audit_context *audit_get_context(struct task_struct *tsk,
         }
 
 get_context:
-        context->pid = tsk->pid;
-        context->ppid = sys_getppid();  /* sic.  tsk == current in all cases */
-        context->uid = tsk->uid;
-        context->gid = tsk->gid;
-        context->euid = tsk->euid;
-        context->suid = tsk->suid;
-        context->fsuid = tsk->fsuid;
-        context->egid = tsk->egid;
-        context->sgid = tsk->sgid;
-        context->fsgid = tsk->fsgid;
-        context->personality = tsk->personality;
+
         tsk->audit_context = NULL;
         return context;
 }
@@ -749,6 +743,17 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts
         const char *tty;
 
         /* tsk == current */
+        context->pid = tsk->pid;
+        context->ppid = sys_getppid();  /* sic.  tsk == current in all cases */
+        context->uid = tsk->uid;
+        context->gid = tsk->gid;
+        context->euid = tsk->euid;
+        context->suid = tsk->suid;
+        context->fsuid = tsk->fsuid;
+        context->egid = tsk->egid;
+        context->sgid = tsk->sgid;
+        context->fsgid = tsk->fsgid;
+        context->personality = tsk->personality;
 
         ab = audit_log_start(context, GFP_KERNEL, AUDIT_SYSCALL);
         if (!ab)
@@ -1066,7 +1071,8 @@ void audit_syscall_entry(int arch, int major,
         context->argv[3]    = a4;
 
         state = context->state;
-        if (state == AUDIT_SETUP_CONTEXT || state == AUDIT_BUILD_CONTEXT)
+        context->dummy = !audit_n_rules;
+        if (!context->dummy && (state == AUDIT_SETUP_CONTEXT || state == AUDIT_BUILD_CONTEXT))
                 state = audit_filter_syscall(tsk, context, &audit_filter_list[AUDIT_FILTER_ENTRY]);
         if (likely(state == AUDIT_DISABLED))
                 return;
@@ -1199,14 +1205,18 @@ void audit_putname(const char *name)
 #endif
 }
 
-static void audit_inode_context(int idx, const struct inode *inode)
+/* Copy inode data into an audit_names. */
+static void audit_copy_inode(struct audit_names *name, const struct inode *inode)
 {
-        struct audit_context *context = current->audit_context;
-
-        selinux_get_inode_sid(inode, &context->names[idx].osid);
+        name->ino   = inode->i_ino;
+        name->dev   = inode->i_sb->s_dev;
+        name->mode  = inode->i_mode;
+        name->uid   = inode->i_uid;
+        name->gid   = inode->i_gid;
+        name->rdev  = inode->i_rdev;
+        selinux_get_inode_sid(inode, &name->osid);
 }
 
-
 /**
  * audit_inode - store the inode and device from a lookup
  * @name: name being audited
@@ -1240,20 +1250,14 @@ void __audit_inode(const char *name, const struct inode *inode)
                 ++context->ino_count;
 #endif
         }
-        context->names[idx].ino   = inode->i_ino;
-        context->names[idx].dev   = inode->i_sb->s_dev;
-        context->names[idx].mode  = inode->i_mode;
-        context->names[idx].uid   = inode->i_uid;
-        context->names[idx].gid   = inode->i_gid;
-        context->names[idx].rdev  = inode->i_rdev;
-        audit_inode_context(idx, inode);
+        audit_copy_inode(&context->names[idx], inode);
 }
 
 /**
  * audit_inode_child - collect inode info for created/removed objects
  * @dname: inode's dentry name
  * @inode: inode being audited
- * @pino: inode number of dentry parent
+ * @parent: inode of dentry parent
  *
  * For syscalls that create or remove filesystem objects, audit_inode
  * can only collect information for the filesystem object's parent.
@@ -1264,7 +1268,7 @@ void __audit_inode(const char *name, const struct inode *inode)
  * unsuccessful attempts.
  */
 void __audit_inode_child(const char *dname, const struct inode *inode,
-                         unsigned long pino)
+                         const struct inode *parent)
 {
         int idx;
         struct audit_context *context = current->audit_context;
@@ -1278,7 +1282,7 @@ void __audit_inode_child(const char *dname, const struct inode *inode,
         if (!dname)
                 goto update_context;
         for (idx = 0; idx < context->name_count; idx++)
-                if (context->names[idx].ino == pino) {
+                if (context->names[idx].ino == parent->i_ino) {
                         const char *name = context->names[idx].name;
 
                         if (!name)
@@ -1302,16 +1306,47 @@ update_context:
         context->names[idx].name_len = AUDIT_NAME_FULL;
         context->names[idx].name_put = 0;       /* don't call __putname() */
 
-        if (inode) {
-                context->names[idx].ino   = inode->i_ino;
-                context->names[idx].dev   = inode->i_sb->s_dev;
-                context->names[idx].mode  = inode->i_mode;
-                context->names[idx].uid   = inode->i_uid;
-                context->names[idx].gid   = inode->i_gid;
-                context->names[idx].rdev  = inode->i_rdev;
-                audit_inode_context(idx, inode);
-        } else
-                context->names[idx].ino   = (unsigned long)-1;
+        if (!inode)
+                context->names[idx].ino = (unsigned long)-1;
+        else
+                audit_copy_inode(&context->names[idx], inode);
+
+        /* A parent was not found in audit_names, so copy the inode data for the
+         * provided parent. */
+        if (!found_name) {
+                idx = context->name_count++;
+#if AUDIT_DEBUG
+                context->ino_count++;
+#endif
+                audit_copy_inode(&context->names[idx], parent);
+        }
+}
+
+/**
+ * audit_inode_update - update inode info for last collected name
+ * @inode: inode being audited
+ *
+ * When open() is called on an existing object with the O_CREAT flag, the inode
+ * data audit initially collects is incorrect.  This additional hook ensures
+ * audit has the inode data for the actual object to be opened.
+ */
+void __audit_inode_update(const struct inode *inode)
+{
+        struct audit_context *context = current->audit_context;
+        int idx;
+
+        if (!context->in_syscall || !inode)
+                return;
+
+        if (context->name_count == 0) {
+                context->name_count++;
+#if AUDIT_DEBUG
+                context->ino_count++;
+#endif
+        }
+        idx = context->name_count - 1;
+
+        audit_copy_inode(&context->names[idx], inode);
 }
 
 /**
@@ -1642,7 +1677,7 @@ int audit_bprm(struct linux_binprm *bprm)
         unsigned long p, next;
         void *to;
 
-        if (likely(!audit_enabled || !context))
+        if (likely(!audit_enabled || !context || context->dummy))
                 return 0;
 
         ax = kmalloc(sizeof(*ax) + PAGE_SIZE * MAX_ARG_PAGES - bprm->p,
@@ -1680,7 +1715,7 @@ int audit_socketcall(int nargs, unsigned long *args)
         struct audit_aux_data_socketcall *ax;
         struct audit_context *context = current->audit_context;
 
-        if (likely(!context))
+        if (likely(!context || context->dummy))
                 return 0;
 
         ax = kmalloc(sizeof(*ax) + nargs * sizeof(unsigned long), GFP_KERNEL);
@@ -1708,7 +1743,7 @@ int audit_sockaddr(int len, void *a)
         struct audit_aux_data_sockaddr *ax;
         struct audit_context *context = current->audit_context;
 
-        if (likely(!context))
+        if (likely(!context || context->dummy))
                 return 0;
 
         ax = kmalloc(sizeof(*ax) + len, GFP_KERNEL);
diff --git a/kernel/fork.c b/kernel/fork.c
index 1b0f7b1e0881..aa36c43783cc 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1387,8 +1387,10 @@ long do_fork(unsigned long clone_flags,
 
                 if (clone_flags & CLONE_VFORK) {
                         wait_for_completion(&vfork);
-                        if (unlikely (current->ptrace & PT_TRACE_VFORK_DONE))
+                        if (unlikely (current->ptrace & PT_TRACE_VFORK_DONE)) {
+                                current->ptrace_message = nr;
                                 ptrace_notify ((PTRACE_EVENT_VFORK_DONE << 8) | SIGTRAP);
+                        }
                 }
         } else {
                 free_pid(pid);
diff --git a/kernel/futex.c b/kernel/futex.c
index dda2049692a2..c2b2e0b83abf 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -948,6 +948,7 @@ static int unqueue_me(struct futex_q *q)
         /* In the common case we don't take the spinlock, which is nice. */
  retry:
         lock_ptr = q->lock_ptr;
+        barrier();
         if (lock_ptr != 0) {
                 spin_lock(lock_ptr);
                 /*
diff --git a/kernel/futex_compat.c b/kernel/futex_compat.c
index d1aab1a452cc..c5cca3f65cb7 100644
--- a/kernel/futex_compat.c
+++ b/kernel/futex_compat.c
@@ -39,7 +39,7 @@ void compat_exit_robust_list(struct task_struct *curr)
 {
         struct compat_robust_list_head __user *head = curr->compat_robust_list;
         struct robust_list __user *entry, *pending;
-        unsigned int limit = ROBUST_LIST_LIMIT, pi;
+        unsigned int limit = ROBUST_LIST_LIMIT, pi, pip;
         compat_uptr_t uentry, upending;
         compat_long_t futex_offset;
 
@@ -59,10 +59,10 @@ void compat_exit_robust_list(struct task_struct *curr)
          * if it exists:
          */
         if (fetch_robust_entry(&upending, &pending,
-                               &head->list_op_pending, &pi))
+                               &head->list_op_pending, &pip))
                 return;
         if (upending)
-                handle_futex_death((void *)pending + futex_offset, curr, pi);
+                handle_futex_death((void *)pending + futex_offset, curr, pip);
 
         while (compat_ptr(uentry) != &head->list) {
                 /*
diff --git a/kernel/power/process.c b/kernel/power/process.c
index b2a5f671d6cd..72e72d2c61e6 100644
--- a/kernel/power/process.c
+++ b/kernel/power/process.c
@@ -66,13 +66,25 @@ static inline void freeze_process(struct task_struct *p)
         }
 }
 
+static void cancel_freezing(struct task_struct *p)
+{
+        unsigned long flags;
+
+        if (freezing(p)) {
+                pr_debug("  clean up: %s\n", p->comm);
+                do_not_freeze(p);
+                spin_lock_irqsave(&p->sighand->siglock, flags);
+                recalc_sigpending_tsk(p);
+                spin_unlock_irqrestore(&p->sighand->siglock, flags);
+        }
+}
+
 /* 0 = success, else # of processes that we failed to stop */
 int freeze_processes(void)
 {
         int todo, nr_user, user_frozen;
         unsigned long start_time;
         struct task_struct *g, *p;
-        unsigned long flags;
 
         printk( "Stopping tasks: " );
         start_time = jiffies;
@@ -85,6 +97,10 @@ int freeze_processes(void)
                                 continue;
                         if (frozen(p))
                                 continue;
+                        if (p->state == TASK_TRACED && frozen(p->parent)) {
+                                cancel_freezing(p);
+                                continue;
+                        }
                         if (p->mm && !(p->flags & PF_BORROWED_MM)) {
                                 /* The task is a user-space one.
                                  * Freeze it unless there's a vfork completion
@@ -126,13 +142,7 @@ int freeze_processes(void)
                 do_each_thread(g, p) {
                         if (freezeable(p) && !frozen(p))
                                 printk(KERN_ERR "  %s\n", p->comm);
-                        if (freezing(p)) {
-                                pr_debug("  clean up: %s\n", p->comm);
-                                p->flags &= ~PF_FREEZE;
-                                spin_lock_irqsave(&p->sighand->siglock, flags);
-                                recalc_sigpending_tsk(p);
-                                spin_unlock_irqrestore(&p->sighand->siglock, flags);
-                        }
+                        cancel_freezing(p);
                 } while_each_thread(g, p);
                 read_unlock(&tasklist_lock);
                 return todo;
diff --git a/kernel/printk.c b/kernel/printk.c
index 65ca0688f86f..1149365e989e 100644
--- a/kernel/printk.c
+++ b/kernel/printk.c
@@ -799,6 +799,9 @@ void release_console_sem(void)
                 up(&secondary_console_sem);
                 return;
         }
+
+        console_may_schedule = 0;
+
         for ( ; ; ) {
                 spin_lock_irqsave(&logbuf_lock, flags);
                 wake_klogd |= log_start - log_end;
@@ -812,7 +815,6 @@ void release_console_sem(void)
                 local_irq_restore(flags);
         }
         console_locked = 0;
-        console_may_schedule = 0;
         up(&console_sem);
         spin_unlock_irqrestore(&logbuf_lock, flags);
         if (wake_klogd && !oops_in_progress && waitqueue_active(&log_wait)) {
diff --git a/kernel/resource.c b/kernel/resource.c
index 0dd3a857579e..46286434af80 100644
--- a/kernel/resource.c
+++ b/kernel/resource.c
@@ -244,6 +244,7 @@ int find_next_system_ram(struct resource *res)
 
         start = res->start;
         end = res->end;
+        BUG_ON(start >= end);
 
         read_lock(&resource_lock);
         for (p = iomem_resource.child; p ; p = p->sibling) {
@@ -254,15 +255,17 @@ int find_next_system_ram(struct resource *res)
                         p = NULL;
                         break;
                 }
-                if (p->start >= start)
+                if ((p->end >= start) && (p->start < end))
                         break;
         }
         read_unlock(&resource_lock);
         if (!p)
                 return -1;
         /* copy data */
-        res->start = p->start;
-        res->end = p->end;
+        if (res->start < p->start)
+                res->start = p->start;
+        if (res->end > p->end)
+                res->end = p->end;
         return 0;
 }
 #endif
diff --git a/kernel/signal.c b/kernel/signal.c
index 7fe874d12fae..bfdb5686fa3e 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -791,22 +791,31 @@ out:
 /*
  * Force a signal that the process can't ignore: if necessary
  * we unblock the signal and change any SIG_IGN to SIG_DFL.
+ *
+ * Note: If we unblock the signal, we always reset it to SIG_DFL,
+ * since we do not want to have a signal handler that was blocked
+ * be invoked when user space had explicitly blocked it.
+ *
+ * We don't want to have recursive SIGSEGV's etc, for example.
  */
-
 int
 force_sig_info(int sig, struct siginfo *info, struct task_struct *t)
 {
         unsigned long int flags;
-        int ret;
+        int ret, blocked, ignored;
+        struct k_sigaction *action;
 
         spin_lock_irqsave(&t->sighand->siglock, flags);
-        if (t->sighand->action[sig-1].sa.sa_handler == SIG_IGN) {
-                t->sighand->action[sig-1].sa.sa_handler = SIG_DFL;
-        }
-        if (sigismember(&t->blocked, sig)) {
-                sigdelset(&t->blocked, sig);
+        action = &t->sighand->action[sig-1];
+        ignored = action->sa.sa_handler == SIG_IGN;
+        blocked = sigismember(&t->blocked, sig);
+        if (blocked || ignored) {
+                action->sa.sa_handler = SIG_DFL;
+                if (blocked) {
+                        sigdelset(&t->blocked, sig);
+                        recalc_sigpending_tsk(t);
+                }
         }
-        recalc_sigpending_tsk(t);
         ret = specific_send_sig_info(sig, info, t);
         spin_unlock_irqrestore(&t->sighand->siglock, flags);