Subject: patches for applying patch-3.10.17-vs2.3.6.6.diff to linux-3.10.18
From: Corey Wright <undefined@pobox.com>
Date: Tue, 5 Nov 2013 07:35:37 -0600
Tue, 5 Nov 2013 07:35:37 -0600
patch-3.10.17-vs2.3.6.6.diff appears to apply to linux-3.10.18, but patch
(using version 2.6.1) fuzzes incorrectly with net/core/sock.c (ie "Hunk #6
succeeded at 2495 with fuzz 2 (offset 205 lines)") due to the following
change in 3.10.18:

 * http://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/commit/net/core/sock.c?h=linux-3.10.y&id=5e25ba5003ee5de0ba2be56bfd54d16d4b1b028d

the attached patch fixes that bad fuzz and the Makefile reject (ie
"EXTRAVERSION = -vs2.3.6.6").  apply the patch after applying
patch-3.10.17-vs2.3.6.6.diff to linux-3.10.18.

there's the slightest chance that my placement of hunk #6 should have come
before the newly introduced "sk->sk_pacing_rate = ~0U;", but my brief
analysis of hunk #6 says it doesn't concern itself with sk->sk_pacing_rate
(only sk->sk_vx_info, sk->sk_xid, sk->sk_nx_info, & sk->sk_nid) so it doesn't
matter, but i could be wrong.

attached is also a patch to include the deltas (fixes and features) found
since patch-3.10.17-vs2.3.6.6.diff was released (which i either personally
tested or have included in a linux-3.10.17-vs2.3.6.6.3 kernel which i've been
running "in production" for at least 48 hours).

and finally i've included a patch to allow for vserver experimental features
as CONFIG_EXPERIMENTAL has been removed from 3.10 (starting with 3.9?) so it
is currently impossible to enable them (without the attached patch).  the
experimental features are defaulted to "n", though VSERVER_AUTO_SINGLE use to
default to "y", but only when CONFIG_EXPERIMENTAL was enabled (so the true,
overall "default" was implicitly "n").

the resulting linux-3.10.18-vs2.3.6.6 (with all three attached patches
applied) boots in virtualbox and passes testme.sh and testfs.sh.

corey
--
undefined@pobox.com


--- a/linux-3.10.18-vs2.3.6.6/Makefile	2013-11-04 22:11:46.000000000 -0600
+++ b/linux-3.10.18-vs2.3.6.6/Makefile	2013-11-04 22:31:57.000000000 -0600
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 10
 SUBLEVEL = 18
-EXTRAVERSION =
+EXTRAVERSION = -vs2.3.6.6
 NAME = TOSSUG Baby Fish
 
 # *DOCUMENTATION*
diff -urNpd a/linux-3.10.18-vs2.3.6.6/net/core/sock.c b/linux-3.10.18-vs2.3.6.6/net/core/sock.c
--- a/linux-3.10.18-vs2.3.6.6/net/core/sock.c	2013-11-04 22:37:47.000000000 -0600
+++ b/linux-3.10.18-vs2.3.6.6/net/core/sock.c	2013-11-04 22:30:25.000000000 -0600
@@ -2291,6 +2291,13 @@ void sock_init_data(struct socket *sock,
 	sk->sk_stamp = ktime_set(-1L, 0);
 
 	sk->sk_pacing_rate = ~0U;
+
+	set_vx_info(&sk->sk_vx_info, current_vx_info());
+	sk->sk_xid = vx_current_xid();
+	vx_sock_inc(sk);
+	set_nx_info(&sk->sk_nx_info, current_nx_info());
+	sk->sk_nid = nx_current_nid();
+
 	/*
 	 * Before updating sk_refcnt, we must commit prior changes to memory
 	 * (Documentation/RCU/rculist_nulls.txt for details)
@@ -2495,12 +2502,6 @@ void sk_common_release(struct sock *sk)
 	if (sk->sk_prot->destroy)
 		sk->sk_prot->destroy(sk);
 
-	set_vx_info(&sk->sk_vx_info, current_vx_info());
-	sk->sk_xid = vx_current_xid();
-	vx_sock_inc(sk);
-	set_nx_info(&sk->sk_nx_info, current_nx_info());
-	sk->sk_nid = nx_current_nid();
-
 	/*
 	 * Observation: when sock_common_release is called, processes have
 	 * no access to socket. But net still has.


diff -urNpd a/linux-3.10.18-vs2.3.6.6/drivers/net/tun.c b/linux-3.10.18-vs2.3.6.6/drivers/net/tun.c
--- a/linux-3.10.18-vs2.3.6.6/drivers/net/tun.c	2013-11-04 22:44:18.000000000 -0600
+++ b/linux-3.10.18-vs2.3.6.6/drivers/net/tun.c	2013-11-04 22:32:24.000000000 -0600
@@ -1641,7 +1641,7 @@ static int tun_set_iff(struct net *net,
 		int queues = ifr->ifr_flags & IFF_MULTI_QUEUE ?
 			     MAX_TAP_QUEUES : 1;
 
-		if (!vx_ns_capable(net->user_ns, CAP_NET_ADMIN, NXC_TUN_CREATE))
+		if (!nx_ns_capable(net->user_ns, CAP_NET_ADMIN, NXC_TUN_CREATE))
 			return -EPERM;
 		err = security_tun_dev_create();
 		if (err < 0)
diff -urNpd a/linux-3.10.18-vs2.3.6.6/fs/namespace.c b/linux-3.10.18-vs2.3.6.6/fs/namespace.c
--- a/linux-3.10.18-vs2.3.6.6/fs/namespace.c	2013-11-04 22:44:28.000000000 -0600
+++ b/linux-3.10.18-vs2.3.6.6/fs/namespace.c	2013-11-04 22:32:42.000000000 -0600
@@ -1301,7 +1301,8 @@ static int do_umount(struct mount *mnt,
  */
 static inline bool may_mount(void)
 {
-	return ns_capable(current->nsproxy->mnt_ns->user_ns, CAP_SYS_ADMIN);
+	return vx_ns_capable(current->nsproxy->mnt_ns->user_ns,
+		CAP_SYS_ADMIN, VXC_SECURE_MOUNT);
 }
 
 /*
diff -urNpd a/linux-3.10.18-vs2.3.6.6/fs/proc/root.c b/linux-3.10.18-vs2.3.6.6/fs/proc/root.c
--- a/linux-3.10.18-vs2.3.6.6/fs/proc/root.c	2013-11-04 22:44:31.000000000 -0600
+++ b/linux-3.10.18-vs2.3.6.6/fs/proc/root.c	2013-11-04 22:32:45.000000000 -0600
@@ -116,7 +116,8 @@ static struct dentry *proc_mount(struct
 		options = data;
 
 		if (!current_user_ns()->may_mount_proc ||
-		    !ns_capable(ns->user_ns, CAP_SYS_ADMIN))
+		    !vx_ns_capable(ns->user_ns,
+			CAP_SYS_ADMIN, VXC_SECURE_MOUNT))
 			return ERR_PTR(-EPERM);
 	}
 
diff -urNpd a/linux-3.10.18-vs2.3.6.6/include/linux/vserver/base.h b/linux-3.10.18-vs2.3.6.6/include/linux/vserver/base.h
--- a/linux-3.10.18-vs2.3.6.6/include/linux/vserver/base.h	2013-11-04 22:44:18.000000000
-0600
+++ b/linux-3.10.18-vs2.3.6.6/include/linux/vserver/base.h	2013-11-04 22:32:24.000000000
-0600
@@ -143,6 +143,9 @@ enum {
 #define nx_capable(b, c) (capable(b) || \
 	(cap_raised(current_cap(), b) && nx_ncaps(c)))
 
+#define nx_ns_capable(n, b, c) (ns_capable(n, b) || \
+	(cap_raised(current_cap(), b) && nx_ncaps(c)))
+
 #define vx_task_initpid(t, n) \
 	((t)->vx_info && \
 	((t)->vx_info->vx_initpid == (n)))
diff -urNpd a/linux-3.10.18-vs2.3.6.6/include/uapi/vserver/context.h b/linux-3.10.18-vs2.3.6.6/include/uapi/vserver/context.h
--- a/linux-3.10.18-vs2.3.6.6/include/uapi/vserver/context.h	2013-11-04 22:44:28.000000000
-0600
+++ b/linux-3.10.18-vs2.3.6.6/include/uapi/vserver/context.h	2013-11-04 22:32:42.000000000
-0600
@@ -66,8 +66,8 @@
 #define VXC_OOM_ADJUST		0x00002000
 #define VXC_AUDIT_CONTROL	0x00004000
 
-/* #define VXC_SECURE_MOUNT	0x00010000
-#define VXC_SECURE_REMOUNT	0x00020000 */
+#define VXC_SECURE_MOUNT	0x00010000
+/* #define VXC_SECURE_REMOUNT	0x00020000 */
 #define VXC_BINARY_MOUNT	0x00040000
 #define VXC_DEV_MOUNT		0x00080000
 
diff -urNpd a/linux-3.10.18-vs2.3.6.6/ipc/shm.c b/linux-3.10.18-vs2.3.6.6/ipc/shm.c
--- a/linux-3.10.18-vs2.3.6.6/ipc/shm.c	2013-11-04 22:44:24.000000000 -0600
+++ b/linux-3.10.18-vs2.3.6.6/ipc/shm.c	2013-11-04 22:32:35.000000000 -0600
@@ -576,7 +576,7 @@ static int newseg(struct ipc_namespace *
 
 	ns->shm_tot += numpages;
 	error = shp->shm_perm.id;
-	shm_unlock(shp);
+
 	ipc_unlock_object(&shp->shm_perm);
 	rcu_read_unlock();
 	vx_ipcshm_add(current_vx_info(), key, numpages);


diff -urNpd a/linux-3.10.18-vs2.3.6.6/kernel/vserver/Kconfig b/linux-3.10.18-vs2.3.6.6/kernel/vserver/Kconfig
--- a/linux-3.10.18-vs2.3.6.6/kernel/vserver/Kconfig	2013-11-04 22:37:47.000000000 -0600
+++ b/linux-3.10.18-vs2.3.6.6/kernel/vserver/Kconfig	2013-11-04 22:45:03.000000000 -0600
@@ -13,9 +13,8 @@ config	VSERVER_AUTO_LBACK
 	  startup.
 
 config	VSERVER_AUTO_SINGLE
-	bool	"Automatic Single IP Special Casing"
-	depends on EXPERIMENTAL
-	default y
+	bool	"Automatic Single IP Special Casing (EXPERIMENTAL)"
+	default n
 	help
 	  This allows network contexts with a single IP to
 	  automatically remap 0.0.0.0 bindings to that IP,
@@ -35,8 +34,7 @@ config	VSERVER_COWBL
 	  link and create a copy of the unified file)
 
 config	VSERVER_VTIME
-	bool	"Enable Virtualized Guest Time"
-	depends on EXPERIMENTAL
+	bool	"Enable Virtualized Guest Time (EXPERIMENTAL)"
 	default n
 	help
 	  This enables per guest time offsets to allow for
@@ -45,8 +43,7 @@ config	VSERVER_VTIME
 	  therefore should not be enabled without good reason.
 
 config	VSERVER_DEVICE
-	bool	"Enable Guest Device Mapping"
-	depends on EXPERIMENTAL
+	bool	"Enable Guest Device Mapping (EXPERIMENTAL)"
 	default n
 	help
 	  This enables generic device remapping.