Subject: patching linux-3.10.19 (was Re: patches for applying patch-3.10.17-vs2.3.6.6.diff to linux-3.10.18)
From: Corey Wright <undefined@pobox.com>
Date: Wed, 13 Nov 2013 11:52:37 -0600
Wed, 13 Nov 2013 11:52:37 -0600
On Tue, 5 Nov 2013 07:35:37 -0600
Corey Wright <undefined@pobox.com> wrote:

> patch-3.10.17-vs2.3.6.6.diff appears to apply to linux-3.10.18, but patch
> (using version 2.6.1) fuzzes incorrectly with net/core/sock.c (ie "Hunk #6
> succeeded at 2495 with fuzz 2 (offset 205 lines)") due to the following
> change in 3.10.18:
> 
>  * http://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/commit/net/core/sock.c?h=linux-3.10.y&id=5e25ba5003ee5de0ba2be56bfd54d16d4b1b028d
> 
> the attached patch fixes that bad fuzz and the Makefile reject (ie
> "EXTRAVERSION = -vs2.3.6.6").  apply the patch after applying
> patch-3.10.17-vs2.3.6.6.diff to linux-3.10.18.
> 
> there's the slightest chance that my placement of hunk #6 should have come
> before the newly introduced "sk->sk_pacing_rate = ~0U;", but my brief
> analysis of hunk #6 says it doesn't concern itself with sk->sk_pacing_rate
> (only sk->sk_vx_info, sk->sk_xid, sk->sk_nx_info, & sk->sk_nid) so it doesn't
> matter, but i could be wrong.
> 
> attached is also a patch to include the deltas (fixes and features) found
> since patch-3.10.17-vs2.3.6.6.diff was released (which i either personally
> tested or have included in a linux-3.10.17-vs2.3.6.6.3 kernel which i've been
> running "in production" for at least 48 hours).
> 
> and finally i've included a patch to allow for vserver experimental features
> as CONFIG_EXPERIMENTAL has been removed from 3.10 (starting with 3.9?) so it
> is currently impossible to enable them (without the attached patch).  the
> experimental features are defaulted to "n", though VSERVER_AUTO_SINGLE use to
> default to "y", but only when CONFIG_EXPERIMENTAL was enabled (so the true,
> overall "default" was implicitly "n").
> 
> the resulting linux-3.10.18-vs2.3.6.6 (with all three attached patches
> applied) boots in virtualbox and passes testme.sh and testfs.sh.

3.10.19 appears to deviate little, if at all, from 3.10.18 in regard to
patching with patch-3.10.17-vs2.3.6.6.diff.

so either follow the previous/above instructions for 3.10.18, but using them
for 3.10.19 (and manually setting EXTRAVERSION in Makefile) or apply the
attached set of patches (after applying patch-3.10.17-vs2.3.6.6.diff to
linux-3.10.19).

 * patch-3.10.17-19-vs2.3.6.6.diff
  * merging of previous fixups & deltas patches
  * includes fixes, features, and repairing a bad fuzz
 * patch-3.10.19-vs2.3.6.6-remove_depends_on_EXPERIMENTAL.patch
  * allows enabling linux-vserver features marked experimental

the resulting kernel has been successfully built for x86-64 and tested
against testme.sh and testfs.sh in virtualbox.

corey
--
undefined@pobox.com

> corey
> --
> undefined@pobox.com


diff -urNpd a/linux-3.10.19-vs2.3.6.6/drivers/net/tun.c b/linux-3.10.19-vs2.3.6.6/drivers/net/tun.c
--- a/linux-3.10.19-vs2.3.6.6/drivers/net/tun.c	2013-11-13 08:49:36.000000000 -0600
+++ b/linux-3.10.19-vs2.3.6.6/drivers/net/tun.c	2013-11-13 08:54:37.000000000 -0600
@@ -1641,7 +1641,7 @@ static int tun_set_iff(struct net *net,
 		int queues = ifr->ifr_flags & IFF_MULTI_QUEUE ?
 			     MAX_TAP_QUEUES : 1;
 
-		if (!vx_ns_capable(net->user_ns, CAP_NET_ADMIN, NXC_TUN_CREATE))
+		if (!nx_ns_capable(net->user_ns, CAP_NET_ADMIN, NXC_TUN_CREATE))
 			return -EPERM;
 		err = security_tun_dev_create();
 		if (err < 0)
diff -urNpd a/linux-3.10.19-vs2.3.6.6/fs/namespace.c b/linux-3.10.19-vs2.3.6.6/fs/namespace.c
--- a/linux-3.10.19-vs2.3.6.6/fs/namespace.c	2013-11-13 08:49:36.000000000 -0600
+++ b/linux-3.10.19-vs2.3.6.6/fs/namespace.c	2013-11-13 08:54:37.000000000 -0600
@@ -1301,7 +1301,8 @@ static int do_umount(struct mount *mnt,
  */
 static inline bool may_mount(void)
 {
-	return ns_capable(current->nsproxy->mnt_ns->user_ns, CAP_SYS_ADMIN);
+	return vx_ns_capable(current->nsproxy->mnt_ns->user_ns,
+		CAP_SYS_ADMIN, VXC_SECURE_MOUNT);
 }
 
 /*
diff -urNpd a/linux-3.10.19-vs2.3.6.6/fs/proc/root.c b/linux-3.10.19-vs2.3.6.6/fs/proc/root.c
--- a/linux-3.10.19-vs2.3.6.6/fs/proc/root.c	2013-11-13 08:49:36.000000000 -0600
+++ b/linux-3.10.19-vs2.3.6.6/fs/proc/root.c	2013-11-13 08:54:37.000000000 -0600
@@ -116,7 +116,8 @@ static struct dentry *proc_mount(struct
 		options = data;
 
 		if (!current_user_ns()->may_mount_proc ||
-		    !ns_capable(ns->user_ns, CAP_SYS_ADMIN))
+		    !vx_ns_capable(ns->user_ns,
+			CAP_SYS_ADMIN, VXC_SECURE_MOUNT))
 			return ERR_PTR(-EPERM);
 	}
 
diff -urNpd a/linux-3.10.19-vs2.3.6.6/include/linux/vserver/base.h b/linux-3.10.19-vs2.3.6.6/include/linux/vserver/base.h
--- a/linux-3.10.19-vs2.3.6.6/include/linux/vserver/base.h	2013-11-13 08:49:36.000000000
-0600
+++ b/linux-3.10.19-vs2.3.6.6/include/linux/vserver/base.h	2013-11-13 08:54:37.000000000
-0600
@@ -143,6 +143,9 @@ enum {
 #define nx_capable(b, c) (capable(b) || \
 	(cap_raised(current_cap(), b) && nx_ncaps(c)))
 
+#define nx_ns_capable(n, b, c) (ns_capable(n, b) || \
+	(cap_raised(current_cap(), b) && nx_ncaps(c)))
+
 #define vx_task_initpid(t, n) \
 	((t)->vx_info && \
 	((t)->vx_info->vx_initpid == (n)))
diff -urNpd a/linux-3.10.19-vs2.3.6.6/include/uapi/vserver/context.h b/linux-3.10.19-vs2.3.6.6/include/uapi/vserver/context.h
--- a/linux-3.10.19-vs2.3.6.6/include/uapi/vserver/context.h	2013-11-13 08:49:36.000000000
-0600
+++ b/linux-3.10.19-vs2.3.6.6/include/uapi/vserver/context.h	2013-11-13 08:54:37.000000000
-0600
@@ -66,8 +66,8 @@
 #define VXC_OOM_ADJUST		0x00002000
 #define VXC_AUDIT_CONTROL	0x00004000
 
-/* #define VXC_SECURE_MOUNT	0x00010000
-#define VXC_SECURE_REMOUNT	0x00020000 */
+#define VXC_SECURE_MOUNT	0x00010000
+/* #define VXC_SECURE_REMOUNT	0x00020000 */
 #define VXC_BINARY_MOUNT	0x00040000
 #define VXC_DEV_MOUNT		0x00080000
 
diff -urNpd a/linux-3.10.19-vs2.3.6.6/ipc/shm.c b/linux-3.10.19-vs2.3.6.6/ipc/shm.c
--- a/linux-3.10.19-vs2.3.6.6/ipc/shm.c	2013-11-13 08:49:36.000000000 -0600
+++ b/linux-3.10.19-vs2.3.6.6/ipc/shm.c	2013-11-13 08:54:37.000000000 -0600
@@ -576,7 +576,7 @@ static int newseg(struct ipc_namespace *
 
 	ns->shm_tot += numpages;
 	error = shp->shm_perm.id;
-	shm_unlock(shp);
+
 	ipc_unlock_object(&shp->shm_perm);
 	rcu_read_unlock();
 	vx_ipcshm_add(current_vx_info(), key, numpages);
diff -urNpd a/linux-3.10.19-vs2.3.6.6/Makefile b/linux-3.10.19-vs2.3.6.6/Makefile
--- a/linux-3.10.19-vs2.3.6.6/Makefile	2013-11-13 08:42:27.000000000 -0600
+++ b/linux-3.10.19-vs2.3.6.6/Makefile	2013-11-13 08:54:57.000000000 -0600
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 10
 SUBLEVEL = 19
-EXTRAVERSION =
+EXTRAVERSION = -vs2.3.6.6
 NAME = TOSSUG Baby Fish
 
 # *DOCUMENTATION*
diff -urNpd a/linux-3.10.19-vs2.3.6.6/net/core/sock.c b/linux-3.10.19-vs2.3.6.6/net/core/sock.c
--- a/linux-3.10.19-vs2.3.6.6/net/core/sock.c	2013-11-13 08:49:36.000000000 -0600
+++ b/linux-3.10.19-vs2.3.6.6/net/core/sock.c	2013-11-13 08:54:37.000000000 -0600
@@ -2291,6 +2291,13 @@ void sock_init_data(struct socket *sock,
 	sk->sk_stamp = ktime_set(-1L, 0);
 
 	sk->sk_pacing_rate = ~0U;
+
+	set_vx_info(&sk->sk_vx_info, current_vx_info());
+	sk->sk_xid = vx_current_xid();
+	vx_sock_inc(sk);
+	set_nx_info(&sk->sk_nx_info, current_nx_info());
+	sk->sk_nid = nx_current_nid();
+
 	/*
 	 * Before updating sk_refcnt, we must commit prior changes to memory
 	 * (Documentation/RCU/rculist_nulls.txt for details)
@@ -2495,12 +2502,6 @@ void sk_common_release(struct sock *sk)
 	if (sk->sk_prot->destroy)
 		sk->sk_prot->destroy(sk);
 
-	set_vx_info(&sk->sk_vx_info, current_vx_info());
-	sk->sk_xid = vx_current_xid();
-	vx_sock_inc(sk);
-	set_nx_info(&sk->sk_nx_info, current_nx_info());
-	sk->sk_nid = nx_current_nid();
-
 	/*
 	 * Observation: when sock_common_release is called, processes have
 	 * no access to socket. But net still has.


diff -urNpd a/linux-3.10.19-vs2.3.6.6/kernel/vserver/Kconfig b/linux-3.10.19-vs2.3.6.6/kernel/vserver/Kconfig
--- a/linux-3.10.19-vs2.3.6.6/kernel/vserver/Kconfig	2013-11-13 08:49:36.000000000 -0600
+++ b/linux-3.10.19-vs2.3.6.6/kernel/vserver/Kconfig	2013-11-13 09:12:11.000000000 -0600
@@ -13,9 +13,8 @@ config	VSERVER_AUTO_LBACK
 	  startup.
 
 config	VSERVER_AUTO_SINGLE
-	bool	"Automatic Single IP Special Casing"
-	depends on EXPERIMENTAL
-	default y
+	bool	"Automatic Single IP Special Casing (EXPERIMENTAL)"
+	default n
 	help
 	  This allows network contexts with a single IP to
 	  automatically remap 0.0.0.0 bindings to that IP,
@@ -35,8 +34,7 @@ config	VSERVER_COWBL
 	  link and create a copy of the unified file)
 
 config	VSERVER_VTIME
-	bool	"Enable Virtualized Guest Time"
-	depends on EXPERIMENTAL
+	bool	"Enable Virtualized Guest Time (EXPERIMENTAL)"
 	default n
 	help
 	  This enables per guest time offsets to allow for
@@ -45,8 +43,7 @@ config	VSERVER_VTIME
 	  therefore should not be enabled without good reason.
 
 config	VSERVER_DEVICE
-	bool	"Enable Guest Device Mapping"
-	depends on EXPERIMENTAL
+	bool	"Enable Guest Device Mapping (EXPERIMENTAL)"
 	default n
 	help
 	  This enables generic device remapping.