On Sun, Dec 2, 2018 at 4:51 PM Sasha Levin <sashal(a)kernel.org> wrote:
>
> This is a note to let you know that I've just added the patch titled
>
> libceph: implement CEPHX_V2 calculation mode
>
> to the 4.14-stable tree which can be found at:
> http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
>
> The filename of the patch is:
> libceph-implement-cephx_v2-calculation-mode.patch
> and it can be found in the queue-4.14 subdirectory.
>
> If you, or anyone else, feels it should not be added to the stable tree,
> please let <stable(a)vger.kernel.org> know about it.
>
>
>
> commit 14735e0afb6ed378becd0dedf37d1e5ddfa12084
> Author: Ilya Dryomov <idryomov(a)gmail.com>
> Date: Fri Jul 27 19:25:32 2018 +0200
>
> libceph: implement CEPHX_V2 calculation mode
>
> commit cc255c76c70f7a87d97939621eae04b600d9f4a1 upstream.
>
> Derive the signature from the entire buffer (both AES cipher blocks)
> instead of using just the first half of the first block, leaving out
> data_crc entirely.
>
> This addresses CVE-2018-1129.
>
> Link: http://tracker.ceph.com/issues/24837
> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com>
> Reviewed-by: Sage Weil <sage(a)redhat.com>
> Signed-off-by: Ben Hutchings <ben.hutchings(a)codethink.co.uk>
> Signed-off-by: Sasha Levin <sashal(a)kernel.org>
Hi Sasha,
The CVEs mentioned in this series are server side and CEPHX_V2 is
probably more of a new feature than a security fix. That said, I don't
object to including it in 4.14.z. If you do, please pick up the
remaining two patches for interoperability:
f1d10e046379 libceph: weaken sizeof check in ceph_x_verify_authorizer_reply()
130f52f2b203 libceph: check authorizer reply/challenge length before reading
Thanks,
Ilya
Intel Merrifield has a reduced size of FIFO used in iDMA 32-bit controller,
i.e. 512 bytes instead of 1024.
Fix this by partitioning it as 64 bytes per channel.
Note, in the future we might switch to 'fifo-size' property instead of
hard coded value.
Fixes: 199244d69458 ("dmaengine: dw: add support of iDMA 32-bit hardware")
Signed-off-by: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com>
Cc: stable(a)vger.kernel.org
---
drivers/dma/dw/core.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/dma/dw/core.c b/drivers/dma/dw/core.c
index 2c5ca1961256..dc053e62f894 100644
--- a/drivers/dma/dw/core.c
+++ b/drivers/dma/dw/core.c
@@ -1061,12 +1061,12 @@ static void dwc_issue_pending(struct dma_chan *chan)
/*
* Program FIFO size of channels.
*
- * By default full FIFO (1024 bytes) is assigned to channel 0. Here we
+ * By default full FIFO (512 bytes) is assigned to channel 0. Here we
* slice FIFO on equal parts between channels.
*/
static void idma32_fifo_partition(struct dw_dma *dw)
{
- u64 value = IDMA32C_FP_PSIZE_CH0(128) | IDMA32C_FP_PSIZE_CH1(128) |
+ u64 value = IDMA32C_FP_PSIZE_CH0(64) | IDMA32C_FP_PSIZE_CH1(64) |
IDMA32C_FP_UPDATE;
u64 fifo_partition = 0;
@@ -1079,7 +1079,7 @@ static void idma32_fifo_partition(struct dw_dma *dw)
/* Fill FIFO_PARTITION high bits (Channels 2..3, 6..7) */
fifo_partition |= value << 32;
- /* Program FIFO Partition registers - 128 bytes for each channel */
+ /* Program FIFO Partition registers - 64 bytes per channel */
idma32_writeq(dw, FIFO_PARTITION1, fifo_partition);
idma32_writeq(dw, FIFO_PARTITION0, fifo_partition);
}
--
2.19.2
This is the start of the stable review cycle for the 4.9.143 release.
There are 50 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu Dec 6 10:36:59 UTC 2018.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.143-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.9.143-rc1
Chris Fries <cfries(a)google.com>
kbuild: Set KBUILD_CFLAGS before incl. arch Makefile
Ard Biesheuvel <ard.biesheuvel(a)linaro.org>
efi/libstub: Make file I/O chunking x86-specific
Arnd Bergmann <arnd(a)arndb.de>
workqueue: avoid clang warning
Stefan Agner <stefan(a)agner.ch>
ARM: trusted_foundations: do not use naked function
Stefan Agner <stefan(a)agner.ch>
bus: arm-cci: remove unnecessary unreachable()
Stefan Agner <stefan(a)agner.ch>
ARM: 8767/1: add support for building ARM kernel with clang
Stefan Agner <stefan(a)agner.ch>
ARM: 8766/1: drop no-thumb-interwork in EABI mode
Alistair Strachan <astrachan(a)google.com>
efi/libstub: arm: support building with clang
YueHaibing <yuehaibing(a)huawei.com>
misc: mic/scif: fix copy-paste error in scif_create_remote_lookup
Dexuan Cui <decui(a)microsoft.com>
Drivers: hv: vmbus: check the creation_status in vmbus_establish_gpadl()
Yu Zhao <yuzhao(a)google.com>
mm: use swp_offset as key in shmem_replace_page()
Martin Kelly <martin(a)martingkelly.com>
iio:st_magn: Fix enable device after trigger
Felipe Balbi <felipe.balbi(a)linux.intel.com>
Revert "usb: dwc3: gadget: skip Set/Clear Halt when invalid"
Michael Niewöhner <linux(a)mniewoehner.de>
usb: core: quirks: add RESET_RESUME quirk for Cherry G230 Stream series
Kai-Heng Feng <kai.heng.feng(a)canonical.com>
USB: usb-storage: Add new IDs to ums-realtek
Josef Bacik <josef(a)toxicpanda.com>
btrfs: release metadata before running delayed refs
Richard Genoud <richard.genoud(a)gmail.com>
dmaengine: at_hdmac: fix module unloading
Richard Genoud <richard.genoud(a)gmail.com>
dmaengine: at_hdmac: fix memory leak in at_dma_xlate()
Pan Bian <bianpan2016(a)163.com>
ext2: fix potential use after free
Takashi Iwai <tiwai(a)suse.de>
ALSA: sparc: Fix invalid snd_free_pages() at error path
Takashi Iwai <tiwai(a)suse.de>
ALSA: control: Fix race between adding and removing a user element
Takashi Iwai <tiwai(a)suse.de>
ALSA: ac97: Fix incorrect bit shift at AC97-SPSA control write
Takashi Iwai <tiwai(a)suse.de>
ALSA: wss: Fix invalid snd_free_pages() at error path
Maximilian Heyne <mheyne(a)amazon.de>
fs: fix lost error code in dio_complete
Jiri Olsa <jolsa(a)kernel.org>
perf/x86/intel: Add generic branch tracing check to intel_pmu_has_bts()
Jiri Olsa <jolsa(a)kernel.org>
perf/x86/intel: Move branch tracing setup to the Intel-specific source file
Filipe Manana <fdmanana(a)suse.com>
Btrfs: ensure path name is null terminated at btrfs_control_ioctl
Max Filippov <jcmvbkbc(a)gmail.com>
xtensa: fix coprocessor context offset definitions
Max Filippov <jcmvbkbc(a)gmail.com>
xtensa: enable coprocessors that are being flushed
Wanpeng Li <wanpengli(a)tencent.com>
KVM: X86: Fix scan ioapic use-before-initialization
Jim Mattson <jmattson(a)google.com>
kvm: svm: Ensure an IBPB on all affected CPUs when freeing a vmcb
Junaid Shahid <junaids(a)google.com>
kvm: mmu: Fix race in emulated page table writes
Bernd Eckstein <3erndeckstein(a)gmail.com>
usbnet: ipheth: fix potential recvmsg bug and recvmsg bug 2
Julian Wiedmann <jwi(a)linux.ibm.com>
s390/qeth: fix length check in SNMP processing
Pan Bian <bianpan2016(a)163.com>
rapidio/rionet: do not free skb before reading its length
Petr Machata <petrm(a)mellanox.com>
net: skb_scrub_packet(): Scrub offload_fwd_mark
Sasha Levin <sashal(a)kernel.org>
Revert "wlcore: Add missing PM call for wlcore_cmd_wait_for_event_or_timeout()"
Matthias Schwarzott <zzam(a)gentoo.org>
media: em28xx: Fix use-after-free when disconnecting
Hugh Dickins <hughd(a)google.com>
mm/khugepaged: collapse_shmem() do not crash on Compound
Hugh Dickins <hughd(a)google.com>
mm/khugepaged: collapse_shmem() without freezing new_page
Hugh Dickins <hughd(a)google.com>
mm/khugepaged: minor reorderings in collapse_shmem()
Hugh Dickins <hughd(a)google.com>
mm/khugepaged: collapse_shmem() remember to clear holes
Hugh Dickins <hughd(a)google.com>
mm/khugepaged: fix crashes due to misaccounted holes
Mike Rapoport <rppt(a)linux.vnet.ibm.com>
shmem: introduce shmem_inode_acct_block
Mike Rapoport <rppt(a)linux.vnet.ibm.com>
shmem: shmem_charge: verify max_block is not exceeded before inode update
Hugh Dickins <hughd(a)google.com>
mm/khugepaged: collapse_shmem() stop if punched or truncated
Hugh Dickins <hughd(a)google.com>
mm/huge_memory: fix lockdep complaint on 32-bit i_size_read()
Hugh Dickins <hughd(a)google.com>
mm/huge_memory: splitting set mapping+index before unfreeze
Konstantin Khlebnikov <khlebnikov(a)yandex-team.ru>
mm/huge_memory.c: reorder operations in __split_huge_page_tail()
Hugh Dickins <hughd(a)google.com>
mm/huge_memory: rename freeze_page() to unmap_page()
-------------
Diffstat:
Makefile | 69 ++++++-------
arch/arm/Makefile | 2 +-
arch/arm/boot/compressed/Makefile | 2 +-
arch/arm/firmware/trusted_foundations.c | 14 ++-
arch/x86/events/core.c | 20 ----
arch/x86/events/intel/core.c | 52 +++++++---
arch/x86/events/perf_event.h | 13 ++-
arch/x86/kvm/mmu.c | 27 ++----
arch/x86/kvm/svm.c | 20 +++-
arch/x86/kvm/x86.c | 3 +-
arch/xtensa/kernel/asm-offsets.c | 16 +--
arch/xtensa/kernel/process.c | 5 +-
drivers/bus/arm-cci.c | 2 -
drivers/dma/at_hdmac.c | 10 +-
drivers/firmware/efi/libstub/Makefile | 3 +-
drivers/firmware/efi/libstub/efi-stub-helper.c | 11 ++-
drivers/hv/channel.c | 8 ++
drivers/iio/magnetometer/st_magn_buffer.c | 12 +--
drivers/media/usb/em28xx/em28xx-dvb.c | 3 +-
drivers/misc/mic/scif/scif_rma.c | 2 +-
drivers/net/rionet.c | 2 +-
drivers/net/usb/ipheth.c | 10 +-
drivers/net/wireless/ti/wlcore/cmd.c | 6 --
drivers/s390/net/qeth_core_main.c | 27 +++---
drivers/usb/core/quirks.c | 3 +
drivers/usb/dwc3/gadget.c | 5 -
drivers/usb/storage/unusual_realtek.h | 10 ++
fs/btrfs/super.c | 1 +
fs/btrfs/transaction.c | 6 +-
fs/direct-io.c | 4 +-
fs/ext2/xattr.c | 2 +-
include/linux/workqueue.h | 4 +-
mm/huge_memory.c | 79 +++++++--------
mm/khugepaged.c | 129 ++++++++++++++-----------
mm/shmem.c | 97 ++++++++++---------
net/core/skbuff.c | 4 +
sound/core/control.c | 80 ++++++++-------
sound/isa/wss/wss_lib.c | 2 -
sound/pci/ac97/ac97_codec.c | 2 +-
sound/sparc/cs4231.c | 8 +-
40 files changed, 424 insertions(+), 351 deletions(-)
Hello,
We ran automated tests on a recent commit from this kernel tree:
Kernel repo: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
Commit: 61c68f2a2af0 Linux 4.19.7
The results of these automated tests are provided below.
Overall result: PASSED
Patch merge: OK
Compile: OK
Kernel tests: OK
Please reply to this email if you have any questions about the tests that we
ran or if you have any suggestions on how to make future tests more effective.
,-. ,-.
( C ) ( K ) Continuous
`-',-.`-' Kernel
( I ) Integration
`-'
______________________________________________________________________________
Compile testing
---------------
We compiled the kernel for 2 architectures:
aarch64:
make options: make INSTALL_MOD_STRIP=1 -j56 targz-pkg
configuration: https://artifacts.cki-project.org/builds/aarch64/61c68f2a2af0f3dc531053524f…
x86_64:
make options: make INSTALL_MOD_STRIP=1 -j56 targz-pkg
configuration: https://artifacts.cki-project.org/builds/x86_64/61c68f2a2af0f3dc531053524f9…
Hardware testing
----------------
We booted each kernel and ran the following tests:
arm64:
/distribution/kpkginstall (boot test)
LTP lite - release 20180515
xfstests: ext4
xfstests: xfs
/kernel/misc/amtu
x86_64:
/distribution/kpkginstall (boot test)
LTP lite - release 20180515
xfstests: ext4
xfstests: xfs
/kernel/misc/amtu