I'm announcing the release of the 4.19.279 kernel.
All users of the 4.19 kernel series must upgrade.
The updated 4.19.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.19.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 +-
arch/x86/mm/mem_encrypt_identity.c | 3 ++-
drivers/block/sunvdc.c | 2 ++
drivers/clk/Kconfig | 2 +-
drivers/gpu/drm/amd/amdkfd/kfd_events.c | 9 +++------
drivers/gpu/drm/i915/intel_ringbuffer.c | 5 +++--
drivers/hid/hid-core.c | 18 +++++++++++++-----
drivers/hid/uhid.c | 1 +
drivers/hwmon/adt7475.c | 8 ++++----
drivers/hwmon/xgene-hwmon.c | 1 +
drivers/media/i2c/m5mols/m5mols_core.c | 2 +-
drivers/mmc/host/atmel-mci.c | 3 ---
drivers/net/ethernet/qlogic/qed/qed_dev.c | 5 +++++
drivers/net/ethernet/sun/ldmvsw.c | 3 +++
drivers/net/ethernet/sun/sunvnet.c | 3 +++
drivers/net/phy/smsc.c | 5 ++++-
drivers/net/usb/smsc75xx.c | 7 +++++++
drivers/nfc/pn533/usb.c | 1 +
drivers/nfc/st-nci/ndlc.c | 6 ++++--
drivers/nvme/target/core.c | 4 +++-
drivers/tty/serial/8250/8250_em.c | 4 ++--
drivers/video/fbdev/stifb.c | 27 +++++++++++++++++++++++++++
fs/ext4/inode.c | 18 ++++++++----------
fs/ext4/page-io.c | 11 ++++++-----
fs/ext4/xattr.c | 11 +++++++++++
fs/jffs2/file.c | 15 +++++++--------
fs/sysfs/file.c | 2 +-
include/linux/hid.h | 3 +++
include/linux/netdevice.h | 6 ++++--
include/linux/sh_intc.h | 5 ++++-
include/linux/tracepoint.h | 15 ++++++---------
kernel/trace/ftrace.c | 3 ++-
kernel/trace/trace_events_hist.c | 3 +++
net/ipv4/fib_frontend.c | 3 +++
net/ipv4/ip_tunnel.c | 12 ++++++------
net/ipv4/tcp_output.c | 2 +-
net/ipv6/ip6_tunnel.c | 4 ++--
net/iucv/iucv.c | 2 +-
38 files changed, 159 insertions(+), 77 deletions(-)
Alexandra Winter (1):
net/iucv: Fix size of interrupt data
Baokun Li (2):
ext4: fail ext4_iget if special inode unallocated
ext4: fix task hung in ext4_xattr_delete_inode
Biju Das (1):
serial: 8250_em: Fix UART port type
Breno Leitao (1):
tcp: tcp_make_synack() can be called from process context
Chen Zhongjin (1):
ftrace: Fix invalid address access in lookup_rec() when index is 0
Damien Le Moal (1):
nvmet: avoid potential UAF in nvmet_req_complete()
Daniil Tatianin (1):
qed/qed_dev: guard against a possible division by zero
Eric Biggers (2):
ext4: fix cgroup writeback accounting with fs-layer encryption
fs: sysfs_emit_at: Remove PAGE_SIZE alignment check
Eric Dumazet (1):
net: tunnels: annotate lockless accesses to dev->needed_headroom
Fedor Pchelkin (1):
nfc: pn533: initialize struct pn533_out_arg properly
Greg Kroah-Hartman (1):
Linux 4.19.279
Heiner Kallweit (1):
net: phy: smsc: bail out in lan87xx_read_status if genphy_read_status fails
Helge Deller (1):
fbdev: stifb: Provide valid pixelclock and add fb_check_var() checks
Ido Schimmel (1):
ipv4: Fix incorrect table ID in IOCTL path
John Harrison (1):
drm/i915: Don't use stolen memory for ring buffers with LLC
Lee Jones (2):
HID: core: Provide new max_buffer_size attribute to over-ride the default
HID: uhid: Over-ride the default maximum data buffer value with our own
Liang He (2):
block: sunvdc: add check for mdesc_grab() returning NULL
ethernet: sun: add check for the mdesc_grab()
Linus Torvalds (1):
media: m5mols: fix off-by-one loop termination error
Michael Karcher (1):
sh: intc: Avoid spurious sizeof-pointer-div warning
Nikita Zhandarovich (1):
x86/mm: Fix use of uninitialized buffer in sme_enable()
Qu Huang (1):
drm/amdkfd: Fix an illegal memory access
Randy Dunlap (1):
clk: HI655X: select REGMAP instead of depending on it
Steven Rostedt (Google) (2):
tracing: Check field value in hist_field_name()
tracing: Make tracepoint lockdep check actually test something
Szymon Heidrich (2):
net: usb: smsc75xx: Limit packet length to skb->len
net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull
Tobias Schramm (1):
mmc: atmel-mci: fix race between stop command and start of next command
Tony O'Brien (2):
hwmon: (adt7475) Display smoothing attributes in correct order
hwmon: (adt7475) Fix masking of hysteresis registers
Yifei Liu (1):
jffs2: correct logic when creating a hole in jffs2_write_begin
Zheng Wang (2):
nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition
hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition
I'm announcing the release of the 4.14.311 kernel.
All users of the 4.14 kernel series must upgrade.
The updated 4.14.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.14.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 +-
drivers/block/sunvdc.c | 2 ++
drivers/gpu/drm/i915/intel_ringbuffer.c | 5 +++--
drivers/hid/hid-core.c | 18 +++++++++++++-----
drivers/hid/uhid.c | 1 +
drivers/hwmon/adt7475.c | 8 ++++----
drivers/hwmon/xgene-hwmon.c | 1 +
drivers/media/i2c/m5mols/m5mols_core.c | 2 +-
drivers/mmc/host/atmel-mci.c | 3 ---
drivers/net/ethernet/qlogic/qed/qed_dev.c | 5 +++++
drivers/net/ethernet/sun/ldmvsw.c | 3 +++
drivers/net/ethernet/sun/sunvnet.c | 3 +++
drivers/net/phy/smsc.c | 5 ++++-
drivers/net/usb/smsc75xx.c | 7 +++++++
drivers/nfc/pn533/usb.c | 1 +
drivers/nfc/st-nci/ndlc.c | 6 ++++--
drivers/nvme/target/core.c | 4 +++-
drivers/tty/serial/8250/8250_em.c | 4 ++--
drivers/video/fbdev/stifb.c | 27 +++++++++++++++++++++++++++
fs/ext4/inode.c | 18 ++++++++----------
fs/ext4/page-io.c | 11 ++++++-----
fs/ext4/xattr.c | 11 +++++++++++
fs/sysfs/file.c | 2 +-
include/linux/hid.h | 3 +++
include/linux/netdevice.h | 6 ++++--
include/linux/sh_intc.h | 5 ++++-
kernel/trace/ftrace.c | 3 ++-
net/ipv4/fib_frontend.c | 3 +++
net/ipv4/ip_tunnel.c | 12 ++++++------
net/ipv4/tcp_output.c | 2 +-
net/ipv6/ip6_tunnel.c | 4 ++--
net/iucv/iucv.c | 2 +-
32 files changed, 137 insertions(+), 52 deletions(-)
Alexandra Winter (1):
net/iucv: Fix size of interrupt data
Baokun Li (2):
ext4: fail ext4_iget if special inode unallocated
ext4: fix task hung in ext4_xattr_delete_inode
Biju Das (1):
serial: 8250_em: Fix UART port type
Breno Leitao (1):
tcp: tcp_make_synack() can be called from process context
Chen Zhongjin (1):
ftrace: Fix invalid address access in lookup_rec() when index is 0
Damien Le Moal (1):
nvmet: avoid potential UAF in nvmet_req_complete()
Daniil Tatianin (1):
qed/qed_dev: guard against a possible division by zero
Eric Biggers (2):
ext4: fix cgroup writeback accounting with fs-layer encryption
fs: sysfs_emit_at: Remove PAGE_SIZE alignment check
Eric Dumazet (1):
net: tunnels: annotate lockless accesses to dev->needed_headroom
Fedor Pchelkin (1):
nfc: pn533: initialize struct pn533_out_arg properly
Greg Kroah-Hartman (1):
Linux 4.14.311
Heiner Kallweit (1):
net: phy: smsc: bail out in lan87xx_read_status if genphy_read_status fails
Helge Deller (1):
fbdev: stifb: Provide valid pixelclock and add fb_check_var() checks
Ido Schimmel (1):
ipv4: Fix incorrect table ID in IOCTL path
John Harrison (1):
drm/i915: Don't use stolen memory for ring buffers with LLC
Lee Jones (2):
HID: core: Provide new max_buffer_size attribute to over-ride the default
HID: uhid: Over-ride the default maximum data buffer value with our own
Liang He (2):
block: sunvdc: add check for mdesc_grab() returning NULL
ethernet: sun: add check for the mdesc_grab()
Linus Torvalds (1):
media: m5mols: fix off-by-one loop termination error
Michael Karcher (1):
sh: intc: Avoid spurious sizeof-pointer-div warning
Szymon Heidrich (2):
net: usb: smsc75xx: Limit packet length to skb->len
net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull
Tobias Schramm (1):
mmc: atmel-mci: fix race between stop command and start of next command
Tony O'Brien (2):
hwmon: (adt7475) Display smoothing attributes in correct order
hwmon: (adt7475) Fix masking of hysteresis registers
Zheng Wang (2):
nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition
hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition
The following commit has been merged into the x86/urgent branch of tip:
Commit-ID: b15888840207c2bfe678dd1f68a32db54315e71f
Gitweb: https://git.kernel.org/tip/b15888840207c2bfe678dd1f68a32db54315e71f
Author: Chang S. Bae <chang.seok.bae(a)intel.com>
AuthorDate: Mon, 27 Feb 2023 13:05:03 -08:00
Committer: Dave Hansen <dave.hansen(a)linux.intel.com>
CommitterDate: Wed, 22 Mar 2023 10:59:13 -07:00
x86/fpu/xstate: Prevent false-positive warning in __copy_xstate_uabi_buf()
__copy_xstate_to_uabi_buf() copies either from the tasks XSAVE buffer
or from init_fpstate into the ptrace buffer. Dynamic features, like
XTILEDATA, have an all zeroes init state and are not saved in
init_fpstate, which means the corresponding bit is not set in the
xfeatures bitmap of the init_fpstate header.
But __copy_xstate_to_uabi_buf() retrieves addresses for both the tasks
xstate and init_fpstate unconditionally via __raw_xsave_addr().
So if the tasks XSAVE buffer has a dynamic feature set, then the
address retrieval for init_fpstate triggers the warning in
__raw_xsave_addr() which checks the feature bit in the init_fpstate
header.
Remove the address retrieval from init_fpstate for extended features.
They have an all zeroes init state so init_fpstate has zeros for them.
Then zeroing the user buffer for the init state is the same as copying
them from init_fpstate.
Fixes: 2308ee57d93d ("x86/fpu/amx: Enable the AMX feature in 64-bit mode")
Reported-by: Mingwei Zhang <mizhang(a)google.com>
Link: https://lore.kernel.org/kvm/20230221163655.920289-2-mizhang@google.com/
Signed-off-by: Chang S. Bae <chang.seok.bae(a)intel.com>
Signed-off-by: Dave Hansen <dave.hansen(a)linux.intel.com>
Tested-by: Mingwei Zhang <mizhang(a)google.com>
Link: https://lore.kernel.org/all/20230227210504.18520-2-chang.seok.bae%40intel.c…
Cc: stable(a)vger.kernel.org
---
arch/x86/kernel/fpu/xstate.c | 30 ++++++++++++++----------------
1 file changed, 14 insertions(+), 16 deletions(-)
diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c
index 714166c..0bab497 100644
--- a/arch/x86/kernel/fpu/xstate.c
+++ b/arch/x86/kernel/fpu/xstate.c
@@ -1118,21 +1118,20 @@ void __copy_xstate_to_uabi_buf(struct membuf to, struct fpstate *fpstate,
zerofrom = offsetof(struct xregs_state, extended_state_area);
/*
- * The ptrace buffer is in non-compacted XSAVE format. In
- * non-compacted format disabled features still occupy state space,
- * but there is no state to copy from in the compacted
- * init_fpstate. The gap tracking will zero these states.
- */
- mask = fpstate->user_xfeatures;
-
- /*
- * Dynamic features are not present in init_fpstate. When they are
- * in an all zeros init state, remove those from 'mask' to zero
- * those features in the user buffer instead of retrieving them
- * from init_fpstate.
+ * This 'mask' indicates which states to copy from fpstate.
+ * Those extended states that are not present in fpstate are
+ * either disabled or initialized:
+ *
+ * In non-compacted format, disabled features still occupy
+ * state space but there is no state to copy from in the
+ * compacted init_fpstate. The gap tracking will zero these
+ * states.
+ *
+ * The extended features have an all zeroes init state. Thus,
+ * remove them from 'mask' to zero those features in the user
+ * buffer instead of retrieving them from init_fpstate.
*/
- if (fpu_state_size_dynamic())
- mask &= (header.xfeatures | xinit->header.xcomp_bv);
+ mask = header.xfeatures;
for_each_extended_xfeature(i, mask) {
/*
@@ -1151,9 +1150,8 @@ void __copy_xstate_to_uabi_buf(struct membuf to, struct fpstate *fpstate,
pkru.pkru = pkru_val;
membuf_write(&to, &pkru, sizeof(pkru));
} else {
- copy_feature(header.xfeatures & BIT_ULL(i), &to,
+ membuf_write(&to,
__raw_xsave_addr(xsave, i),
- __raw_xsave_addr(xinit, i),
xstate_sizes[i]);
}
/*
The following commit has been merged into the x86/urgent branch of tip:
Commit-ID: a3f547addcaa10df5a226526bc9e2d9a94542344
Gitweb: https://git.kernel.org/tip/a3f547addcaa10df5a226526bc9e2d9a94542344
Author: Michal Koutný <mkoutny(a)suse.com>
AuthorDate: Mon, 06 Mar 2023 20:31:44 +01:00
Committer: Dave Hansen <dave.hansen(a)linux.intel.com>
CommitterDate: Wed, 22 Mar 2023 10:42:47 -07:00
x86/mm: Do not shuffle CPU entry areas without KASLR
The commit 97e3d26b5e5f ("x86/mm: Randomize per-cpu entry area") fixed
an omission of KASLR on CPU entry areas. It doesn't take into account
KASLR switches though, which may result in unintended non-determinism
when a user wants to avoid it (e.g. debugging, benchmarking).
Generate only a single combination of CPU entry areas offsets -- the
linear array that existed prior randomization when KASLR is turned off.
Since we have 3f148f331814 ("x86/kasan: Map shadow for percpu pages on
demand") and followups, we can use the more relaxed guard
kasrl_enabled() (in contrast to kaslr_memory_enabled()).
Fixes: 97e3d26b5e5f ("x86/mm: Randomize per-cpu entry area")
Signed-off-by: Michal Koutný <mkoutny(a)suse.com>
Signed-off-by: Dave Hansen <dave.hansen(a)linux.intel.com>
Cc: stable(a)vger.kernel.org
Link: https://lore.kernel.org/all/20230306193144.24605-1-mkoutny%40suse.com
---
arch/x86/mm/cpu_entry_area.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/arch/x86/mm/cpu_entry_area.c b/arch/x86/mm/cpu_entry_area.c
index 7316a82..e91500a 100644
--- a/arch/x86/mm/cpu_entry_area.c
+++ b/arch/x86/mm/cpu_entry_area.c
@@ -10,6 +10,7 @@
#include <asm/fixmap.h>
#include <asm/desc.h>
#include <asm/kasan.h>
+#include <asm/setup.h>
static DEFINE_PER_CPU_PAGE_ALIGNED(struct entry_stack_page, entry_stack_storage);
@@ -29,6 +30,12 @@ static __init void init_cea_offsets(void)
unsigned int max_cea;
unsigned int i, j;
+ if (!kaslr_enabled()) {
+ for_each_possible_cpu(i)
+ per_cpu(_cea_offset, i) = i;
+ return;
+ }
+
max_cea = (CPU_ENTRY_AREA_MAP_SIZE - PAGE_SIZE) / CPU_ENTRY_AREA_SIZE;
/* O(sodding terrible) */