linux.git/arch, branch v5.1.18

x86/tls: Fix possible spectre-v1 in do_get_thread_area()

2019-07-14T06:09:48+00:00

commit 993773d11d45c90cb1c6481c2638c3d9f092ea5b upstream.

The index to access the threads tls array is controlled by userspace
via syscall: sys_ptrace(), hence leading to a potential exploitation
of the Spectre variant 1 vulnerability.

The index can be controlled from:
        ptrace -> arch_ptrace -> do_get_thread_area.

Fix this by sanitizing the user supplied index before using it to access
the p->thread.tls_array.

Signed-off-by: Dianzhang Chen 
Signed-off-by: Thomas Gleixner 
Cc: bp@alien8.de
Cc: hpa@zytor.com
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/1561524630-3642-1-git-send-email-dianzhangchen0@gmail.com
Signed-off-by: Greg Kroah-Hartman

x86/ptrace: Fix possible spectre-v1 in ptrace_get_debugreg()

2019-07-14T06:09:48+00:00

commit 31a2fbb390fee4231281b939e1979e810f945415 upstream.

The index to access the threads ptrace_bps is controlled by userspace via
syscall: sys_ptrace(), hence leading to a potential exploitation of the
Spectre variant 1 vulnerability.

The index can be controlled from:
    ptrace -> arch_ptrace -> ptrace_get_debugreg.

Fix this by sanitizing the user supplied index before using it access
thread->ptrace_bps.

Signed-off-by: Dianzhang Chen 
Signed-off-by: Thomas Gleixner 
Cc: bp@alien8.de
Cc: hpa@zytor.com
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/1561476617-3759-1-git-send-email-dianzhangchen0@gmail.com
Signed-off-by: Greg Kroah-Hartman

powerpc: enable a 30-bit ZONE_DMA for 32-bit pmac

2019-07-14T06:09:45+00:00

[ Upstream commit 9739ab7eda459f0669ec9807e0d9be5020bab88c ]

With the strict dma mask checking introduced with the switch to
the generic DMA direct code common wifi chips on 32-bit powerbooks
stopped working.  Add a 30-bit ZONE_DMA to the 32-bit pmac builds
to allow them to reliably allocate dma coherent memory.

Fixes: 65a21b71f948 ("powerpc/dma: remove dma_nommu_dma_supported")
Reported-by: Aaro Koskinen 
Signed-off-by: Christoph Hellwig 
Tested-by: Larry Finger 
Acked-by: Larry Finger 
Tested-by: Aaro Koskinen 
Signed-off-by: Michael Ellerman 
Signed-off-by: Sasha Levin

bpf, x64: fix stack layout of JITed bpf code

2019-07-14T06:09:43+00:00

[ Upstream commit fe8d9571dc50232b569242fac7ea6332a654f186 ]

Since commit 177366bf7ceb the %rbp stopped pointing to %rbp of the
previous stack frame. That broke frame pointer based stack unwinding.
This commit is a partial revert of it.
Note that the location of tail_call_cnt is fixed, since the verifier
enforces MAX_BPF_STACK stack size for programs with tail calls.

Fixes: 177366bf7ceb ("bpf: change x86 JITed program stack layout")
Signed-off-by: Alexei Starovoitov 
Signed-off-by: Sasha Levin

ARM: davinci: da8xx: specify dma_coherent_mask for lcdc

2019-07-14T06:09:42+00:00

[ Upstream commit 68f2515bb31a664ba3e2bc1eb78dd9f529b10067 ]

The lcdc device is missing the dma_coherent_mask definition causing the
following warning on da850-evm:

da8xx_lcdc da8xx_lcdc.0: found Sharp_LK043T1DG01 panel
------------[ cut here ]------------
WARNING: CPU: 0 PID: 1 at kernel/dma/mapping.c:247 dma_alloc_attrs+0xc8/0x110
Modules linked in:
CPU: 0 PID: 1 Comm: swapper Not tainted 5.2.0-rc3-00077-g16d72dd4891f #18
Hardware name: DaVinci DA850/OMAP-L138/AM18x EVM
[] (unwind_backtrace) from [] (show_stack+0x10/0x14)
[] (show_stack) from [] (__warn+0xec/0x114)
[] (__warn) from [] (warn_slowpath_null+0x3c/0x48)
[] (warn_slowpath_null) from [] (dma_alloc_attrs+0xc8/0x110)
[] (dma_alloc_attrs) from [] (fb_probe+0x228/0x5a8)
[] (fb_probe) from [] (platform_drv_probe+0x48/0x9c)
[] (platform_drv_probe) from [] (really_probe+0x1d8/0x2d4)
[] (really_probe) from [] (driver_probe_device+0x5c/0x168)
[] (driver_probe_device) from [] (device_driver_attach+0x58/0x60)
[] (device_driver_attach) from [] (__driver_attach+0x80/0xbc)
[] (__driver_attach) from [] (bus_for_each_dev+0x64/0xb4)
[] (bus_for_each_dev) from [] (bus_add_driver+0xe4/0x1d8)
[] (bus_add_driver) from [] (driver_register+0x78/0x10c)
[] (driver_register) from [] (do_one_initcall+0x48/0x1bc)
[] (do_one_initcall) from [] (kernel_init_freeable+0x10c/0x1d8)
[] (kernel_init_freeable) from [] (kernel_init+0x8/0xf4)
[] (kernel_init) from [] (ret_from_fork+0x14/0x34)
Exception stack(0xc6837fb0 to 0xc6837ff8)
7fa0:                                     00000000 00000000 00000000 00000000
7fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
7fe0: 00000000 00000000 00000000 00000000 00000013 00000000
---[ end trace 8a8073511be81dd2 ]---

Add a 32-bit mask to the platform device's definition.

Signed-off-by: Bartosz Golaszewski 

Signed-off-by: Sekhar Nori 
Signed-off-by: Sasha Levin

ARM: davinci: da850-evm: call regulator_has_full_constraints()

2019-07-14T06:09:41+00:00

[ Upstream commit 0c0c9b5753cd04601b17de09da1ed2885a3b42fe ]

The BB expander at 0x21 i2c bus 1 fails to probe on da850-evm because
the board doesn't set has_full_constraints to true in the regulator
API.

Call regulator_has_full_constraints() at the end of board registration
just like we do in da850-lcdk and da830-evm.

Reviewed-by: Linus Walleij 
Signed-off-by: Bartosz Golaszewski 
Signed-off-by: Sekhar Nori 
Signed-off-by: Sasha Levin

KVM: nVMX: use correct clean fields when copying from eVMCS

2019-07-14T06:09:41+00:00

[ Upstream commit f9bc5227652df4900eff12a9b8b38e9a8c7c78ea ]

Unfortunately, a couple of mistakes were made while implementing
Enlightened VMCS support, in particular, wrong clean fields were
used in copy_enlightened_to_vmcs12():
- exception_bitmap is covered by CONTROL_EXCPN;
- vm_exit_controls/pin_based_vm_exec_control/secondary_vm_exec_control
  are covered by CONTROL_GRP1.

Fixes: 945679e301ea0 ("KVM: nVMX: add enlightened VMCS state")
Signed-off-by: Vitaly Kuznetsov 
Signed-off-by: Paolo Bonzini 
Signed-off-by: Sasha Levin

riscv: Fix udelay in RV32.

2019-07-14T06:09:40+00:00

[ Upstream commit d0e1f2110a5eeb6e410b2dd37d98bc5b30da7bc7 ]

In RV32, udelay would delay the wrong cycle. When it shifts right
"UDELAY_SHIFT" bits, it either delays 0 cycle or 1 cycle. It only works
correctly in RV64. Because the 'ucycles' always needs to be 64 bits
variable.

Signed-off-by: Nick Hu 
Reviewed-by: Palmer Dabbelt 
[paul.walmsley@sifive.com: fixed minor spelling error]
Signed-off-by: Paul Walmsley 
Signed-off-by: Sasha Levin

RISC-V: defconfig: enable clocks, serial console

2019-07-14T06:09:40+00:00

[ Upstream commit 3b025f2bc98973f181d926192b0ceb6ced0f86d2 ]

Enable PRCI clock driver and serial console by default, so the default
upstream defconfig is bootable to a serial console.

Signed-off-by: Kevin Hilman 
Reviewed-by: Christoph Hellwig 
Signed-off-by: Paul Walmsley 
Signed-off-by: Sasha Levin

s390/boot: disable address-of-packed-member warning

2019-07-14T06:09:40+00:00

[ Upstream commit f9364df30420987e77599c4789ec0065c609a507 ]

Get rid of gcc9 warnings like this:

arch/s390/boot/ipl_report.c: In function 'find_bootdata_space':
arch/s390/boot/ipl_report.c:42:26: warning: taking address of packed member of 'struct ipl_rb_components' may result in an unaligned pointer value [-Waddress-of-packed-member]
   42 |  for_each_rb_entry(comp, comps)
      |                          ^~~~~

This is effectively the s390 variant of commit 20c6c1890455
("x86/boot: Disable the address-of-packed-member compiler warning").

Reviewed-by: Vasily Gorbik 
Signed-off-by: Heiko Carstens 
Signed-off-by: Sasha Levin