Linux 5.4.210
Greg Kroah-Hartman
maintainerI'm announcing the release of the 5.4.210 kernel.
All users of the 5.4 kernel series must upgrade.
The updated 5.4.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.4.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Documentation/admin-guide/hw-vuln/spectre.rst | 8 ++ Makefile | 2 arch/x86/include/asm/cpufeatures.h | 2 arch/x86/include/asm/msr-index.h | 4 + arch/x86/include/asm/nospec-branch.h | 19 +++++ arch/x86/kernel/cpu/bugs.c | 61 +++++++++++++++++- arch/x86/kernel/cpu/common.c | 12 ++- arch/x86/kvm/vmx/vmenter.S | 1 drivers/acpi/apei/bert.c | 31 ++++++--- drivers/acpi/video_detect.c | 55 ++++++++++------ drivers/macintosh/adb.c | 2 drivers/media/v4l2-core/v4l2-mem2mem.c | 60 +++++++++++++---- drivers/thermal/of-thermal.c | 9 +- kernel/bpf/verifier.c | 1 tools/arch/x86/include/asm/cpufeatures.h | 1 tools/include/uapi/linux/bpf.h | 3 tools/testing/selftests/bpf/test_align.c | 41 ++++++------ tools/testing/selftests/bpf/verifier/bounds.c | 6 - tools/testing/selftests/bpf/verifier/sock.c | 81 +++++++++++++++++++++++- tools/testing/selftests/kvm/lib/aarch64/ucall.c | 9 +- virt/kvm/kvm_main.c | 5 + 21 files changed, 328 insertions(+), 85 deletions(-)
Alexey Kardashevskiy (1):
KVM: Don't null dereference ops->destroy
Chen-Yu Tsai (1):
media: v4l2-mem2mem: Apply DST_QUEUE_OFF_BASE on MMAP buffers across ioctls
Daniel Sneddon (1):
x86/speculation: Add RSB VM Exit protections
Greg Kroah-Hartman (1):
Linux 5.4.210
Jakub Sitnicki (1):
selftests/bpf: Extend verifier and bpf_sock tests for dst_port loads
Jean-Philippe Brucker (1):
selftests/bpf: Fix "dubious pointer arithmetic" test
John Fastabend (2):
bpf: Verifer, adjust_scalar_min_max_vals to always call update_reg_bounds()
bpf: Test_verifier, #70 error message updates for 32-bit right shift
Ning Qiang (1):
macintosh/adb: fix oob read in do_adb_query() function
Pawan Gupta (1):
x86/speculation: Add LFENCE to RSB fill sequence
Raghavendra Rao Ananta (1):
selftests: KVM: Handle compiler optimizations in ucall
Stanislav Fomichev (1):
selftests/bpf: Fix test_align verifier log patterns
Subbaraman Narayanamurthy (1):
thermal: Fix NULL pointer dereferences in of_thermal_ functions
Tony Luck (1):
ACPI: APEI: Better fix to avoid spamming the console with old error logs
Werner Sembach (2):
ACPI: video: Force backlight native for some TongFang devices
ACPI: video: Shortening quirk list by identifying Clevo by board_name only
Greg Kroah-Hartman
maintainerDocumentation/admin-guide/hw-vuln/spectre.rst +8 -0
@@ -422,6 +422,14 @@ The possible values in this file are: 'RSB filling' Protection of RSB on context switch enabled ============= =========================================== + - EIBRS Post-barrier Return Stack Buffer (PBRSB) protection status: + + =========================== ======================================================= + 'PBRSB-eIBRS: SW sequence' CPU is affected and protection of RSB on VMEXIT enabled + 'PBRSB-eIBRS: Vulnerable' CPU is vulnerable + 'PBRSB-eIBRS: Not affected' CPU is not affected by PBRSB + =========================== ======================================================= + Full mitigation might require a microcode update from the CPU vendor. When the necessary microcode is not available, the kernel will report vulnerability.
Makefile +1 -1
@@ -1,7 +1,7 @@ # SPDX-License-Identifier: GPL-2.0 VERSION = 5 PATCHLEVEL = 4 -SUBLEVEL = 209 +SUBLEVEL = 210 EXTRAVERSION = NAME = Kleptomaniac Octopus
arch/x86/include/asm/cpufeatures.h +2 -0
@@ -286,6 +286,7 @@#define X86_FEATURE_CQM_MBM_LOCAL (11*32+ 3)/* LLC Local MBM monitoring */ #define X86_FEATURE_FENCE_SWAPGS_USER (11*32+ 4)/* "" LFENCE in user entry SWAPGS path */ #define X86_FEATURE_FENCE_SWAPGS_KERNEL (11*32+ 5)/* "" LFENCE in kernel entry SWAPGS path */ +#define X86_FEATURE_RSB_VMEXIT_LITE (11*32+ 6)/* "" Fill RSB on VM exit when EIBRS is enabled */ /* Intel-defined CPU features, CPUID level 0x00000007:1 (EAX), word 12 */ #define X86_FEATURE_AVX512_BF16 (12*32+ 5)/* AVX512 BFLOAT16 instructions */
@@ -406,5 +407,6 @@#define X86_BUG_ITLB_MULTIHIT X86_BUG(23)/* CPU may incur MCE during certain page attribute changes */ #define X86_BUG_SRBDS X86_BUG(24)/* CPU may leak RNG bits if not mitigated */ #define X86_BUG_MMIO_STALE_DATA X86_BUG(25)/* CPU is affected by Processor MMIO Stale Data vulnerabilities */ +#define X86_BUG_EIBRS_PBRSB X86_BUG(26)/* EIBRS is vulnerable to Post Barrier RSB Predictions */ #endif /* _ASM_X86_CPUFEATURES_H */
arch/x86/include/asm/msr-index.h +4 -0
@@ -129,6 +129,10 @@* bit available to control VERW * behavior. */ +#define ARCH_CAP_PBRSB_NO BIT(24)/* +* Not susceptible to Post-Barrier +* Return Stack Buffer Predictions. +*/ #define MSR_IA32_FLUSH_CMD 0x0000010b#define L1D_FLUSH BIT(0)/*
arch/x86/include/asm/nospec-branch.h +18 -1
@@ -61,7 +61,16 @@ 774: \ dec reg; \ jnz 771b; \ - add $(BITS_PER_LONG/8) * nr, sp; + add $(BITS_PER_LONG/8) * nr, sp; \ +/* barrier for jnz misprediction */ \ + lfence; + +#define __ISSUE_UNBALANCED_RET_GUARD (sp) \ + call 881f; \ + int3; \ +881: \ + add $(BITS_PER_LONG/8), sp; \ + lfence;#ifdef __ASSEMBLY__
@@ -130,6 +139,14 @@#else call *\reg #endif +.endm + +.macro ISSUE_UNBALANCED_RET_GUARD ftr:req + ANNOTATE_NOSPEC_ALTERNATIVE +ALTERNATIVE "jmp .Lskip_pbrsb_\@" , \ + __stringify(__ISSUE_UNBALANCED_RET_GUARD(%_ASM_SP)) \ + \ftr +.Lskip_pbrsb_\@: .endm/*
arch/x86/kernel/cpu/bugs.c +60 -1
90 lines not on this page · raw message
arch/x86/kernel/cpu/common.c +10 -2
@@ -1025,6 +1025,7 @@ static void identify_cpu_without_cpuid(struct cpuinfo_x86 *c)#define NO_SWAPGS BIT(6)#define NO_ITLB_MULTIHIT BIT(7)#define NO_SPECTRE_V2 BIT(8) +#define NO_EIBRS_PBRSB BIT(9)#define VULNWL (_vendor, _family, _model, _whitelist) \ { X86_VENDOR_##_vendor, _family, _model, X86_FEATURE_ANY, _whitelist }
@@ -1065,7 +1066,7 @@ static const __initconst struct x86_cpu_id cpu_vuln_whitelist[] = {VULNWL_INTEL (ATOM_GOLDMONT ,NO_MDS |NO_L1TF |NO_SWAPGS |NO_ITLB_MULTIHIT ),VULNWL_INTEL (ATOM_GOLDMONT_D ,NO_MDS |NO_L1TF |NO_SWAPGS |NO_ITLB_MULTIHIT ), - VULNWL_INTEL(ATOM_GOLDMONT_PLUS, NO_MDS | NO_L1TF | NO_SWAPGS | NO_ITLB_MULTIHIT), + VULNWL_INTEL(ATOM_GOLDMONT_PLUS, NO_MDS | NO_L1TF | NO_SWAPGS | NO_ITLB_MULTIHIT | NO_EIBRS_PBRSB),/* * Technically, swapgs isn't serializing on AMD (despite it previously
@@ -1075,7 +1076,9 @@ static const __initconst struct x86_cpu_id cpu_vuln_whitelist[] = {* good enough for our purposes. */ -VULNWL_INTEL (ATOM_TREMONT_D ,NO_ITLB_MULTIHIT ), +VULNWL_INTEL (ATOM_TREMONT ,NO_EIBRS_PBRSB ), +VULNWL_INTEL (ATOM_TREMONT_L ,NO_EIBRS_PBRSB ), +VULNWL_INTEL (ATOM_TREMONT_D ,NO_ITLB_MULTIHIT |NO_EIBRS_PBRSB ),/* AMD Family 0xf - 0x12 */ VULNWL_AMD(0x0f, NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS | NO_SWAPGS | NO_ITLB_MULTIHIT),
@@ -1236,6 +1239,11 @@ static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c) !arch_cap_mmio_immune(ia32_cap))setup_force_cpu_bug (X86_BUG_MMIO_STALE_DATA ); +if (cpu_has (c,X86_FEATURE_IBRS_ENHANCED ) && + !cpu_matches (cpu_vuln_whitelist,NO_EIBRS_PBRSB ) && + !(ia32_cap &ARCH_CAP_PBRSB_NO )) +setup_force_cpu_bug (X86_BUG_EIBRS_PBRSB ); +if (cpu_matches (cpu_vuln_whitelist,NO_MELTDOWN ))return ;
arch/x86/kvm/vmx/vmenter.S +1 -0
@@ -92,6 +92,7 @@ ENTRY(vmx_vmexit) pop %_ASM_AX .Lvmexit_skip_rsb: #endif + ISSUE_UNBALANCED_RET_GUARD X86_FEATURE_RSB_VMEXIT_LITE ret ENDPROC(vmx_vmexit)
drivers/acpi/apei/bert.c +23 -8
@@ -29,16 +29,26 @@#undef pr_fmt#define pr_fmt (fmt) "BERT: " fmt + +#define ACPI_BERT_PRINT_MAX_RECORDS 5#define ACPI_BERT_PRINT_MAX_LEN 1024static int bert_disable; +/* +* Print "all" the error records in the BERT table, but avoid huge spam to +* the console if the BIOS included oversize records, or too many records. +* Skipping some records here does not lose anything because the full +* data is available to user tools in: +* /sys/firmware/acpi/tables/data/BERT +*/ static void __init bert_print_all (struct acpi_bert_region *region,unsigned int region_len) {struct acpi_hest_generic_status *estatus = (struct acpi_hest_generic_status *)region;int remain = region_len; +int printed =0 , skipped =0 ;u32 estatus_len;while (remain >=sizeof (struct acpi_bert_region )) {
@@ -46,24 +56,26 @@ static void __init bert_print_all(struct acpi_bert_region *region,if (remain < estatus_len) {pr_err (FW_BUG "Truncated status block (length: %u).\n" , estatus_len); -return ; +break ; }/* No more error records. */ if (!estatus->block_status) -return ; +break ;if (cper_estatus_check (estatus)) {pr_err (FW_BUG "Invalid error record.\n" ); -return ; +break ; } -pr_info_once ("Error records from previous boot:\n" ); -if (region_len <ACPI_BERT_PRINT_MAX_LEN ) +if (estatus_len <ACPI_BERT_PRINT_MAX_LEN && + printed <ACPI_BERT_PRINT_MAX_RECORDS ) { +pr_info_once ("Error records from previous boot:\n" ); cper_estatus_print(KERN_INFO HW_ERR, estatus); -else -pr_info_once ("Max print length exceeded, table data is available at:\n" -"/sys/firmware/acpi/tables/data/BERT" ); + printed++; + }else { + skipped++; + }/* * Because the boot error source is "one-time polled" type,
@@ -75,6 +87,9 @@ static void __init bert_print_all(struct acpi_bert_region *region, estatus = (void *)estatus + estatus_len; remain -= estatus_len; } + +if (skipped) +pr_info (HW_ERR "Skipped %d error records\n" , skipped); }static int __init setup_bert_disable (char *str)
drivers/acpi/video_detect.c +35 -20
101 lines not on this page · raw message
drivers/macintosh/adb.c +1 -1
@@ -647,7 +647,7 @@ do_adb_query(struct adb_request *req)switch (req->data[1 ]) {case ADB_QUERY_GETDEVINFO : -if (req->nbytes <3 ) +if (req->nbytes <3 || req->data[2 ] >=16 )break ;mutex_lock (&adb_handler_mutex); req->reply[0 ] = adb_handler[req->data[2 ]].original_address;
drivers/media/v4l2-core/v4l2-mem2mem.c +46 -14
101 lines not on this page · raw message
drivers/thermal/of-thermal.c +6 -3
@@ -91,7 +91,7 @@ static int of_thermal_get_temp(struct thermal_zone_device *tz, {struct __thermal_zone *data = tz->devdata; -if (!data->ops->get_temp) +if (!data->ops || !data->ops->get_temp)return -EINVAL ;return data->ops->get_temp (data->sensor_data, temp);
@@ -188,6 +188,9 @@ static int of_thermal_set_emul_temp(struct thermal_zone_device *tz, {struct __thermal_zone *data = tz->devdata; +if (!data->ops || !data->ops->set_emul_temp) +return -EINVAL ; +return data->ops->set_emul_temp (data->sensor_data, temp); }
@@ -196,7 +199,7 @@ static int of_thermal_get_trend(struct thermal_zone_device *tz, int trip, {struct __thermal_zone *data = tz->devdata; -if (!data->ops->get_trend) +if (!data->ops || !data->ops->get_trend)return -EINVAL ;return data->ops->get_trend (data->sensor_data, trip, trend);
@@ -336,7 +339,7 @@ static int of_thermal_set_trip_temp(struct thermal_zone_device *tz, int trip,if (trip >= data->ntrips || trip <0 )return -EDOM ; -if (data->ops->set_trip_temp) { +if (data->ops && data->ops->set_trip_temp) {int ret; ret = data->ops->set_trip_temp (data->sensor_data, trip, temp);
kernel/bpf/verifier.c +1 -0
@@ -5083,6 +5083,7 @@ static int adjust_scalar_min_max_vals(struct bpf_verifier_env *env,coerce_reg_to_size (dst_reg,4 ); } +__update_reg_bounds (dst_reg);__reg_deduce_bounds (dst_reg);__reg_bound_offset (dst_reg);return 0 ;
tools/arch/x86/include/asm/cpufeatures.h +1 -0
@@ -284,6 +284,7 @@#define X86_FEATURE_CQM_MBM_LOCAL (11*32+ 3)/* LLC Local MBM monitoring */ #define X86_FEATURE_FENCE_SWAPGS_USER (11*32+ 4)/* "" LFENCE in user entry SWAPGS path */ #define X86_FEATURE_FENCE_SWAPGS_KERNEL (11*32+ 5)/* "" LFENCE in kernel entry SWAPGS path */ +#define X86_FEATURE_RSB_VMEXIT_LITE (11*32+ 6)/* "" Fill RSB on VM-Exit when EIBRS is enabled */ /* Intel-defined CPU features, CPUID level 0x00000007:1 (EAX), word 12 */ #define X86_FEATURE_AVX512_BF16 (12*32+ 5)/* AVX512 BFLOAT16 instructions */
tools/include/uapi/linux/bpf.h +2 -1
@@ -3068,7 +3068,8 @@ struct bpf_sock {__u32 src_ip4;__u32 src_ip6[4 ];__u32 src_port;/* host byte order */ -__u32 dst_port;/* network byte order */ +__be16 dst_port;/* network byte order */ + __u16 :16 ;/* zero padding */ __u32 dst_ip4;__u32 dst_ip6[4 ];__u32 state;
tools/testing/selftests/bpf/test_align.c +21 -20
121 lines not on this page · raw message
tools/testing/selftests/bpf/verifier/bounds.c +2 -4
@@ -411,16 +411,14 @@BPF_ALU32_IMM (BPF_RSH ,BPF_REG_1 ,31 ),/* r1 = 0xffff'fffe (NOT 0!) */ BPF_ALU32_IMM (BPF_SUB ,BPF_REG_1 ,2 ), -/* computes OOB pointer */ +/* error on computing OOB pointer */ BPF_ALU64_REG (BPF_ADD ,BPF_REG_0 ,BPF_REG_1 ), -/* OOB access */ -BPF_LDX_MEM (BPF_B ,BPF_REG_0 ,BPF_REG_0 ,0 ),/* exit */ BPF_MOV64_IMM (BPF_REG_0 ,0 ), BPF_EXIT_INSN(), }, .fixup_map_hash_8b = { 3 }, - .errstr = "R0 invalid mem access", + .errstr = "math between map_value pointer and 4294967294 is not allowed", .result = REJECT, }, {
tools/testing/selftests/bpf/verifier/sock.c +78 -3
99 lines not on this page · raw message
tools/testing/selftests/kvm/lib/aarch64/ucall.c +4 -5
@@ -73,20 +73,19 @@ void ucall_uninit(struct kvm_vm *vm)void ucall (uint64_t cmd,int nargs, ...) { -struct ucall uc = { - .cmd = cmd, - }; +struct ucall uc = {};va_list va;int i; +WRITE_ONCE (uc.cmd, cmd); nargs = nargs <=UCALL_MAX_ARGS ? nargs :UCALL_MAX_ARGS ;va_start (va, nargs);for (i =0 ; i < nargs; ++i) - uc.args[i] =va_arg (va, uint64_t); +WRITE_ONCE (uc.args[i],va_arg (va, uint64_t));va_end (va); - *ucall_exit_mmio_addr = (vm_vaddr_t)&uc; +WRITE_ONCE (*ucall_exit_mmio_addr, (vm_vaddr_t)&uc); }uint64_t get_ucall (struct kvm_vm *vm,uint32_t vcpu_id,struct ucall *uc)
virt/kvm/kvm_main.c +4 -1
@@ -3329,8 +3329,11 @@ static int kvm_ioctl_create_device(struct kvm *kvm,kvm_put_kvm (kvm);mutex_lock (&kvm->lock);list_del (&dev->vm_node); +if (ops->release) + ops->release (dev);mutex_unlock (&kvm->lock); - ops->destroy (dev); +if (ops->destroy) + ops->destroy (dev);return ret; }