5.10.192-rc1 review
Subsystems (3)
Greg Kroah-Hartman
maintainerPATCH 112/135 mmc: wbsd: fix double mmc_free_host() in wbsd_init()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Yingliang <[email protected]>
commit d83035433701919ac6db15f7737cbf554c36c1a6 upstream.
mmc_free_host() has already be called in wbsd_free_mmc(), remove the mmc_free_host() in error path in wbsd_init().
--- drivers/mmc/host/wbsd.c | 2 -- 1 file changed, 2 deletions(-)
drivers/mmc/host/wbsd.c +0 -2
@@ -1710,8 +1710,6 @@ static int wbsd_init(struct device *dev,wbsd_release_resources (host);wbsd_free_mmc (dev); - -mmc_free_host (mmc);return ret; }
Greg Kroah-Hartman
maintainerPATCH 113/135 mmc: block: Fix in_flight[issue_type] value error
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yibin Ding <[email protected]>
commit 4b430d4ac99750ee2ae2f893f1055c7af1ec3dc5 upstream.
For a completed request, after the mmc_blk_mq_complete_rq(mq, req) function is executed, the bitmap_tags corresponding to the request will be cleared, that is, the request will be regarded as idle. If the request is acquired by a different type of process at this time, the issue_type of the request may change. It further caused the value of mq->in_flight[issue_type] to be abnormal, and a large number of requests could not be sent.
p1: p2:mmc_blk_mq_complete_rq
blk_mq_free_request
blk_mq_get_request
blk_mq_rq_ctx_initmmc_blk_mq_dec_in_flight
mmc_issue_type(mq, req)
This strategy can ensure the consistency of issue_type before and after executing mmc_blk_mq_complete_rq.
--- drivers/mmc/core/block.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/mmc/core/block.c +4 -3
@@ -1980,14 +1980,14 @@ static void mmc_blk_mq_poll_completion(smmc_blk_urgent_bkops (mq, mqrq); } -static void mmc_blk_mq_dec_in_flight (struct mmc_queue *mq,struct request *req) +static void mmc_blk_mq_dec_in_flight (struct mmc_queue *mq,enum mmc_issue_type issue_type) {unsigned long flags;bool put_card;spin_lock_irqsave (&mq->lock, flags); - mq->in_flight[mmc_issue_type (mq, req)] -=1 ; + mq->in_flight[issue_type] -=1 ; put_card = (mmc_tot_in_flight (mq) ==0 );
@@ -1999,6 +1999,7 @@ static void mmc_blk_mq_dec_in_flight(strstatic void mmc_blk_mq_post_req (struct mmc_queue *mq,struct request *req) { +enum mmc_issue_type issue_type =mmc_issue_type (mq, req);struct mmc_queue_req *mqrq =req_to_mmc_queue_req (req);struct mmc_request *mrq = &mqrq->brq.mrq;struct mmc_host *host = mq->card->host;
@@ -2014,7 +2015,7 @@ static void mmc_blk_mq_post_req(struct melse if (likely (!blk_should_fake_timeout (req->q)))blk_mq_complete_request (req); -mmc_blk_mq_dec_in_flight (mq, req); +mmc_blk_mq_dec_in_flight (mq, issue_type); }void mmc_blk_mq_recovery (struct mmc_queue *mq)
Greg Kroah-Hartman
maintainerPATCH 114/135 netfilter: set default timeout to 3 secs for sctp shutdown send and recv state
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <[email protected]>
commit 9bfab6d23a2865966a4f89a96536fbf23f83bc8c upstream.
In SCTP protocol, it is using the same timer (T2 timer) for SHUTDOWN and SHUTDOWN_ACK retransmission. However in sctp conntrack the default timeout value for SCTP_CONNTRACK_SHUTDOWN_ACK_SENT state is 3 secs while it's 300 msecs for SCTP_CONNTRACK_SHUTDOWN_SEND/RECV state.
As Paolo Valerio noticed, this might cause unwanted expiration of the ct entry. In my test, with 1s tc netem delay set on the NAT path, after the SHUTDOWN is sent, the sctp ct entry enters SCTP_CONNTRACK_SHUTDOWN_SEND state. However, due to 300ms (too short) delay, when the SHUTDOWN_ACK is sent back from the peer, the sctp ct entry has expired and been deleted, and then the SHUTDOWN_ACK has to be dropped.
Also, it is confusing these two sysctl options always show 0 due to all timeout values using sec as unit:
net.netfilter.nf_conntrack_sctp_timeout_shutdown_recd = 0 net.netfilter.nf_conntrack_sctp_timeout_shutdown_sent = 0
This patch fixes it by also using 3 secs for sctp shutdown send and recv state in sctp conntrack, which is also RTO.initial value in SCTP protocol.
Note that the very short time value for SCTP_CONNTRACK_SHUTDOWN_SEND/RECV was probably used for a rare scenario where SHUTDOWN is sent on 1st path but SHUTDOWN_ACK is replied on 2nd path, then a new connection started immediately on 1st path. So this patch also moves from SHUTDOWN_SEND/RECV to CLOSE when receiving INIT in the ORIGINAL direction.
--- net/netfilter/nf_conntrack_proto_sctp.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
net/netfilter/nf_conntrack_proto_sctp.c +3 -3
@@ -49,8 +49,8 @@ static const unsigned int sctp_timeouts[ [SCTP_CONNTRACK_COOKIE_WAIT] = 3 SECS, [SCTP_CONNTRACK_COOKIE_ECHOED] = 3 SECS, [SCTP_CONNTRACK_ESTABLISHED] = 210 SECS, - [SCTP_CONNTRACK_SHUTDOWN_SENT] = 300 SECS / 1000, - [SCTP_CONNTRACK_SHUTDOWN_RECD] = 300 SECS / 1000, + [SCTP_CONNTRACK_SHUTDOWN_SENT] = 3 SECS, + [SCTP_CONNTRACK_SHUTDOWN_RECD] = 3 SECS, [SCTP_CONNTRACK_SHUTDOWN_ACK_SENT] = 3 SECS, [SCTP_CONNTRACK_HEARTBEAT_SENT] = 30 SECS, };
@@ -105,7 +105,7 @@ static const u8 sctp_conntracks[2][11][S {/* ORIGINAL */ /* sNO, sCL, sCW, sCE, sES, sSS, sSR, sSA, sHS */ -/* init */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA, sCW}, +/* init */ {sCL, sCL, sCW, sCE, sES, sCL, sCL, sSA, sCW}, /* init_ack */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA, sCL}, /* abort */ {sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL}, /* shutdown */ {sCL, sCL, sCW, sCE, sSS, sSS, sSR, sSA, sCL},
Greg Kroah-Hartman
maintainerPATCH 115/135 af_unix: Fix null-ptr-deref in unix_stream_sendpage().
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
Bing-Jhong Billy Jheng reported null-ptr-deref in unix_stream_sendpage() with detailed analysis and a nice repro.
unix_stream_sendpage() tries to add data to the last skb in the peer's recv queue without locking the queue.
If the peer's FD is passed to another socket and the socket's FD is passed to the peer, there is a loop between them. If we close both sockets without receiving FD, the sockets will be cleaned up by garbage collection.
The garbage collection iterates such sockets and unlinks skb with FD from the socket's receive queue under the queue's lock.
So, there is a race where unix_stream_sendpage() could access an skb locklessly that is being released by garbage collection, resulting in use-after-free.
To avoid the issue, unix_stream_sendpage() must lock the peer's recv queue.
Note the issue does not exist in 6.5+ thanks to the recent sendpage() refactoring.
This patch is originally written by Linus Torvalds.
BUG: unable to handle page fault for address: ffff988004dd6870
PF: supervisor read access in kernel mode
PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
PREEMPT SMP PTI
CPU: 4 PID: 297 Comm: garbage_uaf Not tainted 6.1.46 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:kmem_cache_alloc_node+0xa2/0x1e0 Code: c0 0f 84 32 01 00 00 41 83 fd ff 74 10 48 8b 00 48 c1 e8 3a 41 39 c5 0f 85 1c 01 00 00 41 8b 44 24 28 49 8b 3c 24 48 8d 4a 40 <49> 8b 1c 06 4c 89 f0 65 48 0f c7 0f 0f 94 c0 84 c0 74 a1 41 8b 44 RSP: 0018:ffffc9000079fac0 EFLAGS: 00000246 RAX: 0000000000000070 RBX: 0000000000000005 RCX: 000000000001a284 RDX: 000000000001a244 RSI: 0000000000400cc0 RDI: 000000000002eee0 RBP: 0000000000400cc0 R08: 0000000000400cc0 R09: 0000000000000003 R10: 0000000000000001 R11: 0000000000000000 R12: ffff888003970f00 R13: 00000000ffffffff R14: ffff988004dd6800 R15: 00000000000000e8 FS: 00007f174d6f3600(0000) GS:ffff88807db00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff988004dd6870 CR3: 00000000092be000 CR4: 00000000007506e0 PKRU: 55555554 Call Trace: <TASK> ? __die_body.cold+0x1a/0x1f ? page_fault_oops+0xa9/0x1e0 ? fixup_exception+0x1d/0x310 ? exc_page_fault+0xa8/0x150 ? asm_exc_page_fault+0x22/0x30 ? kmem_cache_alloc_node+0xa2/0x1e0 ? __alloc_skb+0x16c/0x1e0 __alloc_skb+0x16c/0x1e0 alloc_skb_with_frags+0x48/0x1e0 sock_alloc_send_pskb+0x234/0x270 unix_stream_sendmsg+0x1f5/0x690 sock_sendmsg+0x5d/0x60 ____sys_sendmsg+0x210/0x260 ___sys_sendmsg+0x83/0xd0 ? kmem_cache_alloc+0xc6/0x1c0 ? avc_disable+0x20/0x20 ? percpu_counter_add_batch+0x53/0xc0 ? alloc_empty_file+0x5d/0xb0 ? alloc_file+0x91/0x170 ? alloc_file_pseudo+0x94/0x100 ? __fget_light+0x9f/0x120 __sys_sendmsg+0x54/0xa0 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x69/0xd3 RIP: 0033:0x7f174d639a7d Code: 28 89 54 24 1c 48 89 74 24 10 89 7c 24 08 e8 8a c1 f4 ff 8b 54 24 1c 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 33 44 89 c7 48 89 44 24 08 e8 de c1 f4 ff 48 RSP: 002b:00007ffcb563ea50 EFLAGS: 00000293 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f174d639a7d RDX: 0000000000000000 RSI: 00007ffcb563eab0 RDI: 0000000000000007 RBP: 00007ffcb563eb10 R08: 0000000000000000 R09: 00000000ffffffff R10: 00000000004040a0 R11: 0000000000000293 R12: 00007ffcb563ec28 R13: 0000000000401398 R14: 0000000000403e00 R15: 00007f174d72c000 </TASK>
--- net/unix/af_unix.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
net/unix/af_unix.c +4 -5
@@ -2008,6 +2008,7 @@ static ssize_t unix_stream_sendpage(struif (false) { alloc_skb: +spin_unlock (&other->sk_receive_queue.lock);unix_state_unlock (other);mutex_unlock (&unix_sk (other)->iolock); newskb = sock_alloc_send_pskb(sk, 0, 0, flags & MSG_DONTWAIT,
@@ -2047,6 +2048,7 @@ alloc_skb: init_scm = false; } +spin_lock (&other->sk_receive_queue.lock); skb =skb_peek_tail (&other->sk_receive_queue);if (tail && tail == skb) { skb = newskb;
@@ -2077,14 +2079,11 @@ alloc_skb:refcount_add (size, &sk->sk_wmem_alloc);if (newskb) { - err =unix_scm_to_skb (&scm, skb, false); -if (err) - goto err_state_unlock; -spin_lock (&other->sk_receive_queue.lock); +unix_scm_to_skb (&scm, skb, false);__skb_queue_tail (&other->sk_receive_queue, newskb); -spin_unlock (&other->sk_receive_queue.lock); } +spin_unlock (&other->sk_receive_queue.lock);unix_state_unlock (other);mutex_unlock (&unix_sk (other)->iolock);
Greg Kroah-Hartman
maintainerPATCH 116/135 virtio-net: set queues after driver_ok
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Wang <[email protected]>
commit 51b813176f098ff61bd2833f627f5319ead098a5 upstream.
Commit 25266128fe16 ("virtio-net: fix race between set queues and probe") tries to fix the race between set queues and probe by calling _virtnet_set_queues() before DRIVER_OK is set. This violates virtio spec. Fixing this by setting queues after virtio_device_ready().
Note that rtnl needs to be held for userspace requests to change the number of queues. So we are serialized in this way.
--- drivers/net/virtio_net.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/virtio_net.c +2 -2
@@ -3220,8 +3220,6 @@ static int virtnet_probe(struct virtio_d } } -_virtnet_set_queues (vi, vi->curr_queue_pairs); -/* serialize netdev register + virtio_device_ready() with ndo_open() */ rtnl_lock ();
@@ -3234,6 +3232,8 @@ static int virtnet_probe(struct virtio_dvirtio_device_ready (vdev); +_virtnet_set_queues (vi, vi->curr_queue_pairs); +rtnl_unlock (); err =virtnet_cpu_notif_add (vi);
Greg Kroah-Hartman
maintainerPATCH 117/135 net: fix the RTO timer retransmitting skb every 1ms if linear option is enabled
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Xing <[email protected]>
commit e4dd0d3a2f64b8bd8029ec70f52bdbebd0644408 upstream.
In the real workload, I encountered an issue which could cause the RTO timer to retransmit the skb per 1ms with linear option enabled. The amount of lost-retransmitted skbs can go up to 1000+ instantly.
The root cause is that if the icsk_rto happens to be zero in the 6th round (which is the TCP_THIN_LINEAR_RETRIES value), then it will always be zero due to the changed calculation method in tcp_retransmit_timer() as follows:
icsk->icsk_rto = min(icsk->icsk_rto << 1, TCP_RTO_MAX);
Above line could be converted toicsk->icsk_rto = min(0 << 1, TCP_RTO_MAX) = 0
Therefore, the timer expires so quickly without any doubt.
I read through the RFC 6298 and found that the RTO value can be rounded up to a certain value, in Linux, say TCP_RTO_MIN as default, which is regarded as the lower bound in this patch as suggested by Eric.
--- net/ipv4/tcp_timer.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/ipv4/tcp_timer.c +3 -1
@@ -582,7 +582,9 @@ out_reset_timer: tcp_stream_is_thin(tp) && icsk->icsk_retransmits <= TCP_THIN_LINEAR_RETRIES) { icsk->icsk_backoff = 0; - icsk->icsk_rto = min(__tcp_set_rto(tp), TCP_RTO_MAX); + icsk->icsk_rto = clamp(__tcp_set_rto(tp), + tcp_rto_min(sk), + TCP_RTO_MAX); } else {/* Use normal (exponential) backoff */ icsk->icsk_rto =min (icsk->icsk_rto <<1 ,TCP_RTO_MAX );
Greg Kroah-Hartman
maintainerPATCH 118/135 mmc: f-sdh30: fix order of function calls in sdhci_f_sdh30_remove
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yangtao Li <[email protected]>
commit 58abdd80b93b09023ca03007b608685c41e3a289 upstream.
The order of function calls in sdhci_f_sdh30_remove is wrong, let's call sdhci_pltfm_unregister first.
--- drivers/mmc/host/sdhci_f_sdh30.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/mmc/host/sdhci_f_sdh30.c +5 -3
@@ -188,12 +188,14 @@ static int sdhci_f_sdh30_remove(struct p {struct sdhci_host *host =platform_get_drvdata (pdev);struct f_sdhost_priv *priv =sdhci_f_sdhost_priv (host); - -clk_disable_unprepare (priv->clk_iface); -clk_disable_unprepare (priv->clk); +struct clk *clk_iface = priv->clk_iface; +struct clk *clk = priv->clk;sdhci_pltfm_unregister (pdev); +clk_disable_unprepare (clk_iface); +clk_disable_unprepare (clk); +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 119/135 x86/cpu: Fix __x86_return_thunk symbol type
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
commit 77f67119004296a9b2503b377d610e08b08afc2a upstream.
Commit
fb3bd914b3ec ("x86/srso: Add a Speculative RAS Overflow mitigation")
reimplemented __x86_return_thunk with a mix of SYM_FUNC_START and SYM_CODE_END, this is not a sane combination.
Since nothing should ever actually 'CALL' this, make it consistently CODE.
--- arch/x86/lib/retpoline.S | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
arch/x86/lib/retpoline.S +3 -1
@@ -204,7 +204,9 @@ SYM_CODE_END(srso_safe_ret) SYM_FUNC_END(srso_untrain_ret) __EXPORT_THUNK(srso_untrain_ret) -SYM_FUNC_START(__x86_return_thunk) +SYM_CODE_START(__x86_return_thunk) + UNWIND_HINT_FUNC + ANNOTATE_NOENDBR ALTERNATIVE_2 "jmp __ret", "call srso_safe_ret", X86_FEATURE_SRSO, \ "call srso_safe_ret_alias", X86_FEATURE_SRSO_ALIAS int3
Greg Kroah-Hartman
maintainerPATCH 120/135 x86/cpu: Fix up srso_safe_ret() and __x86_return_thunk()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
commit af023ef335f13c8b579298fc432daeef609a9e60 upstream.
vmlinux.o: warning: objtool: srso_untrain_ret() falls through to next function __x86_return_skl() vmlinux.o: warning: objtool: __x86_return_thunk() falls through to next function __x86_return_skl()
This is because these functions (can) end with CALL, which objtool does not consider a terminating instruction. Therefore, replace the INT3 instruction (which is a non-fatal trap) with UD2 (which is a fatal-trap).
This indicates execution will not continue past this point.
--- arch/x86/lib/retpoline.S | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/x86/lib/retpoline.S +2 -2
@@ -199,7 +199,7 @@ SYM_INNER_LABEL(srso_safe_ret, SYM_L_GLO int3 lfence call srso_safe_ret - int3 + ud2 SYM_CODE_END(srso_safe_ret) SYM_FUNC_END(srso_untrain_ret) __EXPORT_THUNK(srso_untrain_ret)
@@ -209,7 +209,7 @@ SYM_CODE_START(__x86_return_thunk) ANNOTATE_NOENDBR ALTERNATIVE_2 "jmp __ret", "call srso_safe_ret", X86_FEATURE_SRSO, \ "call srso_safe_ret_alias", X86_FEATURE_SRSO_ALIAS - int3 + ud2 SYM_CODE_END(__x86_return_thunk) EXPORT_SYMBOL(__x86_return_thunk)
Greg Kroah-Hartman
maintainerPATCH 121/135 x86/alternative: Make custom return thunk unconditional
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
commit 095b8303f3835c68ac4a8b6d754ca1c3b6230711 upstream.
There is infrastructure to rewrite return thunks to point to any random thunk one desires, unwrap that from CALL_THUNKS, which up to now was the sole user of that.
[ bp: Make the thunks visible on 32-bit and add ifdeffery for the
32-bit builds. ]
--- arch/x86/include/asm/nospec-branch.h | 5 +++++ arch/x86/kernel/cpu/bugs.c | 2 ++ 2 files changed, 7 insertions(+)
arch/x86/include/asm/nospec-branch.h +5 -0
@@ -195,7 +195,12 @@ _ASM_PTR" 999b\n\t" \".popsection\n\t" +#ifdef CONFIG_RETHUNK extern void __x86_return_thunk(void); +#else +static inline void __x86_return_thunk (void ) {} +#endif +extern void zen_untrain_ret (void );extern void srso_untrain_ret (void );extern void srso_untrain_ret_alias (void );
arch/x86/kernel/cpu/bugs.c +2 -0
@@ -61,6 +61,8 @@ EXPORT_SYMBOL_GPL(x86_pred_cmd);static DEFINE_MUTEX (spec_ctrl_mutex); +void (*x86_return_thunk)(void )__ro_after_init = &__x86_return_thunk; +/* Update SPEC_CTRL MSR and its cached copy unconditionally */ static void update_spec_ctrl (u64 val) {
Greg Kroah-Hartman
maintainerPATCH 122/135 objtool: Add frame-pointer-specific function ignore
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Poimboeuf <[email protected]>
[ Upstream commit e028c4f7ac7ca8c96126fe46c54ab3d56ffe6a66 ]
Add a CONFIG_FRAME_POINTER-specific version of STACK_FRAME_NON_STANDARD() for the case where a function is intentionally missing frame pointer setup, but otherwise needs objtool/ORC coverage when frame pointers are disabled.
Stable-dep-of: c8c301abeae5 ("x86/ibt: Add ANNOTATE_NOENDBR")
--- include/linux/objtool.h | 12 ++++++++++++ tools/include/linux/objtool.h | 12 ++++++++++++ 2 files changed, 24 insertions(+)
include/linux/objtool.h +12 -0
@@ -71,6 +71,17 @@ struct unwind_hint { static void __used __section(".discard.func_stack_frame_non_standard") \ *__func_stack_frame_non_standard_##func = func +/* +* STACK_FRAME_NON_STANDARD_FP() is a frame-pointer-specific function ignore +* for the case where a function is intentionally missing frame pointer setup, +* but otherwise needs objtool/ORC coverage when frame pointers are disabled. +*/ +#ifdef CONFIG_FRAME_POINTER +#define STACK_FRAME_NON_STANDARD_FP (func) STACK_FRAME_NON_STANDARD(func) +#else +#define STACK_FRAME_NON_STANDARD_FP (func) +#endif +#else /* __ASSEMBLY__ */ /*
@@ -126,6 +137,7 @@ struct unwind_hint {#define UNWIND_HINT (sp_reg, sp_offset, type, end) \ "\n\t"#define STACK_FRAME_NON_STANDARD (func) +#define STACK_FRAME_NON_STANDARD_FP (func)#else #define ANNOTATE_INTRA_FUNCTION_CALL .macro UNWIND_HINT type:req sp_reg=0 sp_offset=0 end=0
tools/include/linux/objtool.h +12 -0
@@ -71,6 +71,17 @@ struct unwind_hint { static void __used __section(".discard.func_stack_frame_non_standard") \ *__func_stack_frame_non_standard_##func = func +/* +* STACK_FRAME_NON_STANDARD_FP() is a frame-pointer-specific function ignore +* for the case where a function is intentionally missing frame pointer setup, +* but otherwise needs objtool/ORC coverage when frame pointers are disabled. +*/ +#ifdef CONFIG_FRAME_POINTER +#define STACK_FRAME_NON_STANDARD_FP (func) STACK_FRAME_NON_STANDARD(func) +#else +#define STACK_FRAME_NON_STANDARD_FP (func) +#endif +#else /* __ASSEMBLY__ */ /*
@@ -126,6 +137,7 @@ struct unwind_hint {#define UNWIND_HINT (sp_reg, sp_offset, type, end) \ "\n\t"#define STACK_FRAME_NON_STANDARD (func) +#define STACK_FRAME_NON_STANDARD_FP (func)#else #define ANNOTATE_INTRA_FUNCTION_CALL .macro UNWIND_HINT type:req sp_reg=0 sp_offset=0 end=0
Greg Kroah-Hartman
maintainerPATCH 123/135 x86/ibt: Add ANNOTATE_NOENDBR
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
[ Upstream commit c8c301abeae58ec756b8fcb2178a632bd3c9e284 ]
In order to have objtool warn about code references to !ENDBR instruction, we need an annotation to allow this for non-control-flow instances -- consider text range checks, text patching, or return trampolines etc.
--- include/linux/objtool.h | 16 ++++++++++++++++ tools/include/linux/objtool.h | 16 ++++++++++++++++ 2 files changed, 32 insertions(+)
include/linux/objtool.h +16 -0
@@ -82,6 +82,12 @@ struct unwind_hint {#define STACK_FRAME_NON_STANDARD_FP (func)#endif +#define ANNOTATE_NOENDBR \ + "986: \n\t" \ + ".pushsection .discard.noendbr\n\t" \ + _ASM_PTR " 986b\n\t" \ + ".popsection\n\t" +#else /* __ASSEMBLY__ */ /*
@@ -128,6 +134,13 @@ struct unwind_hint { .popsection .endm +.macro ANNOTATE_NOENDBR +.Lhere_\@: + .pushsection .discard.noendbr + .quad .Lhere_\@ + .popsection +.endm +#endif /* __ASSEMBLY__ */ #else /* !CONFIG_STACK_VALIDATION */
@@ -138,10 +151,13 @@ struct unwind_hint { "\n\t"#define STACK_FRAME_NON_STANDARD (func)#define STACK_FRAME_NON_STANDARD_FP (func) +#define ANNOTATE_NOENDBR #else #define ANNOTATE_INTRA_FUNCTION_CALL .macro UNWIND_HINT type:req sp_reg=0 sp_offset=0 end=0 .endm +.macro ANNOTATE_NOENDBR +.endm#endif #endif /* CONFIG_STACK_VALIDATION */
tools/include/linux/objtool.h +16 -0
@@ -82,6 +82,12 @@ struct unwind_hint {#define STACK_FRAME_NON_STANDARD_FP (func)#endif +#define ANNOTATE_NOENDBR \ + "986: \n\t" \ + ".pushsection .discard.noendbr\n\t" \ + _ASM_PTR " 986b\n\t" \ + ".popsection\n\t" +#else /* __ASSEMBLY__ */ /*
@@ -128,6 +134,13 @@ struct unwind_hint { .popsection .endm +.macro ANNOTATE_NOENDBR +.Lhere_\@: + .pushsection .discard.noendbr + .quad .Lhere_\@ + .popsection +.endm +#endif /* __ASSEMBLY__ */ #else /* !CONFIG_STACK_VALIDATION */
@@ -138,10 +151,13 @@ struct unwind_hint { "\n\t"#define STACK_FRAME_NON_STANDARD (func)#define STACK_FRAME_NON_STANDARD_FP (func) +#define ANNOTATE_NOENDBR #else #define ANNOTATE_INTRA_FUNCTION_CALL .macro UNWIND_HINT type:req sp_reg=0 sp_offset=0 end=0 .endm +.macro ANNOTATE_NOENDBR +.endm#endif #endif /* CONFIG_STACK_VALIDATION */
Greg Kroah-Hartman
maintainerPATCH 124/135 x86/cpu: Clean up SRSO return thunk mess
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
commit d43490d0ab824023e11d0b57d0aeec17a6e0ca13 upstream.
Use the existing configurable return thunk. There is absolute no justification for having created this __x86_return_thunk alternative.
To clarify, the whole thing looks like:
Zen3/4 does:
srso_alias_untrain_ret:
nop2
lfence
jmp srso_alias_return_thunk
int3
srso_alias_safe_ret: // aliasses srso_alias_untrain_ret just so
add $8, %rsp ret int3
srso_alias_return_thunk:
call srso_alias_safe_ret ud2
While Zen1/2 does:
srso_untrain_ret:
movabs $foo, %rax
lfence
call srso_safe_ret (jmp srso_return_thunk ?)
int3
srso_safe_ret: // embedded in movabs instruction
add $8,%rsp
ret
int3 srso_return_thunk:
call srso_safe_ret ud2
While retbleed does:
zen_untrain_ret:
test $0xcc, %bl
lfence
jmp zen_return_thunk
int3 zen_return_thunk: // embedded in the test instruction
ret
int3
Where Zen1/2 flush the BTB entry using the instruction decoder trick (test,movabs) Zen3/4 use BTB aliasing. SRSO adds a return sequence (srso_safe_ret()) which forces the function return instruction to speculate into a trap (UD2). This RET will then mispredict and execution will continue at the return site read from the top of the stack.
Pick one of three options at boot (evey function can only ever return once).
[ bp: Fixup commit message uarch details and add them in a comment in
the code too. Add a comment about the srso_select_mitigation() dependency on retbleed_select_mitigation(). Add moar ifdeffery for 32-bit builds. Add a dummy srso_untrain_ret_alias() definition for 32-bit alternatives needing the symbol. ]
--- arch/x86/include/asm/nospec-branch.h | 5 +++ arch/x86/kernel/cpu/bugs.c | 17 ++++++++-- arch/x86/kernel/vmlinux.lds.S | 2 - arch/x86/lib/retpoline.S | 58 +++++++++++++++++++++++++---------- tools/objtool/arch/x86/decode.c | 2 - 5 files changed, 63 insertions(+), 21 deletions(-)
arch/x86/include/asm/nospec-branch.h +5 -0
@@ -201,9 +201,14 @@ extern void __x86_return_thunk(void);static inline void __x86_return_thunk (void ) {}#endif +extern void zen_return_thunk (void ); +extern void srso_return_thunk (void ); +extern void srso_alias_return_thunk (void ); +extern void zen_untrain_ret (void );extern void srso_untrain_ret (void );extern void srso_untrain_ret_alias (void ); +extern void entry_ibpb (void );#ifdef CONFIG_RETPOLINE
arch/x86/kernel/cpu/bugs.c +14 -3
@@ -157,8 +157,13 @@ void __init cpu_select_mitigations(void)l1tf_select_mitigation ();md_clear_select_mitigation ();srbds_select_mitigation (); -gds_select_mitigation (); + +/* +* srso_select_mitigation() depends and must run after +* retbleed_select_mitigation(). +*/ srso_select_mitigation (); +gds_select_mitigation (); }/*
@@ -978,6 +983,9 @@ do_cmd_auto:setup_force_cpu_cap (X86_FEATURE_RETHUNK );setup_force_cpu_cap (X86_FEATURE_UNRET ); +if (IS_ENABLED (CONFIG_RETHUNK )) + x86_return_thunk = zen_return_thunk; +if (boot_cpu_data.x86_vendor !=X86_VENDOR_AMD && boot_cpu_data.x86_vendor !=X86_VENDOR_HYGON )pr_err (RETBLEED_UNTRAIN_MSG );
@@ -2352,10 +2360,13 @@ static void __init srso_select_mitigatio*/ setup_force_cpu_cap (X86_FEATURE_RETHUNK ); -if (boot_cpu_data.x86 ==0x19 ) +if (boot_cpu_data.x86 ==0x19 ) {setup_force_cpu_cap (X86_FEATURE_SRSO_ALIAS ); -else + x86_return_thunk = srso_alias_return_thunk; + }else {setup_force_cpu_cap (X86_FEATURE_SRSO ); + x86_return_thunk = srso_return_thunk; + } srso_mitigation =SRSO_MITIGATION_SAFE_RET ; }else {pr_err ("WARNING: kernel not compiled with CPU_SRSO.\n" );
arch/x86/kernel/vmlinux.lds.S +1 -1
@@ -518,7 +518,7 @@ INIT_PER_CPU(irq_stack_backing_store); #endif #ifdef CONFIG_RETHUNK -. = ASSERT((__ret & 0x3f) == 0, "__ret not cacheline-aligned"); +. = ASSERT((zen_return_thunk & 0x3f) == 0, "zen_return_thunk not cacheline-aligned"); . = ASSERT((srso_safe_ret & 0x3f) == 0, "srso_safe_ret not cacheline-aligned"); #endif
arch/x86/lib/retpoline.S +42 -16
139 lines not on this page · raw message
tools/objtool/arch/x86/decode.c +1 -1
@@ -655,5 +655,5 @@ bool arch_is_rethunk(struct symbol *sym)return !strcmp (sym->name,"__x86_return_thunk" ) || !strcmp (sym->name,"srso_untrain_ret" ) || !strcmp (sym->name,"srso_safe_ret" ) || - !strcmp (sym->name,"__ret" ); + !strcmp (sym->name,"zen_return_thunk" ); }
Greg Kroah-Hartman
maintainerPATCH 125/135 x86/cpu: Rename original retbleed methods
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
commit d025b7bac07a6e90b6b98b487f88854ad9247c39 upstream.
Rename the original retbleed return thunk and untrain_ret to retbleed_return_thunk() and retbleed_untrain_ret().
No functional changes.
--- arch/x86/include/asm/nospec-branch.h | 8 ++++---- arch/x86/kernel/cpu/bugs.c | 2 +- arch/x86/kernel/vmlinux.lds.S | 2 +- arch/x86/lib/retpoline.S | 30 +++++++++++++++--------------- tools/objtool/arch/x86/decode.c | 2 +- tools/objtool/check.c | 2 +- 6 files changed, 23 insertions(+), 23 deletions(-)
arch/x86/include/asm/nospec-branch.h +4 -4
@@ -156,7 +156,7 @@ .endm#ifdef CONFIG_CPU_UNRET_ENTRY -#define CALL_ZEN_UNTRAIN_RET "call zen_untrain_ret" +#define CALL_ZEN_UNTRAIN_RET "call retbleed_untrain_ret"#else #define CALL_ZEN_UNTRAIN_RET ""#endif
@@ -166,7 +166,7 @@* return thunk isn't mapped into the userspace tables (then again, AMD * typically has NO_MELTDOWN). * -* While zen_untrain_ret() doesn't clobber anything but requires stack, +* While retbleed_untrain_ret() doesn't clobber anything but requires stack, * entry_ibpb() will clobber AX, CX, DX. * * As such, this must be placed after every *SWITCH_TO_KERNEL_CR3 at a point
@@ -201,11 +201,11 @@ extern void __x86_return_thunk(void);static inline void __x86_return_thunk (void ) {}#endif -extern void zen_return_thunk (void ); +extern void retbleed_return_thunk (void );extern void srso_return_thunk (void );extern void srso_alias_return_thunk (void ); -extern void zen_untrain_ret (void ); +extern void retbleed_untrain_ret (void );extern void srso_untrain_ret (void );extern void srso_untrain_ret_alias (void );
arch/x86/kernel/cpu/bugs.c +1 -1
@@ -984,7 +984,7 @@ do_cmd_auto:setup_force_cpu_cap (X86_FEATURE_UNRET );if (IS_ENABLED (CONFIG_RETHUNK )) - x86_return_thunk = zen_return_thunk; + x86_return_thunk = retbleed_return_thunk;if (boot_cpu_data.x86_vendor !=X86_VENDOR_AMD && boot_cpu_data.x86_vendor !=X86_VENDOR_HYGON )
arch/x86/kernel/vmlinux.lds.S +1 -1
@@ -518,7 +518,7 @@ INIT_PER_CPU(irq_stack_backing_store); #endif #ifdef CONFIG_RETHUNK -. = ASSERT((zen_return_thunk & 0x3f) == 0, "zen_return_thunk not cacheline-aligned"); +. = ASSERT((retbleed_return_thunk & 0x3f) == 0, "retbleed_return_thunk not cacheline-aligned"); . = ASSERT((srso_safe_ret & 0x3f) == 0, "srso_safe_ret not cacheline-aligned"); #endif
arch/x86/lib/retpoline.S +15 -15
@@ -129,32 +129,32 @@ SYM_CODE_END(srso_alias_return_thunk) /* * Safety details here pertain to the AMD Zen{1,2} microarchitecture: - * 1) The RET at zen_return_thunk must be on a 64 byte boundary, for + * 1) The RET at retbleed_return_thunk must be on a 64 byte boundary, for * alignment within the BTB. - * 2) The instruction at zen_untrain_ret must contain, and not + * 2) The instruction at retbleed_untrain_ret must contain, and not * end with, the 0xc3 byte of the RET. * 3) STIBP must be enabled, or SMT disabled, to prevent the sibling thread * from re-poisioning the BTB prediction. */ .align 64 - .skip 64 - (zen_return_thunk - zen_untrain_ret), 0xcc -SYM_FUNC_START_NOALIGN(zen_untrain_ret); + .skip 64 - (retbleed_return_thunk - retbleed_untrain_ret), 0xcc +SYM_FUNC_START_NOALIGN(retbleed_untrain_ret); /* - * As executed from zen_untrain_ret, this is: + * As executed from retbleed_untrain_ret, this is: * * TEST $0xcc, %bl * LFENCE - * JMP zen_return_thunk + * JMP retbleed_return_thunk * * Executing the TEST instruction has a side effect of evicting any BTB * prediction (potentially attacker controlled) attached to the RET, as - * zen_return_thunk + 1 isn't an instruction boundary at the moment. + * retbleed_return_thunk + 1 isn't an instruction boundary at the moment. */ .byte 0xf6 /* - * As executed from zen_return_thunk, this is a plain RET. + * As executed from retbleed_return_thunk, this is a plain RET. * * As part of the TEST above, RET is the ModRM byte, and INT3 the imm8. *
@@ -166,13 +166,13 @@ SYM_FUNC_START_NOALIGN(zen_untrain_ret); * With SMT enabled and STIBP active, a sibling thread cannot poison * RET's prediction to a type of its choice, but can evict the * prediction due to competitive sharing. If the prediction is - * evicted, zen_return_thunk will suffer Straight Line Speculation + * evicted, retbleed_return_thunk will suffer Straight Line Speculation * which will be contained safely by the INT3. */ -SYM_INNER_LABEL(zen_return_thunk, SYM_L_GLOBAL) +SYM_INNER_LABEL(retbleed_return_thunk, SYM_L_GLOBAL) ret int3 -SYM_CODE_END(zen_return_thunk) +SYM_CODE_END(retbleed_return_thunk) /* * Ensure the TEST decoding / BTB invalidation is complete.
@@ -183,13 +183,13 @@ SYM_CODE_END(zen_return_thunk) * Jump back and execute the RET in the middle of the TEST instruction. * INT3 is for SLS protection. */ - jmp zen_return_thunk + jmp retbleed_return_thunk int3 -SYM_FUNC_END(zen_untrain_ret) -__EXPORT_THUNK(zen_untrain_ret) +SYM_FUNC_END(retbleed_untrain_ret) +__EXPORT_THUNK(retbleed_untrain_ret) /* - * SRSO untraining sequence for Zen1/2, similar to zen_untrain_ret() + * SRSO untraining sequence for Zen1/2, similar to retbleed_untrain_ret() * above. On kernel entry, srso_untrain_ret() is executed which is a * * movabs $0xccccccc308c48348,%rax
tools/objtool/arch/x86/decode.c +1 -1
@@ -655,5 +655,5 @@ bool arch_is_rethunk(struct symbol *sym)return !strcmp (sym->name,"__x86_return_thunk" ) || !strcmp (sym->name,"srso_untrain_ret" ) || !strcmp (sym->name,"srso_safe_ret" ) || - !strcmp (sym->name,"zen_return_thunk" ); + !strcmp (sym->name,"retbleed_return_thunk" ); }
tools/objtool/check.c +1 -1
@@ -1165,7 +1165,7 @@ static int add_jump_destinations(structcontinue ;/* -* This is a special case for zen_untrain_ret(). +* This is a special case for retbleed_untrain_ret(). * It jumps to __x86_return_thunk(), but objtool * can't find the thunk's starting RET * instruction, because the RET is also in the
Greg Kroah-Hartman
maintainerPATCH 126/135 x86/cpu: Rename srso_(.*)_alias to srso_alias_\1
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
commit 42be649dd1f2eee6b1fb185f1a231b9494cf095f upstream.
For a more consistent namespace.
[ bp: Fixup names in the doc too. ]
--- Documentation/admin-guide/hw-vuln/srso.rst | 4 ++-- arch/x86/include/asm/nospec-branch.h | 4 ++-- arch/x86/kernel/vmlinux.lds.S | 8 ++++---- arch/x86/lib/retpoline.S | 26 +++++++++++++------------- 4 files changed, 21 insertions(+), 21 deletions(-)
Documentation/admin-guide/hw-vuln/srso.rst +2 -2
@@ -124,8 +124,8 @@ sequence. To ensure the safety of this mitigation, the kernel must ensure that the safe return sequence is itself free from attacker interference. In Zen3 and Zen4, this is accomplished by creating a BTB alias between the -untraining function srso_untrain_ret_alias() and the safe return -function srso_safe_ret_alias() which results in evicting a potentially +untraining function srso_alias_untrain_ret() and the safe return +function srso_alias_safe_ret() which results in evicting a potentially poisoned BTB entry and using that safe one for all function returns. In older Zen1 and Zen2, this is accomplished using a reinterpretation
arch/x86/include/asm/nospec-branch.h +2 -2
@@ -183,7 +183,7 @@#ifdef CONFIG_CPU_SRSO ALTERNATIVE_2 "" ,"call srso_untrain_ret" ,X86_FEATURE_SRSO , \ -"call srso_untrain_ret_alias" ,X86_FEATURE_SRSO_ALIAS +"call srso_alias_untrain_ret" ,X86_FEATURE_SRSO_ALIAS #endif .endm
@@ -207,7 +207,7 @@ extern void srso_alias_return_thunk(voidextern void retbleed_untrain_ret (void );extern void srso_untrain_ret (void ); -extern void srso_untrain_ret_alias (void ); +extern void srso_alias_untrain_ret (void );extern void entry_ibpb (void );
arch/x86/kernel/vmlinux.lds.S +4 -4
@@ -141,10 +141,10 @@ SECTIONS #ifdef CONFIG_CPU_SRSO /* - * See the comment above srso_untrain_ret_alias()'s + * See the comment above srso_alias_untrain_ret()'s * definition. */ - . = srso_untrain_ret_alias | (1 << 2) | (1 << 8) | (1 << 14) | (1 << 20); + . = srso_alias_untrain_ret | (1 << 2) | (1 << 8) | (1 << 14) | (1 << 20); *(.text.__x86.rethunk_safe) #endif ALIGN_ENTRY_TEXT_END
@@ -533,8 +533,8 @@ INIT_PER_CPU(irq_stack_backing_store); * Instead do: (A | B) - (A & B) in order to compute the XOR * of the two function addresses: */ -. = ASSERT(((ABSOLUTE(srso_untrain_ret_alias) | srso_safe_ret_alias) - - (ABSOLUTE(srso_untrain_ret_alias) & srso_safe_ret_alias)) == ((1 << 2) | (1 << 8) | (1 << 14) | (1 << 20)), +. = ASSERT(((ABSOLUTE(srso_alias_untrain_ret) | srso_alias_safe_ret) - + (ABSOLUTE(srso_alias_untrain_ret) & srso_alias_safe_ret)) == ((1 << 2) | (1 << 8) | (1 << 14) | (1 << 20)), "SRSO function pair won't alias"); #endif
arch/x86/lib/retpoline.S +13 -13
@@ -75,55 +75,55 @@ SYM_CODE_END(__x86_indirect_thunk_array) #ifdef CONFIG_RETHUNK /* - * srso_untrain_ret_alias() and srso_safe_ret_alias() are placed at + * srso_alias_untrain_ret() and srso_alias_safe_ret() are placed at * special addresses: * - * - srso_untrain_ret_alias() is 2M aligned - * - srso_safe_ret_alias() is also in the same 2M page but bits 2, 8, 14 + * - srso_alias_untrain_ret() is 2M aligned + * - srso_alias_safe_ret() is also in the same 2M page but bits 2, 8, 14 * and 20 in its virtual address are set (while those bits in the - * srso_untrain_ret_alias() function are cleared). + * srso_alias_untrain_ret() function are cleared). * * This guarantees that those two addresses will alias in the branch * target buffer of Zen3/4 generations, leading to any potential * poisoned entries at that BTB slot to get evicted. * - * As a result, srso_safe_ret_alias() becomes a safe return. + * As a result, srso_alias_safe_ret() becomes a safe return. */ #ifdef CONFIG_CPU_SRSO .section .text.__x86.rethunk_untrain -SYM_START(srso_untrain_ret_alias, SYM_L_GLOBAL, SYM_A_NONE) +SYM_START(srso_alias_untrain_ret, SYM_L_GLOBAL, SYM_A_NONE) UNWIND_HINT_FUNC ASM_NOP2 lfence jmp srso_alias_return_thunk -SYM_FUNC_END(srso_untrain_ret_alias) -__EXPORT_THUNK(srso_untrain_ret_alias) +SYM_FUNC_END(srso_alias_untrain_ret) +__EXPORT_THUNK(srso_alias_untrain_ret) .section .text.__x86.rethunk_safe #else /* dummy definition for alternatives */ -SYM_START(srso_untrain_ret_alias, SYM_L_GLOBAL, SYM_A_NONE) +SYM_START(srso_alias_untrain_ret, SYM_L_GLOBAL, SYM_A_NONE) ANNOTATE_UNRET_SAFE ret int3 -SYM_FUNC_END(srso_untrain_ret_alias) +SYM_FUNC_END(srso_alias_untrain_ret) #endif -SYM_START(srso_safe_ret_alias, SYM_L_GLOBAL, SYM_A_NONE) +SYM_START(srso_alias_safe_ret, SYM_L_GLOBAL, SYM_A_NONE) add $8, %_ASM_SP UNWIND_HINT_FUNC ANNOTATE_UNRET_SAFE ret int3 -SYM_FUNC_END(srso_safe_ret_alias) +SYM_FUNC_END(srso_alias_safe_ret) .section .text.__x86.return_thunk SYM_CODE_START(srso_alias_return_thunk) UNWIND_HINT_FUNC ANNOTATE_NOENDBR - call srso_safe_ret_alias + call srso_alias_safe_ret ud2 SYM_CODE_END(srso_alias_return_thunk)
Greg Kroah-Hartman
maintainerPATCH 127/135 x86/cpu: Cleanup the untrain mess
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
commit e7c25c441e9e0fa75b4c83e0b26306b702cfe90d upstream.
Since there can only be one active return_thunk, there only needs be one (matching) untrain_ret. It fundamentally doesn't make sense to allow multiple untrain_ret at the same time.
Fold all the 3 different untrain methods into a single (temporary) helper stub.
--- arch/x86/include/asm/nospec-branch.h | 12 ++++-------- arch/x86/kernel/cpu/bugs.c | 1 + arch/x86/lib/retpoline.S | 7 +++++++ 3 files changed, 12 insertions(+), 8 deletions(-)
arch/x86/include/asm/nospec-branch.h +4 -8
@@ -156,9 +156,9 @@ .endm#ifdef CONFIG_CPU_UNRET_ENTRY -#define CALL_ZEN_UNTRAIN_RET "call retbleed_untrain_ret" +#define CALL_UNTRAIN_RET "call entry_untrain_ret"#else -#define CALL_ZEN_UNTRAIN_RET "" +#define CALL_UNTRAIN_RET ""#endif /*
@@ -177,14 +177,9 @@defined (CONFIG_CPU_SRSO) ANNOTATE_UNRET_ENDALTERNATIVE_2 "" , \ -CALL_ZEN_UNTRAIN_RET ,X86_FEATURE_UNRET , \ +CALL_UNTRAIN_RET ,X86_FEATURE_UNRET , \"call entry_ibpb" ,X86_FEATURE_ENTRY_IBPB #endif - -#ifdef CONFIG_CPU_SRSO -ALTERNATIVE_2 "" ,"call srso_untrain_ret" ,X86_FEATURE_SRSO , \ -"call srso_alias_untrain_ret" ,X86_FEATURE_SRSO_ALIAS -#endif .endm#else /* __ASSEMBLY__ */
@@ -209,6 +204,7 @@ extern void retbleed_untrain_ret(void);extern void srso_untrain_ret (void );extern void srso_alias_untrain_ret (void ); +extern void entry_untrain_ret (void );extern void entry_ibpb (void );#ifdef CONFIG_RETPOLINE
arch/x86/kernel/cpu/bugs.c +1 -0
@@ -2359,6 +2359,7 @@ static void __init srso_select_mitigatio* like ftrace, static_call, etc. */ setup_force_cpu_cap (X86_FEATURE_RETHUNK ); +setup_force_cpu_cap (X86_FEATURE_UNRET );if (boot_cpu_data.x86 ==0x19 ) {setup_force_cpu_cap (X86_FEATURE_SRSO_ALIAS );
arch/x86/lib/retpoline.S +7 -0
@@ -230,6 +230,13 @@ SYM_CODE_START(srso_return_thunk) ud2 SYM_CODE_END(srso_return_thunk) +SYM_FUNC_START(entry_untrain_ret) + ALTERNATIVE_2 "jmp retbleed_untrain_ret", \ + "jmp srso_untrain_ret", X86_FEATURE_SRSO, \ + "jmp srso_alias_untrain_ret", X86_FEATURE_SRSO_ALIAS +SYM_FUNC_END(entry_untrain_ret) +__EXPORT_THUNK(entry_untrain_ret) + SYM_CODE_START(__x86_return_thunk) UNWIND_HINT_FUNC ANNOTATE_NOENDBR
Greg Kroah-Hartman
maintainerPATCH 128/135 x86/srso: Explain the untraining sequences a bit more
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Borislav Petkov (AMD) <[email protected]>
commit 9dbd23e42ff0b10c9b02c9e649c76e5228241a8e upstream.
The goal is to eventually have a proper documentation about all this.
--- arch/x86/lib/retpoline.S | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+)
arch/x86/lib/retpoline.S +19 -0
@@ -128,6 +128,25 @@ SYM_CODE_START(srso_alias_return_thunk) SYM_CODE_END(srso_alias_return_thunk) /* + * Some generic notes on the untraining sequences: + * + * They are interchangeable when it comes to flushing potentially wrong + * RET predictions from the BTB. + * + * The SRSO Zen1/2 (MOVABS) untraining sequence is longer than the + * Retbleed sequence because the return sequence done there + * (srso_safe_ret()) is longer and the return sequence must fully nest + * (end before) the untraining sequence. Therefore, the untraining + * sequence must fully overlap the return sequence. + * + * Regarding alignment - the instructions which need to be untrained, + * must all start at a cacheline boundary for Zen1/2 generations. That + * is, instruction sequences starting at srso_safe_ret() and + * the respective instruction sequences at retbleed_return_thunk() + * must start at a cacheline boundary. + */ + +/* * Safety details here pertain to the AMD Zen{1,2} microarchitecture: * 1) The RET at retbleed_return_thunk must be on a 64 byte boundary, for * alignment within the BTB.
Greg Kroah-Hartman
maintainerPATCH 129/135 x86/static_call: Fix __static_call_fixup()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
commit 54097309620ef0dc2d7083783dc521c6a5fef957 upstream.
Christian reported spurious module load crashes after some of Song's module memory layout patches.
Turns out that if the very last instruction on the very last page of the module is a 'JMP __x86_return_thunk' then __static_call_fixup() will trip a fault and die.
And while the module rework made this slightly more likely to happen, it's always been possible.
--- arch/x86/kernel/static_call.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
arch/x86/kernel/static_call.c +13 -0
@@ -123,6 +123,19 @@ EXPORT_SYMBOL_GPL(arch_static_call_trans*/ bool __static_call_fixup (void *tramp,u8 op,void *dest) { +unsigned long addr = (unsigned long )tramp; +/* +* Not all .return_sites are a static_call trampoline (most are not). +* Check if the 3 bytes after the return are still kernel text, if not, +* then this definitely is not a trampoline and we need not worry +* further. +* +* This avoids the memcmp() below tripping over pagefaults etc.. +*/ +if (((addr >>PAGE_SHIFT ) != ((addr +7 ) >>PAGE_SHIFT )) && + !kernel_text_address (addr +7 )) +return false; +if (memcmp (tramp+5 , tramp_ud,3 )) {/* Not a trampoline site, not our problem. */ return false;
Greg Kroah-Hartman
maintainerPATCH 130/135 x86/retpoline: Dont clobber RFLAGS during srso_safe_ret()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
commit ba5ca5e5e6a1d55923e88b4a83da452166f5560e upstream.
Use LEA instead of ADD when adjusting %rsp in srso_safe_ret{,_alias}() so as to avoid clobbering flags. Drop one of the INT3 instructions to account for the LEA consuming one more byte than the ADD.
KVM's emulator makes indirect calls into a jump table of sorts, where the destination of each call is a small blob of code that performs fast emulation by executing the target instruction with fixed operands.
E.g. to emulate ADC, fastop() invokes adcb_al_dl():
adcb_al_dl:
<+0>: adc %dl,%al
<+2>: jmp <__x86_return_thunk>A major motivation for doing fast emulation is to leverage the CPU to handle consumption and manipulation of arithmetic flags, i.e. RFLAGS is both an input and output to the target of the call. fastop() collects the RFLAGS result by pushing RFLAGS onto the stack and popping them back into a variable (held in %rdi in this case):
asm("push %[flags]; popf; " CALL_NOSPEC " ; pushf; pop %[flags]\n"
<+71>: mov 0xc0(%r8),%rdx <+78>: mov 0x100(%r8),%rcx <+85>: push %rdi
<+86>: popf
<+87>: call *%rsi
<+89>: nop
<+90>: nop
<+91>: nop
<+92>: pushf
<+93>: pop %rdi
and then propagating the arithmetic flags into the vCPU's emulator state:
ctxt->eflags = (ctxt->eflags & ~EFLAGS_MASK) | (flags & EFLAGS_MASK);
<+64>: and $0xfffffffffffff72a,%r9 <+94>: and $0x8d5,%edi <+109>: or %rdi,%r9 <+122>: mov %r9,0x10(%r8)
The failures can be most easily reproduced by running the "emulator" test in KVM-Unit-Tests.
If you're feeling a bit of deja vu, see commit b63f20a778c8 ("x86/retpoline: Don't clobber RFLAGS during CALL_NOSPEC on i386").
In addition, this breaks booting of clang-compiled guest on a gcc-compiled host where the host contains the %rsp-modifying SRSO mitigations.
[ bp: Massage commit message, extend, remove addresses. ]
--- arch/x86/lib/retpoline.S | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
arch/x86/lib/retpoline.S +3 -4
@@ -111,7 +111,7 @@ SYM_FUNC_END(srso_alias_untrain_ret) #endif SYM_START(srso_alias_safe_ret, SYM_L_GLOBAL, SYM_A_NONE) - add $8, %_ASM_SP + lea 8(%_ASM_SP), %_ASM_SP UNWIND_HINT_FUNC ANNOTATE_UNRET_SAFE ret
@@ -211,7 +211,7 @@ __EXPORT_THUNK(retbleed_untrain_ret) * SRSO untraining sequence for Zen1/2, similar to retbleed_untrain_ret() * above. On kernel entry, srso_untrain_ret() is executed which is a * - * movabs $0xccccccc308c48348,%rax + * movabs $0xccccc30824648d48,%rax * * and when the return thunk executes the inner label srso_safe_ret() * later, it is a stack manipulation and a RET which is mispredicted and
@@ -229,11 +229,10 @@ SYM_START(srso_untrain_ret, SYM_L_GLOBAL * the stack. */ SYM_INNER_LABEL(srso_safe_ret, SYM_L_GLOBAL) - add $8, %_ASM_SP + lea 8(%_ASM_SP), %_ASM_SP ret int3 int3 - int3 /* end of movabs */ lfence call srso_safe_ret
Greg Kroah-Hartman
maintainerPATCH 131/135 x86/CPU/AMD: Fix the DIV(0) initial fix attempt
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Borislav Petkov (AMD) <[email protected]>
commit f58d6fbcb7c848b7f2469be339bc571f2e9d245b upstream.
Initially, it was thought that doing an innocuous division in the #DE handler would take care to prevent any leaking of old data from the divider but by the time the fault is raised, the speculation has already advanced too far and such data could already have been used by younger operations.
Therefore, do the innocuous division on every exit to userspace so that userspace doesn't see any potentially old data from integer divisions in kernel space.
Do the same before VMRUN too, to protect host data from leaking into the guest too.
--- arch/x86/include/asm/entry-common.h | 1 + arch/x86/kernel/cpu/amd.c | 1 + arch/x86/kernel/traps.c | 2 -- arch/x86/kvm/svm/svm.c | 1 + 4 files changed, 3 insertions(+), 2 deletions(-)
arch/x86/include/asm/entry-common.h +1 -0
@@ -78,6 +78,7 @@ static inline void arch_exit_to_user_mod static __always_inline void arch_exit_to_user_mode(void) {mds_user_clear_cpu_buffers (); +amd_clear_divider (); }#define arch_exit_to_user_mode arch_exit_to_user_mode
arch/x86/kernel/cpu/amd.c +1 -0
@@ -1332,3 +1332,4 @@ void noinstr amd_clear_divider(void) asm volatile(ALTERNATIVE("", "div %2\n\t", X86_BUG_DIV0) :: "a" (0), "d" (0), "r" (1)); } +EXPORT_SYMBOL_GPL (amd_clear_divider);
arch/x86/kernel/traps.c +0 -2
@@ -198,8 +198,6 @@ DEFINE_IDTENTRY(exc_divide_error) {do_error_trap (regs,0 ,"divide error" ,X86_TRAP_DE ,SIGFPE ,FPE_INTDIV ,error_get_trap_addr (regs)); - -amd_clear_divider (); }DEFINE_IDTENTRY (exc_overflow)
arch/x86/kvm/svm/svm.c +1 -0
@@ -3376,6 +3376,7 @@ static void svm_flush_tlb_gva(struct kvmstatic void svm_prepare_guest_switch (struct kvm_vcpu *vcpu) { +amd_clear_divider (); }static inline void sync_cr8_to_lapic (struct kvm_vcpu *vcpu)
Greg Kroah-Hartman
maintainerPATCH 132/135 x86/srso: Disable the mitigation on unaffected configurations
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Borislav Petkov (AMD) <[email protected]>
commit e9fbc47b818b964ddff5df5b2d5c0f5f32f4a147 upstream.
Skip the srso cmd line parsing which is not needed on Zen1/2 with SMT disabled and with the proper microcode applied (latter should be the case anyway) as those are not affected.
--- arch/x86/kernel/cpu/bugs.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
arch/x86/kernel/cpu/bugs.c +6 -1
@@ -2329,8 +2329,10 @@ static void __init srso_select_mitigatio* IBPB microcode has been applied. */ if ((boot_cpu_data.x86 <0x19 ) && - (!cpu_smt_possible () || (cpu_smt_control ==CPU_SMT_DISABLED ))) + (!cpu_smt_possible () || (cpu_smt_control ==CPU_SMT_DISABLED ))) {setup_force_cpu_cap (X86_FEATURE_SRSO_NO ); +return ; + } }if (retbleed_mitigation ==RETBLEED_MITIGATION_IBPB ) {
@@ -2616,6 +2618,9 @@ static ssize_t gds_show_state(char *buf)static ssize_t srso_show_state (char *buf) { +if (boot_cpu_has (X86_FEATURE_SRSO_NO )) +return sysfs_emit (buf,"Not affected\n" ); +return sysfs_emit (buf,"%s%s\n" , srso_strings[srso_mitigation], (cpu_has_ibpb_brtype_microcode () ?"" :", no microcode" ));
Greg Kroah-Hartman
maintainerPATCH 133/135 x86/retpoline,kprobes: Fix position of thunk sections with CONFIG_LTO_CLANG
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petr Pavlu <[email protected]>
commit 79cd2a11224eab86d6673fe8a11d2046ae9d2757 upstream.
The linker script arch/x86/kernel/vmlinux.lds.S matches the thunk sections ".text.__x86.*" from arch/x86/lib/retpoline.S as follows:
.text {
[...]
TEXT_TEXT
[...]
__indirect_thunk_start = .;
*(.text.__x86.*)
__indirect_thunk_end = .;
[...]
}Macro TEXT_TEXT references TEXT_MAIN which normally expands to only ".text". However, with CONFIG_LTO_CLANG, TEXT_MAIN becomes ".text .text.[0-9a-zA-Z_]*" which wrongly matches also the thunk sections. The output layout is then different than expected. For instance, the currently defined range [__indirect_thunk_start, __indirect_thunk_end] becomes empty.
Prevent the problem by using ".." as the first separator, for example, ".text..__x86.indirect_thunk". This pattern is utilized by other explicit section names which start with one of the standard prefixes, such as ".text" or ".data", and that need to be individually selected in the linker script.
[ nathan: Fix conflicts with SRSO and fold in fix issue brought up by
Andrew Cooper in post-review:
https://lore.kernel.org/[email protected] ]
--- arch/x86/kernel/vmlinux.lds.S | 8 ++++---- arch/x86/lib/retpoline.S | 8 ++++---- tools/objtool/check.c | 2 +- 3 files changed, 9 insertions(+), 9 deletions(-)
arch/x86/kernel/vmlinux.lds.S +4 -4
@@ -134,7 +134,7 @@ SECTIONS KPROBES_TEXT ALIGN_ENTRY_TEXT_BEGIN #ifdef CONFIG_CPU_SRSO - *(.text.__x86.rethunk_untrain) + *(.text..__x86.rethunk_untrain) #endif ENTRY_TEXT
@@ -145,7 +145,7 @@ SECTIONS * definition. */ . = srso_alias_untrain_ret | (1 << 2) | (1 << 8) | (1 << 14) | (1 << 20); - *(.text.__x86.rethunk_safe) + *(.text..__x86.rethunk_safe) #endif ALIGN_ENTRY_TEXT_END SOFTIRQENTRY_TEXT
@@ -155,8 +155,8 @@ SECTIONS #ifdef CONFIG_RETPOLINE __indirect_thunk_start = .; - *(.text.__x86.indirect_thunk) - *(.text.__x86.return_thunk) + *(.text..__x86.indirect_thunk) + *(.text..__x86.return_thunk) __indirect_thunk_end = .; #endif } :text =0xcccc
arch/x86/lib/retpoline.S +4 -4
@@ -11,7 +11,7 @@ #include <asm/frame.h> #include <asm/nops.h> - .section .text.__x86.indirect_thunk + .section .text..__x86.indirect_thunk .macro RETPOLINE reg ANNOTATE_INTRA_FUNCTION_CALL
@@ -90,7 +90,7 @@ SYM_CODE_END(__x86_indirect_thunk_array) * As a result, srso_alias_safe_ret() becomes a safe return. */ #ifdef CONFIG_CPU_SRSO - .section .text.__x86.rethunk_untrain + .section .text..__x86.rethunk_untrain SYM_START(srso_alias_untrain_ret, SYM_L_GLOBAL, SYM_A_NONE) UNWIND_HINT_FUNC
@@ -100,7 +100,7 @@ SYM_START(srso_alias_untrain_ret, SYM_L_ SYM_FUNC_END(srso_alias_untrain_ret) __EXPORT_THUNK(srso_alias_untrain_ret) - .section .text.__x86.rethunk_safe + .section .text..__x86.rethunk_safe #else /* dummy definition for alternatives */ SYM_START(srso_alias_untrain_ret, SYM_L_GLOBAL, SYM_A_NONE)
@@ -118,7 +118,7 @@ SYM_START(srso_alias_safe_ret, SYM_L_GLO int3 SYM_FUNC_END(srso_alias_safe_ret) - .section .text.__x86.return_thunk + .section .text..__x86.return_thunk SYM_CODE_START(srso_alias_return_thunk) UNWIND_HINT_FUNC
tools/objtool/check.c +1 -1
@@ -369,7 +369,7 @@ static int decode_instructions(struct obif (!strcmp (sec->name,".noinstr.text" ) || !strcmp (sec->name,".entry.text" ) || - !strncmp (sec->name,".text.__x86." ,12 )) + !strncmp (sec->name,".text..__x86." ,13 )) sec->noinstr = true;for (offset =0 ; offset < sec->len; offset += insn->len) {
Greg Kroah-Hartman
maintainerPATCH 134/135 objtool/x86: Fixup frame-pointer vs rethunk
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
commit dbf46008775516f7f25c95b7760041c286299783 upstream.
For stack-validation of a frame-pointer build, objtool validates that every CALL instruction is preceded by a frame-setup. The new SRSO return thunks violate this with their RSB stuffing trickery.
Extend the __fentry__ exception to also cover the embedded_insn case used for this. This cures:
vmlinux.o: warning: objtool: srso_untrain_ret+0xd: call without frame pointer save/setup
--- tools/objtool/check.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-)
tools/objtool/check.c +11 -6
@@ -2079,12 +2079,17 @@ static int decode_sections(struct objtooreturn 0 ; } -static bool is_fentry_call (struct instruction *insn) +static bool is_special_call (struct instruction *insn) { -if (insn->type ==INSN_CALL && - insn->call_dest && - insn->call_dest->fentry) -return true; +if (insn->type ==INSN_CALL ) { +struct symbol *dest = insn->call_dest; + +if (!dest) +return false; + +if (dest->fentry) +return true; + }return false; }
@@ -2958,7 +2963,7 @@ static int validate_branch(struct objtooif (ret)return ret; -if (!no_fp && func && !is_fentry_call (insn) && +if (!no_fp && func && !is_special_call (insn) && !has_valid_stack_frame (&state)) {WARN_FUNC ("call without frame pointer save/setup" , sec, insn->offset);
Greg KH
maintainerRe: [PATCH 5.10 134/135] objtool/x86: Fixup frame-pointer vs rethunk
Quoted 72 lines · John Sperbeck
Quoted 56 lines
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
commit
dbf46008775516f7f25c95b7760041c286299783upstream.For stack-validation of a frame-pointer build, objtool validates that every CALL instruction is preceded by a frame-setup. The new SRSO return thunks violate this with their RSB stuffing trickery.
Extend the
__fentry__exception to also cover theembedded_insncase used for this. This cures:vmlinux.o: warning: objtool:
srso_untrain_ret+0xd: call without frame pointer save/setupFixes 4ae68b26c3ab ("objtool/x86: Fix SRSO mess")Signed-off-by Peter Zijlstra (Intel) <[email protected]>Signed-off-by Borislav Petkov (AMD) <[email protected]>Acked-by Josh Poimboeuf <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>--- tools/objtool/check.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-)tools/objtool/check.c +10
-5@@ -2079,12 +2079,17 @@ static int decode_sections(struct objtooreturn 0 ; } -static bool is_fentry_call (struct instruction *insn) +static bool is_special_call (struct instruction *insn) { -if (insn->type ==INSN_CALL && - insn->call_dest && - insn->call_dest->fentry) -return true; +if (insn->type ==INSN_CALL ) { +struct symbol *dest = insn->call_dest; + +if (!dest) +return false; + +if (dest->fentry) +return true; + }return false; }tools/objtool/check.c static int validate_branch(struct objtoo · line 2969
Quoted 8 lines
tools/objtool/check.c +1
-1@@ -2958,7 +2963,7 @@ static int validate_branch(struct objtooif (ret)return ret; -if (!no_fp && func && !is_fentry_call (insn) && +if (!no_fp && func && !is_special_call (insn) && !has_valid_stack_frame (&state)) {WARN_FUNC ("call without frame pointer save/setup" , sec, insn->offset);We still see the '
srso_untrain_ret+0xd: call without frame pointer save/setup' warning with v5.15.136. It looks like the backport might be incomplete. Is this additional change needed?tools/objtool/check.c +0
-0
tools/objtool/check.c static bool is_special_call(struct instruction *insn) · line 2208
Quoted 8 lines
tools/objtool/check.c +1
-1@@ -2202,7 +2202,7 @@ static bool is_special_call(struct instruction *insn)if (!dest)return false; -if (dest->fentry) +if (dest->fentry || dest->embedded_insn)return true; }
Possibly, I remember this was a pain to backport. Can you try this and see? If so, can you send a working and tested patch?
thanks,
greg k-h
Re: [PATCH 5.10 134/135] objtool/x86: Fixup frame-pointer vs rethunk
Quoted 86 lines · Greg KH
Quoted 72 lines · John Sperbeck
Quoted 56 lines
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
commit
dbf46008775516f7f25c95b7760041c286299783upstream.For stack-validation of a frame-pointer build, objtool validates that every CALL instruction is preceded by a frame-setup. The new SRSO return thunks violate this with their RSB stuffing trickery.
Extend the
__fentry__exception to also cover theembedded_insncase used for this. This cures:vmlinux.o: warning: objtool:
srso_untrain_ret+0xd: call without frame pointer save/setupFixes 4ae68b26c3ab ("objtool/x86: Fix SRSO mess")Signed-off-by Peter Zijlstra (Intel) <[email protected]>Signed-off-by Borislav Petkov (AMD) <[email protected]>Acked-by Josh Poimboeuf <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>--- tools/objtool/check.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-)tools/objtool/check.c +10
-5@@ -2079,12 +2079,17 @@ static int decode_sections(struct objtooreturn 0 ; } -static bool is_fentry_call (struct instruction *insn) +static bool is_special_call (struct instruction *insn) { -if (insn->type ==INSN_CALL && - insn->call_dest && - insn->call_dest->fentry) -return true; +if (insn->type ==INSN_CALL ) { +struct symbol *dest = insn->call_dest; + +if (!dest) +return false; + +if (dest->fentry) +return true; + }return false; }tools/objtool/check.c static int validate_branch(struct objtoo · line 2969
Quoted 8 lines
tools/objtool/check.c +1
-1@@ -2958,7 +2963,7 @@ static int validate_branch(struct objtooif (ret)return ret; -if (!no_fp && func && !is_fentry_call (insn) && +if (!no_fp && func && !is_special_call (insn) && !has_valid_stack_frame (&state)) {WARN_FUNC ("call without frame pointer save/setup" , sec, insn->offset);We still see the '
srso_untrain_ret+0xd: call without frame pointer save/setup' warning with v5.15.136. It looks like the backport might be incomplete. Is this additional change needed?tools/objtool/check.c +0
-0tools/objtool/check.c static bool is_special_call(struct instruction *insn) · line 2208
Quoted 8 lines
tools/objtool/check.c +1
-1@@ -2202,7 +2202,7 @@ static bool is_special_call(struct instruction *insn)if (!dest)return false; -if (dest->fentry) +if (dest->fentry || dest->embedded_insn)return true; }Possibly, I remember this was a pain to backport. Can you try this and see? If so, can you send a working and tested patch?
Quoted 3 lines
thanks,
greg k-h
I think I can do that. What's the process for a patch that would only go to certain stable branches? The 6.5 branch is okay. A fix would apply to 6.1, 5.15, and 5.10. The original partial backport hasn't gone into early releases, but I don't know if it will in the future.
Greg KH
maintainerRe: [PATCH 5.10 134/135] objtool/x86: Fixup frame-pointer vs rethunk
Quoted 87 lines · John Sperbeck
Quoted 86 lines · Greg KH
Quoted 72 lines · John Sperbeck
Quoted 56 lines
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
commit
dbf46008775516f7f25c95b7760041c286299783upstream.For stack-validation of a frame-pointer build, objtool validates that every CALL instruction is preceded by a frame-setup. The new SRSO return thunks violate this with their RSB stuffing trickery.
Extend the
__fentry__exception to also cover theembedded_insncase used for this. This cures:vmlinux.o: warning: objtool:
srso_untrain_ret+0xd: call without frame pointer save/setupFixes 4ae68b26c3ab ("objtool/x86: Fix SRSO mess")Signed-off-by Peter Zijlstra (Intel) <[email protected]>Signed-off-by Borislav Petkov (AMD) <[email protected]>Acked-by Josh Poimboeuf <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>--- tools/objtool/check.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-)tools/objtool/check.c +10
-5@@ -2079,12 +2079,17 @@ static int decode_sections(struct objtooreturn 0 ; } -static bool is_fentry_call (struct instruction *insn) +static bool is_special_call (struct instruction *insn) { -if (insn->type ==INSN_CALL && - insn->call_dest && - insn->call_dest->fentry) -return true; +if (insn->type ==INSN_CALL ) { +struct symbol *dest = insn->call_dest; + +if (!dest) +return false; + +if (dest->fentry) +return true; + }return false; }tools/objtool/check.c static int validate_branch(struct objtoo · line 2969
Quoted 8 lines
tools/objtool/check.c +1
-1@@ -2958,7 +2963,7 @@ static int validate_branch(struct objtooif (ret)return ret; -if (!no_fp && func && !is_fentry_call (insn) && +if (!no_fp && func && !is_special_call (insn) && !has_valid_stack_frame (&state)) {WARN_FUNC ("call without frame pointer save/setup" , sec, insn->offset);We still see the '
srso_untrain_ret+0xd: call without frame pointer save/setup' warning with v5.15.136. It looks like the backport might be incomplete. Is this additional change needed?tools/objtool/check.c +0
-0tools/objtool/check.c static bool is_special_call(struct instruction *insn) · line 2208
Quoted 8 lines
tools/objtool/check.c +1
-1@@ -2202,7 +2202,7 @@ static bool is_special_call(struct instruction *insn)if (!dest)return false; -if (dest->fentry) +if (dest->fentry || dest->embedded_insn)return true; }Possibly, I remember this was a pain to backport. Can you try this and see? If so, can you send a working and tested patch?
Quoted 6 lines
Quoted 3 lines
thanks,
greg k-h
I think I can do that. What's the process for a patch that would only go to certain stable branches?
Send it to use and say "This only applies to X and Y", there are loads of examples on the stable mailing list of this happening all the time.
thanks,
greg k-h
Greg Kroah-Hartman
maintainerPATCH 135/135 x86/srso: Correct the mitigation status when SMT is disabled
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Borislav Petkov (AMD) <[email protected]>
commit 6405b72e8d17bd1875a56ae52d23ec3cd51b9d66 upstream.
Specify how is SRSO mitigated when SMT is disabled. Also, correct the SMT check for that.
--- arch/x86/kernel/cpu/bugs.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
arch/x86/kernel/cpu/bugs.c +2 -3
@@ -2328,8 +2328,7 @@ static void __init srso_select_mitigatio* Zen1/2 with SMT off aren't vulnerable after the right * IBPB microcode has been applied. */ -if ((boot_cpu_data.x86 <0x19 ) && - (!cpu_smt_possible () || (cpu_smt_control ==CPU_SMT_DISABLED ))) { +if (boot_cpu_data.x86 <0x19 && !cpu_smt_possible ()) {setup_force_cpu_cap (X86_FEATURE_SRSO_NO );return ; }
@@ -2619,7 +2618,7 @@ static ssize_t gds_show_state(char *buf)static ssize_t srso_show_state (char *buf) {if (boot_cpu_has (X86_FEATURE_SRSO_NO )) -return sysfs_emit (buf,"Not affected\n" ); +return sysfs_emit (buf,"Mitigation: SMT disabled\n" ); return sysfs_emit(buf, "%s%s\n", srso_strings[srso_mitigation],
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.192 release. There are 135 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 26 Aug 2023 17:05:50 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.192-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.10.y
and the diffstat can be found below.thanks,
greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on BMIPS_GENERIC:
Signature · 1 line
Florian
Quoted 5 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.192 release. There are 135 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 8 lines
Responses should be made by Sat, 26 Aug 2023 17:05:50 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.192-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.10.y
and the diffstat can be found below.
For RCU,
thanks,
- Joel
Quoted 554 lines
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:Greg Kroah-Hartman <[email protected]>
Linux 5.10.192-rc1Borislav Petkov (AMD) <[email protected]>
x86/srso: Correct the mitigation status when SMT is disabledPeter Zijlstra <[email protected]>
objtool/x86: Fixup frame-pointer vs rethunkPetr Pavlu <[email protected]>
x86/retpoline,kprobes: Fix position of thunk sections withCONFIG_LTO_CLANGBorislav Petkov (AMD) <[email protected]>
x86/srso: Disable the mitigation on unaffected configurationsBorislav Petkov (AMD) <[email protected]>
x86/CPU/AMD: Fix the DIV(0) initial fix attemptSean Christopherson <[email protected]>
x86/retpoline: Don't clobber RFLAGS duringsrso_safe_ret()Peter Zijlstra <[email protected]>
x86/static_call: Fix __static_call_fixup()Borislav Petkov (AMD) <[email protected]>
x86/srso: Explain the untraining sequences a bit morePeter Zijlstra <[email protected]>
x86/cpu: Cleanup the untrain messPeter Zijlstra <[email protected]>
x86/cpu: Rename srso_(.*)_alias to srso_alias_\1Peter Zijlstra <[email protected]>
x86/cpu: Rename original retbleed methodsPeter Zijlstra <[email protected]>
x86/cpu: Clean up SRSO return thunk messPeter Zijlstra <[email protected]>
x86/ibt: AddANNOTATE_NOENDBRJosh Poimboeuf <[email protected]>
objtool: Add frame-pointer-specific function ignorePeter Zijlstra <[email protected]>
x86/alternative: Make custom return thunk unconditionalPeter Zijlstra <[email protected]>
x86/cpu: Fix up srso_safe_ret() and __x86_return_thunk()Peter Zijlstra <[email protected]>
x86/cpu: Fix__x86_return_thunksymbol typeYangtao Li <[email protected]>
mmc: f-sdh30: fix order of function calls insdhci_f_sdh30_removeJason Xing <[email protected]>
net: fix the RTO timer retransmitting skb every 1ms if linear option is enabledJason Wang <[email protected]>
virtio-net: set queues afterdriver_okKuniyuki Iwashima <[email protected]>
af_unix: Fix null-ptr-deref inunix_stream_sendpage().Xin Long <[email protected]>
netfilter: set default timeout to 3 secs for sctp shutdown send and recv stateYibin Ding <[email protected]>
mmc: block: Fix in_flight[issue_type] value errorYang Yingliang <[email protected]>
mmc: wbsd: fix doublemmc_free_host()inwbsd_init()Russell Harmon via samba-technical <[email protected]>
cifs: Release folio lock on fscache read hit.dengxiang <[email protected]>
ALSA: usb-audio: Add support for Mythware XA001AU capture and playback interfaces.Tony Lindgren <[email protected]>
serial: 8250: Fix oops for port->pm on uart_change_pm()Alexandre Ghiti <[email protected]>
riscv: uaccess: Return the number of bytes effectively not copiedChen Lifu <[email protected]>
riscv: lib: uaccess: fixCSR_STATUSSR_SUMbitJisheng Zhang <[email protected]>
riscv: lib: uaccess: fold fixups into bodyAkira Tsukamoto <[email protected]>
riscv: __asm_copy_to-from_user: Optimize unaligned memory access and pipeline stallKailang Yang <[email protected]>
ALSA: hda/realtek - Remodified 3k pull low procedureJerome Brunet <[email protected]>
ASoC: meson: axg-tdm-formatter: fix channel slot allocationZhang Shurong <[email protected]>
ASoC: rt5665: add missedregulator_bulk_disableChristopher Obbard <[email protected]>
arm64: dts: rockchip: Disable HS400 for eMMC on ROCK Pi 4FUKAUMI Naoki <[email protected]>
arm64: dts: rockchip: sort nodes/properties on rk3399-rock-4FUKAUMI Naoki <[email protected]>
arm64: dts: rockchip: fix regulator name on rk3399-rock-4Alex Bee <[email protected]>
arm64: dts: rockchip: add SPDIF node for ROCK Pi 4Alex Bee <[email protected]>
arm64: dts: rockchip: add ES8316 codec for ROCK Pi 4Vicente Bergas <[email protected]>
arm64: dts: rockchip: use USB host by default on rk3399-rock-pi-4Vicente Bergas <[email protected]>
arm64: dts: rockchip: fix supplies on rk3399-rock-pi-4Tony Lindgren <[email protected]>
bus: ti-sysc: Flush posted write on enable before resetEric Dumazet <[email protected]>
net: do not allowgso_sizeto be set toGSO_BY_FRAGSAbel Wu <[email protected]>
sock: Fix misuse ofsk_under_memory_pressure()Alfred Lee <[email protected]>
net: dsa: mv88e6xxx: Wait for EEPROM done before HW resetAndrii Staikov <[email protected]>
i40e: fix misleading debug logsZiyang Xuan <[email protected]>
team: Fix incorrect deletion ofETH_P_8021ADprotocol vid from slavesJustin Chen <[email protected]>
net: phy: broadcom: stub c45 read/write for 54810Pablo Neira Ayuso <[email protected]>
netfilter:nft_dynset: disallow object mapsSishuai Gong <[email protected]>
ipvs: fix racy memcpy inproc_do_sync_thresholdLuca Ceresoli <[email protected]>
drm/panel: simple: Fix AUO G121EAN01 panel timings according to the docsPetr Machata <[email protected]>
selftests:mirror_gre_changes: Tighten up the TTL test matchLin Ma <[email protected]>
xfrm: add forgottennla_policyforXFRMA_MTIMER_THRESHLin Ma <[email protected]>
xfrm: add NULL check inxfrm_update_ae_paramsZhengchao Shao <[email protected]>
ip_vti: fix potential slab-use-after-free indecode_session6Zhengchao Shao <[email protected]>
ip6_vti: fix slab-use-after-free indecode_session6Zhengchao Shao <[email protected]>
xfrm: fix slab-use-after-free indecode_session6Lin Ma <[email protected]>
net: xfrm: AmendXFRMA_SEC_CTXnla_policystructureLin Ma <[email protected]>
net:af_key: fixsadb_x_filtervalidationLin Ma <[email protected]>
net: xfrm: Fixxfrm_address_filterOOB readTam Nguyen <[email protected]>
i2c: designware: Handle invalid SMBus block data response length valuexiaoshoukui <[email protected]>
btrfs: fixBUG_ONcondition inbtrfs_cancel_balanceSherry Sun <[email protected]>
tty: serial:fsl_lpuart: Clear the error flags by writing 1 for lpuart32 platformsYi Yang <[email protected]>
tty:n_gsm: fix the UAF caused by race condition ingsm_cleanup_muxNathan Lynch <[email protected]>
powerpc/rtas_flash: allow user copy to flash block cache objectsYuanjun Gong <[email protected]>
fbdev: mmp: fix value check inmmphw_probe()Chengfeng Ye <[email protected]>
i2c: bcm-iproc: Fixbcm_iproc_i2c_isrdeadlock issueWolfram Sang <[email protected]>
virtio-mmio: don't break lifecycle ofvm_devTang Bin <[email protected]>
virtio-mmio: Useto_virtio_mmio_device()to simply codeIvan Mikhaylov <[email protected]>
net/ncsi: change fromndo_set_mac_addresstodev_set_mac_addressMasami Hiramatsu (Google) <[email protected]>
tracing/probes: Fix to update dynamic data counter if fetcharg uses itSteven Rostedt (VMware) <[email protected]>
tracing/probes: Haveprocess_fetch_insn()take a void * instead ofpt_regsSergey Shtylyov <[email protected]>
mmc: meson-gx: fix deferred probingHeiner Kallweit <[email protected]>
mmc: meson-gx: usedevm_mmc_alloc_hostHeiner Kallweit <[email protected]>
mmc: core: adddevm_mmc_alloc_hostSergey Shtylyov <[email protected]>
mmc: sunxi: fix deferred probingSergey Shtylyov <[email protected]>
mmc: bcm2835: fix deferred probingJohan Hovold <[email protected]>
USB: dwc3: qcom: fix NULL-deref on suspendFrank Li <[email protected]>
usb: cdns3: fix NCM gadget RX speed 20x slow than expection at iMX8QMFrank Li <[email protected]>
usb: cdns3: allocate TX FIFO size according to composite EP numberWesley Cheng <[email protected]>
usb: gadget: udc: core: Introducecheck_configto verify USB configurationPawel Laszczak <[email protected]>
usb: cdnsp: Device side header file for CDNSP driverJiaxun Yang <[email protected]>
irqchip/mips-gic: Use raw spinlock forgic_lockMarc Zyngier <[email protected]>
irqchip/mips-gic: Get rid of the reliance onirq_cpu_online()Jeffrey Hugo <[email protected]>
bus: mhi: host: Range check CHDBOFF and ERDBOFFManivannan Sadhasivam <[email protected]>
bus: mhi: Move host MHI code to "host" directoryBhaumik Bhatt <[email protected]>
bus: mhi: Add MMIO region length to controller structureLoic Poulain <[email protected]>
bus: mhi: Add MHI PCI support for WWAN modemsWilliam Breathitt Gray <[email protected]>
iio: addac: stx104: Fix race condition when converting analog-to-digitalWilliam Breathitt Gray <[email protected]>
iio: addac: stx104: Fix race condition forstx104_write_raw()William Breathitt Gray <[email protected]>
iio: adc: stx104: Implement and utilize register structuresWilliam Breathitt Gray <[email protected]>
iio: adc: stx104: Utilize iomap interfaceCosmin Tanislav <[email protected]>
dt-bindings: iio: add AD74413RCosmin Tanislav <[email protected]>
iio: add addac subdirectoryRandy Dunlap <[email protected]>
IMA: allow/fix UML buildsChen Lin <[email protected]>
ring-buffer: Do not swapcpu_bufferduring resize processBenjamin Gray <[email protected]>
powerpc/kasan: Disable KCOV in KASAN codeTuo Li <[email protected]>
ALSA: hda: fix a possible null-pointer dereference due to data race insnd_hdac_regmap_sync()dengxiang <[email protected]>
ALSA: hda/realtek: Add quirks for Unis H3C Desktop B760 & Q760shanzhulig <[email protected]>
drm/amdgpu: Fix potential fence use-after-free v2Matthew Anderson <[email protected]>
Bluetooth: btusb: Add MT7922 bluetooth ID for the Asus AllyZhengping Jiang <[email protected]>
Bluetooth: L2CAP: Fix use-after-freeArmin Wolf <[email protected]>
pcmcia:rsrc_nonstatic: Fix memory leak innonstatic_release_resource_db()Tuo Li <[email protected]>
gfs2: Fix possible data races ingfs2_show_options()Xu Yang <[email protected]>
usb: chipidea: imx: add missing USB PHY DPDM wakeup settingXu Yang <[email protected]>
usb: chipidea: imx: don't request QoS for imx8ulpHans Verkuil <[email protected]>
media: platform: mediatek: vpu: fix NULL ptr dereferencePrashanth K <[email protected]>
usb: gadget:u_serial: Avoid spinlock recursion in__gs_console_pushYunfei Dong <[email protected]>
media: v4l2-mem2mem: add lock to protect parameternum_rdyImmad Mir <[email protected]>
FS: JFS: Check for read-only mounted filesystem in txBeginImmad Mir <[email protected]>
FS: JFS: Fix null-ptr-deref Read in txBeginGustavo A. R. Silva <[email protected]>
MIPS: dec: prom: Address -Warray-bounds warningYogesh <[email protected]>
fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLevJan Kara <[email protected]>
udf: Fix uninitialized array access for some pathnamesChristian Brauner <[email protected]>
ovl: check type and offset of struct vfsmount inovl_entryPatrisious Haddad <[email protected]>
RDMA/mlx5: Return the firmware result upon destroying QP/RQMarco Morandini <[email protected]>
HID: add quirk for 03f0:464a HP Elite Presenter MouseLang Yu <[email protected]>
drm/amdgpu: install stub fence into potential unused fence pointersgaoxu <[email protected]>
dma-remap: use kvmalloc_array/kvfree for larger dma memory remapYe Bin <[email protected]>
quota: fix warning indqgrab()Jan Kara <[email protected]>
quota: Properly disable quotas whenadd_dquot_ref()failsGeert Uytterhoeven <[email protected]>
iopoll: Callcpu_relax()in busy loopsUday M Bhat <[email protected]>
ASoC: Intel:sof_sdw: Add support for Rex soundwireOleksij Rempel <[email protected]>
ARM: dts: imx6dl: prtrvt, prtvt7, prti6q, prtwd2: fix USB related warningsSumit Gupta <[email protected]>
PCI: tegra194: Fix possible array out of bounds accessPeter Ujfalusi <[email protected]>
ASoC: Intel:sof_sdw: add quirk for LNL RVPBard Liao <[email protected]>
ASoC: Intel:sof_sdw: add quirk for MTL RVPOswald Buddenhagen <[email protected]>
ALSA: emu10k1: roll up loops in DSP setup code for Audigyhackyzh002 <[email protected]>
drm/radeon: Fix integer overflow inradeon_cs_parser_initMoshe Shemesh <[email protected]>
net/mlx5: Skip clock update work when device is in error stateEran Ben Elisha <[email protected]>
net/mlx5: Move all internal timer metadata into a dedicated structEran Ben Elisha <[email protected]>
net/mlx5: Refactor init clock functionEric Dumazet <[email protected]>
macsec: useDEV_STATS_INC()Clayton Yager <[email protected]>
macsec: Fix traffic counters/statisticsKunihiko Hayashi <[email protected]>
mmc: sdhci-f-sdh30: Replace withsdhci_pltfm-------------
Diffstat:
Documentation/admin-guide/hw-vuln/srso.rst | 4 +- .../bindings/iio/addac/adi,ad74413r.yaml | 158 +++ Makefile | 4 +- arch/arm/boot/dts/imx6dl-prtrvt.dts | 4 + arch/arm/boot/dts/imx6qdl-prti6q.dtsi | 11 +- arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dtsi | 207 +-- arch/mips/include/asm/dec/prom.h | 2 +- arch/powerpc/kernel/rtas_flash.c | 6 +- arch/powerpc/mm/kasan/Makefile | 1 + arch/riscv/lib/uaccess.S | 212 ++- arch/x86/include/asm/entry-common.h | 1 + arch/x86/include/asm/nospec-branch.h | 28 +- arch/x86/kernel/cpu/amd.c | 1 + arch/x86/kernel/cpu/bugs.c | 28 +- arch/x86/kernel/static_call.c | 13 + arch/x86/kernel/traps.c | 2 - arch/x86/kernel/vmlinux.lds.S | 18 +- arch/x86/kvm/svm/svm.c | 1 + arch/x86/lib/retpoline.S | 141 +- drivers/bluetooth/btusb.c | 3 + drivers/bus/Makefile | 2 +- drivers/bus/mhi/Kconfig | 18 +- drivers/bus/mhi/Makefile | 4 +- drivers/bus/mhi/host/Kconfig | 31 + drivers/bus/mhi/{core => host}/Makefile | 4 +- drivers/bus/mhi/{core => host}/boot.c | 0 drivers/bus/mhi/{core => host}/debugfs.c | 0 drivers/bus/mhi/{core => host}/init.c | 12 + drivers/bus/mhi/{core => host}/internal.h | 0 drivers/bus/mhi/{core => host}/main.c | 0 drivers/bus/mhi/host/pci_generic.c | 345 +++++ drivers/bus/mhi/{core => host}/pm.c | 0 drivers/bus/ti-sysc.c | 2 + drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 6 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 6 +- drivers/gpu/drm/panel/panel-simple.c | 24 +- drivers/gpu/drm/radeon/radeon_cs.c | 3 +- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-quirks.c | 1 + drivers/i2c/busses/i2c-bcm-iproc.c | 11 +- drivers/i2c/busses/i2c-designware-master.c | 15 +- drivers/iio/Kconfig | 1 + drivers/iio/Makefile | 1 + drivers/iio/adc/stx104.c | 98 +- drivers/iio/addac/Kconfig | 8 + drivers/iio/addac/Makefile | 6 + drivers/infiniband/hw/mlx5/qpc.c | 10 +- drivers/irqchip/irq-mips-gic.c | 63 +- drivers/media/platform/mtk-vpu/mtk_vpu.c | 6 +- drivers/mmc/core/block.c | 7 +- drivers/mmc/core/host.c | 26 + drivers/mmc/host/bcm2835.c | 4 +- drivers/mmc/host/meson-gx-mmc.c | 52 +- drivers/mmc/host/sdhci_f_sdh30.c | 66 +- drivers/mmc/host/sunxi-mmc.c | 4 +- drivers/mmc/host/wbsd.c | 2 - drivers/net/dsa/mv88e6xxx/chip.c | 8 + drivers/net/ethernet/intel/i40e/i40e_nvm.c | 16 +- .../net/ethernet/mellanox/mlx5/core/lib/clock.c | 166 ++- .../net/ethernet/mellanox/mlx5/core/lib/clock.h | 3 +- drivers/net/macsec.c | 70 +- drivers/net/phy/broadcom.c | 13 + drivers/net/team/team.c | 4 +- drivers/net/virtio_net.c | 4 +- drivers/pci/controller/dwc/pcie-tegra194.c | 13 +- drivers/pcmcia/rsrc_nonstatic.c | 2 + drivers/tty/n_gsm.c | 3 +- drivers/tty/serial/8250/8250_port.c | 1 + drivers/tty/serial/fsl_lpuart.c | 4 +- drivers/usb/cdns3/cdnsp-gadget.h | 1463 ++++++++++++++++++++ drivers/usb/cdns3/gadget.c | 60 +- drivers/usb/cdns3/gadget.h | 9 +- drivers/usb/chipidea/ci_hdrc_imx.c | 5 + drivers/usb/chipidea/usbmisc_imx.c | 2 +- drivers/usb/dwc3/dwc3-qcom.c | 11 +- drivers/usb/gadget/function/u_serial.c | 3 + drivers/usb/gadget/udc/core.c | 19 + drivers/video/fbdev/mmp/hw/mmp_ctrl.c | 4 +- drivers/virtio/virtio_mmio.c | 8 +- fs/btrfs/volumes.c | 3 +- fs/cifs/file.c | 2 +- fs/gfs2/super.c | 26 +- fs/jfs/jfs_dmap.c | 3 + fs/jfs/jfs_txnmgr.c | 5 + fs/jfs/namei.c | 5 + fs/overlayfs/ovl_entry.h | 9 + fs/quota/dquot.c | 5 +- fs/udf/unicode.c | 2 +- include/dt-bindings/iio/addac/adi,ad74413r.h | 21 + include/linux/iopoll.h | 2 + include/linux/mhi.h | 2 + include/linux/mlx5/driver.h | 12 +- include/linux/mmc/host.h | 1 + include/linux/objtool.h | 28 + include/linux/usb/gadget.h | 4 + include/linux/virtio_net.h | 4 + include/media/v4l2-mem2mem.h | 18 +- include/net/sock.h | 6 + kernel/dma/remap.c | 4 +- kernel/trace/ring_buffer.c | 14 +- kernel/trace/trace.c | 3 +- kernel/trace/trace_kprobe.c | 3 +- kernel/trace/trace_probe_tmpl.h | 18 +- kernel/trace/trace_uprobe.c | 3 +- net/bluetooth/l2cap_core.c | 5 + net/core/sock.c | 2 +- net/ipv4/ip_vti.c | 4 +- net/ipv4/tcp_timer.c | 4 +- net/ipv6/ip6_vti.c | 4 +- net/key/af_key.c | 4 +- net/ncsi/ncsi-rsp.c | 5 +- net/netfilter/ipvs/ip_vs_ctl.c | 4 + net/netfilter/nf_conntrack_proto_sctp.c | 6 +- net/netfilter/nft_dynset.c | 3 + net/unix/af_unix.c | 9 +- net/xfrm/xfrm_compat.c | 2 +- net/xfrm/xfrm_interface_core.c | 4 +- net/xfrm/xfrm_user.c | 14 +- security/integrity/ima/Kconfig | 2 +- sound/hda/hdac_regmap.c | 7 +- sound/pci/emu10k1/emufx.c | 112 +- sound/pci/hda/patch_realtek.c | 16 +- sound/soc/codecs/rt5665.c | 2 + sound/soc/intel/boards/sof_sdw.c | 25 + sound/soc/meson/axg-tdm-formatter.c | 42 +- sound/usb/quirks-table.h | 29 + tools/include/linux/objtool.h | 28 + tools/objtool/arch/x86/decode.c | 2 +- tools/objtool/check.c | 21 +- .../selftests/net/forwarding/mirror_gre_changes.sh | 3 +- 130 files changed, 3442 insertions(+), 695 deletions(-)
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.192 release. There are 135 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 26 Aug 2023 17:05:50 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.192-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.10.y
and the diffstat can be found below.thanks,
greg k-h
The same test regressions found on stable-rc linux.5.10.y as reported on stable-rc linux.6.1.y and linux.5.15.y branch. LTP syscalls chown02 and fchown02 fails on arm64 Rpi4 device with the NFS rootfile system.
Test log:
--------
chown02.c:46: TPASS: chown(testfile1, 0, 0) passed
chown02.c:46: TPASS: chown(testfile2, 0, 0) passed
chown02.c:58: TFAIL: testfile2: wrong mode permissions 0100700, expected 0102700
fchown02.c:57: TPASS: fchown(3, 0, 0) passed fchown02.c:57: TPASS: fchown(4, 0, 0) passed fchown02.c:67: TFAIL: testfile2: wrong mode permissions 0100700, expected 0102700
NOTE:
Do we need a backport for this patch ?
nfsd: use vfs setgid helper
commit 2d8ae8c417db284f598dffb178cc01e7db0f1821 upstream.
## Build
* kernel: 5.10.191-rc1
* git: https://gitlab.com/Linaro/lkft/mirrors/stable/linux-stable-rc
* git branch: linux-5.10.y
* git commit: da59b7b5c515edab9a57efd37b031b5b97e6c1cc
* git describe: v5.10.190-136-gda59b7b5c515
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-5.10.y/build/v5.10.190-136-gda59b7b5c515
## Test Regressions (compared to v5.10.191)
* bcm2711-rpi-4-b, ltp-syscalls
- chown02
- fchown02
* bcm2711-rpi-4-b-clang, ltp-syscalls
- chown02
- fchown02
--
Linaro LKFT
https://lkft.linaro.org
Hi Greg,
Quoted 7 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.192 release. There are 135 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 26 Aug 2023 17:05:50 +0000. Anything received after that time might be too late.
Build test (gcc version 11.4.1 20230625):
mips: 63 configs -> 3 failures
arm: 104 configs -> no failure
arm64: 3 configs -> no failurex86_64: 4 configs -> no failure alpha allmodconfig -> no failure powerpc allmodconfig -> no failure riscv allmodconfig -> no failure s390 allmodconfig -> no failure xtensa allmodconfig -> no failure
Note:
mips db1xxx_defconfig, gpr_defconfig and mtx1_defconfig failed to build:
rch/mips/alchemy/common/dbdma.c: In function 'au1xxx_dbdma_put_source':arch/mips/alchemy/common/dbdma.c:632:14: error: 'dma_default_coherent' undeclared (first use in this function); did you mean 'dma_free_coherent'?
632 | if (!dma_default_coherent)
| ^~~~~~~~~~~~~~~~~~~~
| dma_free_coherent
arch/mips/alchemy/common/dbdma.c:632:14: note: each undeclared identifier is reported only once for each function it appears in
arch/mips/alchemy/common/dbdma.c: In function 'au1xxx_dbdma_put_dest':
arch/mips/alchemy/common/dbdma.c:695:14: error: 'dma_default_coherent' undeclared (first use in this function); did you mean 'dma_free_coherent'?
695 | if (!dma_default_coherent)
| ^~~~~~~~~~~~~~~~~~~~
| dma_free_coherentBoot test:x86_64: Booted on my test laptop. No regression.x86_64: Booted on qemu. No regression. [1]
arm64: Booted on rpi4b (4GB model). No regression. [2]
[1]. https://openqa.qa.codethink.co.uk/tests/4779
[2]. https://openqa.qa.codethink.co.uk/tests/4780
Signature · 2 lines
Regards Sudip
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.192 release. There are 135 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 26 Aug 2023 17:05:50 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.192-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.10.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v5.10:
11 builds: 11 pass, 0 fail
28 boots: 28 pass, 0 fail
75 tests: 75 pass, 0 failLinux version: 5.10.192-rc1-g78bdf347b342
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra194-p2972-0000, tegra194-p3509-0000+p3668-0000,
tegra20-ventana, tegra210-p2371-2180,
tegra210-p3450-0000, tegra30-cardhu-a04Jon
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.192 release. There are 135 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 26 Aug 2023 17:05:50 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.192-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.10.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
NOTE:
1)
LTP syscalls chown02 and fchown02 test failures on NFS mounted filesystem on arm64 Rpi4 will be investigated further.
## Build
* kernel: 5.10.191-rc1
* git: https://gitlab.com/Linaro/lkft/mirrors/stable/linux-stable-rc
* git branch: linux-5.10.y
* git commit: da59b7b5c515edab9a57efd37b031b5b97e6c1cc
* git describe: v5.10.190-136-gda59b7b5c515
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-5.10.y/build/v5.10.190-136-gda59b7b5c515
## Test Regressions (compared to v5.10.191)
## Metric Regressions (compared to v5.10.191)
## Test Fixes (compared to v5.10.191)
## Metric Fixes (compared to v5.10.191)
## Test result summary
total: 98769, pass: 80650, fail: 1588, skip: 16473, xfail: 58
## Build Summary
* arc: 5 total, 5 passed, 0 failed
* arm: 116 total, 116 passed, 0 failed
* arm64: 43 total, 43 passed, 0 failed
* i386: 34 total, 34 passed, 0 failed
* mips: 27 total, 26 passed, 1 failed
* parisc: 4 total, 0 passed, 4 failed
* powerpc: 26 total, 25 passed, 1 failed
* riscv: 12 total, 11 passed, 1 failed
* s390: 12 total, 12 passed, 0 failed
* sh: 14 total, 12 passed, 2 failed
* sparc: 8 total, 8 passed, 0 failed
* x86_64: 36 total, 36 passed, 0 failed
## Test suites summary
* boot
* kselftest-android
* kselftest-arm64
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-drivers-dma-buf
* kselftest-efivarfs
* kselftest-exec
* kselftest-filesystems
* kselftest-filesystems-binderfs
* kselftest-filesystems-epoll
* kselftest-firmware
* kselftest-fpu
* kselftest-ftrace
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-ir
* kselftest-kcmp
* kselftest-kexec
* kselftest-membarrier
* kselftest-memfd
* kselftest-mincore
* kselftest-mqueue
* kselftest-net
* kselftest-net-forwarding
* kselftest-net-mptcp
* kselftest-netfilter
* kselftest-nsfs
* kselftest-openat2
* kselftest-pid_namespace
* kselftest-pidfd
* kselftest-proc
* kselftest-pstore
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-sigaltstack
* kselftest-size
* kselftest-tc-testing
* kselftest-timens
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user
* kselftest-user_events
* kselftest-vDSO
* kselftest-vm
* kselftest-watchdog
* kselftest-x86
* kselftest-zram
* kunit
* kvm-unit-tests
* libgpiod
* log-parser-boot
* log-parser-test
* ltp-cap_bounds
* ltp-commands
* ltp-containers
* ltp-controllers
* ltp-cpuhotplug
* ltp-crypto
* ltp-cve
* ltp-dio
* ltp-fcntl-locktests
* ltp-filecaps
* ltp-fs
* ltp-fs_bind
* ltp-fs_perms_simple
* ltp-fsx
* ltp-hugetlb
* ltp-io
* ltp-ipc
* ltp-math
* ltp-mm
* ltp-nptl
* ltp-pty
* ltp-sched
* ltp-securebits
* ltp-smoke
* ltp-syscalls
* ltp-tracing
* perf
* rcutorture
* v4l2-compliance
--
Linaro LKFT
https://lkft.linaro.org
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.192 release. There are 135 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 26 Aug 2023 17:05:50 +0000. Anything received after that time might be too late.
Testing is not complete, but early feedback: All riscv32 boot tests crash badly with errors such as
Starting syslogd: OK
Starting klogd: OK/etc/init.d/S02sysctl: line 68: syntax error: EOF in backquote substitution /etc/init.d/S20seedrng: line 33: syntax error: unexpected end of file (expecting ";;") Starting network: /bin/sh: syntax error: unterminated quoted string
sed: unmatched '/'/bin/sh: syntax error: unterminated quoted string
FAIL/etc/init.d/S55runtest: line 48: syntax error: EOF in backquote substitution
This is no longer seen after reverting the following patches.
92609bb3a1f8 riscv: uaccess: Return the number of bytes effectively not copied e06648704417 riscv: lib: uaccess: fix CSR_STATUS SR_SUM bit20704d763646 riscv: lib: uaccess: fold fixups into body4f503bad920e riscv: __asm_copy_to-from_user: Optimize unaligned memory access and pipeline stall
Guenter
Greg Kroah-Hartman
maintainerQuoted 23 lines · Guenter Roeck
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.192 release. There are 135 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 26 Aug 2023 17:05:50 +0000. Anything received after that time might be too late.
Testing is not complete, but early feedback: All riscv32 boot tests crash badly with errors such as
Starting syslogd: OK
Starting klogd: OK/etc/init.d/S02sysctl: line 68: syntax error: EOF in backquote substitution/etc/init.d/S20seedrng: line 33: syntax error: unexpected end of file (expecting ";;") Starting network:/bin/sh: syntax error: unterminated quoted string
sed: unmatched '/'/bin/sh: syntax error: unterminated quoted string
FAIL/etc/init.d/S55runtest: line 48: syntax error: EOF in backquote substitution
Quoted 6 lines
This is no longer seen after reverting the following patches.
92609bb3a1f8riscv: uaccess: Return the number of bytes effectively not copiede06648704417riscv: lib: uaccess: fixCSR_STATUSSR_SUMbit20704d763646riscv: lib: uaccess: fold fixups into body4f503bad920eriscv: __asm_copy_to-from_user: Optimize unaligned memory access and pipeline stall
Thanks for the review, I'll go drop all of the riscv patches here. Really, we shouldn't be adding any of them to any kernels older than 5.15 these days as I do not think anyone using that cpu is using those older kernels (or at least I sure hope not...)
thanks,
greg k-h
Quoted 31 lines · Greg Kroah-Hartman
Quoted 23 lines · Guenter Roeck
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.192 release. There are 135 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 26 Aug 2023 17:05:50 +0000. Anything received after that time might be too late.
Testing is not complete, but early feedback: All riscv32 boot tests crash badly with errors such as
Starting syslogd: OK
Starting klogd: OK/etc/init.d/S02sysctl: line 68: syntax error: EOF in backquote substitution/etc/init.d/S20seedrng: line 33: syntax error: unexpected end of file (expecting ";;") Starting network:/bin/sh: syntax error: unterminated quoted string
sed: unmatched '/'/bin/sh: syntax error: unterminated quoted string
FAIL/etc/init.d/S55runtest: line 48: syntax error: EOF in backquote substitutionQuoted 6 lines
This is no longer seen after reverting the following patches.
92609bb3a1f8riscv: uaccess: Return the number of bytes effectively not copiede06648704417riscv: lib: uaccess: fixCSR_STATUSSR_SUMbit20704d763646riscv: lib: uaccess: fold fixups into body4f503bad920eriscv: __asm_copy_to-from_user: Optimize unaligned memory access and pipeline stall
Quoted 4 lines
Thanks for the review, I'll go drop all of the riscv patches here. Really, we shouldn't be adding any of them to any kernels older than 5.15 these days as I do not think anyone using that cpu is using those older kernels (or at least I sure hope not...)
I know one of the main cpu IP vendors does run a 5.10 based tree, but that thing is both an abomination of out-of-tree patches to core arch code & about 100 releases out of date, therefore not really worth factoring. Anyone in their right mind should be running something significantly more recent than 5.10 for riscv.
Greg Kroah-Hartman
maintainerQuoted 37 lines · Conor Dooley
Quoted 31 lines · Greg Kroah-Hartman
Quoted 23 lines · Guenter Roeck
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.192 release. There are 135 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 26 Aug 2023 17:05:50 +0000. Anything received after that time might be too late.
Testing is not complete, but early feedback: All riscv32 boot tests crash badly with errors such as
Starting syslogd: OK
Starting klogd: OK/etc/init.d/S02sysctl: line 68: syntax error: EOF in backquote substitution/etc/init.d/S20seedrng: line 33: syntax error: unexpected end of file (expecting ";;") Starting network:/bin/sh: syntax error: unterminated quoted string
sed: unmatched '/'/bin/sh: syntax error: unterminated quoted string
FAIL/etc/init.d/S55runtest: line 48: syntax error: EOF in backquote substitutionQuoted 6 lines
This is no longer seen after reverting the following patches.
92609bb3a1f8riscv: uaccess: Return the number of bytes effectively not copiede06648704417riscv: lib: uaccess: fixCSR_STATUSSR_SUMbit20704d763646riscv: lib: uaccess: fold fixups into body4f503bad920eriscv: __asm_copy_to-from_user: Optimize unaligned memory access and pipeline stallQuoted 4 lines
Thanks for the review, I'll go drop all of the riscv patches here. Really, we shouldn't be adding any of them to any kernels older than 5.15 these days as I do not think anyone using that cpu is using those older kernels (or at least I sure hope not...)
Quoted 5 lines
I know one of the main cpu IP vendors does run a 5.10 based tree, but that thing is both an abomination of out-of-tree patches to core arch code & about 100 releases out of date, therefore not really worth factoring. Anyone in their right mind should be running something significantly more recent than 5.10 for riscv.
Thanks for the verification. Anyone using such an abomination of a tree, gets their support from the creator of such an abomination :)
greg k-h
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.192 release. There are 135 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 26 Aug 2023 17:05:50 +0000. Anything received after that time might be too late.
Build results:
total: 159 pass: 159 fail: 0 Qemu test results: total: 487 pass: 469 fail: 18 Failed tests: <all riscv32>
As already reported, all riscv32 boot tests fail. The failure is no longer seen after reverting the riscv specific patches.
Guenter
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.192 release. There are 135 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 26 Aug 2023 17:05:50 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.192-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.10.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Tested on arm64 and x86 for 5.10.192-rc1,
Kernel repo:https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
Branch: linux-5.10.y
Version: 5.10.192-rc1
Commit: 78bdf347b342992291284fd060ee34dbccf570a8
Compiler: gcc version 7.3.0 (GCC)
arm64:
--------------------------------------------------------------------
Testcase Result Summary:
total: 8978
passed: 8978
failed: 0
timeout: 0
--------------------------------------------------------------------
x86:
--------------------------------------------------------------------
Testcase Result Summary:
total: 8978
passed: 8978
failed: 0
timeout: 0
--------------------------------------------------------------------
Quoted 569 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.192 release. There are 135 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 26 Aug 2023 17:05:50 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.192-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.10.y
and the diffstat can be found below.thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:Greg Kroah-Hartman <[email protected]>
Linux 5.10.192-rc1Borislav Petkov (AMD) <[email protected]>
x86/srso: Correct the mitigation status when SMT is disabledPeter Zijlstra <[email protected]>
objtool/x86: Fixup frame-pointer vs rethunkPetr Pavlu <[email protected]>
x86/retpoline,kprobes: Fix position of thunk sections withCONFIG_LTO_CLANGBorislav Petkov (AMD) <[email protected]>
x86/srso: Disable the mitigation on unaffected configurationsBorislav Petkov (AMD) <[email protected]>
x86/CPU/AMD: Fix the DIV(0) initial fix attemptSean Christopherson <[email protected]>
x86/retpoline: Don't clobber RFLAGS duringsrso_safe_ret()Peter Zijlstra <[email protected]>
x86/static_call: Fix __static_call_fixup()Borislav Petkov (AMD) <[email protected]>
x86/srso: Explain the untraining sequences a bit morePeter Zijlstra <[email protected]>
x86/cpu: Cleanup the untrain messPeter Zijlstra <[email protected]>
x86/cpu: Rename srso_(.*)_alias to srso_alias_\1Peter Zijlstra <[email protected]>
x86/cpu: Rename original retbleed methodsPeter Zijlstra <[email protected]>
x86/cpu: Clean up SRSO return thunk messPeter Zijlstra <[email protected]>
x86/ibt: AddANNOTATE_NOENDBRJosh Poimboeuf <[email protected]>
objtool: Add frame-pointer-specific function ignorePeter Zijlstra <[email protected]>
x86/alternative: Make custom return thunk unconditionalPeter Zijlstra <[email protected]>
x86/cpu: Fix up srso_safe_ret() and __x86_return_thunk()Peter Zijlstra <[email protected]>
x86/cpu: Fix__x86_return_thunksymbol typeYangtao Li <[email protected]>
mmc: f-sdh30: fix order of function calls insdhci_f_sdh30_removeJason Xing <[email protected]>
net: fix the RTO timer retransmitting skb every 1ms if linear option is enabledJason Wang <[email protected]>
virtio-net: set queues afterdriver_okKuniyuki Iwashima <[email protected]>
af_unix: Fix null-ptr-deref inunix_stream_sendpage().Xin Long <[email protected]>
netfilter: set default timeout to 3 secs for sctp shutdown send and recv stateYibin Ding <[email protected]>
mmc: block: Fix in_flight[issue_type] value errorYang Yingliang <[email protected]>
mmc: wbsd: fix doublemmc_free_host()inwbsd_init()Russell Harmon via samba-technical <[email protected]>
cifs: Release folio lock on fscache read hit.dengxiang <[email protected]>
ALSA: usb-audio: Add support for Mythware XA001AU capture and playback interfaces.Tony Lindgren <[email protected]>
serial: 8250: Fix oops for port->pm on uart_change_pm()Alexandre Ghiti <[email protected]>
riscv: uaccess: Return the number of bytes effectively not copiedChen Lifu <[email protected]>
riscv: lib: uaccess: fixCSR_STATUSSR_SUMbitJisheng Zhang <[email protected]>
riscv: lib: uaccess: fold fixups into bodyAkira Tsukamoto <[email protected]>
riscv: __asm_copy_to-from_user: Optimize unaligned memory access and pipeline stallKailang Yang <[email protected]>
ALSA: hda/realtek - Remodified 3k pull low procedureJerome Brunet <[email protected]>
ASoC: meson: axg-tdm-formatter: fix channel slot allocationZhang Shurong <[email protected]>
ASoC: rt5665: add missedregulator_bulk_disableChristopher Obbard <[email protected]>
arm64: dts: rockchip: Disable HS400 for eMMC on ROCK Pi 4FUKAUMI Naoki <[email protected]>
arm64: dts: rockchip: sort nodes/properties on rk3399-rock-4FUKAUMI Naoki <[email protected]>
arm64: dts: rockchip: fix regulator name on rk3399-rock-4Alex Bee <[email protected]>
arm64: dts: rockchip: add SPDIF node for ROCK Pi 4Alex Bee <[email protected]>
arm64: dts: rockchip: add ES8316 codec for ROCK Pi 4Vicente Bergas <[email protected]>
arm64: dts: rockchip: use USB host by default on rk3399-rock-pi-4Vicente Bergas <[email protected]>
arm64: dts: rockchip: fix supplies on rk3399-rock-pi-4Tony Lindgren <[email protected]>
bus: ti-sysc: Flush posted write on enable before resetEric Dumazet <[email protected]>
net: do not allowgso_sizeto be set toGSO_BY_FRAGSAbel Wu <[email protected]>
sock: Fix misuse ofsk_under_memory_pressure()Alfred Lee <[email protected]>
net: dsa: mv88e6xxx: Wait for EEPROM done before HW resetAndrii Staikov <[email protected]>
i40e: fix misleading debug logsZiyang Xuan <[email protected]>
team: Fix incorrect deletion ofETH_P_8021ADprotocol vid from slavesJustin Chen <[email protected]>
net: phy: broadcom: stub c45 read/write for 54810Pablo Neira Ayuso <[email protected]>
netfilter:nft_dynset: disallow object mapsSishuai Gong <[email protected]>
ipvs: fix racy memcpy inproc_do_sync_thresholdLuca Ceresoli <[email protected]>
drm/panel: simple: Fix AUO G121EAN01 panel timings according to the docsPetr Machata <[email protected]>
selftests:mirror_gre_changes: Tighten up the TTL test matchLin Ma <[email protected]>
xfrm: add forgottennla_policyforXFRMA_MTIMER_THRESHLin Ma <[email protected]>
xfrm: add NULL check inxfrm_update_ae_paramsZhengchao Shao <[email protected]>
ip_vti: fix potential slab-use-after-free indecode_session6Zhengchao Shao <[email protected]>
ip6_vti: fix slab-use-after-free indecode_session6Zhengchao Shao <[email protected]>
xfrm: fix slab-use-after-free indecode_session6Lin Ma <[email protected]>
net: xfrm: AmendXFRMA_SEC_CTXnla_policystructureLin Ma <[email protected]>
net:af_key: fixsadb_x_filtervalidationLin Ma <[email protected]>
net: xfrm: Fixxfrm_address_filterOOB readTam Nguyen <[email protected]>
i2c: designware: Handle invalid SMBus block data response length valuexiaoshoukui <[email protected]>
btrfs: fixBUG_ONcondition inbtrfs_cancel_balanceSherry Sun <[email protected]>
tty: serial:fsl_lpuart: Clear the error flags by writing 1 for lpuart32 platformsYi Yang <[email protected]>
tty:n_gsm: fix the UAF caused by race condition ingsm_cleanup_muxNathan Lynch <[email protected]>
powerpc/rtas_flash: allow user copy to flash block cache objectsYuanjun Gong <[email protected]>
fbdev: mmp: fix value check inmmphw_probe()Chengfeng Ye <[email protected]>
i2c: bcm-iproc: Fixbcm_iproc_i2c_isrdeadlock issueWolfram Sang <[email protected]>
virtio-mmio: don't break lifecycle ofvm_devTang Bin <[email protected]>
virtio-mmio: Useto_virtio_mmio_device()to simply codeIvan Mikhaylov <[email protected]>
net/ncsi: change fromndo_set_mac_addresstodev_set_mac_addressMasami Hiramatsu (Google) <[email protected]>
tracing/probes: Fix to update dynamic data counter if fetcharg uses itSteven Rostedt (VMware) <[email protected]>
tracing/probes: Haveprocess_fetch_insn()take a void * instead ofpt_regsSergey Shtylyov <[email protected]>
mmc: meson-gx: fix deferred probingHeiner Kallweit <[email protected]>
mmc: meson-gx: usedevm_mmc_alloc_hostHeiner Kallweit <[email protected]>
mmc: core: adddevm_mmc_alloc_hostSergey Shtylyov <[email protected]>
mmc: sunxi: fix deferred probingSergey Shtylyov <[email protected]>
mmc: bcm2835: fix deferred probingJohan Hovold <[email protected]>
USB: dwc3: qcom: fix NULL-deref on suspendFrank Li <[email protected]>
usb: cdns3: fix NCM gadget RX speed 20x slow than expection at iMX8QMFrank Li <[email protected]>
usb: cdns3: allocate TX FIFO size according to composite EP numberWesley Cheng <[email protected]>
usb: gadget: udc: core: Introducecheck_configto verify USB configurationPawel Laszczak <[email protected]>
usb: cdnsp: Device side header file for CDNSP driverJiaxun Yang <[email protected]>
irqchip/mips-gic: Use raw spinlock forgic_lockMarc Zyngier <[email protected]>
irqchip/mips-gic: Get rid of the reliance onirq_cpu_online()Jeffrey Hugo <[email protected]>
bus: mhi: host: Range check CHDBOFF and ERDBOFFManivannan Sadhasivam <[email protected]>
bus: mhi: Move host MHI code to "host" directoryBhaumik Bhatt <[email protected]>
bus: mhi: Add MMIO region length to controller structureLoic Poulain <[email protected]>
bus: mhi: Add MHI PCI support for WWAN modemsWilliam Breathitt Gray <[email protected]>
iio: addac: stx104: Fix race condition when converting analog-to-digitalWilliam Breathitt Gray <[email protected]>
iio: addac: stx104: Fix race condition forstx104_write_raw()William Breathitt Gray <[email protected]>
iio: adc: stx104: Implement and utilize register structuresWilliam Breathitt Gray <[email protected]>
iio: adc: stx104: Utilize iomap interfaceCosmin Tanislav <[email protected]>
dt-bindings: iio: add AD74413RCosmin Tanislav <[email protected]>
iio: add addac subdirectoryRandy Dunlap <[email protected]>
IMA: allow/fix UML buildsChen Lin <[email protected]>
ring-buffer: Do not swapcpu_bufferduring resize processBenjamin Gray <[email protected]>
powerpc/kasan: Disable KCOV in KASAN codeTuo Li <[email protected]>
ALSA: hda: fix a possible null-pointer dereference due to data race insnd_hdac_regmap_sync()dengxiang <[email protected]>
ALSA: hda/realtek: Add quirks for Unis H3C Desktop B760 & Q760shanzhulig <[email protected]>
drm/amdgpu: Fix potential fence use-after-free v2Matthew Anderson <[email protected]>
Bluetooth: btusb: Add MT7922 bluetooth ID for the Asus AllyZhengping Jiang <[email protected]>
Bluetooth: L2CAP: Fix use-after-freeArmin Wolf <[email protected]>
pcmcia:rsrc_nonstatic: Fix memory leak innonstatic_release_resource_db()Tuo Li <[email protected]>
gfs2: Fix possible data races ingfs2_show_options()Xu Yang <[email protected]>
usb: chipidea: imx: add missing USB PHY DPDM wakeup settingXu Yang <[email protected]>
usb: chipidea: imx: don't request QoS for imx8ulpHans Verkuil <[email protected]>
media: platform: mediatek: vpu: fix NULL ptr dereferencePrashanth K <[email protected]>
usb: gadget:u_serial: Avoid spinlock recursion in__gs_console_pushYunfei Dong <[email protected]>
media: v4l2-mem2mem: add lock to protect parameternum_rdyImmad Mir <[email protected]>
FS: JFS: Check for read-only mounted filesystem in txBeginImmad Mir <[email protected]>
FS: JFS: Fix null-ptr-deref Read in txBeginGustavo A. R. Silva <[email protected]>
MIPS: dec: prom: Address -Warray-bounds warningYogesh <[email protected]>
fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLevJan Kara <[email protected]>
udf: Fix uninitialized array access for some pathnamesChristian Brauner <[email protected]>
ovl: check type and offset of struct vfsmount inovl_entryPatrisious Haddad <[email protected]>
RDMA/mlx5: Return the firmware result upon destroying QP/RQMarco Morandini <[email protected]>
HID: add quirk for 03f0:464a HP Elite Presenter MouseLang Yu <[email protected]>
drm/amdgpu: install stub fence into potential unused fence pointersgaoxu <[email protected]>
dma-remap: use kvmalloc_array/kvfree for larger dma memory remapYe Bin <[email protected]>
quota: fix warning indqgrab()Jan Kara <[email protected]>
quota: Properly disable quotas whenadd_dquot_ref()failsGeert Uytterhoeven <[email protected]>
iopoll: Callcpu_relax()in busy loopsUday M Bhat <[email protected]>
ASoC: Intel:sof_sdw: Add support for Rex soundwireOleksij Rempel <[email protected]>
ARM: dts: imx6dl: prtrvt, prtvt7, prti6q, prtwd2: fix USB related warningsSumit Gupta <[email protected]>
PCI: tegra194: Fix possible array out of bounds accessPeter Ujfalusi <[email protected]>
ASoC: Intel:sof_sdw: add quirk for LNL RVPBard Liao <[email protected]>
ASoC: Intel:sof_sdw: add quirk for MTL RVPOswald Buddenhagen <[email protected]>
ALSA: emu10k1: roll up loops in DSP setup code for Audigyhackyzh002 <[email protected]>
drm/radeon: Fix integer overflow inradeon_cs_parser_initMoshe Shemesh <[email protected]>
net/mlx5: Skip clock update work when device is in error stateEran Ben Elisha <[email protected]>
net/mlx5: Move all internal timer metadata into a dedicated structEran Ben Elisha <[email protected]>
net/mlx5: Refactor init clock functionEric Dumazet <[email protected]>
macsec: useDEV_STATS_INC()Clayton Yager <[email protected]>
macsec: Fix traffic counters/statisticsKunihiko Hayashi <[email protected]>
mmc: sdhci-f-sdh30: Replace withsdhci_pltfm-------------
Diffstat:
Documentation/admin-guide/hw-vuln/srso.rst | 4 +- .../bindings/iio/addac/adi,ad74413r.yaml | 158 +++ Makefile | 4 +- arch/arm/boot/dts/imx6dl-prtrvt.dts | 4 + arch/arm/boot/dts/imx6qdl-prti6q.dtsi | 11 +- arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dtsi | 207 +-- arch/mips/include/asm/dec/prom.h | 2 +- arch/powerpc/kernel/rtas_flash.c | 6 +- arch/powerpc/mm/kasan/Makefile | 1 + arch/riscv/lib/uaccess.S | 212 ++- arch/x86/include/asm/entry-common.h | 1 + arch/x86/include/asm/nospec-branch.h | 28 +- arch/x86/kernel/cpu/amd.c | 1 + arch/x86/kernel/cpu/bugs.c | 28 +- arch/x86/kernel/static_call.c | 13 + arch/x86/kernel/traps.c | 2 - arch/x86/kernel/vmlinux.lds.S | 18 +- arch/x86/kvm/svm/svm.c | 1 + arch/x86/lib/retpoline.S | 141 +- drivers/bluetooth/btusb.c | 3 + drivers/bus/Makefile | 2 +- drivers/bus/mhi/Kconfig | 18 +- drivers/bus/mhi/Makefile | 4 +- drivers/bus/mhi/host/Kconfig | 31 + drivers/bus/mhi/{core => host}/Makefile | 4 +- drivers/bus/mhi/{core => host}/boot.c | 0 drivers/bus/mhi/{core => host}/debugfs.c | 0 drivers/bus/mhi/{core => host}/init.c | 12 + drivers/bus/mhi/{core => host}/internal.h | 0 drivers/bus/mhi/{core => host}/main.c | 0 drivers/bus/mhi/host/pci_generic.c | 345 +++++ drivers/bus/mhi/{core => host}/pm.c | 0 drivers/bus/ti-sysc.c | 2 + drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 6 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 6 +- drivers/gpu/drm/panel/panel-simple.c | 24 +- drivers/gpu/drm/radeon/radeon_cs.c | 3 +- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-quirks.c | 1 + drivers/i2c/busses/i2c-bcm-iproc.c | 11 +- drivers/i2c/busses/i2c-designware-master.c | 15 +- drivers/iio/Kconfig | 1 + drivers/iio/Makefile | 1 + drivers/iio/adc/stx104.c | 98 +- drivers/iio/addac/Kconfig | 8 + drivers/iio/addac/Makefile | 6 + drivers/infiniband/hw/mlx5/qpc.c | 10 +- drivers/irqchip/irq-mips-gic.c | 63 +- drivers/media/platform/mtk-vpu/mtk_vpu.c | 6 +- drivers/mmc/core/block.c | 7 +- drivers/mmc/core/host.c | 26 + drivers/mmc/host/bcm2835.c | 4 +- drivers/mmc/host/meson-gx-mmc.c | 52 +- drivers/mmc/host/sdhci_f_sdh30.c | 66 +- drivers/mmc/host/sunxi-mmc.c | 4 +- drivers/mmc/host/wbsd.c | 2 - drivers/net/dsa/mv88e6xxx/chip.c | 8 + drivers/net/ethernet/intel/i40e/i40e_nvm.c | 16 +- .../net/ethernet/mellanox/mlx5/core/lib/clock.c | 166 ++- .../net/ethernet/mellanox/mlx5/core/lib/clock.h | 3 +- drivers/net/macsec.c | 70 +- drivers/net/phy/broadcom.c | 13 + drivers/net/team/team.c | 4 +- drivers/net/virtio_net.c | 4 +- drivers/pci/controller/dwc/pcie-tegra194.c | 13 +- drivers/pcmcia/rsrc_nonstatic.c | 2 + drivers/tty/n_gsm.c | 3 +- drivers/tty/serial/8250/8250_port.c | 1 + drivers/tty/serial/fsl_lpuart.c | 4 +- drivers/usb/cdns3/cdnsp-gadget.h | 1463 ++++++++++++++++++++ drivers/usb/cdns3/gadget.c | 60 +- drivers/usb/cdns3/gadget.h | 9 +- drivers/usb/chipidea/ci_hdrc_imx.c | 5 + drivers/usb/chipidea/usbmisc_imx.c | 2 +- drivers/usb/dwc3/dwc3-qcom.c | 11 +- drivers/usb/gadget/function/u_serial.c | 3 + drivers/usb/gadget/udc/core.c | 19 + drivers/video/fbdev/mmp/hw/mmp_ctrl.c | 4 +- drivers/virtio/virtio_mmio.c | 8 +- fs/btrfs/volumes.c | 3 +- fs/cifs/file.c | 2 +- fs/gfs2/super.c | 26 +- fs/jfs/jfs_dmap.c | 3 + fs/jfs/jfs_txnmgr.c | 5 + fs/jfs/namei.c | 5 + fs/overlayfs/ovl_entry.h | 9 + fs/quota/dquot.c | 5 +- fs/udf/unicode.c | 2 +- include/dt-bindings/iio/addac/adi,ad74413r.h | 21 + include/linux/iopoll.h | 2 + include/linux/mhi.h | 2 + include/linux/mlx5/driver.h | 12 +- include/linux/mmc/host.h | 1 + include/linux/objtool.h | 28 + include/linux/usb/gadget.h | 4 + include/linux/virtio_net.h | 4 + include/media/v4l2-mem2mem.h | 18 +- include/net/sock.h | 6 + kernel/dma/remap.c | 4 +- kernel/trace/ring_buffer.c | 14 +- kernel/trace/trace.c | 3 +- kernel/trace/trace_kprobe.c | 3 +- kernel/trace/trace_probe_tmpl.h | 18 +- kernel/trace/trace_uprobe.c | 3 +- net/bluetooth/l2cap_core.c | 5 + net/core/sock.c | 2 +- net/ipv4/ip_vti.c | 4 +- net/ipv4/tcp_timer.c | 4 +- net/ipv6/ip6_vti.c | 4 +- net/key/af_key.c | 4 +- net/ncsi/ncsi-rsp.c | 5 +- net/netfilter/ipvs/ip_vs_ctl.c | 4 + net/netfilter/nf_conntrack_proto_sctp.c | 6 +- net/netfilter/nft_dynset.c | 3 + net/unix/af_unix.c | 9 +- net/xfrm/xfrm_compat.c | 2 +- net/xfrm/xfrm_interface_core.c | 4 +- net/xfrm/xfrm_user.c | 14 +- security/integrity/ima/Kconfig | 2 +- sound/hda/hdac_regmap.c | 7 +- sound/pci/emu10k1/emufx.c | 112 +- sound/pci/hda/patch_realtek.c | 16 +- sound/soc/codecs/rt5665.c | 2 + sound/soc/intel/boards/sof_sdw.c | 25 + sound/soc/meson/axg-tdm-formatter.c | 42 +- sound/usb/quirks-table.h | 29 + tools/include/linux/objtool.h | 28 + tools/objtool/arch/x86/decode.c | 2 +- tools/objtool/check.c | 21 +- .../selftests/net/forwarding/mirror_gre_changes.sh | 3 +- 130 files changed, 3442 insertions(+), 695 deletions(-).
Hi,
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.192 release. There are 135 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 26 Aug 2023 17:05:50 +0000. Anything received after that time might be too late.
[ ... ]
Quoted 3 lines
Lang Yu <[email protected]>
drm/amdgpu: install stub fence into potential unused fence pointers
This patch is causing continuous log spam in chromeos-5.10, so we are going to revert it.
WARNING: CPU: 1 PID: 13383 at include/linux/dma-fence.h:478 amdgpu_sync_keep_later+0x95/0xbd
This is just a note to let others know that this may be the cause if they see the same problem.
Thanks,
Guenter
Greg Kroah-Hartman
maintainerQuoted 17 lines · Guenter Roeck
Hi,
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.192 release. There are 135 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 26 Aug 2023 17:05:50 +0000. Anything received after that time might be too late.
[ ... ]
Quoted 3 lines
Lang Yu <[email protected]>
drm/amdgpu: install stub fence into potential unused fence pointers
Quoted 7 lines
This patch is causing continuous log spam in chromeos-5.10, so we are going to revert it.
WARNING: CPU: 1 PID: 13383 at include/linux/dma-fence.h:478 amdgpu_sync_keep_later+0x95/0xbdThis is just a note to let others know that this may be the cause if they see the same problem.
Thanks, I'll go revert it now.
greg k-h