Linux 4.19.204
Greg Kroah-Hartman
maintainerI'm announcing the release of the 4.19.204 kernel.
All users of the 4.19 kernel series must upgrade.
The updated 4.19.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.19.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Documentation/virtual/kvm/mmu.txt | 4 - Makefile | 2 arch/x86/kvm/paging_tmpl.h | 14 +++-- arch/x86/kvm/svm.c | 2 drivers/net/ethernet/xilinx/xilinx_emaclite.c | 5 - drivers/net/ppp/ppp_generic.c | 19 +++++-- drivers/usb/host/ehci-pci.c | 3 + fs/namespace.c | 42 ++++++++++------ kernel/bpf/verifier.c | 68 ++++++++++++++++++++++---- kernel/trace/trace_events_hist.c | 14 +++++ tools/testing/selftests/bpf/test_verifier.c | 2 11 files changed, 137 insertions(+), 38 deletions(-)
Daniel Borkmann (4):
bpf: Inherit expanded/patched seen count from old aux data
bpf: Do not mark insn as seen under speculative path verification
bpf: Fix leakage under speculation on mispredicted branches bpf, selftests: Adjust few selftest outcomes wrt unreachable code
Greg Kroah-Hartman (1):
Linux 4.19.204
Lai Jiangshan (1):
KVM: X86: MMU: Use the correct inherited permissions to get shadow page
Longfang Liu (1):
USB:ehci:fix Kunpeng920 ehci hardware problem
Masami Hiramatsu (1):
tracing: Reject string operand in the histogram expression
Miklos Szeredi (1):
ovl: prevent private clone if bind mount is not allowed
Pali Rohár (1):
ppp: Fix generating ppp unit id when ifname is not specified
Sean Christopherson (1):
KVM: SVM: Fix off-by-one indexing when nullifying last used SEV VMCB
YueHaibing (1):
net: xilinx_emaclite: Do not print real IOMEM pointer
Greg Kroah-Hartman
maintainerDocumentation/virtual/kvm/mmu.txt +2 -2
@@ -152,8 +152,8 @@ Shadow pages contain the following information: shadow pages) so role.quadrant takes values in the range 0..3. Each quadrant maps 1GB virtual address space. role.access: - Inherited guest access permissions in the form uwx. Note execute - permission is positive, not negative. + Inherited guest access permissions from the parent ptes in the form uwx. + Note execute permission is positive, not negative. role.invalid: The page is invalid and should not be used. It is a root page that is currently pinned (by a cpu hardware register pointing to it); once it is
Makefile +1 -1
@@ -1,7 +1,7 @@ # SPDX-License-Identifier: GPL-2.0 VERSION = 4 PATCHLEVEL = 19 -SUBLEVEL = 203 +SUBLEVEL = 204 EXTRAVERSION = NAME = "People's Front"
arch/x86/kvm/paging_tmpl.h +9 -5
@@ -93,8 +93,8 @@ struct guest_walker {gpa_t pte_gpa[PT_MAX_FULL_LEVELS ];pt_element_t __user *ptep_user[PT_MAX_FULL_LEVELS ];bool pte_writable[PT_MAX_FULL_LEVELS ]; -unsigned pt_access; -unsigned pte_access; +unsigned int pt_access[PT_MAX_FULL_LEVELS ]; +unsigned int pte_access;gfn_t gfn;struct x86_exception fault; };
@@ -388,13 +388,15 @@ static int FNAME(walk_addr_generic)(struct guest_walker *walker, } walker->ptes[walker->level -1 ] = pte; + +/* Convert to ACC_*_MASK flags for struct guest_walker. */ + walker->pt_access[walker->level -1 ] =FNAME (gpte_access)(pt_access ^ walk_nx_mask); }while (!is_last_gpte (mmu, walker->level, pte)); pte_pkey =FNAME (gpte_pkeys)(vcpu, pte); accessed_dirty = have_ad ? pte_access &PT_GUEST_ACCESSED_MASK :0 ;/* Convert to ACC_*_MASK flags for struct guest_walker. */ - walker->pt_access =FNAME (gpte_access)(pt_access ^ walk_nx_mask); walker->pte_access =FNAME (gpte_access)(pte_access ^ walk_nx_mask); errcode =permission_fault (vcpu, mmu, walker->pte_access, pte_pkey, access);if (unlikely (errcode))
@@ -433,7 +435,8 @@ static int FNAME(walk_addr_generic)(struct guest_walker *walker, }pgprintk ("%s: pte %llx pte_access %x pt_access %x\n" , - __func__, (u64 )pte, walker->pte_access, walker->pt_access); + __func__, (u64 )pte, walker->pte_access, + walker->pt_access[walker->level -1 ]);return 1 ; error:
@@ -602,7 +605,7 @@ static int FNAME(fetch)(struct kvm_vcpu *vcpu, gpa_t addr, {struct kvm_mmu_page *sp =NULL ;struct kvm_shadow_walk_iterator it; -unsigned direct_access, access = gw->pt_access; +unsigned int direct_access, access;int top_level, ret;gfn_t gfn, base_gfn;
@@ -634,6 +637,7 @@ static int FNAME(fetch)(struct kvm_vcpu *vcpu, gpa_t addr, sp =NULL ;if (!is_shadow_present_pte (*it.sptep)) { table_gfn = gw->table_gfn[it.level -2 ]; + access = gw->pt_access[it.level -2 ]; sp =kvm_mmu_get_page (vcpu, table_gfn, addr, it.level-1 , false, access); }
arch/x86/kvm/svm.c +1 -1
@@ -1780,7 +1780,7 @@ static void __sev_asid_free(int asid)for_each_possible_cpu (cpu) { sd =per_cpu (svm_data, cpu); - sd->sev_vmcbs[pos] =NULL ; + sd->sev_vmcbs[asid] =NULL ; } }
drivers/net/ethernet/xilinx/xilinx_emaclite.c +2 -3
@@ -1177,9 +1177,8 @@ static int xemaclite_of_probe(struct platform_device *ofdev) }dev_info (dev, -"Xilinx EmacLite at 0x%08X mapped to 0x%08X, irq=%d\n" , - (unsigned int __force )ndev->mem_start, - (unsigned int __force )lp->base_addr, ndev->irq); +"Xilinx EmacLite at 0x%08X mapped to 0x%p, irq=%d\n" , + (unsigned int __force )ndev->mem_start, lp->base_addr, ndev->irq);return 0 ; error:
drivers/net/ppp/ppp_generic.c +15 -4
@@ -287,7 +287,7 @@ static struct channel *ppp_find_channel(struct ppp_net *pn, int unit);static int ppp_connect_channel (struct channel *pch,int unit);static int ppp_disconnect_channel (struct channel *pch);static void ppp_destroy_channel (struct channel *pch); -static int unit_get (struct idr *p,void *ptr); +static int unit_get (struct idr *p,void *ptr,int min);static int unit_set (struct idr *p,void *ptr,int n);static void unit_put (struct idr *p,int n);static void *unit_find (struct idr *p,int n);
@@ -963,9 +963,20 @@ static int ppp_unit_register(struct ppp *ppp, int unit, bool ifname_is_set)mutex_lock (&pn->all_ppp_mutex);if (unit <0 ) { - ret =unit_get (&pn->units_idr, ppp); + ret =unit_get (&pn->units_idr, ppp,0 );if (ret <0 ) goto err; +if (!ifname_is_set) { +while (1 ) { +snprintf (ppp->dev->name,IFNAMSIZ ,"ppp%i" , ret); +if (!__dev_get_by_name (ppp->ppp_net, ppp->dev->name)) +break ; +unit_put (&pn->units_idr, ret); + ret =unit_get (&pn->units_idr, ppp, ret +1 ); +if (ret <0 ) + goto err; + } + } }else {/* Caller asked for a specific unit number. Fail with -EEXIST * if unavailable. For backward compatibility, return -EEXIST
@@ -3252,9 +3263,9 @@ static int unit_set(struct idr *p, void *ptr, int n) }/* get new free unit number and associate pointer with it */ -static int unit_get (struct idr *p,void *ptr) +static int unit_get (struct idr *p,void *ptr,int min) { -return idr_alloc (p, ptr,0 ,0 ,GFP_KERNEL ); +return idr_alloc (p, ptr, min,0 ,GFP_KERNEL ); }/* put unit number back to a pool */
drivers/usb/host/ehci-pci.c +3 -0
@@ -298,6 +298,9 @@ static int ehci_pci_setup(struct usb_hcd *hcd)if (pdev->vendor ==PCI_VENDOR_ID_STMICRO && pdev->device ==PCI_DEVICE_ID_STMICRO_USB_HOST ) ;/* ConneXT has no sbrn register */ +else if (pdev->vendor ==PCI_VENDOR_ID_HUAWEI + && pdev->device ==0xa239 ) + ;/* HUAWEI Kunpeng920 USB EHCI has no sbrn register */ else pci_read_config_byte (pdev,0x60 , &ehci->sbrn);
fs/namespace.c +28 -14
67 lines not on this page · raw message
kernel/bpf/verifier.c +60 -8
120 lines not on this page · raw message
kernel/trace/trace_events_hist.c +14 -0
@@ -2790,6 +2790,12 @@ static struct hist_field *parse_unary(struct hist_trigger_data *hist_data, ret =PTR_ERR (operand1); goto free; } +if (operand1->flags &HIST_FIELD_FL_STRING ) { +/* String type can not be the operand of unary operator. */ +destroy_hist_field (operand1,0 ); + ret = -EINVAL ; + goto free; + } expr->flags |= operand1->flags & (HIST_FIELD_FL_TIMESTAMP |HIST_FIELD_FL_TIMESTAMP_USECS );
@@ -2890,6 +2896,10 @@ static struct hist_field *parse_expr(struct hist_trigger_data *hist_data, operand1 =NULL ; goto free; } +if (operand1->flags &HIST_FIELD_FL_STRING ) { + ret = -EINVAL ; + goto free; + }/* rest of string could be another expression e.g. b+c in a+b+c */ operand_flags =0 ;
@@ -2899,6 +2909,10 @@ static struct hist_field *parse_expr(struct hist_trigger_data *hist_data, operand2 =NULL ; goto free; } +if (operand2->flags &HIST_FIELD_FL_STRING ) { + ret = -EINVAL ; + goto free; + } ret =check_expr_operands (operand1, operand2);if (ret)
tools/testing/selftests/bpf/test_verifier.c +2 -0
@@ -2792,6 +2792,8 @@ static struct bpf_test tests[] = { BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_7, 0), BPF_EXIT_INSN(), }, + .errstr_unpriv = "R7 invalid mem access 'inv'", + .result_unpriv = REJECT, .result = ACCEPT, .retval = 0, },