Linux 5.15.88
Greg Kroah-Hartman
maintainerI'm announcing the release of the 5.15.88 kernel.
All users of the 5.15 kernel series must upgrade.
The updated 5.15.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.15.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 arch/parisc/include/uapi/asm/mman.h | 27 ++--- arch/parisc/kernel/sys_parisc.c | 27 +++++ arch/parisc/kernel/syscalls/syscall.tbl | 2 arch/x86/include/asm/fpu/xstate.h | 4 arch/x86/kernel/fpu/regset.c | 2 arch/x86/kernel/fpu/signal.c | 2 arch/x86/kernel/fpu/xstate.c | 41 +++++++- drivers/tty/serial/fsl_lpuart.c | 2 drivers/tty/serial/serial_core.c | 3 net/ipv4/inet_connection_sock.c | 16 +++ net/ipv4/tcp_ulp.c | 4 net/sched/sch_api.c | 5 + sound/core/control.c | 24 +++- sound/pci/hda/patch_hdmi.c | 1 sound/pci/hda/patch_realtek.c | 1 tools/arch/parisc/include/uapi/asm/mman.h | 12 +- tools/perf/bench/bench.h | 12 -- tools/testing/selftests/vm/pkey-x86.h | 12 ++ tools/testing/selftests/vm/protection_keys.c | 131 ++++++++++++++++++++++++++- 20 files changed, 273 insertions(+), 57 deletions(-)
Adrian Chan (1):
ALSA: hda/hdmi: Add a HP device 0x8715 to force connect list
Chris Chiu (1):
ALSA: hda - Enable headset mic on another Dell laptop with ALC3254
Clement Lecigne (1):
ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF
Frederick Lawler (1):
net: sched: disallow noqueue for qdisc classes
Greg Kroah-Hartman (1):
Linux 5.15.88
Helge Deller (1):
parisc: Align parisc MADV_XXX constants with all other architectures
Kyle Huey (6):
x86/fpu: Take task_struct* in copy_sigframe_from_user_to_xstate() x86/fpu: Add a pkru argument to copy_uabi_from_kernel_to_xstate(). x86/fpu: Add a pkru argument to copy_uabi_to_xstate() x86/fpu: Allow PKRU to be (once again) written by ptrace. x86/fpu: Emulate XRSTOR's behavior if the xfeatures PKRU bit is not set selftests/vm/pkeys: Add a regression test for setting PKRU through ptrace
Paolo Abeni (1):
net/ulp: prevent ULP without clone op from entering the LISTEN status
Rasmus Villemoes (1):
serial: fixup backport of "serial: Deassert Transmit Enable on probe in driver-specific way"
Greg Kroah-Hartman
maintainerMakefile +1 -1
@@ -1,7 +1,7 @@ # SPDX-License-Identifier: GPL-2.0 VERSION = 5 PATCHLEVEL = 15 -SUBLEVEL = 87 +SUBLEVEL = 88 EXTRAVERSION = NAME = Trick or Treat
arch/parisc/include/uapi/asm/mman.h +13 -14
@@ -49,31 +49,30 @@#define MADV_DONTFORK 10/* don't inherit across fork */ #define MADV_DOFORK 11/* do inherit across fork */ -#define MADV_COLD 20/* deactivate these pages */ -#define MADV_PAGEOUT 21/* reclaim these pages */ +#define MADV_MERGEABLE 12/* KSM may merge identical pages */ +#define MADV_UNMERGEABLE 13/* KSM may not merge identical pages */ -#define MADV_POPULATE_READ 22/* populate (prefault) page tables readable */ -#define MADV_POPULATE_WRITE 23/* populate (prefault) page tables writable */ +#define MADV_HUGEPAGE 14/* Worth backing with hugepages */ +#define MADV_NOHUGEPAGE 15/* Not worth backing with hugepages */ -#define MADV_MERGEABLE 65/* KSM may merge identical pages */ -#define MADV_UNMERGEABLE 66/* KSM may not merge identical pages */ +#define MADV_DONTDUMP 16/* Explicity exclude from the core dump, +overrides the coredump filter bits */ +#define MADV_DODUMP 17/* Clear the MADV_NODUMP flag */ -#define MADV_HUGEPAGE 67/* Worth backing with hugepages */ -#define MADV_NOHUGEPAGE 68/* Not worth backing with hugepages */ +#define MADV_WIPEONFORK 18/* Zero memory on fork, child only */ +#define MADV_KEEPONFORK 19/* Undo MADV_WIPEONFORK */ -#define MADV_DONTDUMP 69/* Explicity exclude from the core dump, -overrides the coredump filter bits */ -#define MADV_DODUMP 70/* Clear the MADV_NODUMP flag */ +#define MADV_COLD 20/* deactivate these pages */ +#define MADV_PAGEOUT 21/* reclaim these pages */ -#define MADV_WIPEONFORK 71/* Zero memory on fork, child only */ -#define MADV_KEEPONFORK 72/* Undo MADV_WIPEONFORK */ +#define MADV_POPULATE_READ 22/* populate (prefault) page tables readable */ +#define MADV_POPULATE_WRITE 23/* populate (prefault) page tables writable */ #define MADV_HWPOISON 100/* poison a page for testing */ #define MADV_SOFT_OFFLINE 101/* soft offline page for testing */ /* compatibility flags */ #define MAP_FILE 0 -#define MAP_VARIABLE 0#define PKEY_DISABLE_ACCESS 0x1#define PKEY_DISABLE_WRITE 0x2
arch/parisc/kernel/sys_parisc.c +27 -0
@@ -463,3 +463,30 @@ asmlinkage long parisc_inotify_init1(int flags) flags =FIX_O_NONBLOCK (flags);return sys_inotify_init1 (flags); } + +/* +* madvise() wrapper +* +* Up to kernel v6.1 parisc has different values than all other +* platforms for the MADV_xxx flags listed below. +* To keep binary compatibility with existing userspace programs +* translate the former values to the new values. +* +* XXX: Remove this wrapper in year 2025 (or later) +*/ + +asmlinkage notrace long parisc_madvise(unsigned long start, size_t len_in, int behavior) +{ +switch (behavior) { +case 65 : behavior =MADV_MERGEABLE ;break ; +case 66 : behavior =MADV_UNMERGEABLE ;break ; +case 67 : behavior =MADV_HUGEPAGE ;break ; +case 68 : behavior =MADV_NOHUGEPAGE ;break ; +case 69 : behavior =MADV_DONTDUMP ;break ; +case 70 : behavior =MADV_DODUMP ;break ; +case 71 : behavior =MADV_WIPEONFORK ;break ; +case 72 : behavior =MADV_KEEPONFORK ;break ; + } + +return sys_madvise (start, len_in, behavior); +}
arch/parisc/kernel/syscalls/syscall.tbl +1 -1
@@ -131,7 +131,7 @@ 116 common sysinfo sys_sysinfo compat_sys_sysinfo 117 common shutdown sys_shutdown 118 common fsync sys_fsync -119 common madvise sys_madvise +119 common madvise parisc_madvise 120 common clone sys_clone_wrapper 121 common setdomainname sys_setdomainname 122 common sendfile sys_sendfile compat_sys_sendfile
arch/x86/include/asm/fpu/xstate.h +2 -2
@@ -136,8 +136,8 @@ extern void __init update_regset_xstate_info(unsigned int size,void *get_xsave_addr (struct xregs_state *xsave,int xfeature_nr);int xfeature_size (int xfeature_nr); -int copy_uabi_from_kernel_to_xstate (struct xregs_state *xsave,const void *kbuf); -int copy_sigframe_from_user_to_xstate (struct xregs_state *xsave,const void __user *ubuf); +int copy_uabi_from_kernel_to_xstate (struct xregs_state *xsave,const void *kbuf,u32 *pkru); +int copy_sigframe_from_user_to_xstate (struct task_struct *tsk,const void __user *ubuf);void xsaves (struct xregs_state *xsave,u64 mask);void xrstors (struct xregs_state *xsave,u64 mask);
arch/x86/kernel/fpu/regset.c +1 -1
@@ -163,7 +163,7 @@ int xstateregs_set(struct task_struct *target, const struct user_regset *regset, }fpu_force_restore (fpu); - ret =copy_uabi_from_kernel_to_xstate (&fpu->state.xsave, kbuf ?: tmpbuf); + ret =copy_uabi_from_kernel_to_xstate (&fpu->state.xsave, kbuf ?: tmpbuf, &target->thread.pkru); out:vfree (tmpbuf);
arch/x86/kernel/fpu/signal.c +1 -1
@@ -370,7 +370,7 @@ static int __fpu_restore_sig(void __user *buf, void __user *buf_fx,fpregs_unlock ();if (use_xsave () && !fx_only) { - ret =copy_sigframe_from_user_to_xstate (&fpu->state.xsave, buf_fx); + ret =copy_sigframe_from_user_to_xstate (tsk, buf_fx);if (ret)return ret; }else {
arch/x86/kernel/fpu/xstate.c +36 -5
69 lines not on this page · raw message
drivers/tty/serial/fsl_lpuart.c +1 -1
@@ -2784,9 +2784,9 @@ static int lpuart_probe(struct platform_device *pdev)return 0 ; failed_irq_request: -failed_get_rs485:uart_remove_one_port (&lpuart_reg, &sport->port); failed_attach_port: +failed_get_rs485: failed_reset:lpuart_disable_clks (sport);return ret;
drivers/tty/serial/serial_core.c +2 -1
@@ -2225,7 +2225,8 @@ int uart_suspend_port(struct uart_driver *drv, struct uart_port *uport)spin_lock_irq (&uport->lock); ops->stop_tx (uport); - ops->set_mctrl (uport,0 ); +if (!(uport->rs485.flags &SER_RS485_ENABLED )) + ops->set_mctrl (uport,0 ); ops->stop_rx (uport);spin_unlock_irq (&uport->lock);
net/ipv4/inet_connection_sock.c +15 -1
@@ -1040,11 +1040,25 @@ void inet_csk_prepare_forced_close(struct sock *sk) }EXPORT_SYMBOL (inet_csk_prepare_forced_close); +static int inet_ulp_can_listen (const struct sock *sk) +{ +const struct inet_connection_sock *icsk =inet_csk (sk); + +if (icsk->icsk_ulp_ops && !icsk->icsk_ulp_ops->clone) +return -EINVAL ; + +return 0 ; +} +int inet_csk_listen_start (struct sock *sk,int backlog) {struct inet_connection_sock *icsk =inet_csk (sk);struct inet_sock *inet =inet_sk (sk); -int err = -EADDRINUSE ; +int err; + + err =inet_ulp_can_listen (sk); +if (unlikely (err)) +return err;reqsk_queue_alloc (&icsk->icsk_accept_queue);
net/ipv4/tcp_ulp.c +4 -0
@@ -136,6 +136,10 @@ static int __tcp_set_ulp(struct sock *sk, const struct tcp_ulp_ops *ulp_ops)if (icsk->icsk_ulp_ops) goto out_err; + err = -EINVAL ; +if (!ulp_ops->clone && sk->sk_state ==TCP_LISTEN ) + goto out_err; + err = ulp_ops->init (sk);if (err) goto out_err;
net/sched/sch_api.c +5 -0
@@ -1114,6 +1114,11 @@ static int qdisc_graft(struct net_device *dev, struct Qdisc *parent,return -ENOENT ; } +if (new && new->ops == &noqueue_qdisc_ops) { +NL_SET_ERR_MSG (extack,"Cannot assign noqueue to a class" ); +return -EINVAL ; + } + err = cops->graft (parent, cl, new, &old, extack);if (err)return err;
sound/core/control.c +15 -9
@@ -1067,14 +1067,19 @@ static int snd_ctl_elem_read(struct snd_card *card,const u32 pattern =0xdeadbeef ;int ret; +down_read (&card->controls_rwsem); kctl =snd_ctl_find_id (card, &control->id); -if (kctl ==NULL ) -return -ENOENT ; +if (kctl ==NULL ) { + ret = -ENOENT ; + goto unlock; + } index_offset =snd_ctl_get_ioff (kctl, &control->id); vd = &kctl->vd[index_offset]; -if (!(vd->access &SNDRV_CTL_ELEM_ACCESS_READ ) || kctl->get ==NULL ) -return -EPERM ; +if (!(vd->access &SNDRV_CTL_ELEM_ACCESS_READ ) || kctl->get ==NULL ) { + ret = -EPERM ; + goto unlock; + }snd_ctl_build_ioff (&control->id, kctl, index_offset);
@@ -1084,7 +1089,7 @@ static int snd_ctl_elem_read(struct snd_card *card, info.id = control->id; ret =__snd_ctl_elem_info (card, kctl, &info,NULL );if (ret <0 ) -return ret; + goto unlock;#endif if (!snd_ctl_skip_validation (&info))
@@ -1094,7 +1099,7 @@ static int snd_ctl_elem_read(struct snd_card *card, ret = kctl->get (kctl, control);snd_power_unref (card);if (ret <0 ) -return ret; + goto unlock;if (!snd_ctl_skip_validation (&info) &&sanity_check_elem_value (card, control, &info, pattern) <0 ) { dev_err(card->dev,
@@ -1102,8 +1107,11 @@ static int snd_ctl_elem_read(struct snd_card *card, control->id.iface, control->id.device, control->id.subdevice, control->id.name, control->id.index); -return -EINVAL ; + ret = -EINVAL ; + goto unlock; } +unlock: +up_read (&card->controls_rwsem);return ret; }
@@ -1117,9 +1125,7 @@ static int snd_ctl_elem_read_user(struct snd_card *card,if (IS_ERR (control))return PTR_ERR (control); -down_read (&card->controls_rwsem); result =snd_ctl_elem_read (card, control); -up_read (&card->controls_rwsem);if (result <0 ) goto error;
sound/pci/hda/patch_hdmi.c +1 -0
@@ -1963,6 +1963,7 @@ static const struct snd_pci_quirk force_connect_list[] = {SND_PCI_QUIRK (0x103c ,0x870f ,"HP" ,1 ),SND_PCI_QUIRK (0x103c ,0x871a ,"HP" ,1 ),SND_PCI_QUIRK (0x103c ,0x8711 ,"HP" ,1 ), +SND_PCI_QUIRK (0x103c ,0x8715 ,"HP" ,1 ),SND_PCI_QUIRK (0x1462 ,0xec94 ,"MS-7C94" ,1 ), SND_PCI_QUIRK(0x8086, 0x2081, "Intel NUC 10", 1), {}
sound/pci/hda/patch_realtek.c +1 -0
@@ -8909,6 +8909,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x1028 ,0x0b1a ,"Dell Precision 5570" ,ALC289_FIXUP_DUAL_SPK ),SND_PCI_QUIRK (0x1028 ,0x0b37 ,"Dell Inspiron 16 Plus 7620 2-in-1" ,ALC295_FIXUP_DELL_INSPIRON_TOP_SPEAKERS ),SND_PCI_QUIRK (0x1028 ,0x0b71 ,"Dell Inspiron 16 Plus 7620" ,ALC295_FIXUP_DELL_INSPIRON_TOP_SPEAKERS ), +SND_PCI_QUIRK (0x1028 ,0x0c03 ,"Dell Precision 5340" ,ALC269_FIXUP_DELL4_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1028 ,0x0c19 ,"Dell Precision 3340" ,ALC236_FIXUP_DELL_DUAL_CODECS ),SND_PCI_QUIRK (0x1028 ,0x0c1a ,"Dell Precision 3340" ,ALC236_FIXUP_DELL_DUAL_CODECS ), SND_PCI_QUIRK(0x1028, 0x0c1b, "Dell Precision 3440", ALC236_FIXUP_DELL_DUAL_CODECS),
tools/arch/parisc/include/uapi/asm/mman.h +6 -6
@@ -1,20 +1,20 @@/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ #ifndef TOOLS_ARCH_PARISC_UAPI_ASM_MMAN_FIX_H #define TOOLS_ARCH_PARISC_UAPI_ASM_MMAN_FIX_H -#define MADV_DODUMP 70 +#define MADV_DODUMP 17#define MADV_DOFORK 11 -#define MADV_DONTDUMP 69 +#define MADV_DONTDUMP 16#define MADV_DONTFORK 10#define MADV_DONTNEED 4#define MADV_FREE 8 -#define MADV_HUGEPAGE 67 -#define MADV_MERGEABLE 65 -#define MADV_NOHUGEPAGE 68 +#define MADV_HUGEPAGE 14 +#define MADV_MERGEABLE 12 +#define MADV_NOHUGEPAGE 15#define MADV_NORMAL 0#define MADV_RANDOM 1#define MADV_REMOVE 9#define MADV_SEQUENTIAL 2 -#define MADV_UNMERGEABLE 66 +#define MADV_UNMERGEABLE 13#define MADV_WILLNEED 3#define MAP_ANONYMOUS 0x10#define MAP_DENYWRITE 0x0800
tools/perf/bench/bench.h +0 -12
@@ -10,25 +10,13 @@ extern struct timeval bench__start, bench__end, bench__runtime;* The madvise transparent hugepage constants were added in glibc * 2.13. For compatibility with older versions of glibc, define these * tokens if they are not already defined. -* -* PA-RISC uses different madvise values from other architectures and -* needs to be special-cased. */ -#ifdef __hppa__ -# ifndef MADV_HUGEPAGE -# define MADV_HUGEPAGE 67 -# endif -# ifndef MADV_NOHUGEPAGE -# define MADV_NOHUGEPAGE 68 -# endif -#else # ifndef MADV_HUGEPAGE # define MADV_HUGEPAGE 14# endif # ifndef MADV_NOHUGEPAGE # define MADV_NOHUGEPAGE 15# endif -#endif int bench_numa (int argc,const char **argv);int bench_sched_messaging (int argc,const char **argv);
tools/testing/selftests/vm/pkey-x86.h +12 -0
@@ -119,6 +119,18 @@ static inline int cpu_has_pkeys(void)return 1 ; } +static inline int cpu_max_xsave_size (void ) +{ +unsigned long XSTATE_CPUID =0xd ; +unsigned int eax; +unsigned int ebx; +unsigned int ecx; +unsigned int edx; + +__cpuid_count (XSTATE_CPUID ,0 , eax, ebx, ecx, edx); +return ecx; +} +static inline u32 pkey_bit_position (int pkey) {return pkey *PKEY_BITS_PER_PKEY ;
tools/testing/selftests/vm/protection_keys.c +129 -2
153 lines not on this page · raw message