Linux 4.4.214
Greg KH
maintainerI'm announcing the release of the 4.4.214 kernel.
All users of the 4.4 kernel series must upgrade.
The updated 4.4.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.4.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 arch/arc/boot/dts/axs10x_mb.dtsi | 1 arch/arm/boot/dts/sama5d3.dtsi | 28 arch/arm/boot/dts/sama5d3_can.dtsi | 4 arch/arm/boot/dts/sama5d3_tcb1.dtsi | 1 arch/arm/boot/dts/sama5d3_uart.dtsi | 4 arch/arm/mach-tegra/sleep-tegra30.S | 11 arch/powerpc/Kconfig | 1 arch/powerpc/boot/4xx.c | 2 arch/powerpc/kvm/book3s_hv.c | 4 arch/powerpc/kvm/book3s_pr.c | 4 arch/powerpc/platforms/pseries/hotplug-memory.c | 4 arch/powerpc/platforms/pseries/iommu.c | 43 arch/sparc/include/uapi/asm/ipcbuf.h | 22 arch/x86/kernel/cpu/tsx.c | 13 arch/x86/kvm/emulate.c | 28 arch/x86/kvm/hyperv.c | 11 arch/x86/kvm/i8259.c | 41 arch/x86/kvm/ioapic.c | 15 arch/x86/kvm/lapic.c | 13 arch/x86/kvm/mtrr.c | 9 arch/x86/kvm/pmu.h | 18 arch/x86/kvm/pmu_intel.c | 24 arch/x86/kvm/vmx.c | 4 arch/x86/kvm/vmx/vmx.c | 8033 +++++++++++++++++++++ arch/x86/kvm/x86.c | 23 crypto/algapi.c | 22 crypto/api.c | 3 crypto/internal.h | 1 crypto/pcrypt.c | 1 drivers/crypto/picoxcell_crypto.c | 15 drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_crtc.c | 8 drivers/md/dm.c | 9 drivers/md/persistent-data/dm-space-map-common.c | 27 drivers/md/persistent-data/dm-space-map-common.h | 2 drivers/md/persistent-data/dm-space-map-disk.c | 6 drivers/md/persistent-data/dm-space-map-metadata.c | 5 drivers/media/rc/iguanair.c | 2 drivers/media/usb/uvc/uvc_driver.c | 12 drivers/mfd/da9062-core.c | 2 drivers/mfd/dln2.c | 13 drivers/mfd/rn5t618.c | 1 drivers/mmc/host/mmc_spi.c | 11 drivers/net/bonding/bond_alb.c | 44 drivers/net/ethernet/broadcom/bcmsysport.c | 3 drivers/net/ethernet/dec/tulip/dmfe.c | 7 drivers/net/ethernet/dec/tulip/uli526x.c | 4 drivers/net/ethernet/smsc/smc911x.c | 2 drivers/net/ppp/ppp_async.c | 18 drivers/net/wireless/brcm80211/brcmfmac/usb.c | 1 drivers/net/wireless/libertas/cfg.c | 2 drivers/net/wireless/mwifiex/scan.c | 7 drivers/net/wireless/mwifiex/sta_ioctl.c | 1 drivers/net/wireless/mwifiex/wmm.c | 4 drivers/nfc/pn544/pn544.c | 2 drivers/of/Kconfig | 4 drivers/of/address.c | 6 drivers/pci/host/pci-keystone-dw.c | 2 drivers/pinctrl/sh-pfc/pfc-r8a7778.c | 4 drivers/power/ltc2941-battery-gauge.c | 2 drivers/rtc/rtc-hym8563.c | 2 drivers/scsi/csiostor/csio_scsi.c | 2 drivers/scsi/qla2xxx/qla_mbx.c | 3 drivers/scsi/qla2xxx/qla_nx.c | 8 drivers/scsi/qla4xxx/ql4_os.c | 2 drivers/scsi/ufs/ufshcd.c | 3 drivers/usb/gadget/function/f_ecm.c | 16 drivers/usb/gadget/function/f_ncm.c | 17 drivers/usb/gadget/legacy/cdc2.c | 2 drivers/usb/gadget/legacy/g_ffs.c | 2 drivers/usb/gadget/legacy/multi.c | 2 drivers/usb/gadget/legacy/ncm.c | 2 fs/btrfs/ctree.c | 64 fs/btrfs/ctree.h | 6 fs/btrfs/delayed-ref.c | 8 fs/btrfs/disk-io.c | 1 fs/btrfs/extent_io.c | 8 fs/btrfs/tests/btrfs-tests.c | 1 fs/btrfs/transaction.c | 8 fs/btrfs/tree-log.c | 7 fs/cifs/smb2pdu.c | 10 fs/ext2/super.c | 6 fs/nfs/callback_proc.c | 2 fs/nfs/dir.c | 59 fs/nfs/nfs4client.c | 2 fs/overlayfs/inode.c | 13 kernel/events/core.c | 10 kernel/time/clocksource.c | 11 lib/test_kasan.c | 1 net/hsr/hsr_slave.c | 2 net/ipv4/tcp.c | 3 net/sched/cls_rsvp.h | 6 net/sched/cls_tcindex.c | 40 net/sunrpc/auth_gss/svcauth_gss.c | 4 sound/drivers/dummy.c | 2 sound/soc/qcom/apq8016_sbc.c | 3 sound/soc/soc-pcm.c | 95 97 files changed, 8688 insertions(+), 361 deletions(-)
Alexandre Belloni (2):
ARM: dts: at91: sama5d3: fix maximum peripheral clock rates
ARM: dts: at91: sama5d3: define clock rate range for tcb1
Alexey Kardashevskiy (1):
powerpc/pseries: Allow not having ibm, hypertas-functions::hcall-multi-tce for DDW
Andreas Kemnade (1):
mfd: rn5t618: Mark ADC control register volatile
Arnd Bergmann (1):
sparc32: fix struct ipc64_perm type definition
Bart Van Assche (1):
scsi: qla2xxx: Fix the endianness of the qla82xx_get_fw_size() return type
Bean Huo (1):
scsi: ufs: Fix ufshcd_probe_hba() reture value in case ufshcd_scsi_add_wlus() fails
Brian Norris (1):
mwifiex: fix unbalanced locking in mwifiex_process_country_ie()
Bryan O'Donoghue (2):
usb: gadget: f_ncm: Use atomic_t to track in-flight request
usb: gadget: f_ecm: Use atomic_t to track in-flight request
Chuhong Yuan (1):
crypto: picoxcell - adjust the position of tasklet_init and fix missed tasklet_kill
Claudiu Beznea (1):
drm: atmel-hlcdc: enable clock before configuring timing engine
Cong Wang (1):
net_sched: fix an OOB access in cls_tcindex
David Hildenbrand (1):
KVM: x86: drop picdev_in_range()
David Sterba (1):
btrfs: remove trivial locking wrappers of tree mod log
Eric Dumazet (5):
cls_rsvp: fix rsvp_policy
net: hsr: fix possible NULL deref in hsr_handle_frame()
tcp: clear tp->total_retrans in tcp_disconnect()
tcp: clear tp->segs_{in|out} in tcp_disconnect() bonding/alb: properly access headers in bond_alb_xmit()
Filipe Manana (2):
Btrfs: fix assertion failure on fsync with NO_HOLES enabled
Btrfs: fix race between adding and putting tree mod seq elements and nodes
Florian Fainelli (1):
net: systemport: Avoid RBUF stuck in Wake-on-LAN mode
Geert Uytterhoeven (1):
pinctrl: sh-pfc: r8a7778: Fix duplicate SDSELF_B and SD1_CLK_B
Greg Kroah-Hartman (1):
Linux 4.4.214
Gustavo A. R. Silva (1):
lib/test_kasan.c: fix memory leak in kmalloc_oob_krealloc_more()
Herbert Xu (3):
crypto: api - Check spawn->alg under lock in crypto_drop_spawn
crypto: pcrypt - Do not clear MAY_SLEEP flag in original request
crypto: api - Fix race condition in crypto_spawn_alg
Ioanna Alifieraki (1):
Revert "ovl: modify ovl_permission() to do checks on two inodes"
Joe Thornber (1):
dm space map common: fix to ensure new block isn't already in use
Johan Hovold (1):
media: iguanair: fix endpoint sanity check
Jose Abreu (1):
ARC: [plat-axs10x]: Add missing multicast filter number to GMAC node
Josef Bacik (2):
btrfs: set trans->drity in btrfs_commit_transaction
btrfs: flush write bio if we loop in extent_write_cache_pages
Konstantin Khlebnikov (1):
clocksource: Prevent double add_timer_on() for watchdog_timer
Linus Walleij (1):
mmc: spi: Toggle SPI polarity, do not hardcode it
Marco Felsch (1):
mfd: da9062: Fix watchdog compatible string
Marios Pomonis (12):
KVM: x86: Refactor prefix decoding to prevent Spectre-v1/L1TF attacks
KVM: x86: Protect DR-based index computations from Spectre-v1/L1TF attacks
KVM: x86: Protect kvm_hv_msr_[get|set]_crash_data() from Spectre-v1/L1TF attacks
KVM: x86: Protect ioapic_write_indirect() from Spectre-v1/L1TF attacks
KVM: x86: Protect MSR-based index computations in pmu.h from Spectre-v1/L1TF attacks
KVM: x86: Protect ioapic_read_indirect() from Spectre-v1/L1TF attacks
KVM: x86: Protect MSR-based index computations from Spectre-v1/L1TF attacks in x86.c
KVM: x86: Protect x86_decode_insn from Spectre-v1/L1TF attacks
KVM: x86: Protect MSR-based index computations in fixed_msr_to_seg_unit() from Spectre-v1/L1TF attacks
KVM: x86: Refactor picdev_write() to prevent Spectre-v1/L1TF attacks
KVM: x86: Protect pmu_intel.c from Spectre-v1/L1TF attacks
KVM: x86: Protect kvm_lapic_reg_write() from Spectre-v1/L1TF attacks
Miaohe Lin (1):
KVM: nVMX: vmread should not set rflags to specify success in case of #PF
Michael Ellerman (1):
of: Add OF_DMA_DEFAULT_COHERENT & select it on powerpc
Mike Snitzer (1):
dm: fix potential for q->make_request_fn NULL pointer
Nathan Chancellor (8):
scsi: csiostor: Adjust indentation in csio_device_reset
scsi: qla4xxx: Adjust indentation in qla4xxx_mem_free
ext2: Adjust indentation in ext2_fill_super powerpc/44x: Adjust indentation in ibm4xx_denali_fixup_memsize
NFC: pn544: Adjust indentation in pn544_hci_check_presence
ppp: Adjust indentation into ppp_async_input
net: smc911x: Adjust indentation in smc911x_phy_configure
net: tulip: Adjust indentation in {dmfe, uli526x}_init_module
Navid Emamdoost (1):
brcmfmac: Fix memory leak in brcmf_usbdev_qinit
Nicolai Stange (2):
libertas: don't exit from lbs_ibss_join_existing() with RCU read lock held
libertas: make lbs_ibss_join_existing() return error code on rates overflow
Nobuhiro Iwamatsu (1):
ASoC: qcom: Fix of-node refcount unbalance to link->codec_of_node
Oliver Neukum (1):
mfd: dln2: More sanity checking for endpoints
Paul Kocialkowski (1):
rtc: hym8563: Return -EINVAL if the time is known to be invalid
Pawan Gupta (1):
x86/cpu: Update cached HLE state on write to TSX_CTRL_CPUID_CLEAR
Pingfan Liu (1):
powerpc/pseries: Advance pfn if section is not present in lmb_is_removable()
Qing Xu (2):
mwifiex: Fix possible buffer overflows in mwifiex_ret_wmm_get_status()
mwifiex: Fix possible buffer overflows in mwifiex_cmd_append_vsie_tlv()
Quinn Tran (1):
scsi: qla2xxx: Fix mtcp dump collection failure
Ranjani Sridharan (1):
ASoC: pcm: update FE/BE trigger order based on the command
Roberto Bergantinos Corpas (1):
sunrpc: expiry_time should be seconds not timeval
Roger Quadros (1):
usb: gadget: legacy: set max_speed to super-speed
Ronnie Sahlberg (1):
cifs: fail i/o on soft mounts if sessionsetup errors out
Sean Christopherson (5):
KVM: PPC: Book3S HV: Uninit vCPU if vcore creation fails
KVM: PPC: Book3S PR: Free shared page if mmu initialization fails
KVM: x86: Free wbinvd_dirty_mask if vCPU creation fails
KVM: x86/mmu: Apply max PA check for MMIO sptes to 32-bit KVM
KVM: VMX: Add non-canonical check on writes to RTIT address MSRs
Song Liu (1):
perf/core: Fix mlock accounting in perf_mmap()
Stephen Warren (1):
ARM: tegra: Enable PLLP bypass during Tegra124 LP1
Sven Van Asbroeck (1):
power: supply: ltc2941-battery-gauge: fix use-after-free
Takashi Iwai (1):
ALSA: dummy: Fix PCM format loop in proc output
Thomas Meyer (1):
NFS: Fix bool initialization/comparison
Trond Myklebust (2):
NFS: Fix memory leaks and corruption in readdir
NFS: Directory page cache pages need to be locked when read
Will Deacon (1):
media: uvcvideo: Avoid cyclic entity chains due to malformed USB descriptors
Yurii Monakov (1):
PCI: keystone: Fix link training retries initiation
Greg KH
maintainerMakefile +1 -1
@@ -1,6 +1,6 @@ VERSION = 4 PATCHLEVEL = 4 -SUBLEVEL = 213 +SUBLEVEL = 214 EXTRAVERSION = NAME = Blurry Fish Butt
arch/arc/boot/dts/axs10x_mb.dtsi +1 -0
@@ -44,6 +44,7 @@ interrupt-names = "macirq"; phy-mode = "rgmii"; snps,pbl = < 32 >; + snps,multicast-filter-bins = <256>; clocks = <&apbclk>; clock-names = "stmmaceth"; max-speed = <100>;
arch/arm/boot/dts/sama5d3.dtsi +14 -14
@@ -1106,49 +1106,49 @@ usart0_clk: usart0_clk { #clock-cells = <0>; reg = <12>; - atmel,clk-output-range = <0 66000000>; + atmel,clk-output-range = <0 83000000>; }; usart1_clk: usart1_clk { #clock-cells = <0>; reg = <13>; - atmel,clk-output-range = <0 66000000>; + atmel,clk-output-range = <0 83000000>; }; usart2_clk: usart2_clk { #clock-cells = <0>; reg = <14>; - atmel,clk-output-range = <0 66000000>; + atmel,clk-output-range = <0 83000000>; }; usart3_clk: usart3_clk { #clock-cells = <0>; reg = <15>; - atmel,clk-output-range = <0 66000000>; + atmel,clk-output-range = <0 83000000>; }; uart0_clk: uart0_clk { #clock-cells = <0>; reg = <16>; - atmel,clk-output-range = <0 66000000>; + atmel,clk-output-range = <0 83000000>; }; twi0_clk: twi0_clk { reg = <18>; #clock-cells = <0>; - atmel,clk-output-range = <0 16625000>; + atmel,clk-output-range = <0 41500000>; }; twi1_clk: twi1_clk { #clock-cells = <0>; reg = <19>; - atmel,clk-output-range = <0 16625000>; + atmel,clk-output-range = <0 41500000>; }; twi2_clk: twi2_clk { #clock-cells = <0>; reg = <20>; - atmel,clk-output-range = <0 16625000>; + atmel,clk-output-range = <0 41500000>; }; mci0_clk: mci0_clk {
@@ -1164,19 +1164,19 @@ spi0_clk: spi0_clk { #clock-cells = <0>; reg = <24>; - atmel,clk-output-range = <0 133000000>; + atmel,clk-output-range = <0 166000000>; }; spi1_clk: spi1_clk { #clock-cells = <0>; reg = <25>; - atmel,clk-output-range = <0 133000000>; + atmel,clk-output-range = <0 166000000>; }; tcb0_clk: tcb0_clk { #clock-cells = <0>; reg = <26>; - atmel,clk-output-range = <0 133000000>; + atmel,clk-output-range = <0 166000000>; }; pwm_clk: pwm_clk {
@@ -1187,7 +1187,7 @@ adc_clk: adc_clk { #clock-cells = <0>; reg = <29>; - atmel,clk-output-range = <0 66000000>; + atmel,clk-output-range = <0 83000000>; }; dma0_clk: dma0_clk {
@@ -1218,13 +1218,13 @@ ssc0_clk: ssc0_clk { #clock-cells = <0>; reg = <38>; - atmel,clk-output-range = <0 66000000>; + atmel,clk-output-range = <0 83000000>; }; ssc1_clk: ssc1_clk { #clock-cells = <0>; reg = <39>; - atmel,clk-output-range = <0 66000000>; + atmel,clk-output-range = <0 83000000>; }; sha_clk: sha_clk {
arch/arm/boot/dts/sama5d3_can.dtsi +2 -2
@@ -37,13 +37,13 @@ can0_clk: can0_clk { #clock-cells = <0>; reg = <40>; - atmel,clk-output-range = <0 66000000>; + atmel,clk-output-range = <0 83000000>; }; can1_clk: can1_clk { #clock-cells = <0>; reg = <41>; - atmel,clk-output-range = <0 66000000>; + atmel,clk-output-range = <0 83000000>; }; }; };
arch/arm/boot/dts/sama5d3_tcb1.dtsi +1 -0
@@ -23,6 +23,7 @@ tcb1_clk: tcb1_clk { #clock-cells = <0>; reg = <27>; + atmel,clk-output-range = <0 166000000>; }; }; };
arch/arm/boot/dts/sama5d3_uart.dtsi +2 -2
@@ -42,13 +42,13 @@ uart0_clk: uart0_clk { #clock-cells = <0>; reg = <16>; - atmel,clk-output-range = <0 66000000>; + atmel,clk-output-range = <0 83000000>; }; uart1_clk: uart1_clk { #clock-cells = <0>; reg = <17>; - atmel,clk-output-range = <0 66000000>; + atmel,clk-output-range = <0 83000000>; }; }; };
arch/arm/mach-tegra/sleep-tegra30.S +11 -0
@@ -379,6 +379,14 @@ _pll_m_c_x_done: pll_locked r1, r0, CLK_RESET_PLLC_BASE pll_locked r1, r0, CLK_RESET_PLLX_BASE + tegra_get_soc_id TEGRA_APB_MISC_BASE, r1 + cmp r1, #TEGRA30 + beq 1f + ldr r1, [r0, #CLK_RESET_PLLP_BASE] + bic r1, r1, #(1<<31) @ disable PllP bypass + str r1, [r0, #CLK_RESET_PLLP_BASE] +1: + mov32 r7, TEGRA_TMRUS_BASE ldr r1, [r7] add r1, r1, #LOCK_DELAY
@@ -638,7 +646,10 @@ tegra30_switch_cpu_to_clk32k: str r0, [r4, #PMC_PLLP_WB0_OVERRIDE] /* disable PLLP, PLLA, PLLC and PLLX */ + tegra_get_soc_id TEGRA_APB_MISC_BASE, r1 + cmp r1, #TEGRA30 ldr r0, [r5, #CLK_RESET_PLLP_BASE] + orrne r0, r0, #(1 << 31) @ enable PllP bypass on fast cluster bic r0, r0, #(1 << 30) str r0, [r5, #CLK_RESET_PLLP_BASE] ldr r0, [r5, #CLK_RESET_PLLA_BASE]
arch/powerpc/Kconfig +1 -0
@@ -93,6 +93,7 @@ config PPC select BINFMT_ELF select ARCH_HAS_ELF_RANDOMIZE select OF + select OF_DMA_DEFAULT_COHERENT if !NOT_COHERENT_CACHE select OF_EARLY_FLATTREE select OF_RESERVED_MEM select HAVE_FTRACE_MCOUNT_RECORD
arch/powerpc/boot/4xx.c +1 -1
@@ -232,7 +232,7 @@ void ibm4xx_denali_fixup_memsize(void) dpath =8 ;/* 64 bits */ /* get address pins (rows) */ - val =SDRAM0_READ (DDR0_42 ); + val =SDRAM0_READ (DDR0_42 ); row =DDR_GET_VAL (val,DDR_APIN ,DDR_APIN_SHIFT );if (row > max_row)
arch/powerpc/kvm/book3s_hv.c +3 -1
@@ -1669,7 +1669,7 @@ static struct kvm_vcpu *kvmppc_core_vcpu_create_hv(struct kvm *kvm,mutex_unlock (&kvm->lock);if (!vcore) - goto free_vcpu; + goto uninit_vcpu;spin_lock (&vcore->lock); ++vcore->num_threads;
@@ -1685,6 +1685,8 @@ static struct kvm_vcpu *kvmppc_core_vcpu_create_hv(struct kvm *kvm,return vcpu; +uninit_vcpu: +kvm_vcpu_uninit (vcpu); free_vcpu:kmem_cache_free (kvm_vcpu_cache, vcpu); out:
arch/powerpc/kvm/book3s_pr.c +3 -1
@@ -1434,10 +1434,12 @@ static struct kvm_vcpu *kvmppc_core_vcpu_create_pr(struct kvm *kvm, err =kvmppc_mmu_init (vcpu);if (err <0 ) - goto uninit_vcpu; + goto free_shared_page;return vcpu; +free_shared_page: +free_page ((unsigned long )vcpu->arch.shared); uninit_vcpu:kvm_vcpu_uninit (vcpu); free_shadow_vcpu:
arch/powerpc/platforms/pseries/hotplug-memory.c +3 -1
@@ -205,8 +205,10 @@ static bool lmb_is_removable(struct of_drconf_cell *lmb)for (i =0 ; i < scns_per_block; i++) { pfn =PFN_DOWN (phys_addr); -if (!pfn_present (pfn)) +if (!pfn_present (pfn)) { + phys_addr +=MIN_MEMORY_BLOCK_SIZE ;continue ; + } rc &=is_mem_section_removable (pfn,PAGES_PER_SECTION ); phys_addr +=MIN_MEMORY_BLOCK_SIZE ;
arch/powerpc/platforms/pseries/iommu.c +29 -14
108 lines not on this page · raw message
arch/sparc/include/uapi/asm/ipcbuf.h +11 -11
@@ -14,19 +14,19 @@struct ipc64_perm { -__kernel_key_t key; -__kernel_uid_t uid; -__kernel_gid_t gid; -__kernel_uid_t cuid; -__kernel_gid_t cgid; +__kernel_key_t key; +__kernel_uid32_t uid; +__kernel_gid32_t gid; +__kernel_uid32_t cuid; +__kernel_gid32_t cgid;#ifndef __arch64__ -unsigned short __pad0; +unsigned short __pad0;#endif -__kernel_mode_t mode; -unsigned short __pad1; -unsigned short seq; -unsigned long long __unused1; -unsigned long long __unused2; +__kernel_mode_t mode; +unsigned short __pad1; +unsigned short seq; +unsigned long long __unused1; +unsigned long long __unused2; };#endif /* __SPARC_IPCBUF_H */
arch/x86/kernel/cpu/tsx.c +7 -6
@@ -115,11 +115,12 @@ void __init tsx_init(void)tsx_disable ();/* -* tsx_disable() will change the state of the -* RTM CPUID bit. Clear it here since it is now -* expected to be not set. +* tsx_disable() will change the state of the RTM and HLE CPUID +* bits. Clear them here since they are now expected to be not +* set. */ setup_clear_cpu_cap (X86_FEATURE_RTM ); +setup_clear_cpu_cap (X86_FEATURE_HLE ); }else if (tsx_ctrl_state ==TSX_CTRL_ENABLE ) {/*
@@ -131,10 +132,10 @@ void __init tsx_init(void)tsx_enable ();/* -* tsx_enable() will change the state of the -* RTM CPUID bit. Force it here since it is now -* expected to be set. +* tsx_enable() will change the state of the RTM and HLE CPUID +* bits. Force them here since they are now expected to be set. */ setup_force_cpu_cap (X86_FEATURE_RTM ); +setup_force_cpu_cap (X86_FEATURE_HLE ); } }
arch/x86/kvm/emulate.c +23 -5
@@ -23,6 +23,7 @@#include <linux/kvm_host.h> #include "kvm_cache_regs.h" #include <linux/module.h> +#include <linux/nospec.h> #include <asm/kvm_emulate.h> #include <linux/stringify.h> #include <asm/debugreg.h>
@@ -5041,16 +5042,28 @@ int x86_decode_insn(struct x86_emulate_ctxt *ctxt, void *insn, int insn_len) ctxt->ad_bytes = def_ad_bytes ^6 ;break ;case 0x26 :/* ES override */ + has_seg_override = true; + ctxt->seg_override =VCPU_SREG_ES ; +break ;case 0x2e :/* CS override */ + has_seg_override = true; + ctxt->seg_override =VCPU_SREG_CS ; +break ;case 0x36 :/* SS override */ + has_seg_override = true; + ctxt->seg_override =VCPU_SREG_SS ; +break ;case 0x3e :/* DS override */ has_seg_override = true; - ctxt->seg_override = (ctxt->b >>3 ) &3 ; + ctxt->seg_override =VCPU_SREG_DS ;break ;case 0x64 :/* FS override */ + has_seg_override = true; + ctxt->seg_override =VCPU_SREG_FS ; +break ;case 0x65 :/* GS override */ has_seg_override = true; - ctxt->seg_override = ctxt->b &7 ; + ctxt->seg_override =VCPU_SREG_GS ;break ; case 0x40 ... 0x4f: /* REX */if (mode !=X86EMUL_MODE_PROT64 )
@@ -5134,10 +5147,15 @@ done_prefixes: }break ;case Escape: -if (ctxt->modrm >0xbf ) - opcode = opcode.u.esc->high[ctxt->modrm -0xc0 ]; -else +if (ctxt->modrm >0xbf ) { +size_t size =ARRAY_SIZE (opcode.u.esc->high); +u32 index =array_index_nospec ( + ctxt->modrm -0xc0 , size); + + opcode = opcode.u.esc->high[index]; + }else { opcode = opcode.u.esc->op[(ctxt->modrm >>3 ) &7 ]; + }break ;case InstrDual:if ((ctxt->modrm >>6 ) ==3 )
arch/x86/kvm/hyperv.c +7 -4
@@ -26,6 +26,7 @@#include "hyperv.h" #include <linux/kvm_host.h> +#include <linux/nospec.h> #include <trace/events/kvm.h> #include "trace.h"
@@ -53,11 +54,12 @@ static int kvm_hv_msr_get_crash_data(struct kvm_vcpu *vcpu, u32 index, u64 *pdata) { struct kvm_hv *hv = &vcpu->kvm->arch.hyperv; +size_t size =ARRAY_SIZE (hv->hv_crash_param); -if (WARN_ON_ONCE (index >=ARRAY_SIZE (hv->hv_crash_param))) +if (WARN_ON_ONCE (index >= size))return -EINVAL ; - *pdata = hv->hv_crash_param[index]; + *pdata = hv->hv_crash_param[array_index_nospec (index, size)];return 0 ; }
@@ -96,11 +98,12 @@ static int kvm_hv_msr_set_crash_data(struct kvm_vcpu *vcpu, u32 index, u64 data) {struct kvm_hv *hv = &vcpu->kvm->arch.hyperv; +size_t size =ARRAY_SIZE (hv->hv_crash_param); -if (WARN_ON_ONCE (index >=ARRAY_SIZE (hv->hv_crash_param))) +if (WARN_ON_ONCE (index >= size))return -EINVAL ; - hv->hv_crash_param[index] = data; + hv->hv_crash_param[array_index_nospec (index, size)] = data;return 0 ; }
arch/x86/kvm/i8259.c +17 -24
92 lines not on this page · raw message
arch/x86/kvm/ioapic.c +9 -6
@@ -36,6 +36,7 @@#include <linux/io.h> #include <linux/slab.h> #include <linux/export.h> +#include <linux/nospec.h> #include <asm/processor.h> #include <asm/page.h> #include <asm/current.h>
@@ -73,13 +74,14 @@ static unsigned long ioapic_read_indirect(struct kvm_ioapic *ioapic,default : {u32 redir_index = (ioapic->ioregsel -0x10 ) >>1 ; -u64 redir_content; +u64 redir_content = ~0ULL ; -if (redir_index <IOAPIC_NUM_PINS ) - redir_content = - ioapic->redirtbl[redir_index].bits; -else - redir_content = ~0ULL ; +if (redir_index <IOAPIC_NUM_PINS ) { +u32 index =array_index_nospec ( + redir_index,IOAPIC_NUM_PINS ); + + redir_content = ioapic->redirtbl[index].bits; + } result = (ioapic->ioregsel &0x1 ) ? (redir_content >> 32) & 0xffffffff :
@@ -289,6 +291,7 @@ static void ioapic_write_indirect(struct kvm_ioapic *ioapic, u32 val)ioapic_debug ("change redir index %x val %x\n" , index, val);if (index >=IOAPIC_NUM_PINS )return ; + index =array_index_nospec (index,IOAPIC_NUM_PINS ); e = &ioapic->redirtbl[index]; mask_before = e->fields.mask;/* Preserve read-only fields */
arch/x86/kvm/lapic.c +10 -3
@@ -36,6 +36,7 @@#include <asm/delay.h> #include <linux/atomic.h> #include <linux/jump_label.h> +#include <linux/nospec.h> #include "kvm_cache_regs.h" #include "irq.h" #include "trace.h"
@@ -1432,15 +1433,21 @@ static int apic_reg_write(struct kvm_lapic *apic, u32 reg, u32 val)case APIC_LVTTHMR :case APIC_LVTPC :case APIC_LVT1 : -case APIC_LVTERR : +case APIC_LVTERR : {/* TODO: Check vector */ +size_t size; +u32 index; +if (!kvm_apic_sw_enabled (apic)) val |=APIC_LVT_MASKED ; - val &= apic_lvt_mask[(reg -APIC_LVTT ) >>4 ]; + size =ARRAY_SIZE (apic_lvt_mask); + index =array_index_nospec ( + (reg -APIC_LVTT ) >>4 , size); + val &= apic_lvt_mask[index];apic_set_reg (apic, reg, val); -break ; + }case APIC_LVTT :if (!kvm_apic_sw_enabled (apic))
arch/x86/kvm/mtrr.c +7 -2
@@ -17,6 +17,7 @@*/ #include <linux/kvm_host.h> +#include <linux/nospec.h> #include <asm/mtrr.h> #include "cpuid.h"
@@ -202,11 +203,15 @@ static bool fixed_msr_to_seg_unit(u32 msr, int *seg, int *unit)break ; case MSR_MTRRfix16K_80000 ... MSR_MTRRfix16K_A0000: *seg =1 ; - *unit = msr - MSR_MTRRfix16K_80000; + *unit =array_index_nospec ( + msr - MSR_MTRRfix16K_80000, + MSR_MTRRfix16K_A0000 - MSR_MTRRfix16K_80000 +1 );break ; case MSR_MTRRfix4K_C0000 ... MSR_MTRRfix4K_F8000: *seg =2 ; - *unit = msr - MSR_MTRRfix4K_C0000; + *unit =array_index_nospec ( + msr - MSR_MTRRfix4K_C0000, + MSR_MTRRfix4K_F8000 - MSR_MTRRfix4K_C0000 +1 );break ;default :return false;
arch/x86/kvm/pmu.h +14 -4
@@ -1,6 +1,8 @@#ifndef __KVM_X86_PMU_H#define __KVM_X86_PMU_H +#include <linux/nospec.h> +#define vcpu_to_pmu (vcpu) (&(vcpu)->arch.pmu)#define pmu_to_vcpu (pmu) (container_of((pmu), struct kvm_vcpu, arch.pmu))#define pmc_to_pmu (pmc) (&(pmc)->vcpu->arch.pmu)
@@ -80,8 +82,12 @@ static inline bool pmc_is_enabled(struct kvm_pmc *pmc)static inline struct kvm_pmc *get_gp_pmc (struct kvm_pmu *pmu,u32 msr,u32 base) { -if (msr >= base && msr < base + pmu->nr_arch_gp_counters) -return &pmu->gp_counters[msr - base]; +if (msr >= base && msr < base + pmu->nr_arch_gp_counters) { +u32 index =array_index_nospec (msr - base, + pmu->nr_arch_gp_counters); + +return &pmu->gp_counters[index]; + }return NULL ; }
@@ -91,8 +97,12 @@ static inline struct kvm_pmc *get_fixed_pmc(struct kvm_pmu *pmu, u32 msr) {int base =MSR_CORE_PERF_FIXED_CTR0 ; -if (msr >= base && msr < base + pmu->nr_arch_fixed_counters) -return &pmu->fixed_counters[msr - base]; +if (msr >= base && msr < base + pmu->nr_arch_fixed_counters) { +u32 index =array_index_nospec (msr - base, + pmu->nr_arch_fixed_counters); + +return &pmu->fixed_counters[index]; + }return NULL ; }
arch/x86/kvm/pmu_intel.c +16 -8
@@ -87,10 +87,14 @@ static unsigned intel_find_arch_event(struct kvm_pmu *pmu,static unsigned intel_find_fixed_event (int idx) { -if (idx >=ARRAY_SIZE (fixed_pmc_events)) +u32 event; +size_t size =ARRAY_SIZE (fixed_pmc_events); + +if (idx >= size)return PERF_COUNT_HW_MAX ; -return intel_arch_events[fixed_pmc_events[idx]].event_type; + event = fixed_pmc_events[array_index_nospec (idx, size)]; +return intel_arch_events[event].event_type; }/* check if a PMC is enabled by comparising it with globl_ctrl bits. */
@@ -131,15 +135,19 @@ static struct kvm_pmc *intel_msr_idx_to_pmc(struct kvm_vcpu *vcpu,struct kvm_pmu *pmu =vcpu_to_pmu (vcpu);bool fixed = idx & (1u <<30 );struct kvm_pmc *counters; +unsigned int num_counters; idx &= ~(3u <<30 ); -if (!fixed && idx >= pmu->nr_arch_gp_counters) -return NULL ; -if (fixed && idx >= pmu->nr_arch_fixed_counters) +if (fixed) { + counters = pmu->fixed_counters; + num_counters = pmu->nr_arch_fixed_counters; + }else { + counters = pmu->gp_counters; + num_counters = pmu->nr_arch_gp_counters; + } +if (idx >= num_counters)return NULL ; - counters = fixed ? pmu->fixed_counters : pmu->gp_counters; - -return &counters[idx]; +return &counters[array_index_nospec (idx, num_counters)]; }static bool intel_is_valid_msr (struct kvm_vcpu *vcpu,u32 msr)
arch/x86/kvm/vmx.c +3 -1
@@ -7261,8 +7261,10 @@ static int handle_vmread(struct kvm_vcpu *vcpu)/* _system ok, as nested_vmx_check_permission verified cpl=0 */ if (kvm_write_guest_virt_system (vcpu, gva, &field_value, (is_long_mode (vcpu) ?8 :4 ), - &e)) + &e)) {kvm_inject_page_fault (vcpu, &e); +return 1 ; + } }nested_vmx_succeed (vcpu);
arch/x86/kvm/vmx/vmx.c new file +8033 -0
2,243 lines not on this page · raw message
drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_crtc.c +7 -1
Lines of this file are not shown. View the raw message.
drivers/md/persistent-data/dm-space-map-common.c +27 -0
Lines of this file are not shown. View the raw message.
drivers/md/persistent-data/dm-space-map-common.h +2 -0
Lines of this file are not shown. View the raw message.
drivers/md/persistent-data/dm-space-map-disk.c +4 -2
Lines of this file are not shown. View the raw message.
drivers/md/persistent-data/dm-space-map-metadata.c +4 -1
Lines of this file are not shown. View the raw message.
drivers/net/bonding/bond_alb.c +32 -12
44 lines not on this page · raw message
drivers/net/ethernet/broadcom/bcmsysport.c +3 -0
Lines of this file are not shown. View the raw message.
drivers/net/ethernet/dec/tulip/uli526x.c +2 -2
Lines of this file are not shown. View the raw message.
drivers/net/wireless/brcm80211/brcmfmac/usb.c +1 -0
Lines of this file are not shown. View the raw message.
drivers/net/wireless/mwifiex/sta_ioctl.c +1 -0
Lines of this file are not shown. View the raw message.
fs/btrfs/ctree.c +20 -44
64 lines not on this page · raw message
fs/nfs/dir.c +41 -18
59 lines not on this page · raw message
sound/soc/soc-pcm.c +68 -27
95 lines not on this page · raw message
The rest of this diff is not shown. View the raw message.
Part of the diff is not shown here. View the raw message.