23 Jan, 2020

2 commits


21 Jan, 2020

1 commit

  • Change the exported symbols introduced by commit e9153311491da
    ("regulator: vctrl-regulator: Avoid deadlock getting and setting the voltage")
    from EXPORT_SYMBOL() to EXPORT_SYMBOL_GPL(), like is used for all the core
    parts.

    Fixes: e9153311491da ("regulator: vctrl-regulator: Avoid deadlock getting and setting the voltage")
    Reported-by: Dmitry Osipenko
    Signed-off-by: Enric Balletbo i Serra
    Link: https://lore.kernel.org/r/20200120123921.1204339-1-enric.balletbo@collabora.com
    Signed-off-by: Mark Brown

    Enric Balletbo i Serra
     

20 Jan, 2020

4 commits

  • Linus Torvalds
     
  • Pull RISC-V fixes from Paul Walmsley:
    "Three fixes for RISC-V:

    - Don't free and reuse memory containing the code that CPUs parked at
    boot reside in.

    - Fix rv64 build problems for ubsan and some modules by adding
    logical and arithmetic shift helpers for 128-bit values. These are
    from libgcc and are similar to what's present for ARM64.

    - Fix vDSO builds to clean up their own temporary files"

    * tag 'riscv/for-v5.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:
    riscv: Less inefficient gcc tishift helpers (and export their symbols)
    riscv: delete temporary files
    riscv: make sure the cores stay looping in .Lsecondary_park

    Linus Torvalds
     
  • Pull networking fixes from David Miller:

    1) Fix non-blocking connect() in x25, from Martin Schiller.

    2) Fix spurious decryption errors in kTLS, from Jakub Kicinski.

    3) Netfilter use-after-free in mtype_destroy(), from Cong Wang.

    4) Limit size of TSO packets properly in lan78xx driver, from Eric
    Dumazet.

    5) r8152 probe needs an endpoint sanity check, from Johan Hovold.

    6) Prevent looping in tcp_bpf_unhash() during sockmap/tls free, from
    John Fastabend.

    7) hns3 needs short frames padded on transmit, from Yunsheng Lin.

    8) Fix netfilter ICMP header corruption, from Eyal Birger.

    9) Fix soft lockup when low on memory in hns3, from Yonglong Liu.

    10) Fix NTUPLE firmware command failures in bnxt_en, from Michael Chan.

    11) Fix memory leak in act_ctinfo, from Eric Dumazet.

    * git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (91 commits)
    cxgb4: reject overlapped queues in TC-MQPRIO offload
    cxgb4: fix Tx multi channel port rate limit
    net: sched: act_ctinfo: fix memory leak
    bnxt_en: Do not treat DSN (Digital Serial Number) read failure as fatal.
    bnxt_en: Fix ipv6 RFS filter matching logic.
    bnxt_en: Fix NTUPLE firmware command failures.
    net: systemport: Fixed queue mapping in internal ring map
    net: dsa: bcm_sf2: Configure IMP port for 2Gb/sec
    net: dsa: sja1105: Don't error out on disabled ports with no phy-mode
    net: phy: dp83867: Set FORCE_LINK_GOOD to default after reset
    net: hns: fix soft lockup when there is not enough memory
    net: avoid updating qdisc_xmit_lock_key in netdev_update_lockdep_key()
    net/sched: act_ife: initalize ife->metalist earlier
    netfilter: nat: fix ICMP header corruption on ICMP errors
    net: wan: lapbether.c: Use built-in RCU list checking
    netfilter: nf_tables: fix flowtable list del corruption
    netfilter: nf_tables: fix memory leak in nf_tables_parse_netdev_hooks()
    netfilter: nf_tables: remove WARN and add NLA_STRING upper limits
    netfilter: nft_tunnel: ERSPAN_VERSION must not be null
    netfilter: nft_tunnel: fix null-attribute check
    ...

    Linus Torvalds
     
  • Pull i2c fixes from Wolfram Sang:
    "Two runtime PM fixes and one leak fix"

    * 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
    i2c: iop3xx: Fix memory leak in probe error path
    i2c: tegra: Properly disable runtime PM on driver's probe error
    i2c: tegra: Fix suspending in active runtime PM state

    Linus Torvalds
     

19 Jan, 2020

22 commits

  • A queue can't belong to multiple traffic classes. So, reject
    any such configuration that results in overlapped queues for a
    traffic class.

    Fixes: b1396c2bd675 ("cxgb4: parse and configure TC-MQPRIO offload")
    Signed-off-by: Rahul Lakkireddy
    Signed-off-by: David S. Miller

    Rahul Lakkireddy
     
  • T6 can support 2 egress traffic management channels per port to
    double the total number of traffic classes that can be configured.
    In this configuration, if the class belongs to the other channel,
    then all the queues must be bound again explicitly to the new class,
    for the rate limit parameters on the other channel to take effect.

    So, always explicitly bind all queues to the port rate limit traffic
    class, regardless of the traffic management channel that it belongs
    to. Also, only bind queues to port rate limit traffic class, if all
    the queues don't already belong to an existing different traffic
    class.

    Fixes: 4ec4762d8ec6 ("cxgb4: add TC-MATCHALL classifier egress offload")
    Signed-off-by: Rahul Lakkireddy
    Signed-off-by: David S. Miller

    Rahul Lakkireddy
     
  • Implement a cleanup method to properly free ci->params

    BUG: memory leak
    unreferenced object 0xffff88811746e2c0 (size 64):
    comm "syz-executor617", pid 7106, jiffies 4294943055 (age 14.250s)
    hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
    c0 34 60 84 ff ff ff ff 00 00 00 00 00 00 00 00 .4`.............
    backtrace:
    [] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]
    [] slab_post_alloc_hook mm/slab.h:586 [inline]
    [] slab_alloc mm/slab.c:3320 [inline]
    [] kmem_cache_alloc_trace+0x145/0x2c0 mm/slab.c:3549
    [] kmalloc include/linux/slab.h:556 [inline]
    [] kzalloc include/linux/slab.h:670 [inline]
    [] tcf_ctinfo_init+0x21a/0x530 net/sched/act_ctinfo.c:236
    [] tcf_action_init_1+0x400/0x5b0 net/sched/act_api.c:944
    [] tcf_action_init+0x135/0x1c0 net/sched/act_api.c:1000
    [] tcf_action_add+0x9a/0x200 net/sched/act_api.c:1410
    [] tc_ctl_action+0x14d/0x1bb net/sched/act_api.c:1465
    [] rtnetlink_rcv_msg+0x178/0x4b0 net/core/rtnetlink.c:5424
    [] netlink_rcv_skb+0x61/0x170 net/netlink/af_netlink.c:2477
    [] rtnetlink_rcv+0x1d/0x30 net/core/rtnetlink.c:5442
    [] netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline]
    [] netlink_unicast+0x223/0x310 net/netlink/af_netlink.c:1328
    [] netlink_sendmsg+0x2c0/0x570 net/netlink/af_netlink.c:1917
    [] sock_sendmsg_nosec net/socket.c:639 [inline]
    [] sock_sendmsg+0x54/0x70 net/socket.c:659
    [] ____sys_sendmsg+0x2d0/0x300 net/socket.c:2330
    [] ___sys_sendmsg+0x8a/0xd0 net/socket.c:2384
    [] __sys_sendmsg+0x80/0xf0 net/socket.c:2417
    [] __do_sys_sendmsg net/socket.c:2426 [inline]
    [] __se_sys_sendmsg net/socket.c:2424 [inline]
    [] __x64_sys_sendmsg+0x23/0x30 net/socket.c:2424

    Fixes: 24ec483cec98 ("net: sched: Introduce act_ctinfo action")
    Signed-off-by: Eric Dumazet
    Reported-by: syzbot
    Cc: Kevin 'ldir' Darbyshire-Bryant
    Cc: Cong Wang
    Cc: Toke Høiland-Jørgensen
    Acked-by: Kevin 'ldir' Darbyshire-Bryant
    Signed-off-by: David S. Miller

    Eric Dumazet
     
  • The existing __lshrti3 was really inefficient, and the other two helpers
    are also needed to compile some modules.

    Add the missing versions, and export all of the symbols like arm64
    already does.

    This code is based on the assembly generated by libgcc builds.

    This fixes a build break triggered by ubsan:

    riscv64-unknown-linux-gnu-ld: lib/ubsan.o: in function `.L2':
    ubsan.c:(.text.unlikely+0x38): undefined reference to `__ashlti3'
    riscv64-unknown-linux-gnu-ld: ubsan.c:(.text.unlikely+0x42): undefined reference to `__ashrti3'

    Signed-off-by: Olof Johansson
    [paul.walmsley@sifive.com: use SYM_FUNC_{START,END} instead of
    ENTRY/ENDPROC; note libgcc origin]
    Signed-off-by: Paul Walmsley

    Olof Johansson
     
  • Pull MTD fixes from Miquel Raynal:
    "Raw NAND:
    - GPMI: Fix the suspend/resume

    SPI-NOR:
    - Fix quad enable on Spansion like flashes
    - Fix selection of 4-byte addressing opcodes on Spansion"

    * tag 'mtd/fixes-for-5.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux:
    mtd: rawnand: gpmi: Restore nfc timing setup after suspend/resume
    mtd: rawnand: gpmi: Fix suspend/resume problem
    mtd: spi-nor: Fix quad enable for Spansion like flashes
    mtd: spi-nor: Fix selection of 4-byte addressing opcodes on Spansion

    Linus Torvalds
     
  • Pull drm fixes from Dave Airlie:
    "Back from LCA2020, fixes wasn't too busy last week, seems to have
    quieten down appropriately, some amdgpu, i915, then a core mst fix and
    one fix for virtio-gpu and one for rockchip:

    core mst:
    - serialize down messages and clear timeslots are on unplug

    amdgpu:
    - Update golden settings for renoir
    - eDP fix

    i915:
    - uAPI fix: Remove dash and colon from PMU names to comply with
    tools/perf
    - Fix for include file that was indirectly included
    - Two fixes to make sure VMA are marked active for error capture

    virtio:
    - maintain obj reservation lock when submitting cmds

    rockchip:
    - increase link rate var size to accommodate rates"

    * tag 'drm-fixes-2020-01-19' of git://anongit.freedesktop.org/drm/drm:
    drm/amd/display: Reorder detect_edp_sink_caps before link settings read.
    drm/amdgpu: update goldensetting for renoir
    drm/dp_mst: Have DP_Tx send one msg at a time
    drm/dp_mst: clear time slots for ports invalid
    drm/i915/pmu: Do not use colons or dashes in PMU names
    drm/rockchip: fix integer type used for storing dp data rate
    drm/i915/gt: Mark ring->vma as active while pinned
    drm/i915/gt: Mark context->state vma as active while pinned
    drm/i915/gt: Skip trying to unbind in restore_ggtt_mappings
    drm/i915: Add missing include file
    drm/virtio: add missing virtio_gpu_array_lock_resv call

    Linus Torvalds
     
  • Temporary files used in the VDSO build process linger on even after make
    mrproper: vdso-dummy.o.tmp, vdso.so.dbg.tmp.

    Delete them once they're no longer needed.

    Signed-off-by: Ilie Halip
    Signed-off-by: Paul Walmsley

    Ilie Halip
     
  • Pull x86 fixes from Ingo Molnar:
    "Misc fixes:

    - a resctrl fix for uninitialized objects found by debugobjects

    - a resctrl memory leak fix

    - fix the unintended re-enabling of the of SME and SEV CPU flags if
    memory encryption was disabled at bootup via the MSR space"

    * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
    x86/CPU/AMD: Ensure clearing of SME/SEV features is maintained
    x86/resctrl: Fix potential memory leak
    x86/resctrl: Fix an imbalance in domain_remove_cpu()

    Linus Torvalds
     
  • Pull timer fixes from Ingo Molnar:
    "Three fixes: fix link failure on Alpha, fix a Sparse warning and
    annotate/robustify a lockless access in the NOHZ code"

    * 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
    tick/sched: Annotate lockless access to last_jiffies_update
    lib/vdso: Make __cvdso_clock_getres() static
    time/posix-stubs: Provide compat itimer supoprt for alpha

    Linus Torvalds
     
  • Pull cpu/SMT fix from Ingo Molnar:
    "Fix a build bug on CONFIG_HOTPLUG_SMT=y && !CONFIG_SYSFS kernels"

    * 'smp-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
    cpu/SMT: Fix x86 link error without CONFIG_SYSFS

    Linus Torvalds
     
  • Pull x86 RAS fix from Ingo Molnar:
    "Fix a thermal throttling race that can result in easy to trigger boot
    crashes on certain Ice Lake platforms"

    * 'ras-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
    x86/mce/therm_throt: Do not access uninitialized therm_work

    Linus Torvalds
     
  • Pull perf fixes from Ingo Molnar:
    "Tooling fixes, three Intel uncore driver fixes, plus an AUX events fix
    uncovered by the perf fuzzer"

    * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
    perf/x86/intel/uncore: Remove PCIe3 unit for SNR
    perf/x86/intel/uncore: Fix missing marker for snr_uncore_imc_freerunning_events
    perf/x86/intel/uncore: Add PCI ID of IMC for Xeon E3 V5 Family
    perf: Correctly handle failed perf_get_aux_event()
    perf hists: Fix variable name's inconsistency in hists__for_each() macro
    perf map: Set kmap->kmaps backpointer for main kernel map chunks
    perf report: Fix incorrectly added dimensions as switch perf data file
    tools lib traceevent: Fix memory leakage in filter_event

    Linus Torvalds
     
  • Pull locking fixes from Ingo Molnar:
    "Three fixes:

    - Fix an rwsem spin-on-owner crash, introduced in v5.4

    - Fix a lockdep bug when running out of stack_trace entries,
    introduced in v5.4

    - Docbook fix"

    * 'locking-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
    locking/rwsem: Fix kernel crash when spinning on RWSEM_OWNER_UNKNOWN
    futex: Fix kernel-doc notation warning
    locking/lockdep: Fix buffer overrun problem in stack_trace[]

    Linus Torvalds
     
  • Pull irq fix from Ingo Molnar:
    "Fix a recent regression in the Ingenic SoCs irqchip driver that floods
    the syslog"

    * 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
    irqchip/ingenic: Get rid of the legacy IRQ domain

    Linus Torvalds
     
  • Pull EFI fixes from Ingo Molnar:
    "Three EFI fixes:

    - Fix a slow-boot-scrolling regression but making sure we use WC for
    EFI earlycon framebuffer mappings on x86

    - Fix a mixed EFI mode boot crash

    - Disable paging explicitly before entering startup_32() in mixed
    mode bootup"

    * 'efi-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
    x86/efistub: Disable paging at mixed mode entry
    efi/libstub/random: Initialize pointer variables to zero for mixed mode
    efi/earlycon: Fix write-combine mapping on x86

    Linus Torvalds
     
  • Pull rseq fixes from Ingo Molnar:
    "Two rseq bugfixes:

    - CLONE_VM !CLONE_THREAD didn't work properly, the kernel would end
    up corrupting the TLS of the parent. Technically a change in the
    ABI but the previous behavior couldn't resonably have been relied
    on by applications so this looks like a valid exception to the ABI
    rule.

    - Make the RSEQ_FLAG_UNREGISTER ABI behavior consistent with the
    handling of other flags. This is not thought to impact any
    applications either"

    * 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
    rseq: Unregister rseq for clone CLONE_VM
    rseq: Reject unknown flags on rseq unregister

    Linus Torvalds
     
  • Pull thread fixes from Christian Brauner:
    "Here is an urgent fix for ptrace_may_access() permission checking.

    Commit 69f594a38967 ("ptrace: do not audit capability check when
    outputing /proc/pid/stat") introduced the ability to opt out of audit
    messages for accesses to various proc files since they are not
    violations of policy.

    While doing so it switched the check from ns_capable() to
    has_ns_capability{_noaudit}(). That means it switched from checking
    the subjective credentials (ktask->cred) of the task to using the
    objective credentials (ktask->real_cred). This is appears to be wrong.
    ptrace_has_cap() is currently only used in ptrace_may_access() And is
    used to check whether the calling task (subject) has the
    CAP_SYS_PTRACE capability in the provided user namespace to operate on
    the target task (object). According to the cred.h comments this means
    the subjective credentials of the calling task need to be used.

    With this fix we switch ptrace_has_cap() to use security_capable() and
    thus back to using the subjective credentials.

    As one example where this might be particularly problematic, Jann
    pointed out that in combination with the upcoming IORING_OP_OPENAT{2}
    feature, this bug might allow unprivileged users to bypass the
    capability checks while asynchronously opening files like /proc/*/mem,
    because the capability checks for this would be performed against
    kernel credentials.

    To illustrate on the former point about this being exploitable: When
    io_uring creates a new context it records the subjective credentials
    of the caller. Later on, when it starts to do work it creates a kernel
    thread and registers a callback. The callback runs with kernel creds
    for ktask->real_cred and ktask->cred.

    To prevent this from becoming a full-blown 0-day io_uring will call
    override_cred() and override ktask->cred with the subjective
    credentials of the creator of the io_uring instance. With
    ptrace_has_cap() currently looking at ktask->real_cred this override
    will be ineffective and the caller will be able to open arbitray proc
    files as mentioned above.

    Luckily, this is currently not exploitable but would be so once
    IORING_OP_OPENAT{2} land in v5.6. Let's fix it now.

    To minimize potential regressions I successfully ran the criu
    testsuite. criu makes heavy use of ptrace() and extensively hits
    ptrace_may_access() codepaths and has a good change of detecting any
    regressions.

    Additionally, I succesfully ran the ptrace and seccomp kernel tests"

    * tag 'for-linus-2020-01-18' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux:
    ptrace: reintroduce usage of subjective credentials in ptrace_has_cap()

    Linus Torvalds
     
  • Pull s390 fixes from Vasily Gorbik:

    - Fix printing misleading Secure-IPL enabled message when it is not.

    - Fix a race condition between host ap bus and guest ap bus doing
    device reset in crypto code.

    - Fix sanity check in CCA cipher key function (CCA AES cipher key
    support), which fails otherwise.

    * tag 's390-5.5-5' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
    s390/setup: Fix secure ipl message
    s390/zcrypt: move ap device reset from bus to driver code
    s390/zcrypt: Fix CCA cipher key gen with clear key value function

    Linus Torvalds
     
  • Pull SCSI fixes from James Bottomley:
    "Three fixes in drivers with no impact to core code.

    The mptfusion fix is enormous because the driver API had to be
    rethreaded to pass down the necessary iocp pointer, but once that's
    done a significant chunk of code is deleted.

    The other two patches are small"

    * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
    scsi: mptfusion: Fix double fetch bug in ioctl
    scsi: storvsc: Correctly set number of hardware queues for IDE disk
    scsi: fnic: fix invalid stack access

    Linus Torvalds
     
  • Pull char/misc fixes from Greg KH:
    "Here are some small fixes for 5.5-rc7

    Included here are:

    - two lkdtm fixes

    - coresight build fix

    - Documentation update for the hw process document

    All of these have been in linux-next with no reported issues"

    * tag 'char-misc-5.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
    Documentation/process: Add Amazon contact for embargoed hardware issues
    lkdtm/bugs: fix build error in lkdtm_UNSET_SMEP
    lkdtm/bugs: Make double-fault test always available
    coresight: etm4x: Fix unused function warning

    Linus Torvalds
     
  • Pull staging and IIO driver fixes from Greg KH:
    "Here are some small staging and iio driver fixes for 5.5-rc7

    All of them are for some small reported issues. Nothing major, full
    details in the shortlog.

    All have been in linux-next with no reported issues"

    * tag 'staging-5.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
    staging: comedi: ni_routes: allow partial routing information
    staging: comedi: ni_routes: fix null dereference in ni_find_route_source()
    iio: light: vcnl4000: Fix scale for vcnl4040
    iio: buffer: align the size of scan bytes to size of the largest element
    iio: chemical: pms7003: fix unmet triggered buffer dependency
    iio: imu: st_lsm6dsx: Fix selection of ST_LSM6DS3_ID
    iio: adc: ad7124: Fix DT channel configuration

    Linus Torvalds
     
  • Pull USB driver fixes from Greg KH:
    "Here are some small USB driver and core fixes for 5.5-rc7

    There's one fix for hub wakeup issues and a number of small usb-serial
    driver fixes and device id updates.

    The hub fix has been in linux-next for a while with no reported
    issues, and the usb-serial ones have all passed 0-day with no
    problems"

    * tag 'usb-5.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
    USB: serial: quatech2: handle unbound ports
    USB: serial: keyspan: handle unbound ports
    USB: serial: io_edgeport: add missing active-port sanity check
    USB: serial: io_edgeport: handle unbound ports on URB completion
    USB: serial: ch341: handle unbound port at reset_resume
    USB: serial: suppress driver bind attributes
    USB: serial: option: add support for Quectel RM500Q in QDL mode
    usb: core: hub: Improved device recognition on remote wakeup
    USB: serial: opticon: fix control-message timeouts
    USB: serial: option: Add support for Quectel RM500Q
    USB: serial: simple: Add Motorola Solutions TETRA MTP3xxx and MTP85xx

    Linus Torvalds
     

18 Jan, 2020

11 commits

  • Michael Chan says:

    ====================
    bnxt_en: Bug fixes.

    3 small bug fix patches. The 1st two are aRFS fixes and the last one
    fixes a fatal driver load failure on some kernels without PCIe
    extended config space support enabled.

    Please also queue these for -stable. Thanks.
    ====================

    Signed-off-by: David S. Miller

    David S. Miller
     
  • DSN read can fail, for example on a kdump kernel without PCIe extended
    config space support. If DSN read fails, don't set the
    BNXT_FLAG_DSN_VALID flag and continue loading. Check the flag
    to see if the stored DSN is valid before using it. Only VF reps
    creation should fail without valid DSN.

    Fixes: 03213a996531 ("bnxt: move bp->switch_id initialization to PF probe")
    Reported-by: Marc Smith
    Signed-off-by: Michael Chan
    Signed-off-by: David S. Miller

    Michael Chan
     
  • Fix bnxt_fltr_match() to match ipv6 source and destination addresses.
    The function currently only checks ipv4 addresses and will not work
    corrently on ipv6 filters.

    Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.")
    Signed-off-by: Michael Chan
    Signed-off-by: David S. Miller

    Michael Chan
     
  • The NTUPLE related firmware commands are sent to the wrong firmware
    channel, causing all these commands to fail on new firmware that
    supports the new firmware channel. Fix it by excluding the 3
    NTUPLE firmware commands from the list for the new firmware channel.

    Fixes: 760b6d33410c ("bnxt_en: Add support for 2nd firmware message channel.")
    Signed-off-by: Michael Chan
    Signed-off-by: David S. Miller

    Michael Chan
     
  • Commit 69f594a38967 ("ptrace: do not audit capability check when outputing /proc/pid/stat")
    introduced the ability to opt out of audit messages for accesses to various
    proc files since they are not violations of policy. While doing so it
    somehow switched the check from ns_capable() to
    has_ns_capability{_noaudit}(). That means it switched from checking the
    subjective credentials of the task to using the objective credentials. This
    is wrong since. ptrace_has_cap() is currently only used in
    ptrace_may_access() And is used to check whether the calling task (subject)
    has the CAP_SYS_PTRACE capability in the provided user namespace to operate
    on the target task (object). According to the cred.h comments this would
    mean the subjective credentials of the calling task need to be used.
    This switches ptrace_has_cap() to use security_capable(). Because we only
    call ptrace_has_cap() in ptrace_may_access() and in there we already have a
    stable reference to the calling task's creds under rcu_read_lock() there's
    no need to go through another series of dereferences and rcu locking done
    in ns_capable{_noaudit}().

    As one example where this might be particularly problematic, Jann pointed
    out that in combination with the upcoming IORING_OP_OPENAT feature, this
    bug might allow unprivileged users to bypass the capability checks while
    asynchronously opening files like /proc/*/mem, because the capability
    checks for this would be performed against kernel credentials.

    To illustrate on the former point about this being exploitable: When
    io_uring creates a new context it records the subjective credentials of the
    caller. Later on, when it starts to do work it creates a kernel thread and
    registers a callback. The callback runs with kernel creds for
    ktask->real_cred and ktask->cred. To prevent this from becoming a
    full-blown 0-day io_uring will call override_cred() and override
    ktask->cred with the subjective credentials of the creator of the io_uring
    instance. With ptrace_has_cap() currently looking at ktask->real_cred this
    override will be ineffective and the caller will be able to open arbitray
    proc files as mentioned above.
    Luckily, this is currently not exploitable but will turn into a 0-day once
    IORING_OP_OPENAT{2} land in v5.6. Fix it now!

    Cc: Oleg Nesterov
    Cc: Eric Paris
    Cc: stable@vger.kernel.org
    Reviewed-by: Kees Cook
    Reviewed-by: Serge Hallyn
    Reviewed-by: Jann Horn
    Fixes: 69f594a38967 ("ptrace: do not audit capability check when outputing /proc/pid/stat")
    Signed-off-by: Christian Brauner

    Christian Brauner
     
  • virtio: maintain obj reservation lock when submitting cmds (Gerd)
    rockchip: increase link rate var size to accommodate rates (Tobias)
    mst: serialize down messages and clear timeslots are on unplug (Wayne)

    Cc: Gerd Hoffmann
    Cc: Tobias Schramm
    Cc: Wayne Lin
    Signed-off-by: Dave Airlie

    From: Sean Paul
    Link: https://patchwork.freedesktop.org/patch/msgid/20200116162856.GA11524@art_vandelay

    Dave Airlie
     
  • - uAPI fix: Remove dash and colon from PMU names to comply with tools/perf
    - Fix for include file that was indirectly included
    - Two fixes to make sure VMA are marked active for error capture

    Signed-off-by: Dave Airlie
    From: Joonas Lahtinen
    Link: https://patchwork.freedesktop.org/patch/msgid/20200116161419.GA13594@jlahtine-desk.ger.corp.intel.com

    Dave Airlie
     
  • As we reset the GPMI block at resume, the timing parameters setup by a
    previous exec_op is lost. Rewriting GPMI timing registers on first exec_op
    after resume fixes the problem.

    Fixes: ef347c0cfd61 ("mtd: rawnand: gpmi: Implement exec_op")
    Cc: stable@vger.kernel.org
    Signed-off-by: Esben Haabendal
    Acked-by: Han Xu
    Signed-off-by: Miquel Raynal

    Esben Haabendal
     
  • On system resume, the gpmi clock must be enabled before accessing gpmi
    block. Without this, resume causes something like

    [ 661.348790] gpmi_reset_block(5cbb0f7e): module reset timeout
    [ 661.348889] gpmi-nand 1806000.gpmi-nand: Error setting GPMI : -110
    [ 661.348928] PM: dpm_run_callback(): platform_pm_resume+0x0/0x44 returns -110
    [ 661.348961] PM: Device 1806000.gpmi-nand failed to resume: error -110

    Fixes: ef347c0cfd61 ("mtd: rawnand: gpmi: Implement exec_op")
    Cc: stable@vger.kernel.org
    Signed-off-by: Esben Haabendal
    Acked-by: Han Xu
    Signed-off-by: Miquel Raynal

    Esben Haabendal
     
  • The commit 7b678c69c0ca ("mtd: spi-nor: Merge spansion Quad Enable
    methods") forgot to actually set the QE bit in some cases. Thus this
    breaks quad mode accesses to flashes which support readback of the
    status register-2. Fix it.

    Fixes: 7b678c69c0ca ("mtd: spi-nor: Merge spansion Quad Enable methods")
    Signed-off-by: Michael Walle
    Reviewed-by: Tudor Ambarus
    Signed-off-by: Miquel Raynal

    Michael Walle
     
  • mtd->size is still unassigned when running spansion_post_sfdp_fixups()
    hook, therefore use nor->params.size to determine the size of flash device.

    This makes sure that 4-byte addressing opcodes are used on Spansion
    flashes that are larger than 16MiB and don't have SFDP 4BAIT table
    populated.

    Fixes: 92094ebc385e ("mtd: spi-nor: Add spansion_post_sfdp_fixups()")
    Signed-off-by: Vignesh Raghavendra
    Reviewed-by: Tudor Ambarus
    Signed-off-by: Miquel Raynal

    Vignesh Raghavendra