summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2018-11-29gk20a: do not BUG if the ioctl size does not matchRolf Eike Beer
Signed-off-by: Rolf Eike Beer <eb@emlix.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-11-29xhci-tegra: fix compiler warningsRolf Eike Beer
Signed-off-by: Rolf Eike Beer <eb@emlix.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-11-29Tegra: fix potential one byte overflows when calling strncpy()Rolf Eike Beer
Causes build failures with gcc 8. Signed-off-by: Rolf Eike Beer <eb@emlix.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-11-29api: fix compatibility of linux/in.h with netinet/in.hStephen Hemminger
u This fixes breakage to iproute2 build with recent kernel headers caused by: commit a263653ed798216c0069922d7b5237ca49436007 Author: Pablo Neira Ayuso <pablo@netfilter.org> Date: Wed Jun 17 10:28:27 2015 -0500 netfilter: don't pull include/linux/netfilter.h from netns headers The issue is that definitions in linux/in.h overlap with those in netinet/in.h. This patch solves this by introducing the same mechanism as was used to solve the same problem with linux/in6.h Signed-off-by: Stephen Hemminger <stephen@networkplumber.org> Signed-off-by: David S. Miller <davem@davemloft.net> (cherry picked from commit 279c6c7fa64f5763e6b9f05e7ab3840092e702e7)
2018-11-29in6: fix conflict with glibcstephen hemminger
Resolve conflicts between glibc definition of IPV6 socket options and those defined in Linux headers. Looks like earlier efforts to solve this did not cover all the definitions. It resolves warnings during iproute2 build. Please consider for stable as well. Signed-off-by: Stephen Hemminger <stephen@networkplumber.org> Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org> Signed-off-by: David S. Miller <davem@davemloft.net> (cherry picked from commit 6d08acd2d32e3e877579315dc3202d7a5f336d98)
2018-11-29net: sync some IP headers with glibcCarlos O'Donell
Solution: ========= - Synchronize linux's `include/uapi/linux/in6.h' with glibc's `inet/netinet/in.h'. - Synchronize glibc's `inet/netinet/in.h with linux's `include/uapi/linux/in6.h'. - Allow including the headers in either other. - First header included defines the structures and macros. Details: ======== The kernel promises not to break the UAPI ABI so I don't see why we can't just have the two userspace headers coordinate? If you include the kernel headers first you get those, and if you include the glibc headers first you get those, and the following patch arranges a coordination and synchronization between the two. Let's handle `include/uapi/linux/in6.h' from linux, and `inet/netinet/in.h' from glibc and ensure they compile in any order and preserve the required ABI. These two patches pass the following compile tests: cat >> test1.c <<EOF int main (void) { return 0; } EOF gcc -c test1.c cat >> test2.c <<EOF int main (void) { return 0; } EOF gcc -c test2.c One wrinkle is that the kernel has a different name for one of the members in ipv6_mreq. In the kernel patch we create a macro to cover the uses of the old name, and while that's not entirely clean it's one of the best solutions (aside from an anonymous union which has other issues). I've reviewed the code and it looks to me like the ABI is assured and everything matches on both sides. Notes: - You want netinet/in.h to include bits/in.h as early as possible, but it needs in_addr so define in_addr early. - You want bits/in.h included as early as possible so you can use the linux specific code to define __USE_KERNEL_DEFS based on the _UAPI_* macro definition and use those to cull in.h. - glibc was missing IPPROTO_MH, added here. Compile tested and inspected. Reported-by: Thomas Backlund <tmb@mageia.org> Cc: Thomas Backlund <tmb@mageia.org> Cc: libc-alpha@sourceware.org Cc: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Cc: David S. Miller <davem@davemloft.net> Tested-by: Cong Wang <amwang@redhat.com> Signed-off-by: Carlos O'Donell <carlos@redhat.com> Signed-off-by: Cong Wang <amwang@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net> (cherry picked from commit cfd280c91253cc28e4919e349fa7a813b63e71e8)
2018-11-29apalis-tk1: lvds: fix dts and allow setting lane4 drive strengthDominik Sliwa
Previously, lvds-drive-strength was located in a wrong node and there was no control of the 5th lane. Signed-off-by: Dominik Sliwa <dominik.sliwa@toradex.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-11-29apalis-tk1: proper usb lane and resource assigmentDominik Sliwa
Signed-off-by: Dominik Sliwa <dominik.sliwa@toradex.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-11-29Input: atmel_mxt_ts - fix reset-gpio for level based irqsSebastian Reichel
The current reset-gpio support triggers an interrupt storm on platforms using the maxtouch with level based interrupt. The Motorola Droid 4, which I used for some of the tests is not affected, since it uses a edge based interrupt. This change avoids the interrupt storm by enabling the device while its interrupt is disabled. Afterwards we wait 100ms. This is important for two reasons: The device is unresponsive for some time (~22ms for mxt224E) and the CHG (interrupt) line is not working properly for 100ms. We don't need to wait for any following interrupts, since the following mxt_initialize() checks for bootloader mode anyways. This fixes a boot issue on GE PPD (watchdog kills device due to interrupt storm) and does not cause regression on Motorola Droid 4. Fixes: f657b00df22e ("Input: atmel_mxt_ts - add support for reset line") Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.co.uk> Reviewed-by: Pavel Machek <pavel@ucw.cz> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> (cherry picked from commit ca1cd36cef00260db6b35b32d863e0c580c0488d) Signed-off-by: Dominik Sliwa <dominik.sliwa@toradex.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-11-29apalis-tk1: atmel-mxt-ts reset gpio name changeDominik Sliwa
Align with mainline Atmel MXT driver. Signed-off-by: Dominik Sliwa <dominik.sliwa@toradex.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-11-29Input: atmel_mxt_ts - add support for reset lineSebastian Reichel
Provide support for controlling reset pin. If this is not driven correctly the device will be held in reset and will not respond. Acked-by: Rob Herring <robh@kernel.org> Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.co.uk> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> (cherry picked from commit f657b00df22e231da217ca0162a75db452475e8f) Signed-off-by: Dominik Sliwa <dominik.sliwa@toradex.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-10-09Input: atmel_mxt_ts - use more managed resourcesSebastian Reichel
Switch mxt_data and interrupt to resource managed allocation methods, which cleans up the driver slightly and prepares for adding reset GPIO support. Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.co.uk> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> (cherry picked from commit 8cc8446b9b62ef954b630ed30e53bd1553e916a6)
2018-10-09Input: atmel_mxt_ts - add T100 as a readable objectMaxime Roussin-Bélanger
When using the 'object' sysfs attribute, T100 is not displayed in the output. Signed-off-by: Maxime Roussin-Bélanger <maxime.roussinbelanger@gmail.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> (cherry picked from commit 089b50d95948f691589cca4d81f1f8761747dbaa)
2018-10-09Input: touchscreen - use local variables consistentlyDominik Sliwa
If a function declares a variable to access a structure element, use it consistently. Signed-off-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> (cherry picked from commit d7ddf15414dd598b9b875664e6b7aebe6c988f5d)
2018-10-09Revert "input: atmel_mxt_ts: support reset gpio line"Dominik Sliwa
This reverts commit 22a2065b9a3fa6ad458e3100b66c4acaa05f2466.
2018-09-27net: igb: implement SIOCSMIIREG and allow SIOCGMIIREG to set pagesApalis-TK1_LXDE-Image_2.8b4.129-20181005Dominik Sliwa
Before SIOCGMIIREG was only able to access page 0 registers. Signed-off-by: Dominik Sliwa <dominik.sliwa@toradex.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-09-27bus_client.c: fix build with gcc8Max Krummenacher
/build/krm/oe-core_master/build/tmp-glibc/work-shared/apalis-tk1/kernel-source/drivers/video/tegra/host/bus_client.c: In function 'nvhost_channelctl': /build/krm/oe-core_master/build/tmp-glibc/work-shared/apalis-tk1/kernel-source/drivers/video/tegra/host/bus_client.c:894:11: error: 'snprintf' output may be truncated before the last format character [-Werror=format-truncation=] "%s_%s", dev_name(&pdata->pdev->dev), name); ^ /build/krm/oe-core_master/build/tmp-glibc/work-shared/apalis-tk1/kernel-source/drivers/video/tegra/host/bus_client.c:893:3: note: 'snprintf' output 2 or more bytes (assuming 33) into a destination of size 32 snprintf(set_name, sizeof(set_name), ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ "%s_%s", dev_name(&pdata->pdev->dev), name); ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Signed-off-by: Max Krummenacher <max.krummenacher@toradex.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-09-27ARM: fix put_user() for gcc-8Arnd Bergmann
Building kernels before linux-4.7 with gcc-8 results in many build failures when gcc triggers a check that was meant to catch broken compilers: /tmp/ccCGMQmS.s:648: Error: .err encountered According to the discussion in the gcc bugzilla, a local "register asm()" variable is still supposed to be the correct way to force an inline assembly to use a particular register, but marking it 'const' lets the compiler do optimizations that break that, i.e the compiler is free to treat the variable as either 'const' or 'register' in that case. Upstream commit 9f73bd8bb445 ("ARM: uaccess: remove put_user() code duplication") fixed this problem in linux-4.8 as part of a larger change, but seems a little too big to be backported to 4.4. Let's take the simplest fix and change only the one broken line in the same way as newer kernels. Suggested-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=85745 Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=86673 Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 0ca85fc310e8c24cba10ed241a0188795e177683) /tmp/ccmcXtfu.s: Assembler messages: /tmp/ccmcXtfu.s:1441: Error: .err encountered Signed-off-by: Max Krummenacher <max.krummenacher@toradex.com> Conflicts: arch/arm/include/asm/uaccess.h
2018-09-27give up on gcc ilog2() constant optimizationsLinus Torvalds
gcc-7 has an "optimization" pass that completely screws up, and generates the code expansion for the (impossible) case of calling ilog2() with a zero constant, even when the code gcc compiles does not actually have a zero constant. And we try to generate a compile-time error for anybody doing ilog2() on a constant where that doesn't make sense (be it zero or negative). So now gcc7 will fail the build due to our sanity checking, because it created that constant-zero case that didn't actually exist in the source code. There's a whole long discussion on the kernel mailing about how to work around this gcc bug. The gcc people themselevs have discussed their "feature" in https://gcc.gnu.org/bugzilla/show_bug.cgi?id=72785 but it's all water under the bridge, because while it looked at one point like it would be solved by the time gcc7 was released, that was not to be. So now we have to deal with this compiler braindamage. And the only simple approach seems to be to just delete the code that tries to warn about bad uses of ilog2(). So now "ilog2()" will just return 0 not just for the value 1, but for any non-positive value too. It's not like I can recall anybody having ever actually tried to use this function on any invalid value, but maybe the sanity check just meant that such code never made it out in public. Reported-by: Laura Abbott <labbott@redhat.com> Cc: John Stultz <john.stultz@linaro.org>, Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> (cherry picked from commit 474c90156c8dcc2fa815e6716cc9394d7930cb9c) Conflicts: tools/include/linux/log2.h File does not exist in the 3.1 kernel, change dropped. This helps with the move to GCC 8. | include/linux/log2.h:22:1: error: ignoring attribute 'noreturn' because it conflicts with attribute 'const' [-Werror=attributes] | int ____ilog2_NaN(void); Signed-off-by: Max Krummenacher <max.krummenacher@toradex.com>
2018-09-27apalis-tk1: mfd: k20: update supported fw version to 1.2Dominik Sliwa
Signed-off-by: Dominik Sliwa <dominik.sliwa@toradex.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-09-27apalis-tk1: can: k20: change tx complete signalingDominik Sliwa
In fw version 1.2 K20 CANINTF_TX now indicates TX in progress, not TX completed. Signed-off-by: Dominik Sliwa <dominik.sliwa@toradex.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-09-27apalis-tk1: mfd: k20: add fw_ignore and fw_reload parametersDominik Sliwa
Parameter fw_ignore disables fw version check. Parameter fw_reload forces k20 firmware reflash via EzPort. Signed-off-by: Dominik Sliwa <dominik.sliwa@toradex.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-09-27i2c: sw-edid: add a driver which simulates edidMax Krummenacher
This adds a driver which simulates a i2c bus with an attached EDID memory. The memory content is read from the device tree. This allows to simulate EDID data which may differ from an attached display. Signed-off-by: Max Krummenacher <max.krummenacher@toradex.com> Signed-off-by: Dominik Sliwa <dominik.sliwa@toradex.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-09-27apalis-tk1: lvds: allow setting LVDS drive strength in dtDominik Sliwa
Hardcoded value was used before. This allows setting drive strength values in the devicetree. Signed-off-by: Dominik Sliwa <dominik.sliwa@toradex.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-09-27apalis-tk1: build SELinux supportDominik Sliwa
Build SELinux support in kernel, but keep it disabled. Signed-off-by: Dominik Sliwa <dominik.sliwa@toradex.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-09-27apalis-tk1: improve pcie reset for reliable gigabit ethernet operationMarcel Ziswiler
While the PCIe reset implementation seems to work it currently resets multiple times due to not differentiating which PCIe port needs resetting. Improve this by doing specific reset per port only. Signed-off-by: Marcel Ziswiler <marcel.ziswiler@toradex.com> Acked-by: Max Krummenacher <max.krummenacher@toradex.com>
2018-06-22media: tegra_camera: stop capturing on errorApalis-TK1_LXDE-Image_2.8b3.111-20180626Gerard Salvatella
Kernel hangs if camera capture errors are not handled to allow for a way out of the the capture thread. Signed-off-by: Gerard Salvatella <gerard.salvatella@toradex.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-06-21apalis-tk1: mfd: k20: cleanup and fw version 1.1 supportDominik Sliwa
Signed-off-by: Dominik Sliwa <dominik.sliwa@toradex.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-06-21apalis-tk1: support 2nd ov5640 with sccb_id of 0x3d on csi_3Marcel Ziswiler
This commit adds support for the 2nd CSI Camera Module 5MP OV5640 with SCCB_ID of 0x3d connected to Apalis TK1 Mezzanine V2.0A on X7 aka CSI_3_CSI-2/4x. Signed-off-by: Marcel Ziswiler <marcel.ziswiler@toradex.com> Acked-by: Dominik Sliwa <dominik.sliwa@toradex.com>
2018-06-21apalis-tk1: fix issues when using eDP display-outDominik Sliwa
Signed-off-by: Dominik Sliwa <dominik.sliwa@toradex.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-06-21apalis-tk1: Enable USB 3.0 host on USBO1Dominik Sliwa
Port retains dual function capability. Peripheral mode supports only USB 2.0. Signed-off-by: Dominik Sliwa <dominik.sliwa@toradex.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-06-21apalis-tk1: align i2c3 configurationsDominik Sliwa
Now device trees for revision <1.2 and 1.2 use the same rcv-sel on i2c3 (in NVIDIA's documentation known as i2c4). Signed-off-by: Dominik Sliwa <dominik.sliwa@toradex.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-06-21apalis-tk1: disable crypto devMarcel Ziswiler
Disable Tegra SE crypto dev as done in NVIDIA L4T R21.7. Similar to commit a7e55a39cdd1 ("CRYPTO: disable crypto dev fot t124"). Signed-off-by: Marcel Ziswiler <marcel.ziswiler@toradex.com> Acked-by: Dominik Sliwa <dominik.sliwa@toradex.com>
2018-06-21arm: fix build issue caused by spectre/meltdown patchMarcel Ziswiler
Currently building fails as follows due to an erroneous + sign in front of an #endif in arch/arm/mm/fsr-3level.c: In file included from /home/user/linux-3.10/arch/arm/mm/fault.c:554:0: /home/user/linux-3.10/arch/arm/mm/fsr-3level.c:68:0: error: unterminated #else make[2]: *** [/home/user/linux-3.10/scripts/Makefile.build:308: arch/arm/mm/fault.o] Error 1 This fixes commit de3110548b04 ("arm: Invalidate BTB on prefetch abort outside of user mapping on Cortex A8, A9, A12 and A17"). Signed-off-by: Marcel Ziswiler <marcel.ziswiler@toradex.com> Acked-by: Max Krummenacher <max.krummenacher@toradex.com>
2018-06-21Merge tag 'tegra-l4t-r21.7' into toradex_tk1_l4t_r21.7-nextMarcel Ziswiler
Merge NVIDIA's latest Linux for Tegra aka L4T R21.7 Linux kernel changes from git://nv-tegra.nvidia.com/linux-3.10.git commit: e78bb38b883c42edf81766a1d557aed74458e08f Conflicts involved missing 24-bit LVDS support and a single whitespace aka tab difference in drivers/video/tegra/dc/sor.c. Signed-off-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-04-28arm: Add BTB invalidation on switch_mm for Cortex-A9, A12 and A17Marc Zyngier
** Not yet queued for inclusion in mainline ** In order to avoid aliasing attacks against the branch predictor, some implementations require to invalidate the BTB when switching from one user context to another. For this, we reuse the existing implementation for Cortex-A8, and apply it to A9, A12 and A17. Signed-off-by: Marc Zyngier <marc.zyngier@arm.com> Signed-off-by: Will Deacon <will.deacon@arm.com> Change-Id: Ibbd99465a5dcf5eda6a29dd23a55f9b21b280e65 Reviewed-on: https://git-master.nvidia.com/r/1704129 GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu <bbasu@nvidia.com> Tested-by: Bibek Basu <bbasu@nvidia.com>
2018-04-28host1x: prevent speculative load related leakJeetesh Burman
Data can be speculatively loaded from memory and stay in cache even when bound check fails. This can lead to unintended information disclosure via side-channel analysis. To mitigate this problem, insert speculation barrier. bug 2039126 CVE-2017-5753 Change-Id: Ifc618c00cee497e6d84cac01a9b73fcecbe8f260 Signed-off-by: David Gilhooley <dgilhooley@nvidia.com> Signed-off-by: James Huang <jamehuang@nvidia.com> Reviewed-on: https://git-master.nvidia.com/r/1650036 (cherry picked from commit 164f8684deb5b15a53c60a60c7d9b8e3bf5af5be) Signed-off-by: Jeetesh Burman <jburman@nvidia.com> Reviewed-on: https://git-master.nvidia.com/r/1682714 Signed-off-by: Jeetesh Burman <jburman@nvidia.com> Reviewed-on: https://git-master.nvidia.com/r/1698611 GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu <bbasu@nvidia.com> Tested-by: Bibek Basu <bbasu@nvidia.com>
2018-04-28gpu: nvgpu: add speculative load barrier (ctrl IOCTLs)Jeetesh Burman
Data can be speculatively loaded from memory and stay in cache even when bound check fails. This can lead to unintended information disclosure via side-channel analysis. To mitigate this problem insert a speculation barrier. bug 2039126 CVE-2017-5753 Change-Id: Ib6c4b2f99b85af3119cce3882fe35ab47509c76f Signed-off-by: Alex Waterman <alexw@nvidia.com> Reviewed-on: https://git-master.nvidia.com/r/1640500 Signed-off-by: James Huang <jamehuang@nvidia.com> Reviewed-on: https://git-master.nvidia.com/r/1650050 (cherry picked from commit f293fa670fd2f4fbe170f1e372e9aa237283c67a) Signed-off-by: Jeetesh Burman <jburman@nvidia.com> Reviewed-on: https://git-master.nvidia.com/r/1682715 Signed-off-by: Jeetesh Burman <jburman@nvidia.com> Reviewed-on: https://git-master.nvidia.com/r/1698610 GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu <bbasu@nvidia.com> Tested-by: Bibek Basu <bbasu@nvidia.com>
2018-04-28arm: Invalidate icache on prefetch abort outside of user mapping on Cortex-A15Marc Zyngier
** Not yet queued for inclusion in mainline ** In order to prevent aliasing attacks on the branch predictor, invalidate the icache on Cortex-A15, which has the side effect of invalidating the BTB. This requires ACTLR[0] to be set to 1 (secure operation). Change-Id: I4bb8e3ec05853d739bebd8fb3c61657e252808c0 Signed-off-by: Marc Zyngier <marc.zyngier@arm.com> Signed-off-by: Will Deacon <will.deacon@arm.com> Signed-off-by: Jeetesh Burman <jburman@nvidia.com> Reviewed-on: https://git-master.nvidia.com/r/1698400 GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu <bbasu@nvidia.com> Tested-by: Bibek Basu <bbasu@nvidia.com>
2018-04-28arm: Invalidate BTB on prefetch abort outside of user mapping on Cortex A8, ↵Marc Zyngier
A9, A12 and A17 ** Not yet queued for inclusion in mainline ** In order to prevent aliasing attacks on the branch predictor, invalidate the BTB on CPUs that are known to be affected when taking a prefetch abort on a address that is outside of a user task limit. __ACCESS_CP15 and __ACCESS_CP15_64 added from below link: https://patchwork.kernel.org/patch/9234399/ Change-Id: Ib8c9807f5e787437e66b83ea0305d75cce4bbbdf Signed-off-by: Marc Zyngier <marc.zyngier@arm.com> Signed-off-by: Will Deacon <will.deacon@arm.com> Signed-off-by: Jeetesh Burman <jburman@nvidia.com> Reviewed-on: https://git-master.nvidia.com/r/1698399 GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu <bbasu@nvidia.com> Tested-by: Bibek Basu <bbasu@nvidia.com>
2018-04-28arm: Add icache invalidation on switch_mm for Cortex-A15Marc Zyngier
** Not yet queued for inclusion in mainline ** In order to avoid aliasing attacks against the branch predictor, Cortex-A15 require to invalidate the BTB when switching from one user context to another. The only way to do so on this CPU is to perform an ICIALLU, having set ACTLR[0] to 1 from secure mode. Change-Id: Ib0083803d75a4399b8225193349a4b490d1776a1 Signed-off-by: Marc Zyngier <marc.zyngier@arm.com> Signed-off-by: Will Deacon <will.deacon@arm.com> Signed-off-by: Jeetesh Burman <jburman@nvidia.com> Reviewed-on: https://git-master.nvidia.com/r/1698398 GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu <bbasu@nvidia.com> Tested-by: Bibek Basu <bbasu@nvidia.com>
2018-04-28Documentation: Document array_index_nospecMark Rutland
Commit f84a56f73ddd upstream. Document the rationale and usage of the new array_index_nospec() helper. Change-Id: I4b804638bbe9811b82d34cd58314cbb1738d7d25 Signed-off-by: Mark Rutland <mark.rutland@arm.com> Signed-off-by: Will Deacon <will.deacon@arm.com> Signed-off-by: Dan Williams <dan.j.williams@intel.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Reviewed-by: Kees Cook <keescook@chromium.org> Cc: linux-arch@vger.kernel.org Cc: Jonathan Corbet <corbet@lwn.net> Cc: Peter Zijlstra <peterz@infradead.org> Cc: gregkh@linuxfoundation.org Cc: kernel-hardening@lists.openwall.com Cc: torvalds@linux-foundation.org Cc: alan@linux.intel.com Link: https://lkml.kernel.org/r/151727413645.33451.15878817161436755393.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Jeetesh Burman <jburman@nvidia.com> Reviewed-on: https://git-master.nvidia.com/r/1698397 GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu <bbasu@nvidia.com> Tested-by: Bibek Basu <bbasu@nvidia.com>
2018-04-28array_index_nospec: Sanitize speculative array de-referencesDan Williams
Commit f3804203306e upstream. array_index_nospec() is proposed as a generic mechanism to mitigate against Spectre-variant-1 attacks, i.e. an attack that bypasses boundary checks via speculative execution. The array_index_nospec() implementation is expected to be safe for current generation CPUs across multiple architectures (ARM, x86). Based on an original implementation by Linus Torvalds, tweaked to remove speculative flows by Alexei Starovoitov, and tweaked again by Linus to introduce an x86 assembly implementation for the mask generation. Change-Id: I859161a289215b20bd25ef4006115c0268b30b83 Co-developed-by: Linus Torvalds <torvalds@linux-foundation.org> Co-developed-by: Alexei Starovoitov <ast@kernel.org> Suggested-by: Cyril Novikov <cnovikov@lynx.com> Signed-off-by: Dan Williams <dan.j.williams@intel.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Will Deacon <will.deacon@arm.com> Cc: linux-arch@vger.kernel.org Cc: kernel-hardening@lists.openwall.com Cc: Peter Zijlstra <peterz@infradead.org> Cc: Catalin Marinas <catalin.marinas@arm.com> Cc: Will Deacon <will.deacon@arm.com> Cc: Russell King <linux@armlinux.org.uk> Cc: gregkh@linuxfoundation.org Cc: torvalds@linux-foundation.org Cc: alan@linux.intel.com Link: https://lkml.kernel.org/r/151727414229.33451.18411580953862676575.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Jeetesh Burman <jburman@nvidia.com> Reviewed-on: https://git-master.nvidia.com/r/1698396 GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu <bbasu@nvidia.com> Tested-by: Bibek Basu <bbasu@nvidia.com>
2018-04-19HID: core: prevent out-of-bound readingsAmulya Y
Plugging a Logitech DJ receiver with KASAN activated raises a bunch of out-of-bound readings. The fields are allocated up to MAX_USAGE, meaning that potentially, we do not have enough fields to fit the incoming values. Add checks and silence KASAN. Bug 1823317 Bug 1935735 Change-Id: Ib3ba92572acbdd4c9ec265e54a45f92606107700 Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Gagan Grover <ggrover@nvidia.com> Signed-off-by: Amulya Yarlagadda <ayarlagadda@nvidia.com> Reviewed-on: http://git-master/r/1259928 (cherry picked from commit fbc389a39540e177bfa4d49b9214dfe408ef2d4a) Reviewed-on: https://git-master.nvidia.com/r/1690285 GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu <bbasu@nvidia.com> Reviewed-by: Winnie Hsu <whsu@nvidia.com>
2018-04-19perf: Fix race in swevent hashAmulya Y
There's a race on CPU unplug where we free the swevent hash array while it can still have events on. This will result in a use-after-free which is BAD. Simply do not free the hash array on unplug. This leaves the thing around and no use-after-free takes place. When the last swevent dies, we do a for_each_possible_cpu() iteration anyway to clean these up, at which time we'll free it, so no leakage will occur. Bug 1823317 But 1935735 Change-Id: I309528873f8576f96663afbe51ce2739934df16c Reported-by: Sasha Levin <sasha.levin@oracle.com> Tested-by: Sasha Levin <sasha.levin@oracle.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Cc: Arnaldo Carvalho de Melo <acme@redhat.com> Cc: Frederic Weisbecker <fweisbec@gmail.com> Cc: Jiri Olsa <jolsa@redhat.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Stephane Eranian <eranian@google.com> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Vince Weaver <vincent.weaver@maine.edu> Signed-off-by: Ingo Molnar <mingo@kernel.org> Signed-off-by: Gagan Grover <ggrover@nvidia.com> Signed-off-by: Amulya Yarlagadda <ayarlagadda@nvidia.com> Reviewed-on: http://git-master/r/1259934 (cherry picked from commit 5ea640855404df656d94bfa3990d8eba2b5f90f9) Reviewed-on: https://git-master.nvidia.com/r/1690284 GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu <bbasu@nvidia.com> Reviewed-by: Winnie Hsu <whsu@nvidia.com>
2018-04-19ext4:fix use after free in __ext4_journal_stopAmulya Y
There is a use-after-free possibility in __ext4_journal_stop() in the case that we free the handle in the first jbd2_journal_stop() because we're referencing handle->h_err afterwards. This was introduced in 9705acd63b125dee8b15c705216d7186daea4625 and it is wrong. Fix it by storing the handle->h_err value beforehand and avoid referencing potentially freed handle. Bug 1823317 Change-Id: Ib6fe50ed8013943d5fc3459eb499ecda5533c6ef Fixes: 9705acd63b125dee8b15c705216d7186daea4625 Signed-off-by: Lukas Czerner <lczerner@redhat.com> Reviewed-by: Andreas Dilger <adilger@dilger.ca> Cc: stable@vger.kernel.org Signed-off-by: Gagan Grover <ggrover@nvidia.com> Signed-off-by: Amulya Yarlagadda <ayarlagadda@nvidia.com> Reviewed-on: http://git-master/r/1259975 (cherry picked from commit 3c15c37dc613cb75339f8e0d546ab30643e65b84) Reviewed-on: https://git-master.nvidia.com/r/1690287 GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu <bbasu@nvidia.com> Reviewed-by: Winnie Hsu <whsu@nvidia.com>
2018-04-19proc:prevent /proc/PID/environ access until readyAmulya Y
If /proc/<PID>/environ gets read before the envp[] array is fully set up in create_{aout,elf,elf_fdpic,flat}_tables(), we might end up trying to read more bytes than are actually written, as env_start will already be set but env_end will still be zero, making the range calculation underflow, allowing to read beyond the end of what has been written. Fix this as it is done for /proc/<PID>/cmdline by testing env_end for zero. It is, apparently, intentionally set last in create_*_tables(). This bug was found by the PaX size_overflow plugin that detected the arithmetic underflow of 'this_len = env_end - (env_start + src)' when env_end is still zero. The expected consequence is that userland trying to access /proc/<PID>/environ of a not yet fully set up process may get inconsistent data as we're in the middle of copying in the environment variables. Bug 1823317 Bug 1935735 Change-Id: I38356eb68ffd1294f1f1250fb328bd01a3b37158 Fixes: https://forums.grsecurity.net/viewtopic.php?f=3&t=4363 Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=116461 Signed-off-by: Mathias Krause <minipli@googlemail.com> Cc: Emese Revfy <re.emese@gmail.com> Cc: Pax Team <pageexec@freemail.hu> Cc: Al Viro <viro@zeniv.linux.org.uk> Cc: Mateusz Guzik <mguzik@redhat.com> Cc: Alexey Dobriyan <adobriyan@gmail.com> Cc: Cyrill Gorcunov <gorcunov@openvz.org> Cc: Jarod Wilson <jarod@redhat.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Gagan Grover <ggrover@nvidia.com> Signed-off-by: Amulya Yarlagadda <ayarlagadda@nvidia.com> Reviewed-on: http://git-master/r/1259930 (cherry picked from commit 78d40f25b8e090782ca6b0c6051020557d373c92) Reviewed-on: https://git-master.nvidia.com/r/1690302 Reviewed-by: Automatic_Commit_Validation_User GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu <bbasu@nvidia.com> Reviewed-by: Winnie Hsu <whsu@nvidia.com>
2018-04-19tty: Prevent ldisc drivers from re-using stale tty fieldsPeter Hurley
Line discipline drivers may mistakenly misuse ldisc-related fields when initializing. For example, a failure to initialize tty->receive_room in the N_GIGASET_M101 line discipline was recently found and fixed [1]. Now, the N_X25 line discipline has been discovered accessing the previous line discipline's already-freed private data [2]. Harden the ldisc interface against misuse by initializing revelant tty fields before instancing the new line discipline. [1] commit fd98e9419d8d622a4de91f76b306af6aa627aa9c Author: Tilman Schmidt <tilman@imap.cc> Date: Tue Jul 14 00:37:13 2015 +0200 isdn/gigaset: reset tty->receive_room when attaching ser_gigaset [2] Report from Sasha Levin <sasha.levin@oracle.com> [ 634.336761] ================================================================== [ 634.338226] BUG: KASAN: use-after-free in x25_asy_open_tty+0x13d/0x490 at addr ffff8800a743efd0 [ 634.339558] Read of size 4 by task syzkaller_execu/8981 [ 634.340359] ============================================================================= [ 634.341598] BUG kmalloc-512 (Not tainted): kasan: bad access detected ... [ 634.405018] Call Trace: [ 634.405277] dump_stack (lib/dump_stack.c:52) [ 634.405775] print_trailer (mm/slub.c:655) [ 634.406361] object_err (mm/slub.c:662) [ 634.406824] kasan_report_error (mm/kasan/report.c:138 mm/kasan/report.c:236) [ 634.409581] __asan_report_load4_noabort (mm/kasan/report.c:279) [ 634.411355] x25_asy_open_tty (drivers/net/wan/x25_asy.c:559 (discriminator 1)) [ 634.413997] tty_ldisc_open.isra.2 (drivers/tty/tty_ldisc.c:447) [ 634.414549] tty_set_ldisc (drivers/tty/tty_ldisc.c:567) [ 634.415057] tty_ioctl (drivers/tty/tty_io.c:2646 drivers/tty/tty_io.c:2879) [ 634.423524] do_vfs_ioctl (fs/ioctl.c:43 fs/ioctl.c:607) [ 634.427491] SyS_ioctl (fs/ioctl.c:622 fs/ioctl.c:613) [ 634.427945] entry_SYSCALL_64_fastpath (arch/x86/entry/entry_64.S:188) Bug 1823317 Bug 1935735 Change-Id: Ica54faa9334c587594cc19bc9da007340fda672d Cc: Tilman Schmidt <tilman@imap.cc> Cc: Sasha Levin <sasha.levin@oracle.com> Signed-off-by: Peter Hurley <peter@hurleysoftware.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Gagan Grover <ggrover@nvidia.com> Reviewed-on: http://git-master/r/1259925 (cherry picked from commit 2b1401855a2bdd31556a93feba50dd0dc0bb70e8) Reviewed-on: https://git-master.nvidia.com/r/1690300 GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu <bbasu@nvidia.com> Tested-by: Amulya Yarlagadda <ayarlagadda@nvidia.com> Reviewed-by: Winnie Hsu <whsu@nvidia.com>
2018-04-19cgroup: Correct the address format specifierAmulya Y
The format specifier %p can leak kernel addresses while not valuing the kptr_restrict system settings.The fix is designed to use %pK instead of %p, which also evaluates whether kptr_restrict is set. Bug 1823317 Bug 1935735 Change-Id: I19dc309e7f5341663add987f5d0b47ee32e1be50 Signed-off-by: Gagan Grover <ggrover@nvidia.com> Signed-off-by: Amulya Yarlagadda <ayarlagadda@nvidia.com> Reviewed-on: http://git-master/r/1260110 (cherry picked from commit d018ef6518a7527562bedae1eab86838cfcc0570) Reviewed-on: https://git-master.nvidia.com/r/1690299 GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu <bbasu@nvidia.com> Reviewed-by: Winnie Hsu <whsu@nvidia.com>
2018-04-19audit: fix a double fetch in audit_log_single_execve_arg()Paul Moore
There is a double fetch problem in audit_log_single_execve_arg() where we first check the execve(2) argumnets for any "bad" characters which would require hex encoding and then re-fetch the arguments for logging in the audit record[1]. Of course this leaves a window of opportunity for an unsavory application to munge with the data. This patch reworks things by only fetching the argument data once[2] into a buffer where it is scanned and logged into the audit records(s). In addition to fixing the double fetch, this patch improves on the original code in a few other ways: better handling of large arguments which require encoding, stricter record length checking, and some performance improvements (completely unverified, but we got rid of some strlen() calls, that's got to be a good thing). As part of the development of this patch, I've also created a basic regression test for the audit-testsuite, the test can be tracked on GitHub at the following link: * https://github.com/linux-audit/audit-testsuite/issues/25 [1] If you pay careful attention, there is actually a triple fetch problem due to a strnlen_user() call at the top of the function. [2] This is a tiny white lie, we do make a call to strnlen_user() prior to fetching the argument data. I don't like it, but due to the way the audit record is structured we really have no choice unless we copy the entire argument at once (which would require a rather wasteful allocation). The good news is that with this patch the kernel no longer relies on this strnlen_user() value for anything beyond recording it in the log, we also update it with a trustworthy value whenever possible. Bug 1823317 Bug 1935735 Change-Id: I500834e1e699cb43d207333fa91292673de54933 Reported-by: Pengfei Wang <wpengfeinudt@gmail.com> Cc: <stable@vger.kernel.org> Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Gagan Grover <ggrover@nvidia.com> Reviewed-on: http://git-master/r/1261377 (cherry picked from commit 1cc418b165a23b352e06aa5ab66a2d1e1a942a98) Reviewed-on: https://git-master.nvidia.com/r/1690297 GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu <bbasu@nvidia.com> Tested-by: Amulya Yarlagadda <ayarlagadda@nvidia.com> Reviewed-by: Winnie Hsu <whsu@nvidia.com>
generated by cgit v1.2.3 (git 2.0.4) at 2024-05-05 13:32:54 +0000