1. 21 Jul, 2022 4 commits
  2. 20 Jul, 2022 2 commits
    • Linus Torvalds's avatar
      watchqueue: make sure to serialize 'wqueue->defunct' properly · 353f7988
      Linus Torvalds authored
      When the pipe is closed, we mark the associated watchqueue defunct by
      calling watch_queue_clear().  However, while that is protected by the
      watchqueue lock, new watchqueue entries aren't actually added under that
      lock at all: they use the pipe->rd_wait.lock instead, and looking up
      that pipe happens without any locking.
      
      The watchqueue code uses the RCU read-side section to make sure that the
      wqueue entry itself hasn't disappeared, but that does not protect the
      pipe_info in any way.
      
      So make sure to actually hold the wqueue lock when posting watch events,
      properly serializing against the pipe being torn down.
      Reported-by: default avatarNoam Rathaus <noamr@ssd-disclosure.com>
      Cc: Greg KH <gregkh@linuxfoundation.org>
      Cc: David Howells <dhowells@redhat.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      353f7988
    • Eric Snowberg's avatar
      lockdown: Fix kexec lockdown bypass with ima policy · 543ce63b
      Eric Snowberg authored
      The lockdown LSM is primarily used in conjunction with UEFI Secure Boot.
      This LSM may also be used on machines without UEFI.  It can also be
      enabled when UEFI Secure Boot is disabled.  One of lockdown's features
      is to prevent kexec from loading untrusted kernels.  Lockdown can be
      enabled through a bootparam or after the kernel has booted through
      securityfs.
      
      If IMA appraisal is used with the "ima_appraise=log" boot param,
      lockdown can be defeated with kexec on any machine when Secure Boot is
      disabled or unavailable.  IMA prevents setting "ima_appraise=log" from
      the boot param when Secure Boot is enabled, but this does not cover
      cases where lockdown is used without Secure Boot.
      
      To defeat lockdown, boot without Secure Boot and add ima_appraise=log to
      the kernel command line; then:
      
        $ echo "integrity" > /sys/kernel/security/lockdown
        $ echo "appraise func=KEXEC_KERNEL_CHECK appraise_type=imasig" > \
          /sys/kernel/security/ima/policy
        $ kexec -ls unsigned-kernel
      
      Add a call to verify ima appraisal is set to "enforce" whenever lockdown
      is enabled.  This fixes CVE-2022-21505.
      
      Cc: stable@vger.kernel.org
      Fixes: 29d3c1c8 ("kexec: Allow kexec_file() with appropriate IMA policy when locked down")
      Signed-off-by: default avatarEric Snowberg <eric.snowberg@oracle.com>
      Acked-by: default avatarMimi Zohar <zohar@linux.ibm.com>
      Reviewed-by: default avatarJohn Haxby <john.haxby@oracle.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      543ce63b
  3. 19 Jul, 2022 1 commit
  4. 18 Jul, 2022 1 commit
  5. 17 Jul, 2022 15 commits
  6. 16 Jul, 2022 12 commits
  7. 15 Jul, 2022 5 commits
    • Linus Torvalds's avatar
      Merge tag 'riscv-for-linus-5.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux · 9b59ec8d
      Linus Torvalds authored
      Pull RISC-V fixes from Palmer Dabbelt:
      
       - A fix to avoid printing a warning when modules do not exercise any
         errata-dependent behavior and the SiFive errata are enabled.
      
       - A fix to the Microchip PFSOC to attach the L2 cache to the CPU nodes.
      
      * tag 'riscv-for-linus-5.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:
        riscv: don't warn for sifive erratas in modules
        riscv: dts: microchip: hook up the mpfs' l2cache
      9b59ec8d
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm · a8ebfcd3
      Linus Torvalds authored
      Pull KVM fixes from Paolo Bonzini:
       "RISC-V:
         - Fix missing PAGE_PFN_MASK
      
         - Fix SRCU deadlock caused by kvm_riscv_check_vcpu_requests()
      
        x86:
         - Fix for nested virtualization when TSC scaling is active
      
         - Estimate the size of fastcc subroutines conservatively, avoiding
           disastrous underestimation when return thunks are enabled
      
         - Avoid possible use of uninitialized fields of 'struct
           kvm_lapic_irq'
      
        Generic:
         - Mark as such the boolean values available from the statistics file
           descriptors
      
         - Clarify statistics documentation"
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
        KVM: emulate: do not adjust size of fastop and setcc subroutines
        KVM: x86: Fully initialize 'struct kvm_lapic_irq' in kvm_pv_kick_cpu_op()
        Documentation: kvm: clarify histogram units
        kvm: stats: tell userspace which values are boolean
        x86/kvm: fix FASTOP_SIZE when return thunks are enabled
        KVM: nVMX: Always enable TSC scaling for L2 when it was enabled for L1
        RISC-V: KVM: Fix SRCU deadlock caused by kvm_riscv_check_vcpu_requests()
        riscv: Fix missing PAGE_PFN_MASK
      a8ebfcd3
    • Linus Torvalds's avatar
      Merge tag 'ceph-for-5.19-rc7' of https://github.com/ceph/ceph-client · 1ce9d792
      Linus Torvalds authored
      Pull ceph fix from Ilya Dryomov:
       "A folio locking fixup that Xiubo and David cooperated on, marked for
        stable. Most of it is in netfs but I picked it up into ceph tree on
        agreement with David"
      
      * tag 'ceph-for-5.19-rc7' of https://github.com/ceph/ceph-client:
        netfs: do not unlock and put the folio twice
      1ce9d792
    • Linus Torvalds's avatar
      Merge tag 'spi-fix-v5.19-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi · 8006112d
      Linus Torvalds authored
      Pull spi fixes from Mark Brown:
       "A few driver specific fixes, none especially remarkable, plus a
        MAINTAINERS file update due to the previous maintainer for the NXP
        FSPI driver having left the company"
      
      * tag 'spi-fix-v5.19-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
        spi: cadence-quadspi: Remove spi_master_put() in probe failure path
        MAINTAINERS: change the NXP FSPI driver maintainer.
        spi: amd: Limit max transfer and message size
        spi: aspeed: Fix division by zero
        spi: aspeed: Add dev_dbg() to dump the spi-mem direct mapping descriptor
      8006112d
    • Linus Torvalds's avatar
      Merge tag 'soc-fixes-5.19-3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc · 1c49f281
      Linus Torvalds authored
      Pull ARM SoC fixes from Arnd Bergmann:
       "Most of the contents are bugfixes for the devicetree files:
      
         - A Qualcomm MSM8974 pin controller regression, caused by a cleanup
           patch that gets partially reverted here.
      
         - Missing properties for Broadcom BCM49xx to fix timer detection and
           SMP boot.
      
         - Fix touchscreen pinctrl for imx6ull-colibri board
      
         - Multiple fixes for Rockchip rk3399 based machines including the vdu
           clock-rate fix, otg port fix on Quartz64-A and ethernet on
           Quartz64-B
      
         - Fixes for misspelled DT contents causing minor problems on
           imx6qdl-ts7970m, orangepi-zero, sama5d2, kontron-kswitch-d10, and
           ls1028a
      
        And a couple of changes elsewhere:
      
         - Fix binding for Allwinner D1 display pipeline
      
         - Trivial code fixes to the TEE and reset controller driver
           subsystems and the rockchip platform code.
      
         - Multiple updates to the MAINTAINERS files, marking the Palm Treo
           support as orphaned, and fixing some entries for added or changed
           file names"
      
      * tag 'soc-fixes-5.19-3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (21 commits)
        arm64: dts: broadcom: bcm4908: Fix cpu node for smp boot
        arm64: dts: broadcom: bcm4908: Fix timer node for BCM4906 SoC
        ARM: dts: sunxi: Fix SPI NOR campatible on Orange Pi Zero
        ARM: dts: at91: sama5d2: Fix typo in i2s1 node
        tee: tee_get_drvdata(): fix description of return value
        optee: Remove duplicate 'of' in two places.
        ARM: dts: kswitch-d10: use open drain mode for coma-mode pins
        ARM: dts: colibri-imx6ull: fix snvs pinmux group
        optee: smc_abi.c: fix wrong pointer passed to IS_ERR/PTR_ERR()
        MAINTAINERS: add polarfire rng, pci and clock drivers
        MAINTAINERS: mark ARM/PALM TREO SUPPORT orphan
        ARM: dts: imx6qdl-ts7970: Fix ngpio typo and count
        arm64: dts: ls1028a: Update SFP node to include clock
        dt-bindings: display: sun4i: Fix D1 pipeline count
        ARM: dts: qcom: msm8974: re-add missing pinctrl
        reset: Fix devm bulk optional exclusive control getter
        MAINTAINERS: rectify entry for SYNOPSYS AXS10x RESET CONTROLLER DRIVER
        ARM: rockchip: Add missing of_node_put() in rockchip_suspend_init()
        arm64: dts: rockchip: Assign RK3399 VDU clock rate
        arm64: dts: rockchip: Fix Quartz64-A dwc3 otg port behavior
        ...
      1c49f281