1. 14 Jan, 2018 6 commits
  2. 12 Jan, 2018 13 commits
  3. 11 Jan, 2018 10 commits
    • Paolo Bonzini's avatar
      Merge branch 'kvm-insert-lfence' into kvm-master · 2aad9b3e
      Paolo Bonzini authored
      Topic branch for CVE-2017-5753, avoiding conflicts in the next merge window.
      2aad9b3e
    • Andrew Honig's avatar
      KVM: x86: Add memory barrier on vmcs field lookup · 75f139aa
      Andrew Honig authored
      This adds a memory barrier when performing a lookup into
      the vmcs_field_to_offset_table.  This is related to
      CVE-2017-5753.
      Signed-off-by: default avatarAndrew Honig <ahonig@google.com>
      Reviewed-by: default avatarJim Mattson <jmattson@google.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      75f139aa
    • Paolo Bonzini's avatar
      KVM: x86: emulate #UD while in guest mode · bd89525a
      Paolo Bonzini authored
      This reverts commits ae1f5767
      and ac9b305c.
      
      If the hardware doesn't support MOVBE, but L0 sets CPUID.01H:ECX.MOVBE
      in L1's emulated CPUID information, then L1 is likely to pass that
      CPUID bit through to L2. L2 will expect MOVBE to work, but if L1
      doesn't intercept #UD, then any MOVBE instruction executed in L2 will
      raise #UD, and the exception will be delivered in L2.
      
      Commit ac9b305c is a better and more
      complete version of ae1f5767 ("KVM: nVMX: Do not emulate #UD while
      in guest mode"); however, neither considers the above case.
      Suggested-by: default avatarJim Mattson <jmattson@redhat.com>
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      bd89525a
    • Arnd Bergmann's avatar
      x86: kvm: propagate register_shrinker return code · ab271bd4
      Arnd Bergmann authored
      Patch "mm,vmscan: mark register_shrinker() as __must_check" is
      queued for 4.16 in linux-mm and adds a warning about the unchecked
      call to register_shrinker:
      
      arch/x86/kvm/mmu.c:5485:2: warning: ignoring return value of 'register_shrinker', declared with attribute warn_unused_result [-Wunused-result]
      
      This changes the kvm_mmu_module_init() function to fail itself
      when the call to register_shrinker fails.
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      ab271bd4
    • Paolo Bonzini's avatar
      Merge tag 'kvm-ppc-fixes-4.15-3' of... · 0217690f
      Paolo Bonzini authored
      Merge tag 'kvm-ppc-fixes-4.15-3' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc into kvm-master
      
      PPC KVM fixes for 4.15
      
      Four commits here, including two that were tagged but never merged.
      Three of them are for the HPT resizing code; two of those fix a
      user-triggerable use-after-free in the host, and one that fixes
      stale TLB entries in the guest.  The remaining commit fixes a bug
      causing PR KVM guests under PowerVM to fail to start.
      0217690f
    • Haozhong Zhang's avatar
      KVM MMU: check pending exception before injecting APF · 2a266f23
      Haozhong Zhang authored
      For example, when two APF's for page ready happen after one exit and
      the first one becomes pending, the second one will result in #DF.
      Instead, just handle the second page fault synchronously.
      Reported-by: default avatarRoss Zwisler <zwisler@gmail.com>
      Message-ID: <CAOxpaSUBf8QoOZQ1p4KfUp0jq76OKfGY4Uxs-Gg8ngReD99xww@mail.gmail.com>
      Reported-by: default avatarAlec Blayne <ab@tevsa.net>
      Signed-off-by: default avatarHaozhong Zhang <haozhong.zhang@intel.com>
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      2a266f23
    • Chris Wilson's avatar
      drm/i915: Don't adjust priority on an already signaled fence · 5005c851
      Chris Wilson authored
      When we retire a signaled fence, we free the dependency tree. However,
      we skip clearing the list so that if we then try to adjust the priority
      of the signaled fence, we may walk the list of freed dependencies.
      
      [ 3083.156757] ==================================================================
      [ 3083.156806] BUG: KASAN: use-after-free in execlists_schedule+0x199/0x660 [i915]
      [ 3083.156810] Read of size 8 at addr ffff8806bf20f400 by task Xorg/831
      
      [ 3083.156815] CPU: 0 PID: 831 Comm: Xorg Not tainted 4.15.0-rc6-no-psn+ #1
      [ 3083.156817] Hardware name: Notebook                         N24_25BU/N24_25BU, BIOS 5.12 02/17/2017
      [ 3083.156818] Call Trace:
      [ 3083.156823]  dump_stack+0x5c/0x7a
      [ 3083.156827]  print_address_description+0x6b/0x290
      [ 3083.156830]  kasan_report+0x28f/0x380
      [ 3083.156872]  ? execlists_schedule+0x199/0x660 [i915]
      [ 3083.156914]  execlists_schedule+0x199/0x660 [i915]
      [ 3083.156956]  ? intel_crtc_atomic_check+0x146/0x4e0 [i915]
      [ 3083.156997]  ? execlists_submit_request+0xe0/0xe0 [i915]
      [ 3083.157038]  ? i915_vma_misplaced.part.4+0x25/0xb0 [i915]
      [ 3083.157079]  ? __i915_vma_do_pin+0x7c8/0xc80 [i915]
      [ 3083.157121]  ? intel_atomic_state_alloc+0x44/0x60 [i915]
      [ 3083.157130]  ? drm_atomic_helper_page_flip+0x3e/0xb0 [drm_kms_helper]
      [ 3083.157145]  ? drm_mode_page_flip_ioctl+0x7d2/0x850 [drm]
      [ 3083.157159]  ? drm_ioctl_kernel+0xa7/0xf0 [drm]
      [ 3083.157172]  ? drm_ioctl+0x45b/0x560 [drm]
      [ 3083.157211]  i915_gem_object_wait_priority+0x14c/0x2c0 [i915]
      [ 3083.157251]  ? i915_gem_get_aperture_ioctl+0x150/0x150 [i915]
      [ 3083.157290]  ? i915_vma_pin_fence+0x1d8/0x320 [i915]
      [ 3083.157331]  ? intel_pin_and_fence_fb_obj+0x175/0x250 [i915]
      [ 3083.157372]  ? intel_rotation_info_size+0x60/0x60 [i915]
      [ 3083.157413]  ? intel_link_compute_m_n+0x80/0x80 [i915]
      [ 3083.157428]  ? drm_dev_printk+0x1b0/0x1b0 [drm]
      [ 3083.157443]  ? drm_dev_printk+0x1b0/0x1b0 [drm]
      [ 3083.157485]  intel_prepare_plane_fb+0x2f8/0x5a0 [i915]
      [ 3083.157527]  ? intel_crtc_get_vblank_counter+0x80/0x80 [i915]
      [ 3083.157536]  drm_atomic_helper_prepare_planes+0xa0/0x1c0 [drm_kms_helper]
      [ 3083.157587]  intel_atomic_commit+0x12e/0x4e0 [i915]
      [ 3083.157605]  drm_atomic_helper_page_flip+0xa2/0xb0 [drm_kms_helper]
      [ 3083.157621]  drm_mode_page_flip_ioctl+0x7d2/0x850 [drm]
      [ 3083.157638]  ? drm_mode_cursor2_ioctl+0x10/0x10 [drm]
      [ 3083.157652]  ? drm_lease_owner+0x1a/0x30 [drm]
      [ 3083.157668]  ? drm_mode_cursor2_ioctl+0x10/0x10 [drm]
      [ 3083.157681]  drm_ioctl_kernel+0xa7/0xf0 [drm]
      [ 3083.157696]  drm_ioctl+0x45b/0x560 [drm]
      [ 3083.157711]  ? drm_mode_cursor2_ioctl+0x10/0x10 [drm]
      [ 3083.157725]  ? drm_getstats+0x20/0x20 [drm]
      [ 3083.157729]  ? timerqueue_del+0x49/0x80
      [ 3083.157732]  ? __remove_hrtimer+0x62/0xb0
      [ 3083.157735]  ? hrtimer_try_to_cancel+0x173/0x210
      [ 3083.157738]  do_vfs_ioctl+0x13b/0x880
      [ 3083.157741]  ? ioctl_preallocate+0x140/0x140
      [ 3083.157744]  ? _raw_spin_unlock_irq+0xe/0x30
      [ 3083.157746]  ? do_setitimer+0x234/0x370
      [ 3083.157750]  ? SyS_setitimer+0x19e/0x1b0
      [ 3083.157752]  ? SyS_alarm+0x140/0x140
      [ 3083.157755]  ? __rcu_read_unlock+0x66/0x80
      [ 3083.157757]  ? __fget+0xc4/0x100
      [ 3083.157760]  SyS_ioctl+0x74/0x80
      [ 3083.157763]  entry_SYSCALL_64_fastpath+0x1a/0x7d
      [ 3083.157765] RIP: 0033:0x7f6135d0c6a7
      [ 3083.157767] RSP: 002b:00007fff01451888 EFLAGS: 00003246 ORIG_RAX: 0000000000000010
      [ 3083.157769] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007f6135d0c6a7
      [ 3083.157771] RDX: 00007fff01451950 RSI: 00000000c01864b0 RDI: 000000000000000c
      [ 3083.157772] RBP: 00007f613076f600 R08: 0000000000000001 R09: 0000000000000000
      [ 3083.157773] R10: 0000000000000060 R11: 0000000000003246 R12: 0000000000000000
      [ 3083.157774] R13: 0000000000000060 R14: 000000000000001b R15: 0000000000000060
      
      [ 3083.157779] Allocated by task 831:
      [ 3083.157783]  kmem_cache_alloc+0xc0/0x200
      [ 3083.157822]  i915_gem_request_await_dma_fence+0x2c4/0x5d0 [i915]
      [ 3083.157861]  i915_gem_request_await_object+0x321/0x370 [i915]
      [ 3083.157900]  i915_gem_do_execbuffer+0x1165/0x19c0 [i915]
      [ 3083.157937]  i915_gem_execbuffer2+0x1ad/0x550 [i915]
      [ 3083.157950]  drm_ioctl_kernel+0xa7/0xf0 [drm]
      [ 3083.157962]  drm_ioctl+0x45b/0x560 [drm]
      [ 3083.157964]  do_vfs_ioctl+0x13b/0x880
      [ 3083.157966]  SyS_ioctl+0x74/0x80
      [ 3083.157968]  entry_SYSCALL_64_fastpath+0x1a/0x7d
      
      [ 3083.157971] Freed by task 831:
      [ 3083.157973]  kmem_cache_free+0x77/0x220
      [ 3083.158012]  i915_gem_request_retire+0x72c/0xa70 [i915]
      [ 3083.158051]  i915_gem_request_alloc+0x1e9/0x8b0 [i915]
      [ 3083.158089]  i915_gem_do_execbuffer+0xa96/0x19c0 [i915]
      [ 3083.158127]  i915_gem_execbuffer2+0x1ad/0x550 [i915]
      [ 3083.158140]  drm_ioctl_kernel+0xa7/0xf0 [drm]
      [ 3083.158153]  drm_ioctl+0x45b/0x560 [drm]
      [ 3083.158155]  do_vfs_ioctl+0x13b/0x880
      [ 3083.158156]  SyS_ioctl+0x74/0x80
      [ 3083.158158]  entry_SYSCALL_64_fastpath+0x1a/0x7d
      
      [ 3083.158162] The buggy address belongs to the object at ffff8806bf20f400
                      which belongs to the cache i915_dependency of size 64
      [ 3083.158166] The buggy address is located 0 bytes inside of
                      64-byte region [ffff8806bf20f400, ffff8806bf20f440)
      [ 3083.158168] The buggy address belongs to the page:
      [ 3083.158171] page:00000000d43decc4 count:1 mapcount:0 mapping:          (null) index:0x0
      [ 3083.158174] flags: 0x17ffe0000000100(slab)
      [ 3083.158179] raw: 017ffe0000000100 0000000000000000 0000000000000000 0000000180200020
      [ 3083.158182] raw: ffffea001afc16c0 0000000500000005 ffff880731b881c0 0000000000000000
      [ 3083.158184] page dumped because: kasan: bad access detected
      
      [ 3083.158187] Memory state around the buggy address:
      [ 3083.158190]  ffff8806bf20f300: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
      [ 3083.158192]  ffff8806bf20f380: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
      [ 3083.158195] >ffff8806bf20f400: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
      [ 3083.158196]                    ^
      [ 3083.158199]  ffff8806bf20f480: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
      [ 3083.158201]  ffff8806bf20f500: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
      [ 3083.158203] ==================================================================
      Reported-by: default avatarAlexandru Chirvasitu <achirvasub@gmail.com>
      Reported-by: default avatarMike Keehan <mike@keehan.net>
      Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=104436
      Fixes: 1f181225 ("drm/i915/execlists: Keep request->priority for its lifetime")
      Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
      Cc: Alexandru Chirvasitu <achirvasub@gmail.com>
      Cc: Michał Winiarski <michal.winiarski@intel.com>
      Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
      Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
      Tested-by: default avatarAlexandru Chirvasitu <achirvasub@gmail.com>
      Reviewed-by: default avatarMichał Winiarski <michal.winiarski@intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20180106105618.13532-1-chris@chris-wilson.co.uk
      (cherry picked from commit c218ee03)
      Signed-off-by: default avatarJani Nikula <jani.nikula@intel.com>
      5005c851
    • Kenneth Graunke's avatar
      drm/i915: Whitelist SLICE_COMMON_ECO_CHICKEN1 on Geminilake. · 4636bda8
      Kenneth Graunke authored
      Geminilake requires the 3D driver to select whether barriers are
      intended for compute shaders, or tessellation control shaders, by
      whacking a "Barrier Mode" bit in SLICE_COMMON_ECO_CHICKEN1 when
      switching pipelines.  Failure to do this properly can result in GPU
      hangs.
      
      Unfortunately, this means it needs to switch mid-batch, so only
      userspace can properly set it.  To facilitate this, the kernel needs
      to whitelist the register.
      
      The workarounds page currently tags this as applying to Broxton only,
      but that doesn't make sense.  The documentation for the register it
      references says the bit userspace is supposed to toggle only exists on
      Geminilake.  Empirically, the Mesa patch to toggle this bit appears to
      fix intermittent GPU hangs in tessellation control shader barrier tests
      on Geminilake; we haven't seen those hangs on Broxton.
      
      v2: Mention WA #0862 in the comment (it doesn't have a name).
      Signed-off-by: default avatarKenneth Graunke <kenneth@whitecape.org>
      Acked-by: default avatarRodrigo Vivi <rodrigo.vivi@intel.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarRodrigo Vivi <rodrigo.vivi@intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20180105085905.9298-1-kenneth@whitecape.org
      (cherry picked from commit ab062639)
      Signed-off-by: default avatarJani Nikula <jani.nikula@intel.com>
      4636bda8
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · cbd0a6a2
      Linus Torvalds authored
      Pull vfs regression fix from Al Viro/
      
      Fix a leak in socket() introduced by commit 8e1611e2 ("make
      sock_alloc_file() do sock_release() on failures").
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        Fix a leak in socket(2) when we fail to allocate a file descriptor.
      cbd0a6a2
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 64fce444
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) BPF speculation prevention and BPF_JIT_ALWAYS_ON, from Alexei
          Starovoitov.
      
       2) Revert dev_get_random_name() changes as adjust the error code
          returns seen by userspace definitely breaks stuff.
      
       3) Fix TX DMA map/unmap on older iwlwifi devices, from Emmanuel
          Grumbach.
      
       4) From wrong AF family when requesting sock diag modules, from Andrii
          Vladyka.
      
       5) Don't add new ipv6 routes attached to the null_entry, from Wei Wang.
      
       6) Some SCTP sockopt length fixes from Marcelo Ricardo Leitner.
      
       7) Don't leak when removing VLAN ID 0, from Cong Wang.
      
       8) Hey there's a potential leak in ipv6_make_skb() too, from Eric
          Dumazet.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (27 commits)
        ipv6: sr: fix TLVs not being copied using setsockopt
        ipv6: fix possible mem leaks in ipv6_make_skb()
        mlxsw: spectrum_qdisc: Don't use variable array in mlxsw_sp_tclass_congestion_enable
        mlxsw: pci: Wait after reset before accessing HW
        nfp: always unmask aux interrupts at init
        8021q: fix a memory leak for VLAN 0 device
        of_mdio: avoid MDIO bus removal when a PHY is missing
        caif_usb: use strlcpy() instead of strncpy()
        doc: clarification about setting SO_ZEROCOPY
        net: gianfar_ptp: move set_fipers() to spinlock protecting area
        sctp: make use of pre-calculated len
        sctp: add a ceiling to optlen in some sockopts
        sctp: GFP_ATOMIC is not needed in sctp_setsockopt_events
        bpf: introduce BPF_JIT_ALWAYS_ON config
        bpf: avoid false sharing of map refcount with max_entries
        ipv6: remove null_entry before adding default route
        SolutionEngine771x: add Ether TSU resource
        SolutionEngine771x: fix Ether platform data
        docs-rst: networking: wire up msg_zerocopy
        net: ipv4: emulate READ_ONCE() on ->hdrincl bit-field in raw_sendmsg()
        ...
      64fce444
  4. 10 Jan, 2018 11 commits