Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b6d1b4b4 authored by Greg Kroah-Hartman's avatar Greg Kroah-Hartman
Browse files

Merge 4.19.241 into android-4.19-stable 



Changes in 4.19.241
	media: vicodec: upon release, call m2m release before freeing ctrl handler
	floppy: disable FDRAWCMD by default
	hamradio: defer 6pack kfree after unregister_netdev
	hamradio: remove needs_free_netdev to avoid UAF
	net/sched: cls_u32: fix netns refcount changes in u32_change()
	powerpc/64/interrupt: Temporarily save PPR on stack to fix register corruption due to SLB miss
	powerpc/64s: Unmerge EX_LR and EX_DAR
	Revert "ia64: kprobes: Fix to pass correct trampoline address to the handler"
	Revert "ia64: kprobes: Use generic kretprobe trampoline handler"
	ia64: kprobes: Fix to pass correct trampoline address to the handler
	Revert "net: ethernet: stmmac: fix altr_tse_pcs function when using a fixed-link"
	lightnvm: disable the subsystem
	Linux 4.19.241

Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@google.com>
Change-Id: I8af6fcd7a8b0a41d14c4b76980d17c16070885cf
parents 535c72f4 f4b582b9

Makefile

+1 −1
Original line number Diff line number Diff line 
# SPDX-License-Identifier: GPL-2.0

VERSION = 4

PATCHLEVEL = 19

SUBLEVEL = 240

SUBLEVEL = 241

EXTRAVERSION =

NAME = "People's Front"

arch/ia64/kernel/kprobes.c

+75 −3
Original line number Diff line number Diff line
@@ -409,10 +409,83 @@ static void kretprobe_trampoline(void) 
{

}



/*

 * At this point the target function has been tricked into

 * returning into our trampoline.  Lookup the associated instance

 * and then:

 *    - call the handler function

 *    - cleanup by marking the instance as unused

 *    - long jump back to the original return address

 */

int __kprobes trampoline_probe_handler(struct kprobe *p, struct pt_regs *regs)

{

	regs->cr_iip = __kretprobe_trampoline_handler(regs,

		dereference_function_descriptor(kretprobe_trampoline), NULL);

	struct kretprobe_instance *ri = NULL;

	struct hlist_head *head, empty_rp;

	struct hlist_node *tmp;

	unsigned long flags, orig_ret_address = 0;

	unsigned long trampoline_address =

		(unsigned long)dereference_function_descriptor(kretprobe_trampoline);



	INIT_HLIST_HEAD(&empty_rp);

	kretprobe_hash_lock(current, &head, &flags);



	/*

	 * It is possible to have multiple instances associated with a given

	 * task either because an multiple functions in the call path

	 * have a return probe installed on them, and/or more than one return

	 * return probe was registered for a target function.

	 *

	 * We can handle this because:

	 *     - instances are always inserted at the head of the list

	 *     - when multiple return probes are registered for the same

	 *       function, the first instance's ret_addr will point to the

	 *       real return address, and all the rest will point to

	 *       kretprobe_trampoline

	 */

	hlist_for_each_entry_safe(ri, tmp, head, hlist) {

		if (ri->task != current)

			/* another task is sharing our hash bucket */

			continue;



		orig_ret_address = (unsigned long)ri->ret_addr;

		if (orig_ret_address != trampoline_address)

			/*

			 * This is the real return address. Any other

			 * instances associated with this task are for

			 * other calls deeper on the call stack

			 */

			break;

	}



	regs->cr_iip = orig_ret_address;



	hlist_for_each_entry_safe(ri, tmp, head, hlist) {

		if (ri->task != current)

			/* another task is sharing our hash bucket */

			continue;



		if (ri->rp && ri->rp->handler)

			ri->rp->handler(ri, regs);



		orig_ret_address = (unsigned long)ri->ret_addr;

		recycle_rp_inst(ri, &empty_rp);



		if (orig_ret_address != trampoline_address)

			/*

			 * This is the real return address. Any other

			 * instances associated with this task are for

			 * other calls deeper on the call stack

			 */

			break;

	}

	kretprobe_assert(ri, orig_ret_address, trampoline_address);



	kretprobe_hash_unlock(current, &flags);



	hlist_for_each_entry_safe(ri, tmp, &empty_rp, hlist) {

		hlist_del(&ri->hlist);

		kfree(ri);

	}

	/*

	 * By returning a non-zero value, we are telling

	 * kprobe_handler() that we don't want the post_handler
@@ -425,7 +498,6 @@ void __kprobes arch_prepare_kretprobe(struct kretprobe_instance *ri, 
				      struct pt_regs *regs)

{

	ri->ret_addr = (kprobe_opcode_t *)regs->b0;

	ri->fp = NULL;



	/* Replace the return addr with trampoline addr */

	regs->b0 = (unsigned long)dereference_function_descriptor(kretprobe_trampoline);

arch/powerpc/include/asm/exception-64s.h

+22 −15
Original line number Diff line number Diff line
@@ -48,11 +48,12 @@ 
#define EX_CCR		52

#define EX_CFAR		56

#define EX_PPR		64

#define EX_LR		72

#if defined(CONFIG_RELOCATABLE)

#define EX_CTR		72

#define EX_SIZE		10	/* size in u64 units */

#define EX_CTR		80

#define EX_SIZE		11	/* size in u64 units */

#else

#define EX_SIZE		9	/* size in u64 units */

#define EX_SIZE		10	/* size in u64 units */

#endif



/*
@@ -60,14 +61,6 @@ 
 */

#define MAX_MCE_DEPTH	4



/*

 * EX_LR is only used in EXSLB and where it does not overlap with EX_DAR

 * EX_CCR similarly with DSISR, but being 4 byte registers there is a hole

 * in the save area so it's not necessary to overlap them. Could be used

 * for future savings though if another 4 byte register was to be saved.

 */

#define EX_LR		EX_DAR



/*

 * EX_R3 is only used by the bad_stack handler. bad_stack reloads and

 * saves DAR from SPRN_DAR, and EX_DAR is not used. So EX_R3 can overlap
@@ -243,10 +236,22 @@ 
 * PPR save/restore macros used in exceptions_64s.S  

 * Used for P7 or later processors

 */

#define SAVE_PPR(area, ra, rb)						\

#define SAVE_PPR(area, ra)						\

BEGIN_FTR_SECTION_NESTED(940)						\

	ld	ra,area+EX_PPR(r13);	/* Read PPR from paca */	\

	std	ra,RESULT(r1);		/* Store PPR in RESULT for now */ \

END_FTR_SECTION_NESTED(CPU_FTR_HAS_PPR,CPU_FTR_HAS_PPR,940)



/*

 * This is called after we are finished accessing 'area', so we can now take

 * SLB faults accessing the thread struct, which will use PACA_EXSLB area.

 * This is required because the large_addr_slb handler uses EXSLB and it also

 * uses the common exception macros including this PPR saving.

 */

#define MOVE_PPR_TO_THREAD(ra, rb)					\

BEGIN_FTR_SECTION_NESTED(940)						\

	ld	ra,PACACURRENT(r13);					\

	ld	rb,area+EX_PPR(r13);	/* Read PPR from paca */	\

	ld	rb,RESULT(r1);		/* Read PPR from stack */	\

	std	rb,TASKTHREADPPR(ra);					\

END_FTR_SECTION_NESTED(CPU_FTR_HAS_PPR,CPU_FTR_HAS_PPR,940)
@@ -515,9 +520,11 @@ END_FTR_SECTION_NESTED(ftr,ftr,943) 
3:	EXCEPTION_PROLOG_COMMON_1();					   \

	beq	4f;			/* if from kernel mode		*/ \

	ACCOUNT_CPU_USER_ENTRY(r13, r9, r10);				   \

	SAVE_PPR(area, r9, r10);					   \

	SAVE_PPR(area, r9);						   \

4:	EXCEPTION_PROLOG_COMMON_2(area)					   \

	EXCEPTION_PROLOG_COMMON_3(n)					   \

	beq	5f;			/* if from kernel mode		*/ \

	MOVE_PPR_TO_THREAD(r9, r10);					   \

5:	EXCEPTION_PROLOG_COMMON_3(n)					   \

	ACCOUNT_STOLEN_TIME



/* Save original regs values from save area to stack frame. */

drivers/block/Kconfig

+16 −0
Original line number Diff line number Diff line
@@ -39,6 +39,22 @@ config BLK_DEV_FD 
	  To compile this driver as a module, choose M here: the

	  module will be called floppy.



config BLK_DEV_FD_RAWCMD

	bool "Support for raw floppy disk commands (DEPRECATED)"

	depends on BLK_DEV_FD

	help

	  If you want to use actual physical floppies and expect to do

	  special low-level hardware accesses to them (access and use

	  non-standard formats, for example), then enable this.



	  Note that the code enabled by this option is rarely used and

	  might be unstable or insecure, and distros should not enable it.



	  Note: FDRAWCMD is deprecated and will be removed from the kernel

	  in the near future.



	  If unsure, say N.



config AMIGA_FLOPPY

	tristate "Amiga floppy support"

	depends on AMIGA

drivers/block/floppy.c

+32 −11
Original line number Diff line number Diff line
@@ -3023,6 +3023,8 @@ static const char *drive_name(int type, int drive) 
		return "(null)";

}



#ifdef CONFIG_BLK_DEV_FD_RAWCMD



/* raw commands */

static void raw_cmd_done(int flag)

{
@@ -3234,6 +3236,35 @@ static int raw_cmd_ioctl(int cmd, void __user *param) 
	return ret;

}



static int floppy_raw_cmd_ioctl(int type, int drive, int cmd,

				void __user *param)

{

	int ret;



	pr_warn_once("Note: FDRAWCMD is deprecated and will be removed from the kernel in the near future.\n");



	if (type)

		return -EINVAL;

	if (lock_fdc(drive))

		return -EINTR;

	set_floppy(drive);

	ret = raw_cmd_ioctl(cmd, param);

	if (ret == -EINTR)

		return -EINTR;

	process_fd_request();

	return ret;

}



#else /* CONFIG_BLK_DEV_FD_RAWCMD */



static int floppy_raw_cmd_ioctl(int type, int drive, int cmd,

				void __user *param)

{

	return -EOPNOTSUPP;

}



#endif



static int invalidate_drive(struct block_device *bdev)

{

	/* invalidate the buffer track to force a reread */
@@ -3421,7 +3452,6 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int 
{

	int drive = (long)bdev->bd_disk->private_data;

	int type = ITYPE(UDRS->fd_device);

	int i;

	int ret;

	int size;

	union inparam {
@@ -3572,16 +3602,7 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int 
		outparam = UDRWE;

		break;

	case FDRAWCMD:

		if (type)

			return -EINVAL;

		if (lock_fdc(drive))

			return -EINTR;

		set_floppy(drive);

		i = raw_cmd_ioctl(cmd, (void __user *)param);

		if (i == -EINTR)

			return -EINTR;

		process_fd_request();

		return i;

		return floppy_raw_cmd_ioctl(type, drive, cmd, (void __user *)param);

	case FDTWADDLE:

		if (lock_fdc(drive))

			return -EINTR;