Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit bdde16a5 authored by Greg Kroah-Hartman's avatar Greg Kroah-Hartman
Browse files

Merge tag 'android11-5.4.254_r00' into android11-5.4



This is the merge of 5.4.254 into the android11-5.4 branch.

It contains the following commits:

* aa527280 Merge android11-5.4 branch into android11-5.4-lts branch
*   38b412a1 Merge 5.4.254 into android11-5.4-lts
|\
| * fd2a1d1f Linux 5.4.254
| * e7711f15 sch_netem: fix issues in netem_change() vs get_dist_table()
| * 3c3ffd6a alpha: remove __init annotation from exported page_is_ram()
| * e12fac07 scsi: core: Fix possible memory leak if device_add() fails
| * cea09922 scsi: snic: Fix possible memory leak if device_add() fails
| * 12162414 scsi: 53c700: Check that command slot is not NULL
| * 048ebc9a scsi: storvsc: Fix handling of virtual Fibre Channel timeouts
| * ecb1fbe2 scsi: core: Fix legacy /proc parsing buffer overflow
| * 97982284 netfilter: nf_tables: report use refcount overflow
| * 137e25f0 nvme-rdma: fix potential unbalanced freeze & unfreeze
| * ab32fbe3 nvme-tcp: fix potential unbalanced freeze & unfreeze
| * 756c0246 btrfs: set cache_block_group_error if we find an error
| * fa7bc268 btrfs: don't stop integrity writeback too early
| * 0a3b5893 ibmvnic: Handle DMA unmapping of login buffs in release functions
| * d66a2711 net/mlx5: Allow 0 for total host VFs
| * d7b2df97 dmaengine: mcf-edma: Fix a potential un-allocated memory access
| * e913d894 wifi: cfg80211: fix sband iftype data lookup for AP_VLAN
| * c2145b18 IB/hfi1: Fix possible panic during hotplug remove
| * 9d469552 drivers: net: prevent tun_build_skb() to exceed the packet size limit
| * 67eebc7a dccp: fix data-race around dp->dccps_mss_cache
| * ef881096 bonding: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves
| * 9c7deea5 net/packet: annotate data-races around tp->status
| * 60d9662f mISDN: Update parameter type of dsp_cmx_send()
| * dd72849b selftests/rseq: Fix build with undefined __weak
| * 302d8481 drm/nouveau/disp: Revert a NULL check inside nouveau_connector_get_modes
| * ed8dcd95 x86: Move gds_ucode_mitigated() declaration to header
| * 6b342b1f x86/mm: Fix VDSO and VVAR placement on 5-level paging machines
| * 91a5e755 x86/cpu/amd: Enable Zenbleed fix for AMD Custom APU 0405
| * 14254212 usb: common: usb-conn-gpio: Prevent bailing out if initial role is none
| * 25038d3f usb: dwc3: Properly handle processing of pending events
| * 044f4446 usb-storage: alauda: Fix uninit-value in alauda_check_media()
| * b97dad01 binder: fix memory leak in binder_init()
| * 182f0e71 iio: cros_ec: Fix the allocation size for cros_ec_command
| * d2c539c2 nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput
| * 65571693 x86/pkeys: Revert a5eff725 ("x86/pkeys: Add PKRU value to init_fpstate")
| * ea1b4c31 radix tree test suite: fix incorrect allocation size for pthreads
| * aa0bfe16 drm/nouveau/gr: enable memory loads on helper invocation on all channels
| * 8a489b0b dmaengine: pl330: Return DMA_PAUSED when transaction is paused
| * 7c62508d ipv6: adjust ndisc_is_useropt() to also return true for PIO
| * 0a67c126 mmc: moxart: read scr register without changing byte order
* | 27926744 Merge 5.4.253 into android11-5.4-lts
|\|
| * 4b4223f7 Linux 5.4.253
| * 9e537487 Revert "driver core: Annotate dev_err_probe() with __must_check"
| * ca33c070 drivers: core: fix kernel-doc markup for dev_err_probe()
| * 04ece65d driver code: print symbolic error code
| * f2c1b4f9 driver core: Annotate dev_err_probe() with __must_check
| * 2e8fc2dd ARM: dts: nxp/imx6sll: fix wrong property name in usbphy node
| * a1ba8725 ARM: dts: imx6sll: fixup of operating points
| * 6c71d739 ARM: dts: imx: add usb alias
| * 66579ee1 ARM: dts: imx: Align L2 cache-controller nodename with dtschema
| * 3b454fb9 ARM: dts: imx6sll: Make ssi node name same as other platforms
| * 03b119d9 arm64: dts: stratix10: fix incorrect I2C property for SCL signal
| * 72c94624 ceph: defer stopping mdsc delayed_work
| * f82fe11a ceph: use kill_anon_super helper
| * 82edffea ceph: show tasks waiting on caps in debugfs caps file
| * 632023a2 PM: sleep: wakeirq: fix wake irq arming
| * d7f34e2c PM / wakeirq: support enabling wake-up irq after runtime_suspend called
| * 9cbffa33 selftests/rseq: Play nice with binaries statically linked against glibc 2.35+
| * 13553469 selftests/rseq: check if libc rseq support is registered
| * a65e7b4b powerpc/mm/altmap: Fix altmap boundary check
| * f8cf0f83 mtd: rawnand: omap_elm: Fix incorrect type in assignment
| * 2af8ed11 test_firmware: return ENOMEM instead of ENOSPC on failed memory allocation
| * 0f68b0f8 test_firmware: prevent race conditions by a correct implementation of locking
| * 040cdadf ext2: Drop fragment support
| * 0336b424 fs: Protect reconfiguration of sb read-write from racing writes
| * a05ac5d0 net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb
| * a2da00d1 Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb
| * 0a44ceba fs/sysv: Null check to prevent null-ptr-deref bug
| * 1202deb1 net: tap_open(): set sk_uid from current_fsuid()
| * 1d53ea77 net: tun_chr_open(): set sk_uid from current_fsuid()
| * ae9cf408 mtd: rawnand: meson: fix OOB available bytes for ECC
| * 8deaaf4b mtd: spinand: toshiba: Fix ecc_get_status
| * eacb19bd USB: zaurus: Add ID for A-300/B-500/C-700
| * 5107f9e8 libceph: fix potential hang in ceph_osdc_notify()
| * 6f14228e scsi: zfcp: Defer fc_rport blocking until after ADISC response
| * a490c2e8 tcp_metrics: fix data-race in tcpm_suck_dst() vs fastopen
| * 6d49ed95 tcp_metrics: annotate data-races around tm->tcpm_net
| * fc566cf3 tcp_metrics: annotate data-races around tm->tcpm_vals[]
| * 76b47dab tcp_metrics: annotate data-races around tm->tcpm_lock
| * 38661fe6 tcp_metrics: annotate data-races around tm->tcpm_stamp
| * 96f14d68 tcp_metrics: fix addr_same() helper
| * 0438e60a ip6mr: Fix skb_under_panic in ip6mr_cache_report()
| * 5b3dbedb net: dcb: choose correct policy to parse DCB_ATTR_BCN
| * 363c56f9 net: ll_temac: fix error checking of irq_of_parse_and_map()
| * 7928f814 net: ll_temac: Switch to use dev_err_probe() helper
| * 97d8a0bb driver core: add device probe log helper
| * 227b8ce5 bpf: sockmap: Remove preempt_disable in sock_map_sk_acquire
| * 1c8262f3 net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free
| * 83e3d4b0 net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free
| * be785808 net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free
| * b705759a net: add missing data-race annotation for sk_ll_usec
| * 95dd65f2 net: add missing data-race annotations around sk->sk_peek_off
| * 8a6dddcb net: add missing READ_ONCE(sk->sk_rcvbuf) annotation
| * ec4b7532 net: add missing READ_ONCE(sk->sk_sndbuf) annotation
| * 9cd3adc2 net: add missing READ_ONCE(sk->sk_rcvlowat) annotation
| * 481186ca net: annotate data-races around sk->sk_max_pacing_rate
| * 1774250a mISDN: hfcpci: Fix potential deadlock on &hc->lock
| * 42b28808 net: sched: cls_u32: Fix match key mis-addressing
| * 1b047dc9 perf test uprobe_from_different_cu: Skip if there is no gcc
| * ad46d486 rtnetlink: let rtnl_bridge_setlink checks IFLA_BRIDGE_MODE length
| * 80381ecf net/mlx5e: fix return value check in mlx5e_ipsec_remove_trailer()
| * 800d8c96 net/mlx5: DR, fix memory leak in mlx5dr_cmd_create_reformat_ctx
| * 4730c0a1 KVM: s390: fix sthyi error handling
| * d2fb0969 word-at-a-time: use the same return type for has_zero regardless of endianness
| * be4d2b45 loop: Select I/O scheduler 'none' from inside add_disk()
| * 11e929c3 perf: Fix function pointer case
| * 1db90f97 arm64: Fix bit-shifting UB in the MIDR_CPU_MODEL() macro
| * f41cab7a arm64: Add AMPERE1 to the Spectre-BHB affected list
| * 6e4aa8c8 ASoC: cs42l51: fix driver to properly autoload with automatic module loading
| * cf8ecd6e net/sched: sch_qfq: account for stab overhead in qfq_enqueue
| * 0e0f324c btrfs: fix race between quota disable and quota assign ioctls
| * 4f8f86bc btrfs: qgroup: return ENOTCONN instead of EINVAL when quotas are not enabled
| * 8c1d1f3a btrfs: qgroup: remove one-time use variables for quota_root checks
| * c8b1499e cpufreq: intel_pstate: Drop ACPI _PSS states table patching
| * f331413e ACPI: processor: perflib: Avoid updating frequency QoS unnecessarily
| * 511851c8 ACPI: processor: perflib: Use the "no limit" frequency QoS
| * 81cd6cee dm cache policy smq: ensure IO doesn't prevent cleaner policy progress
| * e3efc476 ASoC: wm8904: Fill the cache for WM8904_ADC_TEST_0 register
| * 00748bc5 s390/dasd: fix hanging device after quiesce/resume
| * 73e87246 virtio-net: fix race between set queues and probe
| * 6db2a3c5 btrfs: check if the transaction was aborted at btrfs_wait_for_commit()
| * 5adbd7cc irq-bcm6345-l1: Do not assume a fixed block to cpu mapping
| * a0019e13 tpm_tis: Explicitly check for error code
| * d1c6e680 btrfs: check for commit error at btrfs_attach_transaction_barrier()
| * ee2eed83 hwmon: (nct7802) Fix for temp6 (PECI1) processed even if PECI1 disabled
| * 5373a1aa staging: ks7010: potential buffer overflow in ks_wlan_set_encode_ext()
| * 352e0cae Documentation: security-bugs.rst: clarify CVE handling
| * e331a88e Documentation: security-bugs.rst: update preferences when dealing with the linux-distros group
| * fd21197a Revert "usb: xhci: tegra: Fix error check"
| * e0c92c32 usb: xhci-mtk: set the dma max_seg_size
| * 3f39d58a USB: quirks: add quirk for Focusrite Scarlett
| * 8f86b1b3 usb: ohci-at91: Fix the unhandle interrupt when resume
| * 640cb5f5 usb: dwc3: don't reset device side if dwc3 was configured as host-only
| * a7d080cf usb: dwc3: pci: skip BYT GPIO lookup table for hardwired phy
| * 5fc6ace7 Revert "usb: dwc3: core: Enable AutoRetry feature in the controller"
| * 80d40a3d can: gs_usb: gs_can_close(): add missing set of CAN state to CAN_STATE_STOPPED
| * 58f0affb USB: serial: simple: sort driver entries
| * 43ee3cf0 USB: serial: simple: add Kaufmann RKS+CAN VCP
| * bcf1fc78 USB: serial: option: add Quectel EC200A module support
| * 3ec7c5ef USB: serial: option: support Quectel EM060K_128
| * da7ebd86 serial: sifive: Fix sifive_serial_console_setup() section
| * d674cb90 serial: 8250_dw: Preserve original value of DLF register
| * cdcc35e6 tracing: Fix warning in trace_buffered_event_disable()
| * d7b20279 ring-buffer: Fix wrong stat of cpu_buffer->read
| * f6e1e569 ata: pata_ns87415: mark ns87560_tf_read static
| * 53c06e0d dm raid: fix missing reconfig_mutex unlock in raid_ctr() error paths
| * 9ebcca93 block: Fix a source code comment in include/uapi/linux/blkzoned.h
| * c0aad2fe ASoC: fsl_spdif: Silence output on stop
| * 3bd1b479 drm/msm: Fix IS_ERR_OR_NULL() vs NULL check in a5xx_submit_in_rb()
| * 4970f72f drm/msm/adreno: Fix snapshot BINDLESS_DATA size
| * 5200bd7e drm/msm/dpu: drop enum dpu_core_perf_data_bus_id
| * 4990f529 RDMA/mlx4: Make check for invalid flags stricter
| * 74843851 benet: fix return value check in be_lancer_xmit_workarounds()
| * 07d9723c net/sched: mqprio: Add length check for TCA_MQPRIO_{MAX/MIN}_RATE64
| * 2eb61752 net/sched: mqprio: add extack to mqprio_parse_nlattr()
| * 29c5eb0f net/sched: mqprio: refactor nlattr parsing to a separate function
| * 17afc24d platform/x86: msi-laptop: Fix rfkill out-of-sync on MSI Wind U100
| * 504177c8 team: reset team's flags when down link is P2P device
| * a3bb0259 bonding: reset bond's flags when down link is P2P device
| * d87d67c8 tcp: Reduce chance of collisions in inet6_hashfn().
| * 458294ee ipv6 addrconf: fix bug where deleting a mngtmpaddr can create a new temporary address
| * a2497058 ethernet: atheros: fix return value check in atl1e_tso_csum()
| * 195e806b phy: hisilicon: Fix an out of bounds check in hisi_inno_phy_probe()
| * 27b63e8b vxlan: calculate correct header length for GPE
| * 5e98318c i40e: Fix an NULL vs IS_ERR() bug for debugfs_create_dir()
| * 6b1ee62e ext4: fix to check return value of freeze_bdev() in ext4_shutdown()
| * 65bd66a7 keys: Fix linking a duplicate key to a keyring's assoc_array
| * c1df9668 uapi: General notification queue definitions
| * ea64c727 scsi: qla2xxx: Array index may go out of bound
| * 5e387df4 scsi: qla2xxx: Fix inconsistent format argument type in qla_os.c
| * 62962873 pwm: meson: fix handling of period/duty if greater than UINT_MAX
| * 7ae4671a pwm: meson: Simplify duplicated per-channel tracking
| * 8abacc57 pwm: meson: Remove redundant assignment to variable fin_freq
| * 680e1455 ftrace: Fix possible warning on checking all pages used in ftrace_process_locs()
| * 05ff1d35 ftrace: Store the order of pages allocated in ftrace_page
| * e3098e52 ftrace: Check if pages were allocated before calling free_pages()
| * aad84a97 ftrace: Add information on number of page groups allocated
| * bd020c77 fs: dlm: interrupt posix locks only when process is killed
| * f61d5752 dlm: rearrange async condition return
| * ed092c49 dlm: cleanup plock_op vs plock_xop
| * a50ad9f8 PCI/ASPM: Avoid link retraining race
| * e50434e3 PCI/ASPM: Factor out pcie_wait_for_retrain()
| * 7411202a PCI/ASPM: Return 0 or -ETIMEDOUT from pcie_retrain_link()
| * 8eb15ff2 ext4: Fix reusing stale buffer heads from last failed mounting
| * 0204319d ext4: rename journal_dev to s_journal_dev inside ext4_sb_info
| * 356056cb btrfs: fix extent buffer leak after tree mod log failure at split_node()
| * 63008dab btrfs: fix race between quota disable and relocation
| * 0a55f346 btrfs: qgroup: catch reserved space leaks at unmount time
| * b070f29a bcache: Fix __bch_btree_node_alloc to make the failure behavior consistent
| * 38a6dd2b bcache: remove 'int n' from parameter list of bch_bucket_alloc_set()
| * edb81d6e gpio: tps68470: Make tps68470_gpio_output() always set the initial value
| * 34e71f7d jbd2: Fix wrongly judgement for buffer head removing while doing checkpoint
| * 937cb207 jbd2: recheck chechpointing non-dirty buffer
| * acc9a81f jbd2: remove redundant buffer io error checks
| * 05d440d0 jbd2: fix kernel-doc markups
| * b41fa1ed jbd2: fix incorrect code style
* | 85caed29 Merge 5.4.252 into android11-5.4-lts
|\|
| * 21732fd2 Linux 5.4.252
| * 9399ea1c x86: fix backwards merge of GDS/SRSO bit
| * bc7b9a6c xen/netback: Fix buffer overrun triggered by unusual packet
| * 43ed6f79 x86/cpu, kvm: Add support for CPUID_80000021_EAX
| * 1f0618bb x86/bugs: Increase the x86 bugs vector size to two u32s
| * 08ba4815 tools headers cpufeatures: Sync with the kernel sources
| * 694b40dc x86/cpufeatures: Assign dedicated feature word for CPUID_0x8000001F[EAX]
| * 4fa849d4 x86/cpu: Add VM page flush MSR availablility as a CPUID feature
| * 998eec06 x86/cpufeatures: Add SEV-ES CPU feature
| * 3e21d8b0 Documentation/x86: Fix backwards on/off logic about YMM support
| * ad7670dd x86/mm: Initialize text poking earlier
| * 979366f5 mm: Move mm_cachep initialization to mm_init()
| * 3d1b8cfd x86/mm: Use mm_alloc() in poking_init()
| * ddcf05fe x86/mm: fix poking_init() for Xen PV guests
| * 3f8968f1 x86/xen: Fix secondary processors' FPU initialization
| * e56c1e0f KVM: Add GDS_NO support to KVM
| * ed56430a x86/speculation: Add Kconfig option for GDS
| * e35c6579 x86/speculation: Add force option to GDS mitigation
| * f68f9f2d x86/speculation: Add Gather Data Sampling mitigation
| * 6e604436 x86/fpu: Move FPU initialization into arch_cpu_finalize_init()
| * 2ee37a46 x86/fpu: Mark init functions __init
| * 77fe8150 x86/fpu: Remove cpuinfo argument from init functions
| * 95356fff init, x86: Move mem_encrypt_init() into arch_cpu_finalize_init()
| * 7aa2cec2 init: Invoke arch_cpu_finalize_init() earlier
| * 944d5c3f init: Remove check_bugs() leftovers
| * a03ef708 um/cpu: Switch to arch_cpu_finalize_init()
| * 98c3955e sparc/cpu: Switch to arch_cpu_finalize_init()
| * 568d68fc sh/cpu: Switch to arch_cpu_finalize_init()
| * 18cd611a mips/cpu: Switch to arch_cpu_finalize_init()
| * 2febb4a7 m68k/cpu: Switch to arch_cpu_finalize_init()
| * 1f4494ea ia64/cpu: Switch to arch_cpu_finalize_init()
| * 73719e89 ARM: cpu: Switch to arch_cpu_finalize_init()
| * 1743bc75 x86/cpu: Switch to arch_cpu_finalize_init()
| * afe787cf init: Provide arch_cpu_finalize_init()
* | 7233414a Revert "posix-timers: Ensure timer ID search-loop limit is valid"
* | f829d762 Revert "drm/panel: Initialise panel dev and funcs through drm_panel_init()"
* | 4d6b7da7 Revert "drm/panel: Add and fill drm_panel type field"
* | 7d6c570f Revert "drm/panel: simple: Add connector_type for innolux_at043tn24"
* | eea11c51 Revert "Revert "8250: add support for ASIX devices with a FIFO bug""
* | 34df0a4c Merge 5.4.251 into android11-5.4-lts
|\|
| * 887433e4 Linux 5.4.251
| * 1e02fbe4 tracing/histograms: Return an error if we fail to add histogram to hist_vars list
| * b1062596 tcp: annotate data-races around fastopenq.max_qlen
| * 21c325d0 tcp: annotate data-races around tp->notsent_lowat
| * 7175277b tcp: annotate data-races around rskq_defer_accept
| * 3121d649 tcp: annotate data-races around tp->linger2
| * b1cd5655 net: Replace the limit of TCP_LINGER2 with TCP_FIN_TIMEOUT_MAX
| * 8ce44cf3 tcp: annotate data-races around tp->tcp_tx_delay
| * c822536b netfilter: nf_tables: can't schedule in nft_chain_validate
| * caa22879 netfilter: nf_tables: fix spurious set element insertion failure
| * b8944e53 llc: Don't drop packet from non-root netns.
| * b07e3182 fbdev: au1200fb: Fix missing IRQ check in au1200fb_drv_probe
| * 6d39e9fc Revert "tcp: avoid the lookup process failing to get sk in ehash table"
| * 0c0bd978 net:ipv6: check return value of pskb_trim()
| * 17046107 iavf: Fix use-after-free in free_netdev
| * 765e1eaf net: ethernet: ti: cpsw_ale: Fix cpsw_ale_get_field()/cpsw_ale_set_field()
| * 3b6f5602 pinctrl: amd: Use amd_pinconf_set() for all config options
| * 951f4e97 fbdev: imxfb: warn about invalid left/right margin
| * 3e03319a spi: bcm63xx: fix max prepend length
| * c9f56f3c igb: Fix igb_down hung on surprise removal
| * 7d80e834 wifi: iwlwifi: mvm: avoid baid size integer overflow
| * 41d14937 wifi: wext-core: Fix -Wstringop-overflow warning in ioctl_standard_iw_point()
| * 970c7035 devlink: report devlink_port_type_warn source device
| * e09a285e bpf: Address KCSAN report on bpf_lru_list
| * cec1857b sched/fair: Don't balance task to its current running CPU
| * 9d8d3df7 arm64: mm: fix VA-range sanity check
| * 8ad6679a posix-timers: Ensure timer ID search-loop limit is valid
| * d0345f7c md/raid10: prevent soft lockup while flush writes
| * 09539f9e md: fix data corruption for raid456 when reshape restart while grow up
| * 4181c30a nbd: Add the maximum limit of allocated index in nbd_dev_add
| * d4f1cd9b debugobjects: Recheck debug_objects_enabled before reporting
| * 0afcebce ext4: correct inline offset when handling xattrs in inode body
| * 5d580017 drm/client: Fix memory leak in drm_client_modeset_probe
| * 52daf6ba drm/client: Fix memory leak in drm_client_target_cloned
| * 9533dbfa can: bcm: Fix UAF in bcm_proc_show()
| * 5dd838be selftests: tc: set timeout to 15 minutes
| * 7f831998 fuse: revalidate: don't invalidate if interrupted
| * ae91ab71 btrfs: fix warning when putting transaction with qgroups enabled after abort
| * e217a3d1 perf probe: Add test for regression introduced by switch to die_get_decl_file()
| * 380c7cea drm/atomic: Fix potential use-after-free in nonblocking commits
| * b7084ebf scsi: qla2xxx: Remove unused nvme_ls_waitq wait queue
| * 3f22f9dd scsi: qla2xxx: Pointer may be dereferenced
| * a1c5149a scsi: qla2xxx: Correct the index of array
| * 1b7e5bdf scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport()
| * 4f90a8b0 scsi: qla2xxx: Fix potential NULL pointer dereference
| * d25fded7 scsi: qla2xxx: Wait for io return on terminate rport
| * 056fd182 tracing/probes: Fix not to count error code to total length
| * 93114cbc tracing: Fix null pointer dereference in tracing_err_log_open()
| * 597eb525 xtensa: ISS: fix call to split_if_spec
| * e8482952 ring-buffer: Fix deadloop issue on reading trace_pipe
| * 48153590 tracing/histograms: Add histograms to hist_vars if they have referenced variables
| * 46574e5a tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() when iterating clk
| * 30962268 tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() in case of error
| * 0697a1a5 Revert "8250: add support for ASIX devices with a FIFO bug"
| * 45e55e9c meson saradc: fix clock divider mask length
| * 2cdced57 ceph: don't let check_caps skip sending responses for revoke msgs
| * 1883a484 hwrng: imx-rngc - fix the timeout for init and self check
| * e3373e6b firmware: stratix10-svc: Fix a potential resource leak in svc_create_memory_pool()
| * 826c7bfe serial: atmel: don't enable IRQs prematurely
| * 15d4bd0f drm/rockchip: vop: Leave vblank enabled in self-refresh
| * 6bc6ec8b drm/atomic: Allow vblank-enabled + self-refresh "disable"
| * f8694270 fs: dlm: return positive pid value for F_GETLK
| * ecfd1f82 md/raid0: add discard support for the 'original' layout
| * dac4afa3 misc: pci_endpoint_test: Re-init completion for every test
| * dd221037 misc: pci_endpoint_test: Free IRQs before removing the device
| * 9cfa4ef2 PCI: rockchip: Set address alignment for endpoint mode
| * 35aec6bc PCI: rockchip: Use u32 variable to access 32-bit registers
| * 13b93891 PCI: rockchip: Fix legacy IRQ generation for RK3399 PCIe endpoint core
| * c049b206 PCI: rockchip: Add poll and timeout to wait for PHY PLLs to be locked
| * a1f311d4 PCI: rockchip: Write PCI Device ID to correct register
| * 59279511 PCI: rockchip: Assert PCI Configuration Enable bit after probe
| * 35c95eda PCI: qcom: Disable write access to read only registers for IP v2.3.3
| * b0aac779 PCI: Add function 1 DMA alias quirk for Marvell 88SE9235
| * f450388d PCI/PM: Avoid putting EloPOS E2/S2/H2 PCIe Ports in D3cold
| * a4855aeb jfs: jfs_dmap: Validate db_l2nbperpage while mounting
| * ee2fd448 ext4: only update i_reserved_data_blocks on successful block allocation
| * 02543d1d ext4: fix wrong unit use in ext4_mb_clear_bb
| * 96a85bec erofs: fix compact 4B support for 16k block size
| * 42725e5c SUNRPC: Fix UAF in svc_tcp_listen_data_ready()
| * 29a56043 misc: fastrpc: Create fastrpc scalar with correct buffer count
| * b1579872 powerpc: Fail build if using recordmcount with binutils v2.37
| * 2b59740e net: bcmgenet: Ensure MDIO unregistration has clocks enabled
| * 1fe96568 mtd: rawnand: meson: fix unaligned DMA buffers handling
| * 86b98203 tpm: tpm_vtpm_proxy: fix a race condition in /dev/vtpmx creation
| * 96a16069 pinctrl: amd: Only use special debounce behavior for GPIO 0
| * 6dcb493f pinctrl: amd: Detect internal GPIO0 debounce handling
| * a1a44365 pinctrl: amd: Fix mistake in handling clearing pins at startup
| * cf57a085 net/sched: make psched_mtu() RTNL-less safe
| * 96391959 net/sched: flower: Ensure both minimum and maximum ports are specified
| * 166fa538 cls_flower: Add extack support for src and dst port range options
| * aadca5f0 wifi: airo: avoid uninitialized warning in airo_get_rate()
| * cc2c06ca erofs: avoid infinite loop in z_erofs_do_read_page() when reading beyond EOF
| * b55c38fe platform/x86: wmi: Break possible infinite loop when parsing GUID
| * cb8a2562 platform/x86: wmi: move variables
| * 669c488c platform/x86: wmi: use guid_t and guid_equal()
| * fd8049d6 platform/x86: wmi: remove unnecessary argument
| * 4c8e26fc platform/x86: wmi: Fix indentation in some cases
| * 8717326e platform/x86: wmi: Replace UUID redefinitions by their originals
| * c7eeba47 ipv6/addrconf: fix a potential refcount underflow for idev
| * 7a065542 NTB: ntb_tool: Add check for devm_kcalloc
| * 88e24361 NTB: ntb_transport: fix possible memory leak while device_register() fails
| * b5b9e041 ntb: intel: Fix error handling in intel_ntb_pci_driver_init()
| * 0ae4fac8 NTB: amd: Fix error handling in amd_ntb_pci_driver_init()
| * bb17520c ntb: idt: Fix error handling in idt_pci_driver_init()
| * 4e64ef41 udp6: fix udp6_ehashfn() typo
| * 61b4c465 icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev().
| * 4c7276a6 ionic: remove WARN_ON to prevent panic_on_warn
| * 3e77647a ionic: ionic_intr_free parameter change
| * f0dc38bd ionic: move irq request to qcq alloc
| * 7cf21fba ionic: clean irq affinity on queue deinit
| * ef7fc26b ionic: improve irq numa locality
| * 808211a8 net/sched: cls_fw: Fix improper refcount update leads to use-after-free
| * d98ac5bc net: mvneta: fix txq_map in case of txq_number==1
| * 58cd1688 scsi: qla2xxx: Fix error code in qla2x00_start_sp()
| * b49b55a7 igc: set TP bit in 'supported' and 'advertising' fields of ethtool_link_ksettings
| * a45afb07 igc: Remove delay during TX ring configuration
| * 59c19008 drm/panel: simple: Add connector_type for innolux_at043tn24
| * 64b76abf drm/panel: Add and fill drm_panel type field
| * 362940f8 drm/panel: Initialise panel dev and funcs through drm_panel_init()
| * 6d5172a3 workqueue: clean up WORK_* constant types, clarify masking
| * 003d3392 net: lan743x: Don't sleep in atomic context
| * 373b9475 block/partition: fix signedness issue for Amiga partitions
| * 22df19fe tty: serial: fsl_lpuart: add earlycon for imx8ulp platform
| * b7d636c9 netfilter: nf_tables: prevent OOB access in nft_byteorder_eval
| * 61c7a525 netfilter: conntrack: Avoid nf_ct_helper_hash uses after free
| * 565bdccd netfilter: nf_tables: fix scheduling-while-atomic splat
| * 7c4610ac netfilter: nf_tables: unbind non-anonymous set if rule construction fails
| * 90d54ee3 netfilter: nf_tables: reject unbound anonymous set before commit phase
| * 1df28fde netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain
| * 1adb5c27 netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE
| * 077ef851 netfilter: nf_tables: add rescheduling points during loop detection walks
| * 11352851 netfilter: nf_tables: use net_generic infra for transaction data
| * d59ed9dc netfilter: add helper function to set up the nfnetlink header and use it
| * fa498dea netfilter: nftables: add helper function to set the base sequence number
| * ef35dd70 netfilter: nf_tables: fix nat hook table deletion
| * d1b7fe30 block: add overflow checks for Amiga partition support
| * 2b71cbf7 fanotify: disallow mount/sb marks on kernel internal pseudo fs
| * 9a6ce27a fs: no need to check source
| * c1c41cda ARM: orion5x: fix d2net gpio initialization
| * 679c3482 btrfs: fix race when deleting quota root from the dirty cow roots list
| * f0fbbd40 fs: Lock moved directories
| * b97ac51f fs: Establish locking order for unrelated directories
| * d95dc41a Revert "f2fs: fix potential corruption when moving a directory"
| * a9a92642 ext4: Remove ext4 locking of moved directory
| * eefebf88 fs: avoid empty option when generating legacy mount string
| * e9a3310b jffs2: reduce stack usage in jffs2_build_xattr_subsystem()
| * a249a61a integrity: Fix possible multiple allocation in integrity_inode_get()
| * 0729029e bcache: Remove unnecessary NULL point check in node allocations
| * 4be68f1c mmc: sdhci: fix DMA configure compatibility issue when 64bit DMA mode is used.
| * 2f6c7699 mmc: core: disable TRIM on Micron MTFC4GACAJCN-1M
| * c491e271 mmc: core: disable TRIM on Kingston EMMC04G-M627
| * ce7278de NFSD: add encoding of op_recall flag for write delegation
| * 50165112 ALSA: jack: Fix mutex call in snd_jack_report()
| * c64fda48 i2c: xiic: Don't try to handle more interrupt events after error
| * 696e470e i2c: xiic: Defer xiic_wakeup() and __xiic_start_xfer() in xiic_process()
| * 49896271 sh: dma: Fix DMA channel offset calculation
| * 58b1b3c5 net: dsa: tag_sja1105: fix MAC DA patching from meta frames
| * 67a67e25 net/sched: act_pedit: Add size check for TCA_PEDIT_PARMS_EX
| * ab0085bd xsk: Honor SO_BINDTODEVICE on bind
| * 9347e432 xsk: Improve documentation for AF_XDP
| * e63dc31b tcp: annotate data races in __tcp_oow_rate_limited()
| * e9c26879 net: bridge: keep ports without IFF_UNICAST_FLT in BR_PROMISC mode
| * fffa51e7 powerpc: allow PPC_EARLY_DEBUG_CPM only when SERIAL_CPM=y
| * 45b34500 f2fs: fix error path handling in truncate_dnode()
| * 860d9b71 mailbox: ti-msgmgr: Fill non-message tx data fields with 0x0
| * 398e6a01 spi: bcm-qspi: return error if neither hif_mspi nor mspi is available
| * 18d50fb4 Add MODULE_FIRMWARE() for FIRMWARE_TG357766.
| * 4d8fc613 sctp: fix potential deadlock on &net->sctp.addr_wq_lock
| * 999ff7fe rtc: st-lpc: Release some resources in st_rtc_probe() in case of error
| * d5c39cca pwm: sysfs: Do not apply state to already disabled PWMs
| * 5375c024 pwm: imx-tpm: force 'real_period' to be zero in suspend
| * d252c74b mfd: stmpe: Only disable the regulators if they are enabled
| * d9db18ad KVM: s390: vsie: fix the length of APCB bitmap
| * baec7967 mfd: stmfx: Fix error path in stmfx_chip_init
| * 5d26f134 serial: 8250_omap: Use force_suspend and resume for system suspend
| * 337073ca mfd: intel-lpss: Add missing check for platform_get_resource
| * 0a6afc83 usb: dwc3: qcom: Release the correct resources in dwc3_qcom_remove()
| * becd0968 KVM: s390: fix KVM_S390_GET_CMMA_BITS for GFNs in memslot holes
| * 151b0dd6 mfd: rt5033: Drop rt5033-battery sub-device
| * 8e8dae8e usb: hide unused usbfs_notify_suspend/resume functions
| * fe9cdc19 usb: phy: phy-tahvo: fix memory leak in tahvo_usb_probe()
| * 1531ba3f extcon: Fix kernel doc of property capability fields to avoid warnings
| * 257daec2 extcon: Fix kernel doc of property fields to avoid warnings
| * 648a163c usb: dwc3: qcom: Fix potential memory leak
| * d485150c media: usb: siano: Fix warning due to null work_func_t function pointer
| * 619e6f9a media: videodev2.h: Fix struct v4l2_input tuner index comment
| * e9586c49 media: usb: Check az6007_read() return value
| * fd869bdb sh: j2: Use ioremap() to translate device tree address into kernel memory
| * 85f4c538 w1: fix loop in w1_fini()
| * dc88382c block: change all __u32 annotations to __be32 in affs_hardblocks.h
| * fa8548d1 block: fix signed int overflow in Amiga partition support
| * bec21825 usb: dwc3: gadget: Propagate core init errors to UDC during pullup
| * f55127df USB: serial: option: add LARA-R6 01B PIDs
| * bac502cd hwrng: st - keep clock enabled while hwrng is registered
| * 07156020 hwrng: st - Fix W=1 unused variable warning
| * 18fa56ca NFSv4.1: freeze the session table upon receiving NFS4ERR_BADSESSION
| * c182d87c ARC: define ASM_NL and __ALIGN(_STR) outside #ifdef __ASSEMBLY__ guard
| * 02dc8e8b modpost: fix off by one in is_executable_section()
| * 1030c0c3 crypto: marvell/cesa - Fix type mismatch warning
| * ad3c4ecf modpost: fix section mismatch message for R_ARM_{PC24,CALL,JUMP24}
| * 084bf580 modpost: fix section mismatch message for R_ARM_ABS32
| * c893658d crypto: nx - fix build warnings when DEBUG_FS is not enabled
| * a43bcb0b hwrng: virtio - Fix race on data_avail and actual data
| * b70315e4 hwrng: virtio - always add a pending request
| * 102a354d hwrng: virtio - don't waste entropy
| * f2a7dfd3 hwrng: virtio - don't wait on cleanup
| * 6fe73276 hwrng: virtio - add an internal buffer
| * 2cbfb51d powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary
| * aa3932eb pinctrl: at91-pio4: check return value of devm_kasprintf()
| * e297350c perf dwarf-aux: Fix off-by-one in die_get_varname()
| * 7f822c80 pinctrl: cherryview: Return correct value if pin in push-pull mode
| * 1768e362 PCI: Add pci_clear_master() stub for non-CONFIG_PCI
| * 5d3955bc PCI: ftpci100: Release the clock resources
| * 331dce61 PCI: pciehp: Cancel bringup sequence if card is not present
| * f58c8563 scsi: 3w-xxxx: Add error handling for initialization failure in tw_probe()
| * 666e7f9d PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free
| * 961c8370 scsi: qedf: Fix NULL dereference in error handling
| * 6f64558b ASoC: imx-audmix: check return value of devm_kasprintf()
| * 35455616 clk: keystone: sci-clk: check return value of kasprintf()
| * ffe6ad17 clk: cdce925: check return value of kasprintf()
| * 5f13d670 ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer
| * 801c8341 clk: tegra: tegra124-emc: Fix potential memory leak
| * 262db3ff drm/radeon: fix possible division-by-zero errors
| * cacc0506 drm/amdkfd: Fix potential deallocation of previously deallocated memory.
| * 9e3858f8 fbdev: omapfb: lcd_mipid: Fix an error handling path in mipid_spi_probe()
| * 5541d185 arm64: dts: renesas: ulcb-kf: Remove flow control for SCIF1
| * 40ac5cb6 IB/hfi1: Fix sdma.h tx->num_descs off-by-one errors
| * 68e0033d soc/fsl/qe: fix usb.c build errors
| * b756eb5e ASoC: es8316: Do not set rate constraints for unsupported MCLKs
| * d1c1ca27 ASoC: es8316: Increment max value for ALC Capture Target Volume control
| * b54bac97 memory: brcmstb_dpfe: fix testing array offset after use
| * f54142ed ARM: ep93xx: fix missing-prototype warnings
| * c2324c5a drm/panel: simple: fix active size for Ampire AM-480272H3TMQW-T01H
| * 4a239542 arm64: dts: qcom: msm8916: correct camss unit address
| * 97dcb8df ARM: dts: gta04: Move model property out of pinctrl node
| * 25bbd1c7 RDMA/bnxt_re: Fix to remove an unnecessary log
| * ed039ad8 drm: sun4i_tcon: use devm_clk_get_enabled in `sun4i_tcon_init_clocks`
| * 87ccaf56 Input: adxl34x - do not hardcode interrupt trigger type
| * c7a8cc91 ARM: dts: BCM5301X: Drop "clock-names" from the SPI node
| * c516c008 Input: drv260x - sleep between polling GO bit
| * 3e789aee radeon: avoid double free in ci_dpm_init()
| * bc5b57a2 netlink: Add __sock_i_ino() for __netlink_diag_dump().
| * 1c405b3d ipvlan: Fix return value of ipvlan_queue_xmit()
| * 1d2ab3d4 netfilter: nf_conntrack_sip: fix the ct_sip_parse_numerical_param() return value.
| * 337fdce4 netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one
| * 32deadf8 lib/ts_bm: reset initial match offset for every block of text
| * dd6ff3f3 net: nfc: Fix use-after-free caused by nfc_llcp_find_local
| * edc5d877 nfc: llcp: simplify llcp_sock_connect() error paths
| * 9c9662e2 gtp: Fix use-after-free in __gtp_encap_destroy().
| * 08d8ff1b selftests: rtnetlink: remove netdevsim device after ipsec offload test
| * bd1de610 netlink: do not hard code device address lenth in fdb dumps
| * 8f6652ed netlink: fix potential deadlock in netlink_set_err()
| * 88d89b4a wifi: ath9k: convert msecs to jiffies where needed
| * 76d5bda2 wifi: cfg80211: rewrite merging of inherited elements
| * e4c33144 wifi: iwlwifi: pull from TXQs with softirqs disabled
| * 2ba902da rtnetlink: extend RTEXT_FILTER_SKIP_STATS to IFLA_VF_INFO
| * 786e264b wifi: ath9k: Fix possible stall on ath9k_txq_list_has_key()
| * 68305a19 memstick r592: make memstick_debug_get_tpc_name() static
| * 6f4454cc kexec: fix a memory leak in crash_shrink_memory()
| * 4503261a watchdog/perf: more properly prevent false positives with turbo modes
| * d5fa3918 watchdog/perf: define dummy watchdog_update_hrtimer_threshold() on correct config
| * 7874fb3b wifi: rsi: Do not set MMC_PM_KEEP_POWER in shutdown
| * 4dc35605 wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes
| * f4321980 wifi: ray_cs: Fix an error handling path in ray_probe()
| * 8fe51dce wifi: ray_cs: Drop useless status variable in parse_addr()
| * 0dec0ad3 wifi: ray_cs: Utilize strnlen() in parse_addr()
| * ee73ad56 wifi: wl3501_cs: Fix an error handling path in wl3501_probe()
| * b7df4e0c wl3501_cs: use eth_hw_addr_set()
| * 24f34f67 net: create netdev->dev_addr assignment helpers
| * dd5dca10 wl3501_cs: Fix misspelling and provide missing documentation
| * 051d7077 wl3501_cs: Remove unnecessary NULL check
| * 91c3c9ea wl3501_cs: Fix a bunch of formatting issues related to function docs
| * add539f7 wifi: atmel: Fix an error handling path in atmel_probe()
| * 5b06f702 wifi: orinoco: Fix an error handling path in orinoco_cs_probe()
| * ca4a2955 wifi: orinoco: Fix an error handling path in spectrum_cs_probe()
| * 91c3325d regulator: core: Streamline debugfs operations
| * 1bb38ef6 regulator: core: Fix more error checking for debugfs_create_dir()
| * 6ca0c94f nfc: llcp: fix possible use of uninitialized variable in nfc_llcp_send_connect()
| * 66a1be74 nfc: constify several pointers to u8, char and sk_buff
| * fea2104e wifi: mwifiex: Fix the size of a memory allocation in mwifiex_ret_802_11_scan()
| * bc509951 spi: spi-geni-qcom: Correct CS_TOGGLE bit in SPI_TRANS_CFG
| * f394d204 samples/bpf: Fix buffer overflow in tcp_basertt
| * 90e3c101 wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx
| * be3989d9 wifi: ath9k: fix AR9003 mac hardware hang check register offset calculation
| * 717e4277 ima: Fix build warnings
| * 8430a8e8 pstore/ram: Add check for kstrdup
| * 540cdd72 evm: Complete description of evm_inode_setattr()
| * 568b7340 ARM: 9303/1: kprobes: avoid missing-declaration warnings
| * ba6da16e powercap: RAPL: Fix CONFIG_IOSF_MBI dependency
| * c97460ce PM: domains: fix integer overflow issues in genpd_parse_state()
| * 54cc10a0 clocksource/drivers/cadence-ttc: Fix memory leak in ttc_timer_probe
| * 38ca169d clocksource/drivers/cadence-ttc: Use ttc driver as platform driver
| * 8af3b8d7 tracing/timer: Add missing hrtimer modes to decode_hrtimer_mode().
| * 7b0c6645 irqchip/jcore-aic: Fix missing allocation of IRQ descriptors
| * d244927e irqchip/jcore-aic: Kill use of irq_create_strict_mappings()
| * be481881 md/raid10: fix io loss while replacement replace rdev
| * 45fa023b md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request
| * 31c805a4 md/raid10: fix wrong setting of max_corr_read_errors
| * 283f4a63 md/raid10: fix overflow of md/safe_mode_delay
| * b0b971fe md/raid10: check slab-out-of-bounds in md_bitmap_get_counter
| * 48410491 x86/resctrl: Only show tasks' pid in current pid namespace
| * 7206eca1 x86/resctrl: Use is_closid_match() in more places
| * 6f2bb37d bgmac: fix *initial* chip reset to support BCM5358
| * 794bfb6f drm/amdgpu: Validate VM ioctl flags.
| * 2a4cfd5b scripts/tags.sh: Resolve gtags empty index generation
| * fff826d6 drm/i915: Initialise outparam for error return from wait_for_register
| * 99036f1a HID: wacom: Use ktime_t rather than int when dealing with timestamps
| * 815c95d8 fbdev: imsttfb: Fix use after free bug in imsttfb_probe
| * a7c8d2f3 video: imsttfb: check for ioremap() failures
| * f042d80a x86/smp: Use dedicated cache-line for mwait_play_dead()
| * 23f98fe8 gfs2: Don't deref jdesc in evict
* | f9395ee5 Merge branch 'android11-5.4 into branch 'android11-5.4-lts'
* | bf04ac50 Merge 5.4.250 into android11-5.4-lts
|/
* 27745d94 Linux 5.4.250
* 00363ef3 x86/cpu/amd: Add a Zenbleed fix
* 92b292be x86/cpu/amd: Move the errata checking functionality up
* 4d4112e2 x86/microcode/AMD: Load late on both threads too

Change-Id: I002d618a2982b4dc957a5fe58620d506d3be6bbd
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@google.com>
parents 627da86f aa527280
Loading
Loading
Loading
Loading
+6 −5
Original line number Diff line number Diff line
@@ -480,16 +480,17 @@ Description: information about CPUs heterogeneity.
		cpu_capacity: capacity of cpu#.

What:		/sys/devices/system/cpu/vulnerabilities
		/sys/devices/system/cpu/vulnerabilities/gather_data_sampling
		/sys/devices/system/cpu/vulnerabilities/itlb_multihit
		/sys/devices/system/cpu/vulnerabilities/l1tf
		/sys/devices/system/cpu/vulnerabilities/mds
		/sys/devices/system/cpu/vulnerabilities/meltdown
		/sys/devices/system/cpu/vulnerabilities/mmio_stale_data
		/sys/devices/system/cpu/vulnerabilities/spec_store_bypass
		/sys/devices/system/cpu/vulnerabilities/spectre_v1
		/sys/devices/system/cpu/vulnerabilities/spectre_v2
		/sys/devices/system/cpu/vulnerabilities/spec_store_bypass
		/sys/devices/system/cpu/vulnerabilities/l1tf
		/sys/devices/system/cpu/vulnerabilities/mds
		/sys/devices/system/cpu/vulnerabilities/srbds
		/sys/devices/system/cpu/vulnerabilities/tsx_async_abort
		/sys/devices/system/cpu/vulnerabilities/itlb_multihit
		/sys/devices/system/cpu/vulnerabilities/mmio_stale_data
Date:		January 2018
Contact:	Linux kernel mailing list <linux-kernel@vger.kernel.org>
Description:	Information about CPU vulnerabilities
+109 −0
Original line number Diff line number Diff line
.. SPDX-License-Identifier: GPL-2.0

GDS - Gather Data Sampling
==========================

Gather Data Sampling is a hardware vulnerability which allows unprivileged
speculative access to data which was previously stored in vector registers.

Problem
-------
When a gather instruction performs loads from memory, different data elements
are merged into the destination vector register. However, when a gather
instruction that is transiently executed encounters a fault, stale data from
architectural or internal vector registers may get transiently forwarded to the
destination vector register instead. This will allow a malicious attacker to
infer stale data using typical side channel techniques like cache timing
attacks. GDS is a purely sampling-based attack.

The attacker uses gather instructions to infer the stale vector register data.
The victim does not need to do anything special other than use the vector
registers. The victim does not need to use gather instructions to be
vulnerable.

Because the buffers are shared between Hyper-Threads cross Hyper-Thread attacks
are possible.

Attack scenarios
----------------
Without mitigation, GDS can infer stale data across virtually all
permission boundaries:

	Non-enclaves can infer SGX enclave data
	Userspace can infer kernel data
	Guests can infer data from hosts
	Guest can infer guest from other guests
	Users can infer data from other users

Because of this, it is important to ensure that the mitigation stays enabled in
lower-privilege contexts like guests and when running outside SGX enclaves.

The hardware enforces the mitigation for SGX. Likewise, VMMs should  ensure
that guests are not allowed to disable the GDS mitigation. If a host erred and
allowed this, a guest could theoretically disable GDS mitigation, mount an
attack, and re-enable it.

Mitigation mechanism
--------------------
This issue is mitigated in microcode. The microcode defines the following new
bits:

 ================================   ===   ============================
 IA32_ARCH_CAPABILITIES[GDS_CTRL]   R/O   Enumerates GDS vulnerability
                                          and mitigation support.
 IA32_ARCH_CAPABILITIES[GDS_NO]     R/O   Processor is not vulnerable.
 IA32_MCU_OPT_CTRL[GDS_MITG_DIS]    R/W   Disables the mitigation
                                          0 by default.
 IA32_MCU_OPT_CTRL[GDS_MITG_LOCK]   R/W   Locks GDS_MITG_DIS=0. Writes
                                          to GDS_MITG_DIS are ignored
                                          Can't be cleared once set.
 ================================   ===   ============================

GDS can also be mitigated on systems that don't have updated microcode by
disabling AVX. This can be done by setting gather_data_sampling="force" or
"clearcpuid=avx" on the kernel command-line.

If used, these options will disable AVX use by turning off XSAVE YMM support.
However, the processor will still enumerate AVX support.  Userspace that
does not follow proper AVX enumeration to check both AVX *and* XSAVE YMM
support will break.

Mitigation control on the kernel command line
---------------------------------------------
The mitigation can be disabled by setting "gather_data_sampling=off" or
"mitigations=off" on the kernel command line. Not specifying either will default
to the mitigation being enabled. Specifying "gather_data_sampling=force" will
use the microcode mitigation when available or disable AVX on affected systems
where the microcode hasn't been updated to include the mitigation.

GDS System Information
------------------------
The kernel provides vulnerability status information through sysfs. For
GDS this can be accessed by the following sysfs file:

/sys/devices/system/cpu/vulnerabilities/gather_data_sampling

The possible values contained in this file are:

 ============================== =============================================
 Not affected                   Processor not vulnerable.
 Vulnerable                     Processor vulnerable and mitigation disabled.
 Vulnerable: No microcode       Processor vulnerable and microcode is missing
                                mitigation.
 Mitigation: AVX disabled,
 no microcode                   Processor is vulnerable and microcode is missing
                                mitigation. AVX disabled as mitigation.
 Mitigation: Microcode          Processor is vulnerable and mitigation is in
                                effect.
 Mitigation: Microcode (locked) Processor is vulnerable and mitigation is in
                                effect and cannot be disabled.
 Unknown: Dependent on
 hypervisor status              Running on a virtual guest processor that is
                                affected but with no way to know if host
                                processor is mitigated or vulnerable.
 ============================== =============================================

GDS Default mitigation
----------------------
The updated microcode will enable the mitigation by default. The kernel's
default action is to leave the mitigation enabled.
+1 −0
Original line number Diff line number Diff line
@@ -16,3 +16,4 @@ are configurable at compile, boot or run time.
   multihit.rst
   special-register-buffer-data-sampling.rst
   processor_mmio_stale_data.rst
   gather_data_sampling.rst
+30 −9
Original line number Diff line number Diff line
@@ -1336,6 +1336,26 @@
			Format: off | on
			default: on

	gather_data_sampling=
			[X86,INTEL] Control the Gather Data Sampling (GDS)
			mitigation.

			Gather Data Sampling is a hardware vulnerability which
			allows unprivileged speculative access to data which was
			previously stored in vector registers.

			This issue is mitigated by default in updated microcode.
			The mitigation may have a performance impact but can be
			disabled. On systems without the microcode mitigation
			disabling AVX serves as a mitigation.

			force:	Disable AVX to mitigate systems without
				microcode mitigation. No effect if the microcode
				mitigation is present. Known to cause crashes in
				userspace with buggy AVX enumeration.

			off:    Disable GDS mitigation.

	gcov_persist=	[GCOV] When non-zero (default), profiling data for
			kernel modules is saved and remains accessible via
			debugfs, even when the module is unloaded/reloaded.
@@ -2696,21 +2716,22 @@
				Disable all optional CPU mitigations.  This
				improves system performance, but it may also
				expose users to several CPU vulnerabilities.
				Equivalent to: nopti [X86,PPC]
				Equivalent to: gather_data_sampling=off [X86]
					       kpti=0 [ARM64]
					       nospectre_v1 [X86,PPC]
					       kvm.nx_huge_pages=off [X86]
					       l1tf=off [X86]
					       mds=off [X86]
					       mmio_stale_data=off [X86]
					       no_entry_flush [PPC]
					       no_uaccess_flush [PPC]
					       nobp=0 [S390]
					       nopti [X86,PPC]
					       nospectre_v1 [X86,PPC]
					       nospectre_v2 [X86,PPC,S390,ARM64]
					       spectre_v2_user=off [X86]
					       spec_store_bypass_disable=off [X86,PPC]
					       spectre_v2_user=off [X86]
					       ssbd=force-off [ARM64]
					       l1tf=off [X86]
					       mds=off [X86]
					       tsx_async_abort=off [X86]
					       kvm.nx_huge_pages=off [X86]
					       no_entry_flush [PPC]
					       no_uaccess_flush [PPC]
					       mmio_stale_data=off [X86]

				Exceptions:
					       This does not have any effect on
+18 −21
Original line number Diff line number Diff line
@@ -56,31 +56,28 @@ information submitted to the security list and any followup discussions
of the report are treated confidentially even after the embargo has been
lifted, in perpetuity.

Coordination
------------

Fixes for sensitive bugs, such as those that might lead to privilege
escalations, may need to be coordinated with the private
<linux-distros@vs.openwall.org> mailing list so that distribution vendors
are well prepared to issue a fixed kernel upon public disclosure of the
upstream fix. Distros will need some time to test the proposed patch and
will generally request at least a few days of embargo, and vendor update
publication prefers to happen Tuesday through Thursday. When appropriate,
the security team can assist with this coordination, or the reporter can
include linux-distros from the start. In this case, remember to prefix
the email Subject line with "[vs]" as described in the linux-distros wiki:
<http://oss-security.openwall.org/wiki/mailing-lists/distros#how-to-use-the-lists>
Coordination with other groups
------------------------------

The kernel security team strongly recommends that reporters of potential
security issues NEVER contact the "linux-distros" mailing list until
AFTER discussing it with the kernel security team.  Do not Cc: both
lists at once.  You may contact the linux-distros mailing list after a
fix has been agreed on and you fully understand the requirements that
doing so will impose on you and the kernel community.

The different lists have different goals and the linux-distros rules do
not contribute to actually fixing any potential security problems.

CVE assignment
--------------

The security team does not normally assign CVEs, nor do we require them
for reports or fixes, as this can needlessly complicate the process and
may delay the bug handling. If a reporter wishes to have a CVE identifier
assigned ahead of public disclosure, they will need to contact the private
linux-distros list, described above. When such a CVE identifier is known
before a patch is provided, it is desirable to mention it in the commit
message if the reporter agrees.
The security team does not assign CVEs, nor do we require them for
reports or fixes, as this can needlessly complicate the process and may
delay the bug handling.  If a reporter wishes to have a CVE identifier
assigned, they should find one by themselves, for example by contacting
MITRE directly.  However under no circumstances will a patch inclusion
be delayed to wait for a CVE identifier to arrive.

Non-disclosure agreements
-------------------------
Loading