Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Unverified Commit 10ae1dae authored by Michael Bestas's avatar Michael Bestas
Browse files

Merge tag 'ASB-2024-09-05_4.19-stable' of... 

Merge tag 'ASB-2024-09-05_4.19-stable' of https://android.googlesource.com/kernel/common into android13-4.19-kona

https://source.android.com/docs/security/bulletin/2024-09-01
CVE-2024-36972

* tag 'ASB-2024-09-05_4.19-stable' of https://android.googlesource.com/kernel/common: (331 commits)
  Linux 4.19.321
  drm/fb-helper: set x/yres_virtual in drm_fb_helper_check_var
  ipc: remove memcg accounting for sops objects in do_semtimedop()
  scsi: aacraid: Fix double-free on probe failure
  usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in remove_power_attributes()
  usb: dwc3: st: fix probed platform device ref count on probe error path
  usb: dwc3: core: Prevent USB core invalid event buffer address access
  usb: dwc3: omap: add missing depopulate in probe error path
  USB: serial: option: add MeiG Smart SRM825L
  cdc-acm: Add DISABLE_ECHO quirk for GE HealthCare UI Controller
  net: busy-poll: use ktime_get_ns() instead of local_clock()
  gtp: fix a potential NULL pointer dereference
  soundwire: stream: fix programming slave ports for non-continous port maps
  net: prevent mss overflow in skb_segment()
  ida: Fix crash in ida_free when the bitmap is empty
  net:rds: Fix possible deadlock in rds_message_put
  fbmem: Check virtual screen sizes in fb_set_var()
  fbcon: Prevent that screen size is smaller than font size
  memcg: enable accounting of ipc resources
  cgroup/cpuset: Prevent UAF in proc_cpuset_show()
  ...

 Conflicts:
	Documentation/arm64/silicon-errata.txt
	arch/arm64/include/asm/cpucaps.h
	arch/arm64/kernel/cpu_errata.c
	drivers/mmc/core/mmc_test.c

Change-Id: Ibfaed509d545f9895e5d515f4e237d9c97c2086d
parents 5889b586 d7575523

Documentation/arm64/silicon-errata.txt

+18 −0
Original line number Diff line number Diff line
@@ -61,8 +61,26 @@ stable kernels. 
| ARM            | Cortex-A73      | #858921         | ARM64_ERRATUM_858921        |

| ARM            | Cortex-A55      | #1024718        | ARM64_ERRATUM_1024718       |

| ARM            | Cortex-A76      | #1463225        | ARM64_ERRATUM_1463225       |

| ARM            | Cortex-A76      | #3324349        | ARM64_ERRATUM_3194386       |

| ARM            | Cortex-A77      | #3324348        | ARM64_ERRATUM_3194386       |

| ARM            | Cortex-A78      | #3324344        | ARM64_ERRATUM_3194386       |

| ARM            | Cortex-A78C     | #3324346,3324347| ARM64_ERRATUM_3194386       |

| ARM            | Cortex-A710     | #3324338        | ARM64_ERRATUM_3194386       |

| ARM            | Cortex-A720     | #3456091        | ARM64_ERRATUM_3194386       |

| ARM            | Cortex-A725     | #3456106        | ARM64_ERRATUM_3194386       |

| ARM            | Cortex-X1       | #3324344        | ARM64_ERRATUM_3194386       |

| ARM            | Cortex-X1C      | #3324346        | ARM64_ERRATUM_3194386       |

| ARM            | Cortex-X2       | #3324338        | ARM64_ERRATUM_3194386       |

| ARM            | Cortex-X3       | #3324335        | ARM64_ERRATUM_3194386       |

| ARM            | Cortex-X4       | #3194386        | ARM64_ERRATUM_3194386       |

| ARM            | Cortex-X925     | #3324334        | ARM64_ERRATUM_3194386       |

| ARM            | Cortex-A77      | #1542418        | ARM64_ERRATUM_1542418       |

| ARM            | Neoverse-N1     | #1542419        | ARM64_ERRATUM_1542419       |

| ARM            | Neoverse-N1     | #3324349        | ARM64_ERRATUM_3194386       |

| ARM            | Neoverse-N2     | #3324339        | ARM64_ERRATUM_3194386       |

| ARM            | Neoverse-V1     | #3324341        | ARM64_ERRATUM_3194386       |

| ARM            | Neoverse-V2     | #3324336        | ARM64_ERRATUM_3194386       |

| ARM            | Neoverse-V3     | #3312417        | ARM64_ERRATUM_3194386       |

| ARM            | MMU-500         | #841119,#826419 | N/A                         |

|                |                 |                 |                             |

| Cavium         | ThunderX ITS    | #22375, #24313  | CAVIUM_ERRATUM_22375        |

Documentation/hwmon/hwmon-kernel-api.txt

+16 −8
Original line number Diff line number Diff line
@@ -299,17 +299,25 @@ functions is used. 
The header file linux/hwmon-sysfs.h provides a number of useful macros to

declare and use hardware monitoring sysfs attributes.



In many cases, you can use the exsting define DEVICE_ATTR to declare such

attributes. This is feasible if an attribute has no additional context. However,

in many cases there will be additional information such as a sensor index which

will need to be passed to the sysfs attribute handling function.

In many cases, you can use the exsting define DEVICE_ATTR or its variants

DEVICE_ATTR_{RW,RO,WO} to declare such attributes. This is feasible if an

attribute has no additional context. However, in many cases there will be

additional information such as a sensor index which will need to be passed

to the sysfs attribute handling function.



SENSOR_DEVICE_ATTR and SENSOR_DEVICE_ATTR_2 can be used to define attributes

which need such additional context information. SENSOR_DEVICE_ATTR requires

one additional argument, SENSOR_DEVICE_ATTR_2 requires two.



SENSOR_DEVICE_ATTR defines a struct sensor_device_attribute variable.

This structure has the following fields.

Simplified variants of SENSOR_DEVICE_ATTR and SENSOR_DEVICE_ATTR_2 are available

and should be used if standard attribute permissions and function names are

feasible. Standard permissions are 0644 for SENSOR_DEVICE_ATTR[_2]_RW,

0444 for SENSOR_DEVICE_ATTR[_2]_RO, and 0200 for SENSOR_DEVICE_ATTR[_2]_WO.

Standard functions, similar to DEVICE_ATTR_{RW,RO,WO}, have _show and _store

appended to the provided function name.



SENSOR_DEVICE_ATTR and its variants define a struct sensor_device_attribute

variable. This structure has the following fields.



struct sensor_device_attribute {

	struct device_attribute dev_attr;
@@ -320,8 +328,8 @@ You can use to_sensor_dev_attr to get the pointer to this structure from the 
attribute read or write function. Its parameter is the device to which the

attribute is attached.



SENSOR_DEVICE_ATTR_2 defines a struct sensor_device_attribute_2 variable,

which is defined as follows.

SENSOR_DEVICE_ATTR_2 and its variants define a struct sensor_device_attribute_2

variable, which is defined as follows.



struct sensor_device_attribute_2 {

	struct device_attribute dev_attr;

Makefile

+1 −1
Original line number Diff line number Diff line 
# SPDX-License-Identifier: GPL-2.0

VERSION = 4

PATCHLEVEL = 19

SUBLEVEL = 318

SUBLEVEL = 321

EXTRAVERSION =

NAME = "People's Front"

arch/arm/include/asm/uaccess.h

+2 −12
Original line number Diff line number Diff line
@@ -145,16 +145,6 @@ extern int __get_user_64t_1(void *); 
extern int __get_user_64t_2(void *);

extern int __get_user_64t_4(void *);



#define __GUP_CLOBBER_1	"lr", "cc"

#ifdef CONFIG_CPU_USE_DOMAINS

#define __GUP_CLOBBER_2	"ip", "lr", "cc"

#else

#define __GUP_CLOBBER_2 "lr", "cc"

#endif

#define __GUP_CLOBBER_4	"lr", "cc"

#define __GUP_CLOBBER_32t_8 "lr", "cc"

#define __GUP_CLOBBER_8	"lr", "cc"



#define __get_user_x(__r2, __p, __e, __l, __s)				\

	   __asm__ __volatile__ (					\

		__asmeq("%0", "r0") __asmeq("%1", "r2")			\
@@ -162,7 +152,7 @@ extern int __get_user_64t_4(void *); 
		"bl	__get_user_" #__s				\

		: "=&r" (__e), "=r" (__r2)				\

		: "0" (__p), "r" (__l)					\

		: __GUP_CLOBBER_##__s)

		: "ip", "lr", "cc")



/* narrowing a double-word get into a single 32bit word register: */

#ifdef __ARMEB__
@@ -184,7 +174,7 @@ extern int __get_user_64t_4(void *); 
		"bl	__get_user_64t_" #__s				\

		: "=&r" (__e), "=r" (__r2)				\

		: "0" (__p), "r" (__l)					\

		: __GUP_CLOBBER_##__s)

		: "ip", "lr", "cc")

#else

#define __get_user_x_64t __get_user_x

#endif

arch/arm64/Kconfig

+38 −0
Original line number Diff line number Diff line
@@ -579,6 +579,44 @@ config ARM64_ERRATUM_1742098 


	  If unsure, say Y.



config ARM64_ERRATUM_3194386

	bool "Cortex-*/Neoverse-*: workaround for MSR SSBS not self-synchronizing"

	default y

	help

	  This option adds the workaround for the following errata:



	  * ARM Cortex-A76 erratum 3324349

	  * ARM Cortex-A77 erratum 3324348

	  * ARM Cortex-A78 erratum 3324344

	  * ARM Cortex-A78C erratum 3324346

	  * ARM Cortex-A78C erratum 3324347

	  * ARM Cortex-A710 erratam 3324338

	  * ARM Cortex-A720 erratum 3456091

	  * ARM Cortex-A725 erratum 3456106

	  * ARM Cortex-X1 erratum 3324344

	  * ARM Cortex-X1C erratum 3324346

	  * ARM Cortex-X2 erratum 3324338

	  * ARM Cortex-X3 erratum 3324335

	  * ARM Cortex-X4 erratum 3194386

	  * ARM Cortex-X925 erratum 3324334

	  * ARM Neoverse-N1 erratum 3324349

	  * ARM Neoverse N2 erratum 3324339

	  * ARM Neoverse-V1 erratum 3324341

	  * ARM Neoverse V2 erratum 3324336

	  * ARM Neoverse-V3 erratum 3312417



	  On affected cores "MSR SSBS, #0" instructions may not affect

	  subsequent speculative instructions, which may permit unexepected

	  speculative store bypassing.



	  Work around this problem by placing a Speculation Barrier (SB) or

	  Instruction Synchronization Barrier (ISB) after kernel changes to

	  SSBS. The presence of the SSBS special-purpose register is hidden

	  from hwcaps and EL0 reads of ID_AA64PFR1_EL1, such that userspace

	  will use the PR_SPEC_STORE_BYPASS prctl to change SSBS.



	  If unsure, say Y.



config CAVIUM_ERRATUM_22375

	bool "Cavium erratum 22375, 24313"

	default y