Commit 50f91435 authored May 22, 2019 by Greg Kroah-Hartman

Merge 4.19.45 into android-4.19



Changes in 4.19.45
	locking/rwsem: Prevent decrement of reader count before increment
	x86/speculation/mds: Revert CPU buffer clear on double fault exit
	x86/speculation/mds: Improve CPU buffer clear documentation
	objtool: Fix function fallthrough detection
	arm64: dts: rockchip: Disable DCMDs on RK3399's eMMC controller.
	ARM: dts: exynos: Fix interrupt for shared EINTs on Exynos5260
	ARM: dts: exynos: Fix audio (microphone) routing on Odroid XU3
	mmc: sdhci-of-arasan: Add DTS property to disable DCMDs.
	ARM: exynos: Fix a leaked reference by adding missing of_node_put
	power: supply: axp288_charger: Fix unchecked return value
	power: supply: axp288_fuel_gauge: Add ACEPC T8 and T11 mini PCs to the blacklist
	arm64: mmap: Ensure file offset is treated as unsigned
	arm64: arch_timer: Ensure counter register reads occur with seqlock held
	arm64: compat: Reduce address limit
	arm64: Clear OSDLR_EL1 on CPU boot
	arm64: Save and restore OSDLR_EL1 across suspend/resume
	sched/x86: Save [ER]FLAGS on context switch
	crypto: crypto4xx - fix ctr-aes missing output IV
	crypto: crypto4xx - fix cfb and ofb "overran dst buffer" issues
	crypto: salsa20 - don't access already-freed walk.iv
	crypto: chacha20poly1305 - set cra_name correctly
	crypto: ccp - Do not free psp_master when PLATFORM_INIT fails
	crypto: vmx - fix copy-paste error in CTR mode
	crypto: skcipher - don't WARN on unprocessed data after slow walk step
	crypto: crct10dif-generic - fix use via crypto_shash_digest()
	crypto: x86/crct10dif-pcl - fix use via crypto_shash_digest()
	crypto: arm64/gcm-aes-ce - fix no-NEON fallback code
	crypto: gcm - fix incompatibility between "gcm" and "gcm_base"
	crypto: rockchip - update IV buffer to contain the next IV
	crypto: arm/aes-neonbs - don't access already-freed walk.iv
	crypto: arm64/aes-neonbs - don't access already-freed walk.iv
	mmc: core: Fix tag set memory leak
	ALSA: line6: toneport: Fix broken usage of timer for delayed execution
	ALSA: usb-audio: Fix a memory leak bug
	ALSA: hda/hdmi - Read the pin sense from register when repolling
	ALSA: hda/hdmi - Consider eld_valid when reporting jack event
	ALSA: hda/realtek - EAPD turn on later
	ALSA: hdea/realtek - Headset fixup for System76 Gazelle (gaze14)
	ASoC: max98090: Fix restore of DAPM Muxes
	ASoC: RT5677-SPI: Disable 16Bit SPI Transfers
	ASoC: fsl_esai: Fix missing break in switch statement
	ASoC: codec: hdac_hdmi add device_link to card device
	bpf, arm64: remove prefetch insn in xadd mapping
	crypto: ccree - remove special handling of chained sg
	crypto: ccree - fix mem leak on error path
	crypto: ccree - don't map MAC key on stack
	crypto: ccree - use correct internal state sizes for export
	crypto: ccree - don't map AEAD key and IV on stack
	crypto: ccree - pm resume first enable the source clk
	crypto: ccree - HOST_POWER_DOWN_EN should be the last CC access during suspend
	crypto: ccree - add function to handle cryptocell tee fips error
	crypto: ccree - handle tee fips error during power management resume
	mm/mincore.c: make mincore() more conservative
	mm/huge_memory: fix vmf_insert_pfn_{pmd, pud}() crash, handle unaligned addresses
	mm/hugetlb.c: don't put_page in lock of hugetlb_lock
	hugetlb: use same fault hash key for shared and private mappings
	ocfs2: fix ocfs2 read inode data panic in ocfs2_iget
	userfaultfd: use RCU to free the task struct when fork fails
	ACPI: PM: Set enable_for_wake for wakeup GPEs during suspend-to-idle
	mfd: da9063: Fix OTP control register names to match datasheets for DA9063/63L
	mfd: max77620: Fix swapped FPS_PERIOD_MAX_US values
	mtd: spi-nor: intel-spi: Avoid crossing 4K address boundary on read/write
	tty: vt.c: Fix TIOCL_BLANKSCREEN console blanking if blankinterval == 0
	tty/vt: fix write/write race in ioctl(KDSKBSENT) handler
	jbd2: check superblock mapped prior to committing
	ext4: make sanity check in mballoc more strict
	ext4: ignore e_value_offs for xattrs with value-in-ea-inode
	ext4: avoid drop reference to iloc.bh twice
	ext4: fix use-after-free race with debug_want_extra_isize
	ext4: actually request zeroing of inode table after grow
	ext4: fix ext4_show_options for file systems w/o journal
	btrfs: Check the first key and level for cached extent buffer
	btrfs: Correctly free extent buffer in case btree_read_extent_buffer_pages fails
	btrfs: Honour FITRIM range constraints during free space trim
	Btrfs: send, flush dellaloc in order to avoid data loss
	Btrfs: do not start a transaction during fiemap
	Btrfs: do not start a transaction at iterate_extent_inodes()
	bcache: fix a race between cache register and cacheset unregister
	bcache: never set KEY_PTRS of journal key to 0 in journal_reclaim()
	ipmi:ssif: compare block number correctly for multi-part return messages
	crypto: ccm - fix incompatibility between "ccm" and "ccm_base"
	fs/writeback.c: use rcu_barrier() to wait for inflight wb switches going into workqueue when umount
	tty: Don't force RISCV SBI console as preferred console
	ext4: zero out the unused memory region in the extent tree block
	ext4: fix data corruption caused by overlapping unaligned and aligned IO
	ext4: fix use-after-free in dx_release()
	ext4: avoid panic during forced reboot due to aborted journal
	ALSA: hda/realtek - Corrected fixup for System76 Gazelle (gaze14)
	ALSA: hda/realtek - Fixup headphone noise via runtime suspend
	ALSA: hda/realtek - Fix for Lenovo B50-70 inverted internal microphone bug
	jbd2: fix potential double free
	KVM: x86: Skip EFER vs. guest CPUID checks for host-initiated writes
	KVM: lapic: Busy wait for timer to expire when using hv_timer
	kbuild: turn auto.conf.cmd into a mandatory include file
	xen/pvh: set xen_domain_type to HVM in xen_pvh_init
	libnvdimm/namespace: Fix label tracking error
	iov_iter: optimize page_copy_sane()
	pstore: Centralize init/exit routines
	pstore: Allocate compression during late_initcall()
	pstore: Refactor compression initialization
	ext4: fix compile error when using BUFFER_TRACE
	ext4: don't update s_rev_level if not required
	Linux 4.19.45

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

parents e6e368c9 c3a07259

Documentation/x86/mds.rst

+6 −38

Original line number	Diff line number	Diff line
		@@ -142,45 +142,13 @@ Mitigation points
		mds_user_clear.

		The mitigation is invoked in prepare_exit_to_usermode() which covers
		most of the kernel to user space transitions. There are a few exceptions
		which are not invoking prepare_exit_to_usermode() on return to user
		space. These exceptions use the paranoid exit code.
		all but one of the kernel to user space transitions. The exception
		is when we return from a Non Maskable Interrupt (NMI), which is
		handled directly in do_nmi().

		- Non Maskable Interrupt (NMI):

		Access to sensible data like keys, credentials in the NMI context is
		mostly theoretical: The CPU can do prefetching or execute a
		misspeculated code path and thereby fetching data which might end up
		leaking through a buffer.

		But for mounting other attacks the kernel stack address of the task is
		already valuable information. So in full mitigation mode, the NMI is
		mitigated on the return from do_nmi() to provide almost complete
		coverage.

		- Double fault (#DF):

		A double fault is usually fatal, but the ESPFIX workaround, which can
		be triggered from user space through modify_ldt(2) is a recoverable
		double fault. #DF uses the paranoid exit path, so explicit mitigation
		in the double fault handler is required.

		- Machine Check Exception (#MC):

		Another corner case is a #MC which hits between the CPU buffer clear
		invocation and the actual return to user. As this still is in kernel
		space it takes the paranoid exit path which does not clear the CPU
		buffers. So the #MC handler repopulates the buffers to some
		extent. Machine checks are not reliably controllable and the window is
		extremly small so mitigation would just tick a checkbox that this
		theoretical corner case is covered. To keep the amount of special
		cases small, ignore #MC.

		- Debug Exception (#DB):

		This takes the paranoid exit path only when the INT1 breakpoint is in
		kernel space. #DB on a user space address takes the regular exit path,
		so no extra mitigation required.
		(The reason that NMI is special is that prepare_exit_to_usermode() can
		enable IRQs. In NMI context, NMIs are blocked, and we don't want to
		enable IRQs with NMIs blocked.)


		2. C-State transition

Makefile

+2 −2

Original line number	Diff line number	Diff line
		# SPDX-License-Identifier: GPL-2.0
		VERSION = 4
		PATCHLEVEL = 19
		SUBLEVEL = 44
		SUBLEVEL = 45
		EXTRAVERSION =
		NAME = "People's Front"

		@@ -630,7 +630,7 @@ ifeq ($(may-sync-config),1)
		# Read in dependencies to all Kconfig* files, make sure to run syncconfig if
		# changes are detected. This should be included after arch/$(SRCARCH)/Makefile
		# because some architectures define CROSS_COMPILE there.
		-include include/config/auto.conf.cmd
		include include/config/auto.conf.cmd

		# To avoid any implicit rule to kick in, define an empty command
		$(KCONFIG_CONFIG): ;

arch/arm/boot/dts/exynos5260.dtsi

+1 −1

Original line number	Diff line number	Diff line
		@@ -223,7 +223,7 @@
		wakeup-interrupt-controller {
		compatible = "samsung,exynos4210-wakeup-eint";
		interrupt-parent = <&gic>;
		interrupts = <GIC_SPI 32 IRQ_TYPE_LEVEL_HIGH>;
		interrupts = <GIC_SPI 48 IRQ_TYPE_LEVEL_HIGH>;
		};
		};

arch/arm/boot/dts/exynos5422-odroidxu3-audio.dtsi

+1 −1

Original line number	Diff line number	Diff line
		@@ -22,7 +22,7 @@
		"Headphone Jack", "HPL",
		"Headphone Jack", "HPR",
		"Headphone Jack", "MICBIAS",
		"IN1", "Headphone Jack",
		"IN12", "Headphone Jack",
		"Speakers", "SPKL",
		"Speakers", "SPKR";

arch/arm/crypto/aes-neonbs-glue.c

+2 −0

Original line number	Diff line number	Diff line
		@@ -278,6 +278,8 @@ static int __xts_crypt(struct skcipher_request *req,
		int err;

		err = skcipher_walk_virt(&walk, req, true);
		if (err)
		return err;

		crypto_cipher_encrypt_one(ctx->tweak_tfm, walk.iv, walk.iv);