summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2015-01-22x86, tls: Interpret an all-zero struct user_desc as "no segment"Andy Lutomirski
The Witcher 2 did something like this to allocate a TLS segment index: struct user_desc u_info; bzero(&u_info, sizeof(u_info)); u_info.entry_number = (uint32_t)-1; syscall(SYS_set_thread_area, &u_info); Strictly speaking, this code was never correct. It should have set read_exec_only and seg_not_present to 1 to indicate that it wanted to find a free slot without putting anything there, or it should have put something sensible in the TLS slot if it wanted to allocate a TLS entry for real. The actual effect of this code was to allocate a bogus segment that could be used to exploit espfix. The set_thread_area hardening patches changed the behavior, causing set_thread_area to return -EINVAL and crashing the game. This changes set_thread_area to interpret this as a request to find a free slot and to leave it empty, which isn't *quite* what the game expects but should be close enough to keep it working. In particular, using the code above to allocate two segments will allocate the same segment both times. According to FrostbittenKing on Github, this fixes The Witcher 2. If this somehow still causes problems, we could instead allocate a limit==0 32-bit data segment, but that seems rather ugly to me. Fixes: 41bdc78544b8 x86/tls: Validate TLS entries to protect espfix Signed-off-by: Andy Lutomirski <luto@amacapital.net> Cc: stable@vger.kernel.org Cc: torvalds@linux-foundation.org Link: http://lkml.kernel.org/r/0cb251abe1ff0958b8e468a9a9a905b80ae3a746.1421954363.git.luto@amacapital.net Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
2015-01-22x86, tls, ldt: Stop checking lm in LDT_emptyAndy Lutomirski
32-bit programs don't have an lm bit in their ABI, so they can't reliably cause LDT_empty to return true without resorting to memset. They shouldn't need to do this. This should fix a longstanding, if minor, issue in all 64-bit kernels as well as a potential regression in the TLS hardening code. Fixes: 41bdc78544b8 x86/tls: Validate TLS entries to protect espfix Cc: stable@vger.kernel.org Signed-off-by: Andy Lutomirski <luto@amacapital.net> Cc: torvalds@linux-foundation.org Link: http://lkml.kernel.org/r/72a059de55e86ad5e2935c80aa91880ddf19d07c.1421954363.git.luto@amacapital.net Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
2015-01-22x86, mpx: Strictly enforce empty prctl() argsDave Hansen
Description from Michael Kerrisk. He suggested an identical patch to one I had already coded up and tested. commit fe3d197f8431 "x86, mpx: On-demand kernel allocation of bounds tables" added two new prctl() operations, PR_MPX_ENABLE_MANAGEMENT and PR_MPX_DISABLE_MANAGEMENT. However, no checks were included to ensure that unused arguments are zero, as is done in many existing prctl()s and as should be done for all new prctl()s. This patch adds the required checks. Suggested-by: Andy Lutomirski <luto@amacapital.net> Suggested-by: Michael Kerrisk <mtk.manpages@gmail.com> Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com> Cc: Dave Hansen <dave@sr71.net> Link: http://lkml.kernel.org/r/20150108223022.7F56FD13@viggo.jf.intel.com Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
2015-01-22x86, mpx: Fix potential performance issue on unmapsDave Hansen
The 3.19 merge window saw some TLB modifications merged which caused a performance regression. They were fixed in commit 045bbb9fa. Once that fix was applied, I also noticed that there was a small but intermittent regression still present. It was not present consistently enough to bisect reliably, but I'm fairly confident that it came from (my own) MPX patches. The source was reading a relatively unused field in the mm_struct via arch_unmap. I also noted that this code was in the main instruction flow of do_munmap() and probably had more icache impact than we want. This patch does two things: 1. Adds a static (via Kconfig) and dynamic (via cpuid) check for MPX with cpu_feature_enabled(). This keeps us from reading that cacheline in the mm and trades it for a check of the global CPUID variables at least on CPUs without MPX. 2. Adds an unlikely() to ensure that the MPX call ends up out of the main instruction flow in do_munmap(). I've added a detailed comment about why this was done and why we want it even on systems where MPX is present. Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com> Cc: luto@amacapital.net Cc: Dave Hansen <dave@sr71.net> Link: http://lkml.kernel.org/r/20150108223021.AEEAB987@viggo.jf.intel.com Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
2015-01-22x86, mpx: Explicitly disable 32-bit MPX support on 64-bit kernelsDave Hansen
We had originally planned on submitting MPX support in one patch set. We eventually broke it up in to two pieces for easier review. One of the features that didn't make the first round was supporting 32-bit binaries on 64-bit kernels. Once we split the set up, we never added code to restrict 32-bit binaries from _using_ MPX on 64-bit kernels. The 32-bit bounds tables are a different format than the 64-bit ones. Without this patch, the kernel will try to read a 32-bit binary's tables as if they were the 64-bit version. They will likely be noticed as being invalid rather quickly and the app will get killed, but that's kinda mean. This patch adds an explicit check, and will make a 64-bit kernel essentially behave as if it has no MPX support when called from a 32-bit binary. Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com> Cc: Andy Lutomirski <luto@amacapital.net> Cc: Dave Hansen <dave@sr71.net> Link: http://lkml.kernel.org/r/20150108223020.9E9AA511@viggo.jf.intel.com Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
2015-01-22MAINTAINERS: Update Richard Zhu's email addressLucas Stach
The old cryptic address bounces, fix it by using a properly working one. Signed-off-by: Lucas Stach <l.stach@pengutronix.de> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Acked-by: Richard Zhu <Richard.Zhu@freescale.com>
2015-01-23Merge branch 'for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Martin Schwidefsky: "Five more bug fixes from Michael for the s390 BPF jit" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/bpf: Zero extend parameters before calling C function s390/bpf: Fix sk_load_byte_msh() s390/bpf: Fix offset parameter for skb_copy_bits() s390/bpf: Fix skb_copy_bits() parameter passing s390/bpf: Fix JMP_JGE_K (A >= K) and JMP_JGT_K (A > K)
2015-01-23Merge tag 'nios2-fixes-v3.19-rc6' of ↵Linus Torvalds
git://git.rocketboards.org/linux-socfpga-next Pull one arch/nios2 fix from Ley Foon Tan: "Fix kuser trampoline address" * tag 'nios2-fixes-v3.19-rc6' of git://git.rocketboards.org/linux-socfpga-next: nios2: fix kuser trampoline address
2015-01-23Merge tag 'fixes-for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux Pull module and param fixes from Rusty Russell: "Surprising number of fixes this merge window :( The first two are minor fallout from the param rework which went in this merge window. The next three are a series which fixes a longstanding (but never previously reported and unlikely , so no CC stable) race between kallsyms and freeing the init section. Finally, a minor cleanup as our module refcount will now be -1 during unload" * tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux: module: make module_refcount() a signed integer. module: fix race in kallsyms resolution during module load success. module: remove mod arg from module_free, rename module_memfree(). module_arch_freeing_init(): new hook for archs before module->module_init freed. param: fix uninitialized read with CONFIG_DEBUG_LOCK_ALLOC param: initialize store function to NULL if not available.
2015-01-22MAINTAINERS: ibmvscsi driver maintainer changeTyrel Datwyler
Change maintainer of ibmvscsi driver to Tyrel Datwyler. Signed-off-by: Tyrel Datwyler <tyreld@linux.vnet.ibm.com> Acked-by: Nathan Fontenot <nfont@linux.vnet.ibm.com> Cc: Brian King <brking@linux.vnet.ibm.com> Signed-off-by: Christoph Hellwig <hch@lst.de>
2015-01-22MAINTAINERS: ibmvfc driver maintainer changeTyrel Datwyler
Change maintainer of ibmvfc driver to Tyrel Datwyler. Signed-off-by: Tyrel Datwyler <tyreld@linux.vnet.ibm.com> Cc: Nathan Fontenot <nfont@linux.vnet.ibm.com> Cc: Brian King <brking@linux.vnet.ibm.com> Signed-off-by: Christoph Hellwig <hch@lst.de>
2015-01-22MAINTAINERS: Remove self as isci maintainerDave Jiang
Removing myself as a maintainer. Signed-off-by: Dave Jiang <dave.jiang@intel.com> Signed-off-by: Christoph Hellwig <hch@lst.de>
2015-01-22scsi_debug: test always evaluates to false, || should be used insteadColin Ian King
cppcheck found the following issue: (warning) Logical conjunction always evaluates to false: alloc_len < 4 && alloc_len > 65535. ..the test should be instead: if (alloc_len < 4 || alloc_len > 65536) This error was introduced by recent commit 38d5c8336e60bf6e53a1da9 ("scsi_debug: add Report supported opcodes+tmfs; Compare and write") Signed-off-by: Colin Ian King <colin.king@canonical.com> Acked-by: Douglas Gilbert <dgilbert@interlog.com> Signed-off-by: Christoph Hellwig <hch@lst.de>
2015-01-22drm/radeon: Remove rdev->gart.pages_addr arrayMichel Dänzer
radeon_vm_map_gart can use rdev->gart.pages_entry instead. Also move the masking of the page address to radeon_vm_map_gart from its callers. Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Michel Dänzer <michel.daenzer@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2015-01-22drm/radeon: Restore GART table contents after pinning it in VRAM v3Michel Dänzer
The GART table BO has to be moved out of VRAM for suspend/resume. Any updates to the GART table during that time were silently dropped without this change. This caused GPU lockups on resume in some cases, see the bug reports referenced below. This might also make GPU reset more robust in some cases, as we no longer rely on the GART table in VRAM being preserved across the GPU lockup/reset. v2: Add logic to radeon_gart_table_vram_pin directly instead of reinstating radeon_gart_restore v3: Move code after assignment of rdev->gart.table_addr so that the GART TLB flush can work as intended, add code comment explaining why we're doing this Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=85204 Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=86267 Reviewed-by: Christian König <christian.koenig@amd.com> Cc: stable@vger.kernel.org Signed-off-by: Michel Dänzer <michel.daenzer@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2015-01-22drm/radeon: Split off gart_get_page_entry ASIC hook from set_page_entryMichel Dänzer
get_page_entry calculates the GART page table entry, which is just written to the GART page table by set_page_entry. This is a prerequisite for the following fix. Reviewed-by: Christian König <christian.koenig@amd.com> Cc: stable@vger.kernel.org Signed-off-by: Michel Dänzer <michel.daenzer@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2015-01-22drm/amdkfd: change amdkfd version to 0.7.1Oded Gabbay
Signed-off-by: Oded Gabbay <oded.gabbay@amd.com>
2015-01-22drm/radeon: cik_sdma_ctx_switch_enable() can be statickbuild test robot
drivers/gpu/drm/radeon/cik_sdma.c:293:6: sparse: symbol 'cik_sdma_ctx_switch_enable' was not declared. Should it be static? Signed-off-by: Fengguang Wu <fengguang.wu@intel.com> Signed-off-by: Oded Gabbay <oded.gabbay@amd.com>
2015-01-22drm/amdkfd: Fix sparse errorsOded Gabbay
Signed-off-by: Oded Gabbay <oded.gabbay@amd.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
2015-01-22drm/radeon: make MMU_NOTIFIER optionalRob Clark
In cases where MMU_NOTIFIER is not available, userptr will not be available. Similar to i915, although not making an exception for CAP_SYS_ADMIN. The proposed userspace patches for userptr seem to handle the fall- back properly, so a userptr-less kernel should not be a problem. Signed-off-by: Rob Clark <robdclark@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2015-01-22drm/radeon: use NULL rather then 0 in audio detectAlex Deucher
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2015-01-22drm/radeon: whitespace clean up in radeon_audio.cAlex Deucher
Clean up some formatting in radeon_audio.c to be more consistent with the rest of the driver. Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2015-01-22radeon/audio: enable DP audioSlava Grigorev
Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Slava Grigorev <slava.grigorev@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2015-01-22radeon/audio: moved audio caps programming to audio_hotplug() functionSlava Grigorev
Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Slava Grigorev <slava.grigorev@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2015-01-22radeon/audio: applied audio_dpms() and audio_mode_set() callsSlava Grigorev
Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Slava Grigorev <slava.grigorev@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2015-01-22radeon/audio: consolidate audio_mode_set() functionsSlava Grigorev
Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Slava Grigorev <slava.grigorev@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2015-01-22radeon/audio: removed unnecessary debug settingsSlava Grigorev
Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Slava Grigorev <slava.grigorev@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2015-01-22radeon/audio: moved mute programming to a separate functionSlava Grigorev
Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Slava Grigorev <slava.grigorev@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2015-01-22radeon/audio: moved audio packet programming to a separate functionSlava Grigorev
Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Slava Grigorev <slava.grigorev@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2015-01-22radeon/audio: set_avi_packet() function cleanupSlava Grigorev
Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Slava Grigorev <slava.grigorev@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2015-01-22radeon/audio: removed unnecessary CRC control programingSlava Grigorev
Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Slava Grigorev <slava.grigorev@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2015-01-22radeon: moved HDMI color depth programming to a separate functionSlava Grigorev
Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Slava Grigorev <slava.grigorev@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2015-01-22radeon/audio: moved VBI packet programming to separate functionsAlex Deucher
Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Slava Grigorev <slava.grigorev@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2015-01-22radeon/audio: consolidate update_acr() functions (v2)Slava Grigorev
V2: fix missing dce6 callback Signed-off-by: Slava Grigorev <slava.grigorev@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2015-01-22radeon/audio: consolidate update_avi_infoframe() functionsSlava Grigorev
Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Slava Grigorev <slava.grigorev@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2015-01-22radeon/audio: consolidate audio_set_dto() functionsSlava Grigorev
Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Slava Grigorev <slava.grigorev@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2015-01-22radeon/audio: consolidate audio_fini() functionsSlava Grigorev
Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Slava Grigorev <slava.grigorev@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2015-01-22radeon/audio: consolidate audio_enable() functionsSlava Grigorev
Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Slava Grigorev <slava.grigorev@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2015-01-22radeon/audio: consolidate select_pin() functionsSlava Grigorev
Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Slava Grigorev <slava.grigorev@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2015-01-22radeon/audio: consolidate audio_get_pin() functionsSlava Grigorev
Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Slava Grigorev <slava.grigorev@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2015-01-22radeon/audio: consolidate write_latency_fields() functionsSlava Grigorev
Signed-off-by: Slava Grigorev <slava.grigorev@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2015-01-22radeon/audio: consolidate write_speaker_allocation() functionsSlava Grigorev
Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Slava Grigorev <slava.grigorev@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2015-01-22radeon/audio: consolidate write_sad_regs() functionsAlex Deucher
Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Slava Grigorev <slava.grigorev@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2015-01-22radeon/audio: defined initial audio interface that gets initialized via ↵Slava Grigorev
detect() call Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Slava Grigorev <slava.grigorev@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2015-01-22radeon/audio: consolidate audio_init() functionsSlava Grigorev
Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Slava Grigorev <slava.grigorev@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2015-01-22drm/radeon: comment out some currently unused 7xx dpm codeAlex Deucher
Keep it around for reference. Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2015-01-22drm/radeon: comment out some currently unused eg dpm codeAlex Deucher
Keep it around for reference. Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2015-01-22drm/radeon: comment out some currently unused sumo dpm codeAlex Deucher
Keep it around for reference. Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2015-01-22drm/radeon: comment out some currently unused tn dpm codeAlex Deucher
Keep it around for reference. Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2015-01-22drm/radeon: comment out some currently unused btc dpm codeAlex Deucher
Keep it around for reference. Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
generated by cgit (git 2.34.1) at 2025-09-12 21:19:42 +0000