linux-stable.git/arch/arm/include, branch v4.0.4

ARM: 8320/1: fix integer overflow in ELF_ET_DYN_BASE

2015-05-06T20:03:45+00:00

commit 8defb3367fcd19d1af64c07792aade0747b54e0f upstream.

Usually ELF_ET_DYN_BASE is 2/3 of TASK_SIZE. With 3G/1G user/kernel
split this is not so, because 2*TASK_SIZE overflows 32 bits,
so the actual value of ELF_ET_DYN_BASE is:
	(2 * TASK_SIZE / 3) = 0x2a000000

When ASLR is disabled PIE binaries will load at ELF_ET_DYN_BASE address.
On 32bit platforms AddressSanitzer uses addresses [0x20000000 - 0x40000000]
for shadow memory [1]. So ASan doesn't work for PIE binaries when ASLR disabled
as it fails to map shadow memory.
Also after Kees's 'split ET_DYN ASLR from mmap ASLR' patchset PIE binaries
has a high chance of loading somewhere in between [0x2a000000 - 0x40000000]
even if ASLR enabled. This makes ASan with PIE absolutely incompatible.

Fix overflow by dividing TASK_SIZE prior to multiplying.
After this patch ELF_ET_DYN_BASE equals to (for CONFIG_VMSPLIT_3G=y):
	(TASK_SIZE / 3 * 2) = 0x7f555554

[1] https://code.google.com/p/address-sanitizer/wiki/AddressSanitizerAlgorithm#Mapping

Signed-off-by: Andrey Ryabinin 
Reported-by: Maria Guseva 
Signed-off-by: Russell King 
Signed-off-by: Greg Kroah-Hartman

KVM: arm/arm64: check IRQ number on userland injection

2015-05-06T20:03:40+00:00

commit fd1d0ddf2ae92fb3df42ed476939861806c5d785 upstream.

When userland injects a SPI via the KVM_IRQ_LINE ioctl we currently
only check it against a fixed limit, which historically is set
to 127. With the new dynamic IRQ allocation the effective limit may
actually be smaller (64).
So when now a malicious or buggy userland injects a SPI in that
range, we spill over on our VGIC bitmaps and bytemaps memory.
I could trigger a host kernel NULL pointer dereference with current
mainline by injecting some bogus IRQ number from a hacked kvmtool:
-----------------
....
DEBUG: kvm_vgic_inject_irq(kvm, cpu=0, irq=114, level=1)
DEBUG: vgic_update_irq_pending(kvm, cpu=0, irq=114, level=1)
DEBUG: IRQ #114 still in the game, writing to bytemap now...
Unable to handle kernel NULL pointer dereference at virtual address 00000000
pgd = ffffffc07652e000
[00000000] *pgd=00000000f658b003, *pud=00000000f658b003, *pmd=0000000000000000
Internal error: Oops: 96000006 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 1053 Comm: lkvm-msi-irqinj Not tainted 4.0.0-rc7+ #3027
Hardware name: FVP Base (DT)
task: ffffffc0774e9680 ti: ffffffc0765a8000 task.ti: ffffffc0765a8000
PC is at kvm_vgic_inject_irq+0x234/0x310
LR is at kvm_vgic_inject_irq+0x30c/0x310
pc : [] lr : [] pstate: 80000145
.....

So this patch fixes this by checking the SPI number against the
actual limit. Also we remove the former legacy hard limit of
127 in the ioctl code.

Signed-off-by: Andre Przywara 
Reviewed-by: Christoffer Dall 
[maz: wrap KVM_ARM_IRQ_GIC_MAX with #ifndef __KERNEL__,
as suggested by Christopher Covington]
Signed-off-by: Marc Zyngier 
Signed-off-by: Greg Kroah-Hartman

Merge git://git.kernel.org/pub/scm/virt/kvm/kvm

2015-03-17T17:31:36+00:00

Pull kvm fixes from Marcelo Tosatti:
 "KVM bug fixes (ARM and x86)"

* git://git.kernel.org/pub/scm/virt/kvm/kvm:
  arm/arm64: KVM: Keep elrsr/aisr in sync with software model
  KVM: VMX: Set msr bitmap correctly if vcpu is in guest mode
  arm/arm64: KVM: fix missing unlock on error in kvm_vgic_create()
  kvm: x86: i8259: return initialized data on invalid-size read
  arm64: KVM: Fix outdated comment about VTCR_EL2.PS
  arm64: KVM: Do not use pgd_index to index stage-2 pgd
  arm64: KVM: Fix stage-2 PGD allocation to have per-page refcounting
  kvm: move advertising of KVM_CAP_IRQFD to common code

Merge tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc

2015-03-15T17:49:38+00:00

Pull ARM SoC fixes from Arnd Bergmann:
 "This is a rather unpleasantly large set of bug fixes for arm-soc, Most
  of them because of cross-tree dependencies for Exynos where we should
  have figured out the right path to merge things before the merge
  window, and then the maintainer being unable to sort things out in
  time during a business trip.

  The other changes contained here are the usual collection:

  MAINTAINERS file updates
   - Gregory Clement is now a co-maintainer for the legacy Marvell EBU
     platforms
   - A MAINTAINERS entry for the Freescale Vybrid platform that was
     added last year
   - Matt Porter no longer works as a maintainer on Broadcom SoCs

  Build-time issues
   - A compile-time error for at91
   - Several minor DT fixes on at91, imx, exynos, socfpga, and omap
   - The new digicolor platform was not correctly enabled at all

  Configuration issues
   - Two defconfig fix for regressions using USB on versatile express
     and on OMAP3
   - Enabling all 8 CPUs on Allwinner/SUNxi
   - Enabling the new STiH410 platform to be usable

  Bug fixes in platform code
   - A missing barrier for socfpga
   - Fixing LPDDR1 self-refresh mode on at91
   - Fixing RTC interrupt numbers on Exynos3250
   - Fixing a cache-coherency issues in CPU power-down on Exynos5
   - Multiple small OMAP power management fixes"

* tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (69 commits)
  MAINTAINERS: Add myself as co-maintainer to the legacy support of the mvebu SoCs
  ARM: at91: pm_slowclock: fix the compilation error
  ARM: at91/dt: fix USB high-speed clock to select UTMI
  ARM: at91/dt: fix at91 udc compatible strings
  ARM: at91/dt: declare matrix node as a syscon device
  ARM: vexpress: update CONFIG_USB_ISP1760 option
  ARM: digicolor: add the machine directory to Makefile
  ARM: STi: Add STiH410 SoC support
  MAINTAINERS: add Freescale Vybrid SoC
  MAINTAINERS: Remove self as ARM mach-bcm co-maintainer
  ARM: imx6sl-evk: set swbst_reg as vbus's parent reg
  ARM: imx6qdl-sabresd: set swbst_reg as vbus's parent reg
  ARM: at91/dt: at91sam9261: fix clocks and clock-names in udc definition
  ARM: OMAP2+: Fix wl12xx on dm3730-evm with mainline u-boot
  ARM: OMAP: enable TWL4030_USB in omap2plus_defconfig
  ARM: dts: dra7x-evm: avoid possible contention while muxing on CAN lines
  ARM: dts: dra7x-evm: Don't use dcan1_rx.gpio1_15 in DCAN pinctrl
  ARM: dts: am43xx: fix SLEWCTRL_FAST pinctrl binding
  ARM: dts: am33xx: fix SLEWCTRL_FAST pinctrl binding
  ARM: dts: OMAP5: fix polling intervals for thermal zones
  ...

arm64: KVM: Do not use pgd_index to index stage-2 pgd

2015-03-11T13:24:36+00:00

The kernel's pgd_index macro is designed to index a normal, page
sized array. KVM is a bit diffferent, as we can use concatenated
pages to have a bigger address space (for example 40bit IPA with
4kB pages gives us an 8kB PGD.

In the above case, the use of pgd_index will always return an index
inside the first 4kB, which makes a guest that has memory above
0x8000000000 rather unhappy, as it spins forever in a page fault,
whist the host happilly corrupts the lower pgd.

The obvious fix is to get our own kvm_pgd_index that does the right
thing(tm).

Tested on X-Gene with a hacked kvmtool that put memory at a stupidly
high address.

Reviewed-by: Christoffer Dall 
Signed-off-by: Marc Zyngier 
Signed-off-by: Christoffer Dall

arm64: KVM: Fix stage-2 PGD allocation to have per-page refcounting

2015-03-11T13:23:20+00:00

We're using __get_free_pages with to allocate the guest's stage-2
PGD. The standard behaviour of this function is to return a set of
pages where only the head page has a valid refcount.

This behaviour gets us into trouble when we're trying to increment
the refcount on a non-head page:

page:ffff7c00cfb693c0 count:0 mapcount:0 mapping:          (null) index:0x0
flags: 0x4000000000000000()
page dumped because: VM_BUG_ON_PAGE((*({ __attribute__((unused)) typeof((&page->_count)->counter) __var = ( typeof((&page->_count)->counter)) 0; (volatile typeof((&page->_count)->counter) *)&((&page->_count)->counter); })) <= 0)
BUG: failure at include/linux/mm.h:548/get_page()!
Kernel panic - not syncing: BUG!
CPU: 1 PID: 1695 Comm: kvm-vcpu-0 Not tainted 4.0.0-rc1+ #3825
Hardware name: APM X-Gene Mustang board (DT)
Call trace:
[] dump_backtrace+0x0/0x13c
[] show_stack+0x10/0x1c
[] dump_stack+0x74/0x94
[] panic+0x100/0x240
[] stage2_get_pmd+0x17c/0x2bc
[] kvm_handle_guest_abort+0x4b4/0x6b0
[] handle_exit+0x58/0x180
[] kvm_arch_vcpu_ioctl_run+0x114/0x45c
[] kvm_vcpu_ioctl+0x2e0/0x754
[] do_vfs_ioctl+0x424/0x5c8
[] SyS_ioctl+0x40/0x78
CPU0: stopping

A possible approach for this is to split the compound page using
split_page() at allocation time, and change the teardown path to
free one page at a time.  It turns out that alloc_pages_exact() and
free_pages_exact() does exactly that.

While we're at it, the PGD allocation code is reworked to reduce
duplication.

This has been tested on an X-Gene platform with a 4kB/48bit-VA host
kernel, and kvmtool hacked to place memory in the second page of
the hardware PGD (PUD for the host kernel). Also regression-tested
on a Cubietruck (Cortex-A7).

 [ Reworked to use alloc_pages_exact() and free_pages_exact() and to
   return pointers directly instead of by reference as arguments
    - Christoffer ]

Reported-by: Mark Rutland 
Signed-off-by: Marc Zyngier 
Signed-off-by: Christoffer Dall

ARM: at91: debug: fix non MMU debug

2015-03-05T09:55:13+00:00

Linux may be used without MMU on atmel SoCs, fix debug in this configuration.

Signed-off-by: Alexandre Belloni 
Signed-off-by: Nicolas Ferre

ARM: KVM: Fix size check in __coherent_cache_guest_page

2015-02-23T21:28:47+00:00

The check is supposed to catch page-unaligned sizes, not the inverse.

Signed-off-by: Jan Kiszka 
Signed-off-by: Christoffer Dall

Merge tag 'asm-generic-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic

2015-02-18T18:02:24+00:00

Pull asm-generic uaccess.h cleanup from Arnd Bergmann:
 "Like in 3.19, I once more have a multi-stage cleanup for one
  asm-generic header file, this time the work was done by Michael
  Tsirkin and cleans up the uaccess.h file in asm-generic, as well as
  all architectures for which the respective maintainers did not pick up
  his patches directly"

* tag 'asm-generic-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic: (37 commits)
  sparc32: nocheck uaccess coding style tweaks
  sparc64: nocheck uaccess coding style tweaks
  xtensa: macro whitespace fixes
  sh: macro whitespace fixes
  parisc: macro whitespace fixes
  m68k: macro whitespace fixes
  m32r: macro whitespace fixes
  frv: macro whitespace fixes
  cris: macro whitespace fixes
  avr32: macro whitespace fixes
  arm64: macro whitespace fixes
  arm: macro whitespace fixes
  alpha: macro whitespace fixes
  blackfin: macro whitespace fixes
  sparc64: uaccess_64 macro whitespace fixes
  sparc32: uaccess_32 macro whitespace fixes
  avr32: whitespace fix
  sh: fix put_user sparse errors
  metag: fix put_user sparse errors
  ia64: fix put_user sparse errors
  ...

Merge tag 'soc-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc

2015-02-17T17:27:54+00:00

Pull ARM SoC platform changes from Olof Johansson:
 "New and updated SoC support.  Also included are some cleanups where
  the platform maintainers hadn't separated cleanups from new developent
  in separate branches.

  Some of the larger things worth pointing out:

   - A large set of changes from Alexandre Belloni and Nicolas Ferre
     preparing at91 platforms for multiplatform and cleaning up quite a
     bit in the process.

   - Removal of CSR's "Marco" SoC platform that never made it out to the
     market.  We love seeing these since it means the vendor published
     support before product was out, which is exactly what we want!

  New platforms this release are:

   - Conexant Digicolor (CX92755 SoC)
   - Hisilicon HiP01 SoC
   - CSR/sirf Atlas7 SoC
   - ST STiH418 SoC
   - Common code changes for Nvidia Tegra132 (64-bit SoC)

  We're seeing more and more platforms having a harder time labelling
  changes as cleanups vs new development -- which is a good sign that
  we've come quite far on the cleanup effort.  So over time we might
  start combining the cleanup and new-development branches more"

* tag 'soc-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (124 commits)
  ARM: at91/trivial: unify functions and machine names
  ARM: at91: remove at91_dt_initialize and machine init_early()
  ARM: at91: change board files into SoC files
  ARM: at91: remove at91_boot_soc
  ARM: at91: move alternative initial mapping to board-dt-sama5.c
  ARM: at91: merge all SOC_AT91SAM9xxx
  ARM: at91: at91rm9200: set idle and restart from rm9200_dt_device_init()
  ARM: digicolor: select syscon and timer
  ARM: zynq: Simplify SLCR initialization
  ARM: zynq: PM: Fixed simple typo.
  ARM: zynq: Setup default gpio number for Xilinx Zynq
  ARM: digicolor: add low level debug support
  ARM: initial support for Conexant Digicolor CX92755 SoC
  ARM: OMAP2+: Add dm816x hwmod support
  ARM: OMAP2+: Add clock domain support for dm816x
  ARM: OMAP2+: Add board-generic.c entry for ti81xx
  ARM: at91: pm: remove warning to remove SOC_AT91SAM9263 usage
  ARM: at91: remove unused mach/system_rev.h
  ARM: at91: stop using HAVE_AT91_DBGUx
  ARM: at91: fix ordering of SRAM and PM initialization
  ...