<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux-stable.git/arch, branch v5.4.149</title>
<subtitle>Linux kernel stable tree</subtitle>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/'/>
<entry>
<title>drivers: base: cacheinfo: Get rid of DEFINE_SMP_CALL_CACHE_FUNCTION()</title>
<updated>2021-09-26T12:07:10+00:00</updated>
<author>
<name>Thomas Gleixner</name>
<email>tglx@linutronix.de</email>
</author>
<published>2021-08-31T11:48:34+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=2f7bfc07e38662077f802abe56715b5e92663364'/>
<id>2f7bfc07e38662077f802abe56715b5e92663364</id>
<content type='text'>
[ Upstream commit 4b92d4add5f6dcf21275185c997d6ecb800054cd ]

DEFINE_SMP_CALL_CACHE_FUNCTION() was usefel before the CPU hotplug rework
to ensure that the cache related functions are called on the upcoming CPU
because the notifier itself could run on any online CPU.

The hotplug state machine guarantees that the callbacks are invoked on the
upcoming CPU. So there is no need to have this SMP function call
obfuscation. That indirection was missed when the hotplug notifiers were
converted.

This also solves the problem of ARM64 init_cache_level() invoking ACPI
functions which take a semaphore in that context. That's invalid as SMP
function calls run with interrupts disabled. Running it just from the
callback in context of the CPU hotplug thread solves this.

Fixes: 8571890e1513 ("arm64: Add support for ACPI based firmware tables")
Reported-by: Guenter Roeck &lt;linux@roeck-us.net&gt;
Signed-off-by: Thomas Gleixner &lt;tglx@linutronix.de&gt;
Tested-by: Guenter Roeck &lt;linux@roeck-us.net&gt;
Acked-by: Will Deacon &lt;will@kernel.org&gt;
Acked-by: Peter Zijlstra &lt;peterz@infradead.org&gt;
Link: https://lore.kernel.org/r/871r69ersb.ffs@tglx
Signed-off-by: Sasha Levin &lt;sashal@kernel.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
[ Upstream commit 4b92d4add5f6dcf21275185c997d6ecb800054cd ]

DEFINE_SMP_CALL_CACHE_FUNCTION() was usefel before the CPU hotplug rework
to ensure that the cache related functions are called on the upcoming CPU
because the notifier itself could run on any online CPU.

The hotplug state machine guarantees that the callbacks are invoked on the
upcoming CPU. So there is no need to have this SMP function call
obfuscation. That indirection was missed when the hotplug notifiers were
converted.

This also solves the problem of ARM64 init_cache_level() invoking ACPI
functions which take a semaphore in that context. That's invalid as SMP
function calls run with interrupts disabled. Running it just from the
callback in context of the CPU hotplug thread solves this.

Fixes: 8571890e1513 ("arm64: Add support for ACPI based firmware tables")
Reported-by: Guenter Roeck &lt;linux@roeck-us.net&gt;
Signed-off-by: Thomas Gleixner &lt;tglx@linutronix.de&gt;
Tested-by: Guenter Roeck &lt;linux@roeck-us.net&gt;
Acked-by: Will Deacon &lt;will@kernel.org&gt;
Acked-by: Peter Zijlstra &lt;peterz@infradead.org&gt;
Link: https://lore.kernel.org/r/871r69ersb.ffs@tglx
Signed-off-by: Sasha Levin &lt;sashal@kernel.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>um: virtio_uml: fix memory leak on init failures</title>
<updated>2021-09-26T12:07:08+00:00</updated>
<author>
<name>Johannes Berg</name>
<email>johannes.berg@intel.com</email>
</author>
<published>2021-06-25T08:34:37+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=93f8a98ad89cd1dfdc844804b84152f1c0181790'/>
<id>93f8a98ad89cd1dfdc844804b84152f1c0181790</id>
<content type='text'>
commit 7ad28e0df7ee9dbcb793bb88dd81d4d22bb9a10e upstream.

If initialization fails, e.g. because the connection failed,
we leak the 'vu_dev'. Fix that. Reported by smatch.

Fixes: 5d38f324993f ("um: drivers: Add virtio vhost-user driver")
Signed-off-by: Johannes Berg &lt;johannes.berg@intel.com&gt;
Acked-By: Anton Ivanov &lt;anton.ivanov@cambridgegreys.com&gt;
Signed-off-by: Richard Weinberger &lt;richard@nod.at&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 7ad28e0df7ee9dbcb793bb88dd81d4d22bb9a10e upstream.

If initialization fails, e.g. because the connection failed,
we leak the 'vu_dev'. Fix that. Reported by smatch.

Fixes: 5d38f324993f ("um: drivers: Add virtio vhost-user driver")
Signed-off-by: Johannes Berg &lt;johannes.berg@intel.com&gt;
Acked-By: Anton Ivanov &lt;anton.ivanov@cambridgegreys.com&gt;
Signed-off-by: Richard Weinberger &lt;richard@nod.at&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>ARM: 9098/1: ftrace: MODULE_PLT: Fix build problem without DYNAMIC_FTRACE</title>
<updated>2021-09-26T12:07:07+00:00</updated>
<author>
<name>Alex Sverdlin</name>
<email>alexander.sverdlin@nokia.com</email>
</author>
<published>2021-09-22T17:00:34+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=6a12918e906582bd0ea00c7eb83e3a3555847e31'/>
<id>6a12918e906582bd0ea00c7eb83e3a3555847e31</id>
<content type='text'>
commit 6fa630bf473827aee48cbf0efbbdf6f03134e890 upstream

FTRACE_ADDR is only defined when CONFIG_DYNAMIC_FTRACE is defined, the
latter is even stronger requirement than CONFIG_FUNCTION_TRACER (which is
enough for MCOUNT_ADDR).

Link: https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org/thread/ZUVCQBHDMFVR7CCB7JPESLJEWERZDJ3T/

Fixes: 1f12fb25c5c5d22f ("ARM: 9079/1: ftrace: Add MODULE_PLTS support")
Reported-by: kernel test robot &lt;lkp@intel.com&gt;
Signed-off-by: Alexander Sverdlin &lt;alexander.sverdlin@nokia.com&gt;
Signed-off-by: Russell King &lt;rmk+kernel@armlinux.org.uk&gt;
Signed-off-by: Florian Fainelli &lt;f.fainelli@gmail.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 6fa630bf473827aee48cbf0efbbdf6f03134e890 upstream

FTRACE_ADDR is only defined when CONFIG_DYNAMIC_FTRACE is defined, the
latter is even stronger requirement than CONFIG_FUNCTION_TRACER (which is
enough for MCOUNT_ADDR).

Link: https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org/thread/ZUVCQBHDMFVR7CCB7JPESLJEWERZDJ3T/

Fixes: 1f12fb25c5c5d22f ("ARM: 9079/1: ftrace: Add MODULE_PLTS support")
Reported-by: kernel test robot &lt;lkp@intel.com&gt;
Signed-off-by: Alexander Sverdlin &lt;alexander.sverdlin@nokia.com&gt;
Signed-off-by: Russell King &lt;rmk+kernel@armlinux.org.uk&gt;
Signed-off-by: Florian Fainelli &lt;f.fainelli@gmail.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>ARM: 9079/1: ftrace: Add MODULE_PLTS support</title>
<updated>2021-09-26T12:07:07+00:00</updated>
<author>
<name>Alex Sverdlin</name>
<email>alexander.sverdlin@nokia.com</email>
</author>
<published>2021-09-22T17:00:33+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=2f7974cd7b12ae219b11942ac9015341e3f0ba15'/>
<id>2f7974cd7b12ae219b11942ac9015341e3f0ba15</id>
<content type='text'>
commit 79f32b221b18c15a98507b101ef4beb52444cc6f upstream

Teach ftrace_make_call() and ftrace_make_nop() about PLTs.
Teach PLT code about FTRACE and all its callbacks.
Otherwise the following might happen:

------------[ cut here ]------------
WARNING: CPU: 14 PID: 2265 at .../arch/arm/kernel/insn.c:14 __arm_gen_branch+0x83/0x8c()
...
Hardware name: LSI Axxia AXM55XX
[&lt;c0314a49&gt;] (unwind_backtrace) from [&lt;c03115e9&gt;] (show_stack+0x11/0x14)
[&lt;c03115e9&gt;] (show_stack) from [&lt;c0519f51&gt;] (dump_stack+0x81/0xa8)
[&lt;c0519f51&gt;] (dump_stack) from [&lt;c032185d&gt;] (warn_slowpath_common+0x69/0x90)
[&lt;c032185d&gt;] (warn_slowpath_common) from [&lt;c03218f3&gt;] (warn_slowpath_null+0x17/0x1c)
[&lt;c03218f3&gt;] (warn_slowpath_null) from [&lt;c03143cf&gt;] (__arm_gen_branch+0x83/0x8c)
[&lt;c03143cf&gt;] (__arm_gen_branch) from [&lt;c0314337&gt;] (ftrace_make_nop+0xf/0x24)
[&lt;c0314337&gt;] (ftrace_make_nop) from [&lt;c038ebcb&gt;] (ftrace_process_locs+0x27b/0x3e8)
[&lt;c038ebcb&gt;] (ftrace_process_locs) from [&lt;c0378d79&gt;] (load_module+0x11e9/0x1a44)
[&lt;c0378d79&gt;] (load_module) from [&lt;c037974d&gt;] (SyS_finit_module+0x59/0x84)
[&lt;c037974d&gt;] (SyS_finit_module) from [&lt;c030e981&gt;] (ret_fast_syscall+0x1/0x18)
---[ end trace e1b64ced7a89adcc ]---
------------[ cut here ]------------
WARNING: CPU: 14 PID: 2265 at .../kernel/trace/ftrace.c:1979 ftrace_bug+0x1b1/0x234()
...
Hardware name: LSI Axxia AXM55XX
[&lt;c0314a49&gt;] (unwind_backtrace) from [&lt;c03115e9&gt;] (show_stack+0x11/0x14)
[&lt;c03115e9&gt;] (show_stack) from [&lt;c0519f51&gt;] (dump_stack+0x81/0xa8)
[&lt;c0519f51&gt;] (dump_stack) from [&lt;c032185d&gt;] (warn_slowpath_common+0x69/0x90)
[&lt;c032185d&gt;] (warn_slowpath_common) from [&lt;c03218f3&gt;] (warn_slowpath_null+0x17/0x1c)
[&lt;c03218f3&gt;] (warn_slowpath_null) from [&lt;c038e87d&gt;] (ftrace_bug+0x1b1/0x234)
[&lt;c038e87d&gt;] (ftrace_bug) from [&lt;c038ebd5&gt;] (ftrace_process_locs+0x285/0x3e8)
[&lt;c038ebd5&gt;] (ftrace_process_locs) from [&lt;c0378d79&gt;] (load_module+0x11e9/0x1a44)
[&lt;c0378d79&gt;] (load_module) from [&lt;c037974d&gt;] (SyS_finit_module+0x59/0x84)
[&lt;c037974d&gt;] (SyS_finit_module) from [&lt;c030e981&gt;] (ret_fast_syscall+0x1/0x18)
---[ end trace e1b64ced7a89adcd ]---
ftrace failed to modify [&lt;e9ef7006&gt;] 0xe9ef7006
actual: 02:f0:3b:fa
ftrace record flags: 0
(0) expected tramp: c0314265

Signed-off-by: Alexander Sverdlin &lt;alexander.sverdlin@nokia.com&gt;
Signed-off-by: Russell King &lt;rmk+kernel@armlinux.org.uk&gt;
Signed-off-by: Florian Fainelli &lt;f.fainelli@gmail.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 79f32b221b18c15a98507b101ef4beb52444cc6f upstream

Teach ftrace_make_call() and ftrace_make_nop() about PLTs.
Teach PLT code about FTRACE and all its callbacks.
Otherwise the following might happen:

------------[ cut here ]------------
WARNING: CPU: 14 PID: 2265 at .../arch/arm/kernel/insn.c:14 __arm_gen_branch+0x83/0x8c()
...
Hardware name: LSI Axxia AXM55XX
[&lt;c0314a49&gt;] (unwind_backtrace) from [&lt;c03115e9&gt;] (show_stack+0x11/0x14)
[&lt;c03115e9&gt;] (show_stack) from [&lt;c0519f51&gt;] (dump_stack+0x81/0xa8)
[&lt;c0519f51&gt;] (dump_stack) from [&lt;c032185d&gt;] (warn_slowpath_common+0x69/0x90)
[&lt;c032185d&gt;] (warn_slowpath_common) from [&lt;c03218f3&gt;] (warn_slowpath_null+0x17/0x1c)
[&lt;c03218f3&gt;] (warn_slowpath_null) from [&lt;c03143cf&gt;] (__arm_gen_branch+0x83/0x8c)
[&lt;c03143cf&gt;] (__arm_gen_branch) from [&lt;c0314337&gt;] (ftrace_make_nop+0xf/0x24)
[&lt;c0314337&gt;] (ftrace_make_nop) from [&lt;c038ebcb&gt;] (ftrace_process_locs+0x27b/0x3e8)
[&lt;c038ebcb&gt;] (ftrace_process_locs) from [&lt;c0378d79&gt;] (load_module+0x11e9/0x1a44)
[&lt;c0378d79&gt;] (load_module) from [&lt;c037974d&gt;] (SyS_finit_module+0x59/0x84)
[&lt;c037974d&gt;] (SyS_finit_module) from [&lt;c030e981&gt;] (ret_fast_syscall+0x1/0x18)
---[ end trace e1b64ced7a89adcc ]---
------------[ cut here ]------------
WARNING: CPU: 14 PID: 2265 at .../kernel/trace/ftrace.c:1979 ftrace_bug+0x1b1/0x234()
...
Hardware name: LSI Axxia AXM55XX
[&lt;c0314a49&gt;] (unwind_backtrace) from [&lt;c03115e9&gt;] (show_stack+0x11/0x14)
[&lt;c03115e9&gt;] (show_stack) from [&lt;c0519f51&gt;] (dump_stack+0x81/0xa8)
[&lt;c0519f51&gt;] (dump_stack) from [&lt;c032185d&gt;] (warn_slowpath_common+0x69/0x90)
[&lt;c032185d&gt;] (warn_slowpath_common) from [&lt;c03218f3&gt;] (warn_slowpath_null+0x17/0x1c)
[&lt;c03218f3&gt;] (warn_slowpath_null) from [&lt;c038e87d&gt;] (ftrace_bug+0x1b1/0x234)
[&lt;c038e87d&gt;] (ftrace_bug) from [&lt;c038ebd5&gt;] (ftrace_process_locs+0x285/0x3e8)
[&lt;c038ebd5&gt;] (ftrace_process_locs) from [&lt;c0378d79&gt;] (load_module+0x11e9/0x1a44)
[&lt;c0378d79&gt;] (load_module) from [&lt;c037974d&gt;] (SyS_finit_module+0x59/0x84)
[&lt;c037974d&gt;] (SyS_finit_module) from [&lt;c030e981&gt;] (ret_fast_syscall+0x1/0x18)
---[ end trace e1b64ced7a89adcd ]---
ftrace failed to modify [&lt;e9ef7006&gt;] 0xe9ef7006
actual: 02:f0:3b:fa
ftrace record flags: 0
(0) expected tramp: c0314265

Signed-off-by: Alexander Sverdlin &lt;alexander.sverdlin@nokia.com&gt;
Signed-off-by: Russell King &lt;rmk+kernel@armlinux.org.uk&gt;
Signed-off-by: Florian Fainelli &lt;f.fainelli@gmail.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>ARM: 9078/1: Add warn suppress parameter to arm_gen_branch_link()</title>
<updated>2021-09-26T12:07:06+00:00</updated>
<author>
<name>Alex Sverdlin</name>
<email>alexander.sverdlin@nokia.com</email>
</author>
<published>2021-09-22T17:00:32+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=1b27a03d1292875989c5bbdd86932d1e128fe743'/>
<id>1b27a03d1292875989c5bbdd86932d1e128fe743</id>
<content type='text'>
commit 890cb057a46d323fd8c77ebecb6485476614cd21 upstream

Will be used in the following patch. No functional change.

Signed-off-by: Alexander Sverdlin &lt;alexander.sverdlin@nokia.com&gt;
Signed-off-by: Russell King &lt;rmk+kernel@armlinux.org.uk&gt;
Signed-off-by: Florian Fainelli &lt;f.fainelli@gmail.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 890cb057a46d323fd8c77ebecb6485476614cd21 upstream

Will be used in the following patch. No functional change.

Signed-off-by: Alexander Sverdlin &lt;alexander.sverdlin@nokia.com&gt;
Signed-off-by: Russell King &lt;rmk+kernel@armlinux.org.uk&gt;
Signed-off-by: Florian Fainelli &lt;f.fainelli@gmail.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>ARM: 9077/1: PLT: Move struct plt_entries definition to header</title>
<updated>2021-09-26T12:07:06+00:00</updated>
<author>
<name>Alex Sverdlin</name>
<email>alexander.sverdlin@nokia.com</email>
</author>
<published>2021-09-22T17:00:31+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=490be340c86cb8d52401477381d2e36946ad675f'/>
<id>490be340c86cb8d52401477381d2e36946ad675f</id>
<content type='text'>
commit 4e271701c17dee70c6e1351c4d7d42e70405c6a9 upstream

No functional change, later it will be re-used in several files.

Signed-off-by: Alexander Sverdlin &lt;alexander.sverdlin@nokia.com&gt;
Signed-off-by: Russell King &lt;rmk+kernel@armlinux.org.uk&gt;
Signed-off-by: Florian Fainelli &lt;f.fainelli@gmail.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 4e271701c17dee70c6e1351c4d7d42e70405c6a9 upstream

No functional change, later it will be re-used in several files.

Signed-off-by: Alexander Sverdlin &lt;alexander.sverdlin@nokia.com&gt;
Signed-off-by: Russell King &lt;rmk+kernel@armlinux.org.uk&gt;
Signed-off-by: Florian Fainelli &lt;f.fainelli@gmail.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>ARM: Qualify enabling of swiotlb_init()</title>
<updated>2021-09-26T12:07:06+00:00</updated>
<author>
<name>Florian Fainelli</name>
<email>f.fainelli@gmail.com</email>
</author>
<published>2021-03-19T04:03:33+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=f23763ab464f1eaf90912516540165a6e163ad4f'/>
<id>f23763ab464f1eaf90912516540165a6e163ad4f</id>
<content type='text'>
commit fcf044891c84e38fc90eb736b818781bccf94e38 upstream.

We do not need a SWIOTLB unless we have DRAM that is addressable beyond
the arm_dma_limit. Compare max_pfn with arm_dma_pfn_limit to determine
whether we do need a SWIOTLB to be initialized.

Fixes: ad3c7b18c5b3 ("arm: use swiotlb for bounce buffering on LPAE configs")
Signed-off-by: Florian Fainelli &lt;f.fainelli@gmail.com&gt;
Signed-off-by: Konrad Rzeszutek Wilk &lt;konrad.wilk@oracle.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit fcf044891c84e38fc90eb736b818781bccf94e38 upstream.

We do not need a SWIOTLB unless we have DRAM that is addressable beyond
the arm_dma_limit. Compare max_pfn with arm_dma_pfn_limit to determine
whether we do need a SWIOTLB to be initialized.

Fixes: ad3c7b18c5b3 ("arm: use swiotlb for bounce buffering on LPAE configs")
Signed-off-by: Florian Fainelli &lt;f.fainelli@gmail.com&gt;
Signed-off-by: Konrad Rzeszutek Wilk &lt;konrad.wilk@oracle.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>s390/pci_mmio: fully validate the VMA before calling follow_pte()</title>
<updated>2021-09-26T12:07:06+00:00</updated>
<author>
<name>David Hildenbrand</name>
<email>david@redhat.com</email>
</author>
<published>2021-09-09T14:59:42+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=6bfdc3056ca81323870e7c2bee3a62aa9faa78d9'/>
<id>6bfdc3056ca81323870e7c2bee3a62aa9faa78d9</id>
<content type='text'>
commit a8b92b8c1eac8d655a97b1e90f4d83c25d9b9a18 upstream.

We should not walk/touch page tables outside of VMA boundaries when
holding only the mmap sem in read mode. Evil user space can modify the
VMA layout just before this function runs and e.g., trigger races with
page table removal code since commit dd2283f2605e ("mm: mmap: zap pages
with read mmap_sem in munmap").

find_vma() does not check if the address is &gt;= the VMA start address;
use vma_lookup() instead.

Reviewed-by: Niklas Schnelle &lt;schnelle@linux.ibm.com&gt;
Reviewed-by: Liam R. Howlett &lt;Liam.Howlett@oracle.com&gt;
Fixes: dd2283f2605e ("mm: mmap: zap pages with read mmap_sem in munmap")
Signed-off-by: David Hildenbrand &lt;david@redhat.com&gt;
Signed-off-by: Vasily Gorbik &lt;gor@linux.ibm.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit a8b92b8c1eac8d655a97b1e90f4d83c25d9b9a18 upstream.

We should not walk/touch page tables outside of VMA boundaries when
holding only the mmap sem in read mode. Evil user space can modify the
VMA layout just before this function runs and e.g., trigger races with
page table removal code since commit dd2283f2605e ("mm: mmap: zap pages
with read mmap_sem in munmap").

find_vma() does not check if the address is &gt;= the VMA start address;
use vma_lookup() instead.

Reviewed-by: Niklas Schnelle &lt;schnelle@linux.ibm.com&gt;
Reviewed-by: Liam R. Howlett &lt;Liam.Howlett@oracle.com&gt;
Fixes: dd2283f2605e ("mm: mmap: zap pages with read mmap_sem in munmap")
Signed-off-by: David Hildenbrand &lt;david@redhat.com&gt;
Signed-off-by: Vasily Gorbik &lt;gor@linux.ibm.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>s390/bpf: Fix 64-bit subtraction of the -0x80000000 constant</title>
<updated>2021-09-22T10:26:46+00:00</updated>
<author>
<name>Ilya Leoshkevich</name>
<email>iii@linux.ibm.com</email>
</author>
<published>2021-09-07T11:41:16+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=54ac8339ae99e54139637f8cd409de047a101d7a'/>
<id>54ac8339ae99e54139637f8cd409de047a101d7a</id>
<content type='text'>
commit 6e61dc9da0b7a0d91d57c2e20b5ea4fd2d4e7e53 upstream.

The JIT uses agfi for subtracting constants, but -(-0x80000000) cannot
be represented as a 32-bit signed binary integer. Fix by using algfi in
this particular case.

Reported-by: Johan Almbladh &lt;johan.almbladh@anyfinetworks.com&gt;
Fixes: 054623105728 ("s390/bpf: Add s390x eBPF JIT compiler backend")
Reviewed-by: Heiko Carstens &lt;hca@linux.ibm.com&gt;
Signed-off-by: Ilya Leoshkevich &lt;iii@linux.ibm.com&gt;
Signed-off-by: Vasily Gorbik &lt;gor@linux.ibm.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 6e61dc9da0b7a0d91d57c2e20b5ea4fd2d4e7e53 upstream.

The JIT uses agfi for subtracting constants, but -(-0x80000000) cannot
be represented as a 32-bit signed binary integer. Fix by using algfi in
this particular case.

Reported-by: Johan Almbladh &lt;johan.almbladh@anyfinetworks.com&gt;
Fixes: 054623105728 ("s390/bpf: Add s390x eBPF JIT compiler backend")
Reviewed-by: Heiko Carstens &lt;hca@linux.ibm.com&gt;
Signed-off-by: Ilya Leoshkevich &lt;iii@linux.ibm.com&gt;
Signed-off-by: Vasily Gorbik &lt;gor@linux.ibm.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>s390/bpf: Fix optimizing out zero-extensions</title>
<updated>2021-09-22T10:26:46+00:00</updated>
<author>
<name>Ilya Leoshkevich</name>
<email>iii@linux.ibm.com</email>
</author>
<published>2021-09-06T13:04:14+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=a5fc48000b0ed5c389d426c341b43f580faa7904'/>
<id>a5fc48000b0ed5c389d426c341b43f580faa7904</id>
<content type='text'>
commit db7bee653859ef7179be933e7d1384644f795f26 upstream.

Currently the JIT completely removes things like `reg32 += 0`,
however, the BPF_ALU semantics requires the target register to be
zero-extended in such cases.

Fix by optimizing out only the arithmetic operation, but not the
subsequent zero-extension.

Reported-by: Johan Almbladh &lt;johan.almbladh@anyfinetworks.com&gt;
Fixes: 054623105728 ("s390/bpf: Add s390x eBPF JIT compiler backend")
Reviewed-by: Heiko Carstens &lt;hca@linux.ibm.com&gt;
Signed-off-by: Ilya Leoshkevich &lt;iii@linux.ibm.com&gt;
Signed-off-by: Vasily Gorbik &lt;gor@linux.ibm.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit db7bee653859ef7179be933e7d1384644f795f26 upstream.

Currently the JIT completely removes things like `reg32 += 0`,
however, the BPF_ALU semantics requires the target register to be
zero-extended in such cases.

Fix by optimizing out only the arithmetic operation, but not the
subsequent zero-extension.

Reported-by: Johan Almbladh &lt;johan.almbladh@anyfinetworks.com&gt;
Fixes: 054623105728 ("s390/bpf: Add s390x eBPF JIT compiler backend")
Reviewed-by: Heiko Carstens &lt;hca@linux.ibm.com&gt;
Signed-off-by: Ilya Leoshkevich &lt;iii@linux.ibm.com&gt;
Signed-off-by: Vasily Gorbik &lt;gor@linux.ibm.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
</feed>
