From: Greg Kroah-Hartman Date: Mon, 22 Nov 2021 13:09:46 +0000 (+0100) Subject: 5.10-stable patches X-Git-Tag: v5.15.5~53 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=7ef22b051bfe464c2b296118c283cd8673090cbf;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: kvm-nvmx-don-t-use-vcpu-arch.efer-when-checking-host-state-on-nested-state-load.patch net-stmmac-socfpga-add-runtime-suspend-resume-callback-for-stratix10-platform.patch udf-fix-crash-after-seekdir.patch --- diff --git a/queue-5.10/kvm-nvmx-don-t-use-vcpu-arch.efer-when-checking-host-state-on-nested-state-load.patch b/queue-5.10/kvm-nvmx-don-t-use-vcpu-arch.efer-when-checking-host-state-on-nested-state-load.patch new file mode 100644 index 00000000000..52240680923 --- /dev/null +++ b/queue-5.10/kvm-nvmx-don-t-use-vcpu-arch.efer-when-checking-host-state-on-nested-state-load.patch @@ -0,0 +1,91 @@ +From af957eebfcc17433ee83ab85b1195a933ab5049c Mon Sep 17 00:00:00 2001 +From: Maxim Levitsky +Date: Mon, 15 Nov 2021 15:18:36 +0200 +Subject: KVM: nVMX: don't use vcpu->arch.efer when checking host state on nested state load + +From: Maxim Levitsky + +commit af957eebfcc17433ee83ab85b1195a933ab5049c upstream. + +When loading nested state, don't use check vcpu->arch.efer to get the +L1 host's 64-bit vs. 32-bit state and don't check it for consistency +with respect to VM_EXIT_HOST_ADDR_SPACE_SIZE, as register state in vCPU +may be stale when KVM_SET_NESTED_STATE is called---and architecturally +does not exist. When restoring L2 state in KVM, the CPU is placed in +non-root where nested VMX code has no snapshot of L1 host state: VMX +(conditionally) loads host state fields loaded on VM-exit, but they need +not correspond to the state before entry. A simple case occurs in KVM +itself, where the host RIP field points to vmx_vmexit rather than the +instruction following vmlaunch/vmresume. + +However, for the particular case of L1 being in 32- or 64-bit mode +on entry, the exit controls can be treated instead as the source of +truth regarding the state of L1 on entry, and can be used to check +that vmcs12.VM_EXIT_HOST_ADDR_SPACE_SIZE matches vmcs12.HOST_EFER if +vmcs12.VM_EXIT_LOAD_IA32_EFER is set. The consistency check on CPU +EFER vs. vmcs12.VM_EXIT_HOST_ADDR_SPACE_SIZE, instead, happens only +on VM-Enter. That's because, again, there's conceptually no "current" +L1 EFER to check on KVM_SET_NESTED_STATE. + +Suggested-by: Paolo Bonzini +Signed-off-by: Maxim Levitsky +Message-Id: <20211115131837.195527-2-mlevitsk@redhat.com> +Cc: stable@vger.kernel.org +Signed-off-by: Paolo Bonzini +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kvm/vmx/nested.c | 22 +++++++++++++++++----- + 1 file changed, 17 insertions(+), 5 deletions(-) + +--- a/arch/x86/kvm/vmx/nested.c ++++ b/arch/x86/kvm/vmx/nested.c +@@ -2851,6 +2851,17 @@ static int nested_vmx_check_controls(str + return 0; + } + ++static int nested_vmx_check_address_space_size(struct kvm_vcpu *vcpu, ++ struct vmcs12 *vmcs12) ++{ ++#ifdef CONFIG_X86_64 ++ if (CC(!!(vmcs12->vm_exit_controls & VM_EXIT_HOST_ADDR_SPACE_SIZE) != ++ !!(vcpu->arch.efer & EFER_LMA))) ++ return -EINVAL; ++#endif ++ return 0; ++} ++ + static int nested_vmx_check_host_state(struct kvm_vcpu *vcpu, + struct vmcs12 *vmcs12) + { +@@ -2875,18 +2886,16 @@ static int nested_vmx_check_host_state(s + return -EINVAL; + + #ifdef CONFIG_X86_64 +- ia32e = !!(vcpu->arch.efer & EFER_LMA); ++ ia32e = !!(vmcs12->vm_exit_controls & VM_EXIT_HOST_ADDR_SPACE_SIZE); + #else + ia32e = false; + #endif + + if (ia32e) { +- if (CC(!(vmcs12->vm_exit_controls & VM_EXIT_HOST_ADDR_SPACE_SIZE)) || +- CC(!(vmcs12->host_cr4 & X86_CR4_PAE))) ++ if (CC(!(vmcs12->host_cr4 & X86_CR4_PAE))) + return -EINVAL; + } else { +- if (CC(vmcs12->vm_exit_controls & VM_EXIT_HOST_ADDR_SPACE_SIZE) || +- CC(vmcs12->vm_entry_controls & VM_ENTRY_IA32E_MODE) || ++ if (CC(vmcs12->vm_entry_controls & VM_ENTRY_IA32E_MODE) || + CC(vmcs12->host_cr4 & X86_CR4_PCIDE) || + CC((vmcs12->host_rip) >> 32)) + return -EINVAL; +@@ -3555,6 +3564,9 @@ static int nested_vmx_run(struct kvm_vcp + if (nested_vmx_check_controls(vcpu, vmcs12)) + return nested_vmx_fail(vcpu, VMXERR_ENTRY_INVALID_CONTROL_FIELD); + ++ if (nested_vmx_check_address_space_size(vcpu, vmcs12)) ++ return nested_vmx_fail(vcpu, VMXERR_ENTRY_INVALID_HOST_STATE_FIELD); ++ + if (nested_vmx_check_host_state(vcpu, vmcs12)) + return nested_vmx_fail(vcpu, VMXERR_ENTRY_INVALID_HOST_STATE_FIELD); + diff --git a/queue-5.10/net-stmmac-socfpga-add-runtime-suspend-resume-callback-for-stratix10-platform.patch b/queue-5.10/net-stmmac-socfpga-add-runtime-suspend-resume-callback-for-stratix10-platform.patch new file mode 100644 index 00000000000..5f0c5d7d837 --- /dev/null +++ b/queue-5.10/net-stmmac-socfpga-add-runtime-suspend-resume-callback-for-stratix10-platform.patch @@ -0,0 +1,58 @@ +From 9119570039481d56350af1c636f040fb300b8cf3 Mon Sep 17 00:00:00 2001 +From: Meng Li +Date: Mon, 15 Nov 2021 15:04:23 +0800 +Subject: net: stmmac: socfpga: add runtime suspend/resume callback for stratix10 platform + +From: Meng Li + +commit 9119570039481d56350af1c636f040fb300b8cf3 upstream. + +According to upstream commit 5ec55823438e("net: stmmac: +add clocks management for gmac driver"), it improve clocks +management for stmmac driver. So, it is necessary to implement +the runtime callback in dwmac-socfpga driver because it doesn't +use the common stmmac_pltfr_pm_ops instance. Otherwise, clocks +are not disabled when system enters suspend status. + +Fixes: 5ec55823438e ("net: stmmac: add clocks management for gmac driver") +Cc: stable@vger.kernel.org +Signed-off-by: Meng Li +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c | 24 ++++++++++++++++++-- + 1 file changed, 22 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c +@@ -485,8 +485,28 @@ static int socfpga_dwmac_resume(struct d + } + #endif /* CONFIG_PM_SLEEP */ + +-static SIMPLE_DEV_PM_OPS(socfpga_dwmac_pm_ops, stmmac_suspend, +- socfpga_dwmac_resume); ++static int __maybe_unused socfpga_dwmac_runtime_suspend(struct device *dev) ++{ ++ struct net_device *ndev = dev_get_drvdata(dev); ++ struct stmmac_priv *priv = netdev_priv(ndev); ++ ++ stmmac_bus_clks_config(priv, false); ++ ++ return 0; ++} ++ ++static int __maybe_unused socfpga_dwmac_runtime_resume(struct device *dev) ++{ ++ struct net_device *ndev = dev_get_drvdata(dev); ++ struct stmmac_priv *priv = netdev_priv(ndev); ++ ++ return stmmac_bus_clks_config(priv, true); ++} ++ ++static const struct dev_pm_ops socfpga_dwmac_pm_ops = { ++ SET_SYSTEM_SLEEP_PM_OPS(stmmac_suspend, socfpga_dwmac_resume) ++ SET_RUNTIME_PM_OPS(socfpga_dwmac_runtime_suspend, socfpga_dwmac_runtime_resume, NULL) ++}; + + static const struct socfpga_dwmac_ops socfpga_gen5_ops = { + .set_phy_mode = socfpga_gen5_set_phy_mode, diff --git a/queue-5.10/series b/queue-5.10/series index 56129e7d530..4b3214dafff 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -130,3 +130,6 @@ powerpc-8xx-fix-pinned-tlbs-with-config_strict_kernel_rwx.patch scsi-qla2xxx-fix-mailbox-direction-flags-in-qla2xxx_get_adapter_id.patch s390-kexec-fix-memory-leak-of-ipl-report-buffer.patch block-check-admin-before-nice-for-ioprio_class_rt.patch +kvm-nvmx-don-t-use-vcpu-arch.efer-when-checking-host-state-on-nested-state-load.patch +udf-fix-crash-after-seekdir.patch +net-stmmac-socfpga-add-runtime-suspend-resume-callback-for-stratix10-platform.patch diff --git a/queue-5.10/udf-fix-crash-after-seekdir.patch b/queue-5.10/udf-fix-crash-after-seekdir.patch new file mode 100644 index 00000000000..73e626394d6 --- /dev/null +++ b/queue-5.10/udf-fix-crash-after-seekdir.patch @@ -0,0 +1,157 @@ +From a48fc69fe6588b48d878d69de223b91a386a7cb4 Mon Sep 17 00:00:00 2001 +From: Jan Kara +Date: Thu, 4 Nov 2021 15:22:35 +0100 +Subject: udf: Fix crash after seekdir + +From: Jan Kara + +commit a48fc69fe6588b48d878d69de223b91a386a7cb4 upstream. + +udf_readdir() didn't validate the directory position it should start +reading from. Thus when user uses lseek(2) on directory file descriptor +it can trick udf_readdir() into reading from a position in the middle of +directory entry which then upsets directory parsing code resulting in +errors or even possible kernel crashes. Similarly when the directory is +modified between two readdir calls, the directory position need not be +valid anymore. + +Add code to validate current offset in the directory. This is actually +rather expensive for UDF as we need to read from the beginning of the +directory and parse all directory entries. This is because in UDF a +directory is just a stream of data containing directory entries and +since file names are fully under user's control we cannot depend on +detecting magic numbers and checksums in the header of directory entry +as a malicious attacker could fake them. We skip this step if we detect +that nothing changed since the last readdir call. + +Reported-by: Nathan Wilson +CC: stable@vger.kernel.org +Signed-off-by: Jan Kara +Signed-off-by: Greg Kroah-Hartman +--- + fs/udf/dir.c | 32 ++++++++++++++++++++++++++++++-- + fs/udf/namei.c | 3 +++ + fs/udf/super.c | 2 ++ + 3 files changed, 35 insertions(+), 2 deletions(-) + +--- a/fs/udf/dir.c ++++ b/fs/udf/dir.c +@@ -31,6 +31,7 @@ + #include + #include + #include ++#include + + #include "udf_i.h" + #include "udf_sb.h" +@@ -44,7 +45,7 @@ static int udf_readdir(struct file *file + struct fileIdentDesc *fi = NULL; + struct fileIdentDesc cfi; + udf_pblk_t block, iblock; +- loff_t nf_pos; ++ loff_t nf_pos, emit_pos = 0; + int flen; + unsigned char *fname = NULL, *copy_name = NULL; + unsigned char *nameptr; +@@ -58,6 +59,7 @@ static int udf_readdir(struct file *file + int i, num, ret = 0; + struct extent_position epos = { NULL, 0, {0, 0} }; + struct super_block *sb = dir->i_sb; ++ bool pos_valid = false; + + if (ctx->pos == 0) { + if (!dir_emit_dot(file, ctx)) +@@ -68,6 +70,21 @@ static int udf_readdir(struct file *file + if (nf_pos >= size) + goto out; + ++ /* ++ * Something changed since last readdir (either lseek was called or dir ++ * changed)? We need to verify the position correctly points at the ++ * beginning of some dir entry so that the directory parsing code does ++ * not get confused. Since UDF does not have any reliable way of ++ * identifying beginning of dir entry (names are under user control), ++ * we need to scan the directory from the beginning. ++ */ ++ if (!inode_eq_iversion(dir, file->f_version)) { ++ emit_pos = nf_pos; ++ nf_pos = 0; ++ } else { ++ pos_valid = true; ++ } ++ + fname = kmalloc(UDF_NAME_LEN, GFP_NOFS); + if (!fname) { + ret = -ENOMEM; +@@ -123,13 +140,21 @@ static int udf_readdir(struct file *file + + while (nf_pos < size) { + struct kernel_lb_addr tloc; ++ loff_t cur_pos = nf_pos; + +- ctx->pos = (nf_pos >> 2) + 1; ++ /* Update file position only if we got past the current one */ ++ if (nf_pos >= emit_pos) { ++ ctx->pos = (nf_pos >> 2) + 1; ++ pos_valid = true; ++ } + + fi = udf_fileident_read(dir, &nf_pos, &fibh, &cfi, &epos, &eloc, + &elen, &offset); + if (!fi) + goto out; ++ /* Still not at offset where user asked us to read from? */ ++ if (cur_pos < emit_pos) ++ continue; + + liu = le16_to_cpu(cfi.lengthOfImpUse); + lfi = cfi.lengthFileIdent; +@@ -187,8 +212,11 @@ static int udf_readdir(struct file *file + } /* end while */ + + ctx->pos = (nf_pos >> 2) + 1; ++ pos_valid = true; + + out: ++ if (pos_valid) ++ file->f_version = inode_query_iversion(dir); + if (fibh.sbh != fibh.ebh) + brelse(fibh.ebh); + brelse(fibh.sbh); +--- a/fs/udf/namei.c ++++ b/fs/udf/namei.c +@@ -30,6 +30,7 @@ + #include + #include + #include ++#include + + static inline int udf_match(int len1, const unsigned char *name1, int len2, + const unsigned char *name2) +@@ -135,6 +136,8 @@ int udf_write_fi(struct inode *inode, st + mark_buffer_dirty_inode(fibh->ebh, inode); + mark_buffer_dirty_inode(fibh->sbh, inode); + } ++ inode_inc_iversion(inode); ++ + return 0; + } + +--- a/fs/udf/super.c ++++ b/fs/udf/super.c +@@ -57,6 +57,7 @@ + #include + #include + #include ++#include + + #include "udf_sb.h" + #include "udf_i.h" +@@ -149,6 +150,7 @@ static struct inode *udf_alloc_inode(str + init_rwsem(&ei->i_data_sem); + ei->cached_extent.lstart = -1; + spin_lock_init(&ei->i_extent_cache_lock); ++ inode_set_iversion(&ei->vfs_inode, 1); + + return &ei->vfs_inode; + }