From: Greg Kroah-Hartman Date: Fri, 12 Mar 2021 10:03:30 +0000 (+0100) Subject: 5.10-stable patches X-Git-Tag: v4.4.262~124 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=aeb4d7aee4cdac045b766a91e363f03d3586f159;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: gpio-fix-gpio-device-list-corruption.patch powerpc-603-fix-protection-of-user-pages-mapped-with-prot_none.patch --- diff --git a/queue-5.10/gpio-fix-gpio-device-list-corruption.patch b/queue-5.10/gpio-fix-gpio-device-list-corruption.patch new file mode 100644 index 00000000000..2f582ebf1ab --- /dev/null +++ b/queue-5.10/gpio-fix-gpio-device-list-corruption.patch @@ -0,0 +1,40 @@ +From cf25ef6b631c6fc6c0435fc91eba8734cca20511 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 1 Mar 2021 10:05:19 +0100 +Subject: gpio: fix gpio-device list corruption + +From: Johan Hovold + +commit cf25ef6b631c6fc6c0435fc91eba8734cca20511 upstream. + +Make sure to hold the gpio_lock when removing the gpio device from the +gpio_devices list (when dropping the last reference) to avoid corrupting +the list when there are concurrent accesses. + +Fixes: ff2b13592299 ("gpio: make the gpiochip a real device") +Cc: stable@vger.kernel.org # 4.6 +Reviewed-by: Saravana Kannan +Signed-off-by: Johan Hovold +Signed-off-by: Bartosz Golaszewski +[ johan: adjust context to 5.11 ] +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpio/gpiolib.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/gpio/gpiolib.c ++++ b/drivers/gpio/gpiolib.c +@@ -468,8 +468,12 @@ EXPORT_SYMBOL_GPL(gpiochip_line_is_valid + static void gpiodevice_release(struct device *dev) + { + struct gpio_device *gdev = dev_get_drvdata(dev); ++ unsigned long flags; + ++ spin_lock_irqsave(&gpio_lock, flags); + list_del(&gdev->list); ++ spin_unlock_irqrestore(&gpio_lock, flags); ++ + ida_free(&gpio_ida, gdev->id); + kfree_const(gdev->label); + kfree(gdev->descs); diff --git a/queue-5.10/powerpc-603-fix-protection-of-user-pages-mapped-with-prot_none.patch b/queue-5.10/powerpc-603-fix-protection-of-user-pages-mapped-with-prot_none.patch new file mode 100644 index 00000000000..a8d8cd8c4d2 --- /dev/null +++ b/queue-5.10/powerpc-603-fix-protection-of-user-pages-mapped-with-prot_none.patch @@ -0,0 +1,96 @@ +From c119565a15a628efdfa51352f9f6c5186e506a1c Mon Sep 17 00:00:00 2001 +From: Christophe Leroy +Date: Mon, 1 Feb 2021 06:29:50 +0000 +Subject: powerpc/603: Fix protection of user pages mapped with PROT_NONE + +From: Christophe Leroy + +commit c119565a15a628efdfa51352f9f6c5186e506a1c upstream. + +On book3s/32, page protection is defined by the PP bits in the PTE +which provide the following protection depending on the access +keys defined in the matching segment register: +- PP 00 means RW with key 0 and N/A with key 1. +- PP 01 means RW with key 0 and RO with key 1. +- PP 10 means RW with both key 0 and key 1. +- PP 11 means RO with both key 0 and key 1. + +Since the implementation of kernel userspace access protection, +PP bits have been set as follows: +- PP00 for pages without _PAGE_USER +- PP01 for pages with _PAGE_USER and _PAGE_RW +- PP11 for pages with _PAGE_USER and without _PAGE_RW + +For kernelspace segments, kernel accesses are performed with key 0 +and user accesses are performed with key 1. As PP00 is used for +non _PAGE_USER pages, user can't access kernel pages not flagged +_PAGE_USER while kernel can. + +For userspace segments, both kernel and user accesses are performed +with key 0, therefore pages not flagged _PAGE_USER are still +accessible to the user. + +This shouldn't be an issue, because userspace is expected to be +accessible to the user. But unlike most other architectures, powerpc +implements PROT_NONE protection by removing _PAGE_USER flag instead of +flagging the page as not valid. This means that pages in userspace +that are not flagged _PAGE_USER shall remain inaccessible. + +To get the expected behaviour, just mimic other architectures in the +TLB miss handler by checking _PAGE_USER permission on userspace +accesses as if it was the _PAGE_PRESENT bit. + +Note that this problem only is only for 603 cores. The 604+ have +an hash table, and hash_page() function already implement the +verification of _PAGE_USER permission on userspace pages. + +Fixes: f342adca3afc ("powerpc/32s: Prepare Kernel Userspace Access Protection") +Cc: stable@vger.kernel.org # v5.2+ +Reported-by: Christoph Plattner +Signed-off-by: Christophe Leroy +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/4a0c6e3bb8f0c162457bf54d9bc6fd8d7b55129f.1612160907.git.christophe.leroy@csgroup.eu +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/kernel/head_book3s_32.S | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/arch/powerpc/kernel/head_book3s_32.S ++++ b/arch/powerpc/kernel/head_book3s_32.S +@@ -461,10 +461,11 @@ InstructionTLBMiss: + cmplw 0,r1,r3 + #endif + mfspr r2, SPRN_SPRG_PGDIR +- li r1,_PAGE_PRESENT | _PAGE_ACCESSED | _PAGE_EXEC ++ li r1,_PAGE_PRESENT | _PAGE_ACCESSED | _PAGE_EXEC | _PAGE_USER + #if defined(CONFIG_MODULES) || defined(CONFIG_DEBUG_PAGEALLOC) + bgt- 112f + lis r2, (swapper_pg_dir - PAGE_OFFSET)@ha /* if kernel address, use */ ++ li r1,_PAGE_PRESENT | _PAGE_ACCESSED | _PAGE_EXEC + addi r2, r2, (swapper_pg_dir - PAGE_OFFSET)@l /* kernel page table */ + #endif + 112: rlwimi r2,r3,12,20,29 /* insert top 10 bits of address */ +@@ -523,9 +524,10 @@ DataLoadTLBMiss: + lis r1, TASK_SIZE@h /* check if kernel address */ + cmplw 0,r1,r3 + mfspr r2, SPRN_SPRG_PGDIR +- li r1, _PAGE_PRESENT | _PAGE_ACCESSED ++ li r1, _PAGE_PRESENT | _PAGE_ACCESSED | _PAGE_USER + bgt- 112f + lis r2, (swapper_pg_dir - PAGE_OFFSET)@ha /* if kernel address, use */ ++ li r1, _PAGE_PRESENT | _PAGE_ACCESSED + addi r2, r2, (swapper_pg_dir - PAGE_OFFSET)@l /* kernel page table */ + 112: rlwimi r2,r3,12,20,29 /* insert top 10 bits of address */ + lwz r2,0(r2) /* get pmd entry */ +@@ -599,9 +601,10 @@ DataStoreTLBMiss: + lis r1, TASK_SIZE@h /* check if kernel address */ + cmplw 0,r1,r3 + mfspr r2, SPRN_SPRG_PGDIR +- li r1, _PAGE_RW | _PAGE_DIRTY | _PAGE_PRESENT | _PAGE_ACCESSED ++ li r1, _PAGE_RW | _PAGE_DIRTY | _PAGE_PRESENT | _PAGE_ACCESSED | _PAGE_USER + bgt- 112f + lis r2, (swapper_pg_dir - PAGE_OFFSET)@ha /* if kernel address, use */ ++ li r1, _PAGE_RW | _PAGE_DIRTY | _PAGE_PRESENT | _PAGE_ACCESSED + addi r2, r2, (swapper_pg_dir - PAGE_OFFSET)@l /* kernel page table */ + 112: rlwimi r2,r3,12,20,29 /* insert top 10 bits of address */ + lwz r2,0(r2) /* get pmd entry */ diff --git a/queue-5.10/series b/queue-5.10/series index e3edc004463..f17701468b2 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -29,3 +29,5 @@ libbpf-clear-map_info-before-each-bpf_obj_get_info_by_fd.patch ibmvnic-fix-possibly-uninitialized-old_num_tx_queues-variable-warning.patch ibmvnic-always-store-valid-mac-address.patch mt76-dma-do-not-report-truncated-frames-to-mac80211.patch +gpio-fix-gpio-device-list-corruption.patch +powerpc-603-fix-protection-of-user-pages-mapped-with-prot_none.patch