Intel OpenBMC Linux kernel source tree (mirror) https://git.radix-linux.su/BMC/Intel-BMC/linux.git/atom?h=dev-5.10-intel 2021-10-01T18:40:21+00:00 2021-10-01T18:40:21+00:00 Jae Hyun Yoo jae.hyun.yoo@linux.intel.com 2021-10-01T18:38:40+00:00 urn:sha1:9c881021a269af242594e2dfc79f1c4701404887 Pull 5.10.67 stable from OpenBMC upstream. Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@linux.intel.com> 2021-09-20T04:04:02+00:00 Joel Stanley joel@jms.id.au 2021-09-20T04:03:59+00:00 urn:sha1:5a00a12bae41f95d55616fa0661733b0b2d77f81 This is the 5.10.67 stable release Signed-off-by: Joel Stanley <joel@jms.id.au> 2021-09-18T11:40:09+00:00 Wang Hai wanghai38@huawei.com 2021-08-18T12:48:45+00:00 urn:sha1:516dbe27f44748bdf2c413e74997734f3a7af445 commit a30dc6cf0dc51419021550152e435736aaef8799 upstream. I got a NULL pointer dereference report when doing fuzz test: Call Trace: qp_release_pages+0xae/0x130 qp_host_unregister_user_memory.isra.25+0x2d/0x80 vmci_qp_broker_unmap+0x191/0x320 ? vmci_host_do_alloc_queuepair.isra.9+0x1c0/0x1c0 vmci_host_unlocked_ioctl+0x59f/0xd50 ? do_vfs_ioctl+0x14b/0xa10 ? tomoyo_file_ioctl+0x28/0x30 ? vmci_host_do_alloc_queuepair.isra.9+0x1c0/0x1c0 __x64_sys_ioctl+0xea/0x120 do_syscall_64+0x34/0xb0 entry_SYSCALL_64_after_hwframe+0x44/0xae When a queue pair is created by the following call, it will not register the user memory if the page_store is NULL, and the entry->state will be set to VMCIQPB_CREATED_NO_MEM. vmci_host_unlocked_ioctl vmci_host_do_alloc_queuepair vmci_qp_broker_alloc qp_broker_alloc qp_broker_create // set entry->state = VMCIQPB_CREATED_NO_MEM; When unmapping this queue pair, qp_host_unregister_user_memory() will be called to unregister the non-existent user memory, which will result in a null pointer reference. It will also change VMCIQPB_CREATED_NO_MEM to VMCIQPB_CREATED_MEM, which should not be present in this operation. Only when the qp broker has mem, it can unregister the user memory when unmapping the qp broker. Only when the qp broker has no mem, it can register the user memory when mapping the qp broker. Fixes: 06164d2b72aa ("VMCI: queue pairs implementation.") Cc: stable <stable@vger.kernel.org> Reported-by: Hulk Robot <hulkci@huawei.com> Reviewed-by: Jorgen Hansen <jhansen@vmware.com> Signed-off-by: Wang Hai <wanghai38@huawei.com> Link: https://lore.kernel.org/r/20210818124845.488312-1-wanghai38@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 2021-09-16T03:29:35+00:00 Joel Stanley joel@jms.id.au 2021-09-16T03:29:35+00:00 urn:sha1:c283faf1e8932fd6086ebb8b4d269f5329592fea This is the 5.10.65 stable release 2021-09-15T07:50:42+00:00 Kevin Mitchell kevmitch@arista.com 2021-08-19T02:29:39+00:00 urn:sha1:cc59ad70cfb654c6fa3acc07db21d2231c9ffce9 [ Upstream commit d1f278da6b11585f05b2755adfc8851cbf14a1ec ] When scsi_dispatch_cmd was moved to scsi_lib.c and made static, some compilers (i.e., at least gcc 8.4.0) decided to compile this inline. This is a problem for lkdtm.ko, which inserted a kprobe on this function for the SCSI_DISPATCH_CMD crashpoint. Move this crashpoint one function up the call chain to scsi_queue_rq. Though this is also a static function, it should never be inlined because it is assigned as a structure entry. Therefore, kprobe_register should always be able to find it. Fixes: 82042a2cdb55 ("scsi: move scsi_dispatch_cmd to scsi_lib.c") Acked-by: Kees Cook <keescook@chromium.org> Signed-off-by: Kevin Mitchell <kevmitch@arista.com> Link: https://lore.kernel.org/r/20210819022940.561875-2-kevmitch@arista.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org> 2021-09-07T21:25:02+00:00 Jae Hyun Yoo jae.hyun.yoo@intel.com 2021-09-07T21:23:50+00:00 urn:sha1:0037e985251c12fe5e65457ea72df436f8f0101f Pull 5.10.60 stable from OpenBMC upstream Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@intel.com> 2021-09-03T08:09:30+00:00 Kees Cook keescook@chromium.org 2021-06-23T20:39:33+00:00 urn:sha1:f760c1101f5284acdf3a8132dff257838b9bf75c commit f123c42bbeff26bfe8bdb08a01307e92d51eec39 upstream Where feasible, I prefer to have all tests visible on all architectures, but to have them wired to XFAIL. DOUBLE_FAIL was set up to XFAIL, but wasn't actually being added to the test list. Fixes: cea23efb4de2 ("lkdtm/bugs: Make double-fault test always available") Cc: stable@vger.kernel.org Signed-off-by: Kees Cook <keescook@chromium.org> Link: https://lore.kernel.org/r/20210623203936.3151093-7-keescook@chromium.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> [sudip: adjust context] Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 2021-08-19T05:04:25+00:00 Joel Stanley joel@jms.id.au 2021-08-19T05:04:21+00:00 urn:sha1:09869b9b34417297808d8a57b2e9f8f61218354b This is the 5.10.60 stable release Signed-off-by: Joel Stanley <joel@jms.id.au> 2021-08-02T16:04:00+00:00 Jae Hyun Yoo jae.hyun.yoo@linux.intel.com 2021-04-28T16:43:47+00:00 urn:sha1:6ca9cf3944ae74de672b0e0b4b6253d265b77800 This commit adds a raw value setting interface for uart routing to provide an atomic way of switching the route. Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@linux.intel.com> Change-Id: Id8b80f44f9a503d9f25a692211fc5ec78500ce68 2021-08-02T16:04:00+00:00 Jae Hyun Yoo jae.hyun.yoo@intel.com 2021-01-14T23:06:08+00:00 urn:sha1:d22bdd68df3dcb7669672fc5ae660e7b4ca22493 This commit moves Aspeed eSPI driver from misc to soc/aspeed tree to make correct probing order for LPC and eSPI driver. Since LPC runs over eSPI, eSPI driver should be registered ahead of LPC driver. Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@intel.com>