kernel/linux.git/drivers/misc/sgi-gru, branch v3.16.76

drivers/misc/sgi-gru: fix Spectre v1 vulnerability

2019-02-11T17:53:59+00:00

commit fee05f455ceb5c670cbe48e2f9454ebc4a388554 upstream. req.gid can be indirectly controlled by user-space, hence leading to a potential exploitation of the Spectre variant 1 vulnerability. This issue was detected with the help of Smatch: vers/misc/sgi-gru/grukdump.c:200 gru_dump_chiplet_request() warn: potential spectre issue 'gru_base' [w] Fix this by sanitizing req.gid before calling macro GID_TO_GRU, which uses it to index gru_base. Notice that given that speculation windows are large, the policy is to kill the speculation on the first load and not worry if it can be completed with a dependent load/store [1]. [1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2 Signed-off-by: Gustavo A. R. Silva Signed-off-by: Greg Kroah-Hartman Signed-off-by: Ben Hutchings

Merge branch 'x86-uv-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip into next

2014-06-03T22:48:23+00:00

Pull x86/UV changes from Ingo Molnar: "Continued updates for SGI UV 3 hardware support" * 'x86-uv-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/UV: Fix conditional in gru_exit() x86/UV: Set n_lshift based on GAM_GR_CONFIG MMR for UV3

drivers/misc/sgi-gru/grukdump.c: cleanup gru_dump_context() a little

2014-04-07T23:36:09+00:00

"ret" is zero here so we can remove the "!ret" part of the condition. "uhdr" is alread a __user pointer so we can remove the cast. Signed-off-by: Dan Carpenter Acked-by: Dimitri Sivanich Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

x86/UV: Fix conditional in gru_exit()

2014-04-01T10:10:45+00:00

Fix supported system conditional in gru_exit(), in preparation for UV3. Signed-off-by: Dimitri Sivanich Link: http://lkml.kernel.org/r/20140331152320.GA31495@sgi.com Signed-off-by: Ingo Molnar

drivers/misc/sgi-gru/grukdump.c: unlocking should be conditional in gru_dump_context()

2014-02-11T00:01:39+00:00

I was reviewing this and noticed that unlocking should be conditional on the error path. I've changed it to unlock and return directly since we only do it once and it seems unlikely to change in the near future. Signed-off-by: Dan Carpenter Acked-by: Dimitri Sivanich Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

drivers/misc/sgi-gru/grufault.c: fix a sanity test in gru_set_context_option()

2013-07-03T23:07:42+00:00

"req.val1 == -1" is valid but it doesn't make sense to check gru_base[-1]. gru_base[] is a global array. Signed-off-by: Dimitri Sivanich Cc: Dan Carpenter Cc: Robin Holt Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

Merge 3.10-rc6 into char-misc-next

2013-06-17T18:54:25+00:00

We want the fixes in here.

drivers/misc/sgi-gru/grufile.c: fix info leak in gru_get_config_info()

2013-06-12T23:29:46+00:00

The "info.fill" array isn't initialized so it can leak uninitialized stack information to user space. Signed-off-by: Dan Carpenter Acked-by: Robin Holt Acked-by: Dimitri Sivanich Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

misc: replace strict_strtoul() with kstrtoul()

2013-06-06T19:54:08+00:00

The usage of strict_strtoul() is not preferred, because strict_strtoul() is obsolete. Thus, kstrtoul() should be used. Signed-off-by: Jingoo Han Reviewed-by: Andy Shevchenko Signed-off-by: Greg Kroah-Hartman

proc: Supply a function to remove a proc entry by PDE

2013-05-01T21:29:46+00:00

Supply a function (proc_remove()) to remove a proc entry (and any subtree rooted there) by proc_dir_entry pointer rather than by name and (optionally) root dir entry pointer. This allows us to eliminate all remaining pde->name accesses outside of procfs. Signed-off-by: David Howells Acked-by: Grant Likely cc: linux-acpi@vger.kernel.org cc: openipmi-developer@lists.sourceforge.net cc: devicetree-discuss@lists.ozlabs.org cc: linux-pci@vger.kernel.org cc: netdev@vger.kernel.org cc: netfilter-devel@vger.kernel.org cc: alsa-devel@alsa-project.org Signed-off-by: Al Viro