A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-28 02:32:09 -04:00
Code Issues Projects Releases Packages Wiki Activity

This is the 5.4.107 stable release

Browse source 
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmBVwvYACgkQONu9yGCS
 aT7ODBAAwMd9UQ1u5imfCkgmbkVPpF+dW5NSR1stpVrKPzAU+Yspf4YNXMyMrBMa
 OhDAqKWhlsZAFm5FJFw4mMK35LclFJAAktksGzBrrE9nkL0+il88/GO1mGUHRP5G
 0PK4WKkS33svG8cZq7yCWP07eS1lHhLcHb4MN19kqQvErjVD0jIp8qrB7VXp45Ef
 eFRVtejkCa4ycjp+oxx+jUqOq5rPws7szYKKXLcvyP3/XmetOlAb2+Qh/iHhwUTT
 XI3u6lv5lGHeoy6PkVXE+TdYT0/53Gcp8fDJMjVLW0Z3DV5EQfPZZSQE+16fO5q3
 QA4cbPTdjy39eW6GHK8Yc9Mocl/I6b87Nhw3FvocyfDx6s4/xugGW8rDshnOHZmp
 Pjt5UfS4RdFQT0jfztSR06yNgXdsCORo0YE4CuBO7609MXlF9TMSqMKSIWU2yhMn
 Sq0Dk/6rt22sCJbEgcNfDH97QNP2S+2F7OzQXVZxb0biG0kcwZ70IFfJHxWJID07
 KNgWEkOg2AZhplak94ORORWSQBkHRCvAnSw/Qq4f4JgtB6yTJPLC76v8rNI2tVDt
 PpyvoYLb5seBt3OOkPF5lBB3WYPqpTUTmxA2aPF2CoNL9z0miZPPnJ2Vfh8NG+P9
 kPNSColpTAnwFFZOCrHN3sPGkNWsA/fGqISxq+crKlAEmTQc9Z4=
 =dH0a
 -----END PGP SIGNATURE-----

Merge 5.4.107 into android11-5.4-lts

Changes in 5.4.107
	KVM: arm64: nvhe: Save the SPE context early
	bpf: Prohibit alu ops for pointer types not defining ptr_limit
	bpf: Fix off-by-one for area size in creating mask to left
	bpf: Simplify alu_limit masking for pointer arithmetic
	bpf: Add sanity check for upper ptr_limit
	bpf, selftests: Fix up some test_verifier cases for unprivileged
	btrfs: scrub: Don't check free space before marking a block group RO
	drm/i915/gvt: Set SNOOP for PAT3 on BXT/APL to workaround GPU BB hang
	drm/i915/gvt: Fix mmio handler break on BXT/APL.
	drm/i915/gvt: Fix virtual display setup for BXT/APL
	drm/i915/gvt: Fix port number for BDW on EDID region setup
	drm/i915/gvt: Fix vfio_edid issue for BXT/APL
	fuse: fix live lock in fuse_iget()
	crypto: x86 - Regularize glue function prototypes
	crypto: aesni - Use TEST %reg,%reg instead of CMP $0,%reg
	crypto: x86/aes-ni-xts - use direct calls to and 4-way stride
	net: dsa: tag_mtk: fix 802.1ad VLAN egress
	net: dsa: b53: Support setting learning on port
	Linux 5.4.107

Signed-off-by: Greg Kroah-Hartman <[email protected]>
Change-Id: I3da7020a7d39d72ffbcb0baf4267b7dbc0fc0891
This commit is contained in:
Greg Kroah-Hartman 2021-03-20 11:25:50 +01:00
commit 8963cb8881
24 changed files with 555 additions and 143 deletions
Download patch file Download diff file Expand all files Collapse all files

33
kernel/bpf/verifier.c
View file

@ -4268,10 +4268,14 @@ static int retrieve_ptr_limit(const struct bpf_reg_state *ptr_reg,
{
bool mask_to_left = (opcode == BPF_ADD && off_is_neg) ||
(opcode == BPF_SUB && !off_is_neg);
u32 off;
u32 off, max;
switch (ptr_reg->type) {
case PTR_TO_STACK:
/* Offset 0 is out-of-bounds, but acceptable start for the
* left direction, see BPF_REG_FP.
*/
max = MAX_BPF_STACK + mask_to_left;
/* Indirect variable offset stack access is prohibited in
* unprivileged mode so it's not handled here.
*/
@ -4279,16 +4283,17 @@ static int retrieve_ptr_limit(const struct bpf_reg_state *ptr_reg,
if (mask_to_left)
*ptr_limit = MAX_BPF_STACK + off;
else
*ptr_limit = -off;
return 0;
*ptr_limit = -off - 1;
return *ptr_limit >= max ? -ERANGE : 0;
case PTR_TO_MAP_VALUE:
max = ptr_reg->map_ptr->value_size;
if (mask_to_left) {
*ptr_limit = ptr_reg->umax_value + ptr_reg->off;
} else {
off = ptr_reg->smin_value + ptr_reg->off;
*ptr_limit = ptr_reg->map_ptr->value_size - off;
*ptr_limit = ptr_reg->map_ptr->value_size - off - 1;
}
return 0;
return *ptr_limit >= max ? -ERANGE : 0;
default:
return -EINVAL;
}
@ -4341,6 +4346,7 @@ static int sanitize_ptr_alu(struct bpf_verifier_env *env,
u32 alu_state, alu_limit;
struct bpf_reg_state tmp;
bool ret;
int err;
if (can_skip_alu_sanitation(env, insn))
return 0;
@ -4356,10 +4362,13 @@ static int sanitize_ptr_alu(struct bpf_verifier_env *env,
alu_state |= ptr_is_dst_reg ?
BPF_ALU_SANITIZE_SRC : BPF_ALU_SANITIZE_DST;
if (retrieve_ptr_limit(ptr_reg, &alu_limit, opcode, off_is_neg))
return 0;
if (update_alu_sanitation_state(aux, alu_state, alu_limit))
return -EACCES;
err = retrieve_ptr_limit(ptr_reg, &alu_limit, opcode, off_is_neg);
if (err < 0)
return err;
err = update_alu_sanitation_state(aux, alu_state, alu_limit);
if (err < 0)
return err;
do_sim:
/* Simulate and find potential out-of-bounds access under
* speculative execution from truncation as a result of
@ -4467,7 +4476,7 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env,
case BPF_ADD:
ret = sanitize_ptr_alu(env, insn, ptr_reg, dst_reg, smin_val < 0);
if (ret < 0) {
verbose(env, "R%d tried to add from different maps or paths\n", dst);
verbose(env, "R%d tried to add from different maps, paths, or prohibited types\n", dst);
return ret;
}
/* We can take a fixed offset as long as it doesn't overflow
@ -4522,7 +4531,7 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env,
case BPF_SUB:
ret = sanitize_ptr_alu(env, insn, ptr_reg, dst_reg, smin_val < 0);
if (ret < 0) {
verbose(env, "R%d tried to sub from different maps or paths\n", dst);
verbose(env, "R%d tried to sub from different maps, paths, or prohibited types\n", dst);
return ret;
}
if (dst_reg == off_reg) {
@ -9077,7 +9086,7 @@ static int fixup_bpf_calls(struct bpf_verifier_env *env)
off_reg = issrc ? insn->src_reg : insn->dst_reg;
if (isneg)
*patch++ = BPF_ALU64_IMM(BPF_MUL, off_reg, -1);
*patch++ = BPF_MOV32_IMM(BPF_REG_AX, aux->alu_limit - 1);
*patch++ = BPF_MOV32_IMM(BPF_REG_AX, aux->alu_limit);
*patch++ = BPF_ALU64_REG(BPF_SUB, BPF_REG_AX, off_reg);
*patch++ = BPF_ALU64_REG(BPF_OR, BPF_REG_AX, off_reg);
*patch++ = BPF_ALU64_IMM(BPF_NEG, BPF_REG_AX, 0);