rebase patches on top of Ubuntu-4.15.0-34.37
(generated with debian/scripts/import-upstream-tag) Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
This commit is contained in:
parent
2e503580b3
commit
72d7b7039d
@ -74,7 +74,7 @@ index e1c10a202abe..e40248310433 100644
|
|||||||
Safety option to keep boot IRQs enabled. This
|
Safety option to keep boot IRQs enabled. This
|
||||||
should never be necessary.
|
should never be necessary.
|
||||||
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
|
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
|
||||||
index 26b3ed731208..d66c874a7a6e 100644
|
index 2953239fa628..b2c9428b13a3 100644
|
||||||
--- a/drivers/pci/quirks.c
|
--- a/drivers/pci/quirks.c
|
||||||
+++ b/drivers/pci/quirks.c
|
+++ b/drivers/pci/quirks.c
|
||||||
@@ -3702,6 +3702,106 @@ static int __init pci_apply_final_quirks(void)
|
@@ -3702,6 +3702,106 @@ static int __init pci_apply_final_quirks(void)
|
||||||
@ -184,7 +184,7 @@ index 26b3ed731208..d66c874a7a6e 100644
|
|||||||
/*
|
/*
|
||||||
* Following are device-specific reset methods which can be used to
|
* Following are device-specific reset methods which can be used to
|
||||||
* reset a single function if other methods (e.g. FLR, PM D0->D3) are
|
* reset a single function if other methods (e.g. FLR, PM D0->D3) are
|
||||||
@@ -4538,6 +4638,7 @@ static const struct pci_dev_acs_enabled {
|
@@ -4541,6 +4641,7 @@ static const struct pci_dev_acs_enabled {
|
||||||
{ PCI_VENDOR_ID_CAVIUM, PCI_ANY_ID, pci_quirk_cavium_acs },
|
{ PCI_VENDOR_ID_CAVIUM, PCI_ANY_ID, pci_quirk_cavium_acs },
|
||||||
/* APM X-Gene */
|
/* APM X-Gene */
|
||||||
{ PCI_VENDOR_ID_AMCC, 0xE004, pci_quirk_xgene_acs },
|
{ PCI_VENDOR_ID_AMCC, 0xE004, pci_quirk_xgene_acs },
|
||||||
|
@ -1,45 +0,0 @@
|
|||||||
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
||||||
From: "Michael S. Tsirkin" <mst@redhat.com>
|
|
||||||
Date: Thu, 16 Aug 2018 17:02:36 +0800
|
|
||||||
Subject: [PATCH] vhost: fix info leak due to uninitialized memory
|
|
||||||
|
|
||||||
CVE-2018-1118
|
|
||||||
|
|
||||||
struct vhost_msg within struct vhost_msg_node is copied to userspace.
|
|
||||||
Unfortunately it turns out on 64 bit systems vhost_msg has padding after
|
|
||||||
type which gcc doesn't initialize, leaking 4 uninitialized bytes to
|
|
||||||
userspace.
|
|
||||||
|
|
||||||
This padding also unfortunately means 32 bit users of this interface are
|
|
||||||
broken on a 64 bit kernel which will need to be fixed separately.
|
|
||||||
|
|
||||||
Fixes: CVE-2018-1118
|
|
||||||
Cc: stable@vger.kernel.org
|
|
||||||
Reported-by: Kevin Easton <kevin@guarana.org>
|
|
||||||
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
|
|
||||||
Reported-by: syzbot+87cfa083e727a224754b@syzkaller.appspotmail.com
|
|
||||||
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
|
|
||||||
(cherry picked from commit 670ae9caaca467ea1bfd325cb2a5c98ba87f94ad)
|
|
||||||
Signed-off-by: Po-Hsu Lin <po-hsu.lin@canonical.com>
|
|
||||||
Acked-by: Khalid Elmously <khalid.elmously@canonical.com>
|
|
||||||
Acked-by: Kamal Mostafa <kamal@canonical.com>
|
|
||||||
Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>
|
|
||||||
Signed-off-by: Stoiko Ivanov <s.ivanov@proxmox.com>
|
|
||||||
---
|
|
||||||
drivers/vhost/vhost.c | 3 +++
|
|
||||||
1 file changed, 3 insertions(+)
|
|
||||||
|
|
||||||
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
|
|
||||||
index 31bdfd296ced..a922d3d28a20 100644
|
|
||||||
--- a/drivers/vhost/vhost.c
|
|
||||||
+++ b/drivers/vhost/vhost.c
|
|
||||||
@@ -2383,6 +2383,9 @@ struct vhost_msg_node *vhost_new_msg(struct vhost_virtqueue *vq, int type)
|
|
||||||
struct vhost_msg_node *node = kmalloc(sizeof *node, GFP_KERNEL);
|
|
||||||
if (!node)
|
|
||||||
return NULL;
|
|
||||||
+
|
|
||||||
+ /* Make sure all padding within the structure is initialized. */
|
|
||||||
+ memset(&node->msg, 0, sizeof node->msg);
|
|
||||||
node->vq = vq;
|
|
||||||
node->msg.type = type;
|
|
||||||
return node;
|
|
@ -1,76 +0,0 @@
|
|||||||
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
||||||
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
||||||
Date: Sun, 1 Jul 2018 18:22:37 +0200
|
|
||||||
Subject: [PATCH] scsi: hpsa: disable device during shutdown
|
|
||||||
|
|
||||||
4.17-stable review patch. If anyone has any objections, please let me know.
|
|
||||||
|
|
||||||
------------------
|
|
||||||
|
|
||||||
From: Sinan Kaya <okaya@codeaurora.org>
|
|
||||||
|
|
||||||
commit 0d98ba8d70b0070ac117452ea0b663e26bbf46bf upstream.
|
|
||||||
|
|
||||||
'Commit cc27b735ad3a ("PCI/portdrv: Turn off PCIe services during
|
|
||||||
shutdown")' has been added to kernel to shutdown pending PCIe port service
|
|
||||||
interrupts during reboot so that a newly started kexec kernel wouldn't
|
|
||||||
observe pending interrupts.
|
|
||||||
|
|
||||||
pcie_port_device_remove() is disabling the root port and switches by
|
|
||||||
calling pci_disable_device() after all PCIe service drivers are shutdown.
|
|
||||||
|
|
||||||
This has been found to cause crashes on HP DL360 Gen9 machines during
|
|
||||||
reboot due to hpsa driver not clearing the bus master bit during the
|
|
||||||
shutdown procedure by calling pci_disable_device().
|
|
||||||
|
|
||||||
Disable device as part of the shutdown sequence.
|
|
||||||
|
|
||||||
Signed-off-by: Sinan Kaya <okaya@codeaurora.org>
|
|
||||||
Link: https://bugzilla.kernel.org/show_bug.cgi?id=199779
|
|
||||||
Fixes: cc27b735ad3a ("PCI/portdrv: Turn off PCIe services during shutdown")
|
|
||||||
Cc: stable@vger.kernel.org
|
|
||||||
Reported-by: Ryan Finnie <ryan@finnie.org>
|
|
||||||
Tested-by: Don Brace <don.brace@microsemi.com>
|
|
||||||
Acked-by: Don Brace <don.brace@microsemi.com>
|
|
||||||
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
|
|
||||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
||||||
Signed-off-by: Stoiko Ivanov <s.ivanov@proxmox.com>
|
|
||||||
---
|
|
||||||
drivers/scsi/hpsa.c | 10 ++++++++--
|
|
||||||
1 file changed, 8 insertions(+), 2 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
|
|
||||||
index 211975cc28c9..2d4b5177d1a2 100644
|
|
||||||
--- a/drivers/scsi/hpsa.c
|
|
||||||
+++ b/drivers/scsi/hpsa.c
|
|
||||||
@@ -8879,7 +8879,7 @@ static void hpsa_disable_rld_caching(struct ctlr_info *h)
|
|
||||||
kfree(options);
|
|
||||||
}
|
|
||||||
|
|
||||||
-static void hpsa_shutdown(struct pci_dev *pdev)
|
|
||||||
+static void __hpsa_shutdown(struct pci_dev *pdev)
|
|
||||||
{
|
|
||||||
struct ctlr_info *h;
|
|
||||||
|
|
||||||
@@ -8894,6 +8894,12 @@ static void hpsa_shutdown(struct pci_dev *pdev)
|
|
||||||
hpsa_disable_interrupt_mode(h); /* pci_init 2 */
|
|
||||||
}
|
|
||||||
|
|
||||||
+static void hpsa_shutdown(struct pci_dev *pdev)
|
|
||||||
+{
|
|
||||||
+ __hpsa_shutdown(pdev);
|
|
||||||
+ pci_disable_device(pdev);
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
static void hpsa_free_device_info(struct ctlr_info *h)
|
|
||||||
{
|
|
||||||
int i;
|
|
||||||
@@ -8937,7 +8943,7 @@ static void hpsa_remove_one(struct pci_dev *pdev)
|
|
||||||
scsi_remove_host(h->scsi_host); /* init_one 8 */
|
|
||||||
/* includes hpsa_free_irqs - init_one 4 */
|
|
||||||
/* includes hpsa_disable_interrupt_mode - pci_init 2 */
|
|
||||||
- hpsa_shutdown(pdev);
|
|
||||||
+ __hpsa_shutdown(pdev);
|
|
||||||
|
|
||||||
hpsa_free_device_info(h); /* scan */
|
|
||||||
|
|
Loading…
Reference in New Issue
Block a user