diff --git a/0001-KEYS-Fix-crash-when-attempt-to-garbage-collect-an-un.patch b/0001-KEYS-Fix-crash-when-attempt-to-garbage-collect-an-un.patch deleted file mode 100644 index 1564060..0000000 --- a/0001-KEYS-Fix-crash-when-attempt-to-garbage-collect-an-un.patch +++ /dev/null @@ -1,76 +0,0 @@ -From d856e14fb043b742f94170db36b812770a2591d0 Mon Sep 17 00:00:00 2001 -From: David Howells -Date: Thu, 15 Oct 2015 17:21:37 +0100 -Subject: [PATCH 1/2] KEYS: Fix crash when attempt to garbage collect an - uninstantiated keyring - - The following sequence of commands: - - i=`keyctl add user a a @s` - keyctl request2 keyring foo bar @t - keyctl unlink $i @s - - tries to invoke an upcall to instantiate a keyring if one doesn't already - exist by that name within the user's keyring set. However, if the upcall - fails, the code sets keyring->type_data.reject_error to -ENOKEY or some - other error code. When the key is garbage collected, the key destroy - function is called unconditionally and keyring_destroy() uses list_empty() - on keyring->type_data.link - which is in a union with reject_error. - Subsequently, the kernel tries to unlink the keyring from the keyring names - list - which oopses like this: - - BUG: unable to handle kernel paging request at 00000000ffffff8a - IP: [] keyring_destroy+0x3d/0x88 - ... - Workqueue: events key_garbage_collector - ... - RIP: 0010:[] keyring_destroy+0x3d/0x88 - RSP: 0018:ffff88003e2f3d30 EFLAGS: 00010203 - RAX: 00000000ffffff82 RBX: ffff88003bf1a900 RCX: 0000000000000000 - RDX: 0000000000000000 RSI: 000000003bfc6901 RDI: ffffffff81a73a40 - RBP: ffff88003e2f3d38 R08: 0000000000000152 R09: 0000000000000000 - R10: ffff88003e2f3c18 R11: 000000000000865b R12: ffff88003bf1a900 - R13: 0000000000000000 R14: ffff88003bf1a908 R15: ffff88003e2f4000 - ... - CR2: 00000000ffffff8a CR3: 000000003e3ec000 CR4: 00000000000006f0 - ... - Call Trace: - [] key_gc_unused_keys.constprop.1+0x5d/0x10f - [] key_garbage_collector+0x1fa/0x351 - [] process_one_work+0x28e/0x547 - [] worker_thread+0x26e/0x361 - [] ? rescuer_thread+0x2a8/0x2a8 - [] kthread+0xf3/0xfb - [] ? kthread_create_on_node+0x1c2/0x1c2 - [] ret_from_fork+0x3f/0x70 - [] ? kthread_create_on_node+0x1c2/0x1c2 - - Note the value in RAX. This is a 32-bit representation of -ENOKEY. - - The solution is to only call ->destroy() if the key was successfully - instantiated. - - Reported-by: Dmitry Vyukov - Signed-off-by: David Howells ---- - security/keys/gc.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/security/keys/gc.c b/security/keys/gc.c -index c7952375ac53..11c36627adbf 100644 ---- a/security/keys/gc.c -+++ b/security/keys/gc.c -@@ -149,7 +149,9 @@ static noinline void key_gc_unused_keys(struct list_head *keys) - atomic_dec(&key->user->nikeys); - - /* now throw away the key memory */ -- if (key->type->destroy) -+ if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags) && -+ !test_bit(KEY_FLAG_NEGATIVE, &key->flags) && -+ key->type->destroy) - key->type->destroy(key); - - key_user_put(key->user); --- -2.4.3 - diff --git a/0001-KVM-x86-build-kvm_userspace_memory_region-in-x86_set.patch b/0001-KVM-x86-build-kvm_userspace_memory_region-in-x86_set.patch deleted file mode 100644 index 6395b17..0000000 --- a/0001-KVM-x86-build-kvm_userspace_memory_region-in-x86_set.patch +++ /dev/null @@ -1,169 +0,0 @@ -From 1d8007bdee074fdffcf3539492d8a151a1fb3436 Mon Sep 17 00:00:00 2001 -From: Paolo Bonzini -Date: Mon, 12 Oct 2015 13:38:32 +0200 -Subject: [PATCH] KVM: x86: build kvm_userspace_memory_region in - x86_set_memory_region -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -The next patch will make x86_set_memory_region fill the -userspace_addr. Since the struct is not used untouched -anymore, it makes sense to build it in x86_set_memory_region -directly; it also simplifies the callers. - -Reported-by: Alexandre DERUMIER -Cc: stable@vger.kernel.org -Fixes: 9da0e4d5ac969909f6b435ce28ea28135a9cbd69 -Reviewed-by: Radim Krčmář -Signed-off-by: Paolo Bonzini ---- - arch/x86/include/asm/kvm_host.h | 6 ++---- - arch/x86/kvm/vmx.c | 26 ++++++-------------------- - arch/x86/kvm/x86.c | 31 +++++++++++++------------------ - 3 files changed, 21 insertions(+), 42 deletions(-) - -diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h -index 49ec903..4e7ad7e 100644 ---- a/arch/x86/include/asm/kvm_host.h -+++ b/arch/x86/include/asm/kvm_host.h -@@ -1199,9 +1199,7 @@ void kvm_complete_insn_gp(struct kvm_vcpu *vcpu, int err); - - int kvm_is_in_guest(void); - --int __x86_set_memory_region(struct kvm *kvm, -- const struct kvm_userspace_memory_region *mem); --int x86_set_memory_region(struct kvm *kvm, -- const struct kvm_userspace_memory_region *mem); -+int __x86_set_memory_region(struct kvm *kvm, int id, gpa_t gpa, u32 size); -+int x86_set_memory_region(struct kvm *kvm, int id, gpa_t gpa, u32 size); - - #endif /* _ASM_X86_KVM_HOST_H */ -diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c -index 18c30b4..8461e0c 100644 ---- a/arch/x86/kvm/vmx.c -+++ b/arch/x86/kvm/vmx.c -@@ -4105,17 +4105,13 @@ static void seg_setup(int seg) - static int alloc_apic_access_page(struct kvm *kvm) - { - struct page *page; -- struct kvm_userspace_memory_region kvm_userspace_mem; - int r = 0; - - mutex_lock(&kvm->slots_lock); - if (kvm->arch.apic_access_page_done) - goto out; -- kvm_userspace_mem.slot = APIC_ACCESS_PAGE_PRIVATE_MEMSLOT; -- kvm_userspace_mem.flags = 0; -- kvm_userspace_mem.guest_phys_addr = APIC_DEFAULT_PHYS_BASE; -- kvm_userspace_mem.memory_size = PAGE_SIZE; -- r = __x86_set_memory_region(kvm, &kvm_userspace_mem); -+ r = __x86_set_memory_region(kvm, APIC_ACCESS_PAGE_PRIVATE_MEMSLOT, -+ APIC_DEFAULT_PHYS_BASE, PAGE_SIZE); - if (r) - goto out; - -@@ -4140,17 +4136,12 @@ static int alloc_identity_pagetable(struct kvm *kvm) - { - /* Called with kvm->slots_lock held. */ - -- struct kvm_userspace_memory_region kvm_userspace_mem; - int r = 0; - - BUG_ON(kvm->arch.ept_identity_pagetable_done); - -- kvm_userspace_mem.slot = IDENTITY_PAGETABLE_PRIVATE_MEMSLOT; -- kvm_userspace_mem.flags = 0; -- kvm_userspace_mem.guest_phys_addr = -- kvm->arch.ept_identity_map_addr; -- kvm_userspace_mem.memory_size = PAGE_SIZE; -- r = __x86_set_memory_region(kvm, &kvm_userspace_mem); -+ r = __x86_set_memory_region(kvm, IDENTITY_PAGETABLE_PRIVATE_MEMSLOT, -+ kvm->arch.ept_identity_map_addr, PAGE_SIZE); - - return r; - } -@@ -4949,14 +4940,9 @@ static int vmx_interrupt_allowed(struct kvm_vcpu *vcpu) - static int vmx_set_tss_addr(struct kvm *kvm, unsigned int addr) - { - int ret; -- struct kvm_userspace_memory_region tss_mem = { -- .slot = TSS_PRIVATE_MEMSLOT, -- .guest_phys_addr = addr, -- .memory_size = PAGE_SIZE * 3, -- .flags = 0, -- }; - -- ret = x86_set_memory_region(kvm, &tss_mem); -+ ret = x86_set_memory_region(kvm, TSS_PRIVATE_MEMSLOT, addr, -+ PAGE_SIZE * 3); - if (ret) - return ret; - kvm->arch.tss_addr = addr; -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index 373328b..b12665b 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -7721,18 +7721,21 @@ void kvm_arch_sync_events(struct kvm *kvm) - kvm_free_pit(kvm); - } - --int __x86_set_memory_region(struct kvm *kvm, -- const struct kvm_userspace_memory_region *mem) -+int __x86_set_memory_region(struct kvm *kvm, int id, gpa_t gpa, u32 size) - { - int i, r; - - /* Called with kvm->slots_lock held. */ -- BUG_ON(mem->slot >= KVM_MEM_SLOTS_NUM); -+ if (WARN_ON(id >= KVM_MEM_SLOTS_NUM)) -+ return -EINVAL; - - for (i = 0; i < KVM_ADDRESS_SPACE_NUM; i++) { -- struct kvm_userspace_memory_region m = *mem; -+ struct kvm_userspace_memory_region m; - -- m.slot |= i << 16; -+ m.slot = id | (i << 16); -+ m.flags = 0; -+ m.guest_phys_addr = gpa; -+ m.memory_size = size; - r = __kvm_set_memory_region(kvm, &m); - if (r < 0) - return r; -@@ -7742,13 +7745,12 @@ int __x86_set_memory_region(struct kvm *kvm, - } - EXPORT_SYMBOL_GPL(__x86_set_memory_region); - --int x86_set_memory_region(struct kvm *kvm, -- const struct kvm_userspace_memory_region *mem) -+int x86_set_memory_region(struct kvm *kvm, int id, gpa_t gpa, u32 size) - { - int r; - - mutex_lock(&kvm->slots_lock); -- r = __x86_set_memory_region(kvm, mem); -+ r = __x86_set_memory_region(kvm, id, gpa, size); - mutex_unlock(&kvm->slots_lock); - - return r; -@@ -7763,16 +7765,9 @@ void kvm_arch_destroy_vm(struct kvm *kvm) - * unless the the memory map has changed due to process exit - * or fd copying. - */ -- struct kvm_userspace_memory_region mem; -- memset(&mem, 0, sizeof(mem)); -- mem.slot = APIC_ACCESS_PAGE_PRIVATE_MEMSLOT; -- x86_set_memory_region(kvm, &mem); -- -- mem.slot = IDENTITY_PAGETABLE_PRIVATE_MEMSLOT; -- x86_set_memory_region(kvm, &mem); -- -- mem.slot = TSS_PRIVATE_MEMSLOT; -- x86_set_memory_region(kvm, &mem); -+ x86_set_memory_region(kvm, APIC_ACCESS_PAGE_PRIVATE_MEMSLOT, 0, 0); -+ x86_set_memory_region(kvm, IDENTITY_PAGETABLE_PRIVATE_MEMSLOT, 0, 0); -+ x86_set_memory_region(kvm, TSS_PRIVATE_MEMSLOT, 0, 0); - } - kvm_iommu_unmap_guest(kvm); - kfree(kvm->arch.vpic); diff --git a/0001-watchdog-omap_wdt-fix-null-pointer-dereference.patch b/0001-watchdog-omap_wdt-fix-null-pointer-dereference.patch new file mode 100644 index 0000000..7dab1ff --- /dev/null +++ b/0001-watchdog-omap_wdt-fix-null-pointer-dereference.patch @@ -0,0 +1,63 @@ +From 721ebb3cf4788107424f92ac2da6cfce20c67297 Mon Sep 17 00:00:00 2001 +From: Peter Robinson +Date: Sun, 1 Nov 2015 23:54:08 +0000 +Subject: [PATCH] watchdog: omap_wdt: fix null pointer dereference + +Fix issue from two patches overlapping causing a kernel oops + +[ 3569.297449] Unable to handle kernel NULL pointer dereference at virtual address 00000088 +[ 3569.306272] pgd = dc894000 +[ 3569.309287] [00000088] *pgd=00000000 +[ 3569.313104] Internal error: Oops: 5 [#1] SMP ARM +[ 3569.317986] Modules linked in: ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 xt_conntrack ebtable_filter ebtable_nat ebtable_broute bridge stp llc ebtables ip6table_security ip6table_raw ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6table_mangle ip6table_filter ip6_tables iptable_security iptable_raw iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack iptable_mangle musb_dsps cppi41 musb_hdrc phy_am335x udc_core phy_generic phy_am335x_control omap_sham omap_aes omap_rng omap_hwspinlock omap_mailbox hwspinlock_core musb_am335x omap_wdt at24 8250_omap leds_gpio cpufreq_dt smsc davinci_mdio mmc_block ti_cpsw cpsw_common ptp pps_core cpsw_ale davinci_cpdma omap_hsmmc omap_dma mmc_core i2c_dev +[ 3569.386293] CPU: 0 PID: 1429 Comm: wdctl Not tainted 4.3.0-0.rc7.git0.1.fc24.armv7hl #1 +[ 3569.394740] Hardware name: Generic AM33XX (Flattened Device Tree) +[ 3569.401179] task: dbd11a00 ti: dbaac000 task.ti: dbaac000 +[ 3569.406917] PC is at omap_wdt_get_timeleft+0xc/0x20 [omap_wdt] +[ 3569.413106] LR is at watchdog_ioctl+0x3cc/0x42c +[ 3569.417902] pc : [] lr : [] psr: 600f0013 +[ 3569.417902] sp : dbaadf18 ip : 00000003 fp : 7f5d3bbe +[ 3569.430014] r10: 00000000 r9 : 00000003 r8 : bef21ab8 +[ 3569.435535] r7 : dbbc0f7c r6 : dbbc0f18 r5 : bef21ab8 r4 : 00000000 +[ 3569.442427] r3 : 00000000 r2 : 00000000 r1 : 8004570a r0 : dbbc0f18 +[ 3569.449323] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none +[ 3569.456858] Control: 10c5387d Table: 9c894019 DAC: 00000051 +[ 3569.462927] Process wdctl (pid: 1429, stack limit = 0xdbaac220) +[ 3569.469179] Stack: (0xdbaadf18 to 0xdbaae000) +[ 3569.473790] df00: bef21ab8 dbf60e38 +[ 3569.482441] df20: dc91b840 8004570a bef21ab8 c03988a4 dbaadf48 dc854000 00000000 dd313850 +[ 3569.491092] df40: ddf033b8 0000570a dc91b80b dbaadf3c dbf60e38 00000020 c0df9250 c0df6c48 +[ 3569.499741] df60: dc91b840 8004570a 00000000 dc91b840 dc91b840 8004570a bef21ab8 00000003 +[ 3569.508389] df80: 00000000 c03989d4 bef21b74 7f5d3bad 00000003 00000036 c020fcc4 dbaac000 +[ 3569.517037] dfa0: 00000000 c020fb00 bef21b74 7f5d3bad 00000003 8004570a bef21ab8 00000001 +[ 3569.525685] dfc0: bef21b74 7f5d3bad 00000003 00000036 00000001 00000000 7f5e4eb0 7f5d3bbe +[ 3569.534334] dfe0: 7f5e4f10 bef21a3c 7f5d0a54 b6e97e0c a00f0010 00000003 00000000 00000000 +[ 3569.543038] [] (omap_wdt_get_timeleft [omap_wdt]) from [] (watchdog_ioctl+0x3cc/0x42c) +[ 3569.553266] [] (watchdog_ioctl) from [] (do_vfs_ioctl+0x5bc/0x698) +[ 3569.561648] [] (do_vfs_ioctl) from [] (SyS_ioctl+0x54/0x7c) +[ 3569.569400] [] (SyS_ioctl) from [] (ret_fast_syscall+0x0/0x3c) +[ 3569.577413] Code: e12fff1e e52de004 e8bd4000 e5903060 (e5933088) +[ 3569.584089] ---[ end trace cec3039bd3ae610a ]--- + +Cc: # v4.2+ +Signed-off-by: Peter Robinson +--- + drivers/watchdog/omap_wdt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/watchdog/omap_wdt.c b/drivers/watchdog/omap_wdt.c +index d96bee0..6f17c93 100644 +--- a/drivers/watchdog/omap_wdt.c ++++ b/drivers/watchdog/omap_wdt.c +@@ -205,7 +205,7 @@ static int omap_wdt_set_timeout(struct watchdog_device *wdog, + + static unsigned int omap_wdt_get_timeleft(struct watchdog_device *wdog) + { +- struct omap_wdt_dev *wdev = watchdog_get_drvdata(wdog); ++ struct omap_wdt_dev *wdev = to_omap_wdt_dev(wdog); + void __iomem *base = wdev->base; + u32 value; + +-- +2.5.0 + diff --git a/0002-KEYS-Don-t-permit-request_key-to-construct-a-new-key.patch b/0002-KEYS-Don-t-permit-request_key-to-construct-a-new-key.patch deleted file mode 100644 index 727ee6a..0000000 --- a/0002-KEYS-Don-t-permit-request_key-to-construct-a-new-key.patch +++ /dev/null @@ -1,34 +0,0 @@ -From 93f27344ac019135dd5ff31a518f1ef2d9e4e4a1 Mon Sep 17 00:00:00 2001 -From: David Howells -Date: Mon, 19 Oct 2015 11:33:38 +0100 -Subject: [PATCH 2/2] KEYS: Don't permit request_key() to construct a new - keyring - - If request_key() is used to find a keyring, only do the search part - don't - do the construction part if the keyring was not found by the search. We - don't really want keyrings in the negative instantiated state since the - rejected/negative instantiation error value in the payload is unioned with - keyring metadata. - - Signed-off-by: David Howells ---- - security/keys/request_key.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/security/keys/request_key.c b/security/keys/request_key.c -index 486ef6fa393b..0d6253124278 100644 ---- a/security/keys/request_key.c -+++ b/security/keys/request_key.c -@@ -440,6 +440,9 @@ static struct key *construct_key_and_link(struct keyring_search_context *ctx, - - kenter(""); - -+ if (ctx->index_key.type == &key_type_keyring) -+ return ERR_PTR(-EPERM); -+ - user = key_user_lookup(current_fsuid()); - if (!user) - return ERR_PTR(-ENOMEM); --- -2.4.3 - diff --git a/0002-KVM-x86-map-unmap-private-slots-in-__x86_set_memory_.patch b/0002-KVM-x86-map-unmap-private-slots-in-__x86_set_memory_.patch deleted file mode 100644 index 261c6e1..0000000 --- a/0002-KVM-x86-map-unmap-private-slots-in-__x86_set_memory_.patch +++ /dev/null @@ -1,134 +0,0 @@ -From f0d648bdf0a5bbc91da6099d5282f77996558ea4 Mon Sep 17 00:00:00 2001 -From: Paolo Bonzini -Date: Mon, 12 Oct 2015 13:56:27 +0200 -Subject: [PATCH] KVM: x86: map/unmap private slots in __x86_set_memory_region -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Otherwise, two copies (one of them never populated and thus bogus) -are allocated for the regular and SMM address spaces. This breaks -SMM with EPT but without unrestricted guest support, because the -SMM copy of the identity page map is all zeros. - -By moving the allocation to the caller we also remove the last -vestiges of kernel-allocated memory regions (not accessible anymore -in userspace since commit b74a07beed0e, "KVM: Remove kernel-allocated -memory regions", 2010-06-21); that is a nice bonus. - -Reported-by: Alexandre DERUMIER -Cc: stable@vger.kernel.org -Fixes: 9da0e4d5ac969909f6b435ce28ea28135a9cbd69 -Reviewed-by: Radim Krčmář -Signed-off-by: Paolo Bonzini ---- - arch/x86/kvm/x86.c | 62 ++++++++++++++++++++++++++---------------------------- - 1 file changed, 30 insertions(+), 32 deletions(-) - -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index 7bf8096..3ac33f8 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -7477,23 +7477,53 @@ void kvm_arch_sync_events(struct kvm *kvm) - int __x86_set_memory_region(struct kvm *kvm, int id, gpa_t gpa, u32 size) - { - int i, r; -+ u64 hva; -+ struct kvm_memslots *slots = kvm_memslots(kvm); -+ struct kvm_memory_slot *slot, old; - - /* Called with kvm->slots_lock held. */ - if (WARN_ON(id >= KVM_MEM_SLOTS_NUM)) - return -EINVAL; - -+ slot = id_to_memslot(slots, id); -+ if (size) { -+ if (WARN_ON(slot->npages)) -+ return -EEXIST; -+ -+ /* -+ * MAP_SHARED to prevent internal slot pages from being moved -+ * by fork()/COW. -+ */ -+ hva = vm_mmap(NULL, 0, size, PROT_READ | PROT_WRITE, -+ MAP_SHARED | MAP_ANONYMOUS, 0); -+ if (IS_ERR((void *)hva)) -+ return PTR_ERR((void *)hva); -+ } else { -+ if (!slot->npages) -+ return 0; -+ -+ hva = 0; -+ } -+ -+ old = *slot; - for (i = 0; i < KVM_ADDRESS_SPACE_NUM; i++) { - struct kvm_userspace_memory_region m; - - m.slot = id | (i << 16); - m.flags = 0; - m.guest_phys_addr = gpa; -+ m.userspace_addr = hva; - m.memory_size = size; - r = __kvm_set_memory_region(kvm, &m); - if (r < 0) - return r; - } - -+ if (!size) { -+ r = vm_munmap(old.userspace_addr, old.npages * PAGE_SIZE); -+ WARN_ON(r < 0); -+ } -+ - return 0; - } - EXPORT_SYMBOL_GPL(__x86_set_memory_region); -@@ -7623,27 +7653,6 @@ int kvm_arch_prepare_memory_region(struct kvm *kvm, - const struct kvm_userspace_memory_region *mem, - enum kvm_mr_change change) - { -- /* -- * Only private memory slots need to be mapped here since -- * KVM_SET_MEMORY_REGION ioctl is no longer supported. -- */ -- if ((memslot->id >= KVM_USER_MEM_SLOTS) && (change == KVM_MR_CREATE)) { -- unsigned long userspace_addr; -- -- /* -- * MAP_SHARED to prevent internal slot pages from being moved -- * by fork()/COW. -- */ -- userspace_addr = vm_mmap(NULL, 0, memslot->npages * PAGE_SIZE, -- PROT_READ | PROT_WRITE, -- MAP_SHARED | MAP_ANONYMOUS, 0); -- -- if (IS_ERR((void *)userspace_addr)) -- return PTR_ERR((void *)userspace_addr); -- -- memslot->userspace_addr = userspace_addr; -- } -- - return 0; - } - -@@ -7705,17 +7714,6 @@ void kvm_arch_commit_memory_region(struct kvm *kvm, - { - int nr_mmu_pages = 0; - -- if (change == KVM_MR_DELETE && old->id >= KVM_USER_MEM_SLOTS) { -- int ret; -- -- ret = vm_munmap(old->userspace_addr, -- old->npages * PAGE_SIZE); -- if (ret < 0) -- printk(KERN_WARNING -- "kvm_vm_ioctl_set_memory_region: " -- "failed to munmap memory\n"); -- } -- - if (!kvm->arch.n_requested_mmu_pages) - nr_mmu_pages = kvm_mmu_calculate_mmu_pages(kvm); - --- -2.5.0 - diff --git a/0003-KVM-x86-fix-previous-commit-for-32-bit.patch b/0003-KVM-x86-fix-previous-commit-for-32-bit.patch deleted file mode 100644 index df99e60..0000000 --- a/0003-KVM-x86-fix-previous-commit-for-32-bit.patch +++ /dev/null @@ -1,30 +0,0 @@ -From 25188b9986cf6b0cadcf1bc1d1693a2e9c50ed47 Mon Sep 17 00:00:00 2001 -From: Paolo Bonzini -Date: Wed, 14 Oct 2015 15:51:08 +0200 -Subject: [PATCH] KVM: x86: fix previous commit for 32-bit - -Unfortunately I only noticed this after pushing. - -Fixes: f0d648bdf0a5bbc91da6099d5282f77996558ea4 -Cc: stable@vger.kernel.org -Signed-off-by: Paolo Bonzini ---- - arch/x86/kvm/x86.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index 6e03546..9a9a198 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -7482,7 +7482,7 @@ void kvm_arch_sync_events(struct kvm *kvm) - int __x86_set_memory_region(struct kvm *kvm, int id, gpa_t gpa, u32 size) - { - int i, r; -- u64 hva; -+ unsigned long hva; - struct kvm_memslots *slots = kvm_memslots(kvm); - struct kvm_memory_slot *slot, old; - --- -2.5.0 - diff --git a/ACPI-Limit-access-to-custom_method.patch b/ACPI-Limit-access-to-custom_method.patch index 88709a3..3823675 100644 --- a/ACPI-Limit-access-to-custom_method.patch +++ b/ACPI-Limit-access-to-custom_method.patch @@ -1,6 +1,7 @@ +From 4b85149b764cd024e3dd2aff9eb22a9e1aadd1fa Mon Sep 17 00:00:00 2001 From: Matthew Garrett Date: Fri, 9 Mar 2012 08:39:37 -0500 -Subject: [PATCH] ACPI: Limit access to custom_method +Subject: [PATCH 04/20] ACPI: Limit access to custom_method custom_method effectively allows arbitrary access to system memory, making it possible for an attacker to circumvent restrictions on module loading. @@ -25,3 +26,6 @@ index c68e72414a67..4277938af700 100644 if (!(*ppos)) { /* parse the table header to get the table length */ if (count <= sizeof(struct acpi_table_header)) +-- +2.4.3 + diff --git a/ARM-dts-Add-am335x-bonegreen.patch b/ARM-dts-Add-am335x-bonegreen.patch new file mode 100644 index 0000000..35fb3e4 --- /dev/null +++ b/ARM-dts-Add-am335x-bonegreen.patch @@ -0,0 +1,103 @@ +From patchwork Fri Sep 25 15:10:31 2015 +Content-Type: text/plain; charset="utf-8" +MIME-Version: 1.0 +Content-Transfer-Encoding: 7bit +Subject: ARM: dts: Add am335x-bonegreen +From: Robert Nelson +X-Patchwork-Id: 7265851 +Message-Id: <1443193831-5693-1-git-send-email-robertcnelson@gmail.com> +To: tony@atomide.com, devicetree@vger.kernel.org +Cc: linux-omap@vger.kernel.org, linux-arm-kernel@lists.infradead.org, + Robert Nelson , Jason Kridner +Date: Fri, 25 Sep 2015 10:10:31 -0500 + +SeeedStudio BeagleBone Green (BBG) is clone of the BeagleBone Black (BBB) minus +the HDMI port and addition of two Grove connectors (i2c2 and usart2). + +This board can be identified by the 1A value after A335BNLT (BBB) in the at24 eeprom: +1A: [aa 55 33 ee 41 33 33 35 42 4e 4c 54 1a 00 00 00 |.U3.A335BNLT....|] + +http://beagleboard.org/green +http://www.seeedstudio.com/wiki/Beaglebone_green + +Signed-off-by: Robert Nelson +CC: Tony Lindgren +CC: Jason Kridner + +--- +arch/arm/boot/dts/Makefile | 1 + + arch/arm/boot/dts/am335x-bonegreen.dts | 53 ++++++++++++++++++++++++++++++++++ + 2 files changed, 54 insertions(+) + create mode 100644 arch/arm/boot/dts/am335x-bonegreen.dts + +diff --git a/arch/arm/boot/dts/Makefile b/arch/arm/boot/dts/Makefile +index 233159d..e45d771 100644 +--- a/arch/arm/boot/dts/Makefile ++++ b/arch/arm/boot/dts/Makefile +@@ -446,6 +446,7 @@ dtb-$(CONFIG_SOC_AM33XX) += \ + am335x-base0033.dtb \ + am335x-bone.dtb \ + am335x-boneblack.dtb \ ++ am335x-bonegreen.dtb \ + am335x-sl50.dtb \ + am335x-evm.dtb \ + am335x-evmsk.dtb \ +diff --git a/arch/arm/boot/dts/am335x-bonegreen.dts b/arch/arm/boot/dts/am335x-bonegreen.dts +new file mode 100644 +index 0000000..0f65bda +--- /dev/null ++++ b/arch/arm/boot/dts/am335x-bonegreen.dts +@@ -0,0 +1,53 @@ ++/* ++ * Copyright (C) 2012 Texas Instruments Incorporated - http://www.ti.com/ ++ * ++ * This program is free software; you can redistribute it and/or modify ++ * it under the terms of the GNU General Public License version 2 as ++ * published by the Free Software Foundation. ++ */ ++/dts-v1/; ++ ++#include "am33xx.dtsi" ++#include "am335x-bone-common.dtsi" ++ ++/ { ++ model = "TI AM335x BeagleBone Green"; ++ compatible = "ti,am335x-bone-green", "ti,am335x-bone-black", "ti,am335x-bone", "ti,am33xx"; ++}; ++ ++&ldo3_reg { ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <1800000>; ++ regulator-always-on; ++}; ++ ++&mmc1 { ++ vmmc-supply = <&vmmcsd_fixed>; ++}; ++ ++&mmc2 { ++ vmmc-supply = <&vmmcsd_fixed>; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&emmc_pins>; ++ bus-width = <8>; ++ status = "okay"; ++}; ++ ++&am33xx_pinmux { ++ uart2_pins: uart2_pins { ++ pinctrl-single,pins = < ++ 0x150 (PIN_INPUT | MUX_MODE1) /* spi0_sclk.uart2_rxd */ ++ 0x154 (PIN_OUTPUT | MUX_MODE1) /* spi0_d0.uart2_txd */ ++ >; ++ }; ++}; ++ ++&uart2 { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&uart2_pins>; ++ status = "okay"; ++}; ++ ++&rtc { ++ system-power-controller; ++}; diff --git a/Add-an-EFI-signature-blob-parser-and-key-loader.patch b/Add-an-EFI-signature-blob-parser-and-key-loader.patch index c4feebe..06ddd15 100644 --- a/Add-an-EFI-signature-blob-parser-and-key-loader.patch +++ b/Add-an-EFI-signature-blob-parser-and-key-loader.patch @@ -1,6 +1,7 @@ +From c279ba86f93cf6a75d078e2d0e3f59d4ba8a2dd0 Mon Sep 17 00:00:00 2001 From: Dave Howells Date: Tue, 23 Oct 2012 09:36:28 -0400 -Subject: [PATCH] Add an EFI signature blob parser and key loader. +Subject: [PATCH 16/20] Add an EFI signature blob parser and key loader. X.509 certificates are loaded into the specified keyring as asymmetric type keys. @@ -32,7 +33,7 @@ index 4870f28403f5..4a1b50d73b80 100644 + endif # ASYMMETRIC_KEY_TYPE diff --git a/crypto/asymmetric_keys/Makefile b/crypto/asymmetric_keys/Makefile -index e47fcd9ac5e8..6512f6596785 100644 +index cd1406f9b14a..d9db380bbe53 100644 --- a/crypto/asymmetric_keys/Makefile +++ b/crypto/asymmetric_keys/Makefile @@ -8,6 +8,7 @@ asymmetric_keys-y := asymmetric_type.o signature.o @@ -173,3 +174,6 @@ index fac43c611614..414c3c3d988d 100644 /** * efi_range_is_wc - check the WC bit on an address range * @start: starting kvirt address +-- +2.4.3 + diff --git a/Add-option-to-automatically-enforce-module-signature.patch b/Add-option-to-automatically-enforce-module-signature.patch index ff4fc05..015371b 100644 --- a/Add-option-to-automatically-enforce-module-signature.patch +++ b/Add-option-to-automatically-enforce-module-signature.patch @@ -1,7 +1,8 @@ +From 37431394b3eeb1ef6d38d0e6b2693210606c2c2c Mon Sep 17 00:00:00 2001 From: Matthew Garrett Date: Fri, 9 Aug 2013 18:36:30 -0400 -Subject: [PATCH] Add option to automatically enforce module signatures when in - Secure Boot mode +Subject: [PATCH 10/20] Add option to automatically enforce module signatures + when in Secure Boot mode UEFI Secure Boot provides a mechanism for ensuring that the firmware will only load signed bootloaders and kernels. Certain use cases may also @@ -20,10 +21,10 @@ Signed-off-by: Matthew Garrett 7 files changed, 69 insertions(+), 1 deletion(-) diff --git a/Documentation/x86/zero-page.txt b/Documentation/x86/zero-page.txt -index 82fbdbc1e0b0..a811210ad486 100644 +index 95a4d34af3fd..b8527c6b7646 100644 --- a/Documentation/x86/zero-page.txt +++ b/Documentation/x86/zero-page.txt -@@ -30,6 +30,8 @@ Offset Proto Name Meaning +@@ -31,6 +31,8 @@ Offset Proto Name Meaning 1E9/001 ALL eddbuf_entries Number of entries in eddbuf (below) 1EA/001 ALL edd_mbr_sig_buf_entries Number of entries in edd_mbr_sig_buffer (below) @@ -33,10 +34,10 @@ index 82fbdbc1e0b0..a811210ad486 100644 290/040 ALL edd_mbr_sig_buffer EDD MBR signatures 2D0/A00 ALL e820_map E820 memory map table diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig -index 3dbb7e7909ca..4da6644b1fd0 100644 +index cc0d73eac047..14db458f4774 100644 --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig -@@ -1703,6 +1703,16 @@ config EFI_MIXED +@@ -1734,6 +1734,16 @@ config EFI_MIXED If unsure, say N. @@ -54,7 +55,7 @@ index 3dbb7e7909ca..4da6644b1fd0 100644 def_bool y prompt "Enable seccomp to safely compute untrusted bytecode" diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c -index 2c82bd150d43..1ef8ea7f8ed9 100644 +index ee1b6d346b98..b4de3faa3f29 100644 --- a/arch/x86/boot/compressed/eboot.c +++ b/arch/x86/boot/compressed/eboot.c @@ -12,6 +12,7 @@ @@ -115,7 +116,7 @@ index 2c82bd150d43..1ef8ea7f8ed9 100644 setup_efi_pci(boot_params); diff --git a/arch/x86/include/uapi/asm/bootparam.h b/arch/x86/include/uapi/asm/bootparam.h -index ab456dc233b5..74ba4083e7ce 100644 +index 329254373479..b61f8533c0fd 100644 --- a/arch/x86/include/uapi/asm/bootparam.h +++ b/arch/x86/include/uapi/asm/bootparam.h @@ -134,7 +134,8 @@ struct boot_params { @@ -129,10 +130,10 @@ index ab456dc233b5..74ba4083e7ce 100644 * The sentinel is set to a nonzero value (0xff) in header.S. * diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c -index 80f874bf999e..c2e4f52cad30 100644 +index baadbf90a7c5..1ac118146e90 100644 --- a/arch/x86/kernel/setup.c +++ b/arch/x86/kernel/setup.c -@@ -1160,6 +1160,12 @@ void __init setup_arch(char **cmdline_p) +@@ -1135,6 +1135,12 @@ void __init setup_arch(char **cmdline_p) io_delay_init(); @@ -146,10 +147,10 @@ index 80f874bf999e..c2e4f52cad30 100644 * Parse the ACPI tables for possible boot-time SMP configuration. */ diff --git a/include/linux/module.h b/include/linux/module.h -index 57474384b66b..b69d657c3700 100644 +index db386349cd01..4b8df91f03cd 100644 --- a/include/linux/module.h +++ b/include/linux/module.h -@@ -189,6 +189,12 @@ const struct exception_table_entry *search_exception_tables(unsigned long add); +@@ -273,6 +273,12 @@ const struct exception_table_entry *search_exception_tables(unsigned long add); struct notifier_block; @@ -163,10 +164,10 @@ index 57474384b66b..b69d657c3700 100644 extern int modules_disabled; /* for sysctl */ diff --git a/kernel/module.c b/kernel/module.c -index e9869c497175..87fa14fedc88 100644 +index 7f045246e123..2b403ab0ef29 100644 --- a/kernel/module.c +++ b/kernel/module.c -@@ -4084,6 +4084,13 @@ void module_layout(struct module *mod, +@@ -4088,6 +4088,13 @@ void module_layout(struct module *mod, EXPORT_SYMBOL(module_layout); #endif @@ -180,3 +181,6 @@ index e9869c497175..87fa14fedc88 100644 bool secure_modules(void) { #ifdef CONFIG_MODULE_SIG +-- +2.4.3 + diff --git a/Add-secure_modules-call.patch b/Add-secure_modules-call.patch index 158e7f1..b6e039f 100644 --- a/Add-secure_modules-call.patch +++ b/Add-secure_modules-call.patch @@ -1,6 +1,7 @@ +From a1aaf20cffb1a949c5d6b1198690c7c30cfda4d5 Mon Sep 17 00:00:00 2001 From: Matthew Garrett Date: Fri, 9 Aug 2013 17:58:15 -0400 -Subject: [PATCH] Add secure_modules() call +Subject: [PATCH 01/20] Add secure_modules() call Provide a single call to allow kernel code to determine whether the system has been configured to either disable module loading entirely or to load @@ -16,10 +17,10 @@ Signed-off-by: Matthew Garrett 2 files changed, 16 insertions(+) diff --git a/include/linux/module.h b/include/linux/module.h -index d67b1932cc59..57474384b66b 100644 +index 3a19c79918e0..db386349cd01 100644 --- a/include/linux/module.h +++ b/include/linux/module.h -@@ -551,6 +551,8 @@ static inline bool module_requested_async_probing(struct module *module) +@@ -635,6 +635,8 @@ static inline bool module_requested_async_probing(struct module *module) return module && module->async_probe_requested; } @@ -28,7 +29,7 @@ index d67b1932cc59..57474384b66b 100644 #else /* !CONFIG_MODULES... */ /* Given an address, look for it in the exception tables. */ -@@ -667,6 +669,10 @@ static inline bool module_requested_async_probing(struct module *module) +@@ -751,6 +753,10 @@ static inline bool module_requested_async_probing(struct module *module) return false; } @@ -40,10 +41,10 @@ index d67b1932cc59..57474384b66b 100644 #ifdef CONFIG_SYSFS diff --git a/kernel/module.c b/kernel/module.c -index 4d2b82e610e2..e9869c497175 100644 +index b86b7bf1be38..7f045246e123 100644 --- a/kernel/module.c +++ b/kernel/module.c -@@ -4083,3 +4083,13 @@ void module_layout(struct module *mod, +@@ -4087,3 +4087,13 @@ void module_layout(struct module *mod, } EXPORT_SYMBOL(module_layout); #endif @@ -57,3 +58,6 @@ index 4d2b82e610e2..e9869c497175 100644 +#endif +} +EXPORT_SYMBOL(secure_modules); +-- +2.4.3 + diff --git a/Add-sysrq-option-to-disable-secure-boot-mode.patch b/Add-sysrq-option-to-disable-secure-boot-mode.patch index ffc4608..4600848 100644 --- a/Add-sysrq-option-to-disable-secure-boot-mode.patch +++ b/Add-sysrq-option-to-disable-secure-boot-mode.patch @@ -1,6 +1,7 @@ +From 16d2ba5d5bc46e67e6aa7a3d113fbcc18c217388 Mon Sep 17 00:00:00 2001 From: Kyle McMartin Date: Fri, 30 Aug 2013 09:28:51 -0400 -Subject: [PATCH] Add sysrq option to disable secure boot mode +Subject: [PATCH 20/20] Add sysrq option to disable secure boot mode Bugzilla: N/A Upstream-status: Fedora mustard @@ -15,7 +16,7 @@ Upstream-status: Fedora mustard 7 files changed, 64 insertions(+), 9 deletions(-) diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c -index 5def6b4143fa..1eac9d22cb0b 100644 +index f93826b8522c..41679b1aca83 100644 --- a/arch/x86/kernel/setup.c +++ b/arch/x86/kernel/setup.c @@ -70,6 +70,11 @@ @@ -30,7 +31,7 @@ index 5def6b4143fa..1eac9d22cb0b 100644 #include