GitHub PushEvent at 2014-04-15 18:19:01
Repository: kernel-git-davem-net
Actor: mmukadam
Payload: {"shas":[["5678de3f15010b9022ee45673f33bcfc71d47b60","69d3ebcf5ee4e7f05a50dc23cd96655b730804b4@redhat.com","KVM: ioapic: fix assignment of ioapic->rtc_status.pending_eoi (CVE-2014-0155)\n\nQE reported that they got the BUG_ON in ioapic_service to trigger.\nI cannot reproduce it, but there are two reasons why this could happen.\n\nThe less likely but also easiest one, is when kvm_irq_delivery_to_apic\ndoes not deliver to any APIC and returns -1.\n\nBecause irqe.shorthand == 0, the kvm_for_each_vcpu loop in that\nfunction is never reached.  However, you can target the similar loop in\nkvm_irq_delivery_to_apic_fast; just program a zero logical destination\naddress into the IOAPIC, or an out-of-range physical destination address.\n\nSigned-off-by: Paolo Bonzini <pbonzini@redhat.com>","Paolo Bonzini",true],["4009b2499eee26c7f413073300d124a37765dfca","69d3ebcf5ee4e7f05a50dc23cd96655b730804b4@redhat.com","KVM: ioapic: try to recover if pending_eoi goes out of range\n\nThe RTC tracking code tracks the cardinality of rtc_status.dest_map\ninto rtc_status.pending_eoi.  It has some WARN_ONs that trigger if\npending_eoi ever becomes negative; however, these do not do anything\nto recover, and it bad things will happen soon after they trigger.\n\nWhen the next RTC interrupt is triggered, rtc_check_coalesced() will\nreturn false, but ioapic_service will find pending_eoi != 0 and\ndo a BUG_ON.  To avoid this, should pending_eoi ever be nonzero,\ncall kvm_rtc_eoi_tracking_restore_all to recompute a correct\ndest_map and pending_eoi.\n\nSigned-off-by: Paolo Bonzini <pbonzini@redhat.com>","Paolo Bonzini",true],["eb4a5346e777784f1b5ae9fd0c29b96344bdc3ae","c1d287ff3802a4aab0e3770389ea24a33314618b@linaro.org","hwrng: bcm2835 - fix oops when rng h/w is accessed during registration\n\nCommit \"d9e7972 hwrng: add randomness to system from rng sources\"\nexposed a bug in the bcm2835-rng driver resulting in boot failure\non Raspberry Pi due to the following oops:\n\n[   28.261523] BUG: soft lockup - CPU#0 stuck for 23s! [swapper:1]\n[   28.271058]\n[   28.275958] CPU: 0 PID: 1 Comm: swapper Not tainted 3.14.0+ #11\n[   28.285374] task: db480000 ti: db484000 task.ti: db484000\n[   28.294279] PC is at bcm2835_rng_read+0x28/0x48\n[   28.302276] LR is at hwrng_register+0x1a8/0x238\n.\n.\n.\n\nThe RNG h/w is not completely initialized and enabled before\nhwrng_register() is called and so the bcm2835_rng_read() fails.\nFix this by making the warmup/enable writes before registering\nthe RNG source with the hwrng core.\n\nSigned-off-by: Matt Porter <mporter@linaro.org>\nSigned-off-by: Herbert Xu <herbert@gondor.apana.org.au>","Matt Porter",true],["56d6efc2de5fcf76d3c7b33a7671bc04c53cb0e5","521451f4bfda9a96135570722c9f0cfa4b647f81@intel.com","KVM: Remove SMAP bit from CR4_RESERVED_BITS\n\nThis patch removes SMAP bit from CR4_RESERVED_BITS.\n\nSigned-off-by: Feng Wu <feng.wu@intel.com>\nSigned-off-by: Marcelo Tosatti <mtosatti@redhat.com>","Feng Wu",true],["97ec8c067d322d32effdc1701760d3babbc5595f","521451f4bfda9a96135570722c9f0cfa4b647f81@intel.com","KVM: Add SMAP support when setting CR4\n\nThis patch adds SMAP handling logic when setting CR4 for guests\n\nThanks a lot to Paolo Bonzini for his suggestion to use the branchless\nway to detect SMAP violation.\n\nSigned-off-by: Feng Wu <feng.wu@intel.com>\nSigned-off-by: Marcelo Tosatti <mtosatti@redhat.com>","Feng Wu",true],["e1e746b3c55d1d1e0841a2e600a154d8f6747232","521451f4bfda9a96135570722c9f0cfa4b647f81@intel.com","KVM: Disable SMAP for guests in EPT realmode and EPT unpaging mode\n\nSMAP is disabled if CPU is in non-paging mode in hardware.\nHowever KVM always uses paging mode to emulate guest non-paging\nmode with TDP. To emulate this behavior, SMAP needs to be\nmanually disabled when guest switches to non-paging mode.\n\nSigned-off-by: Feng Wu <feng.wu@intel.com>\nSigned-off-by: Marcelo Tosatti <mtosatti@redhat.com>","Feng Wu",true],["de935ae15b0db57f7fb837b37380ee94d4b0fec3","521451f4bfda9a96135570722c9f0cfa4b647f81@intel.com","KVM: expose SMAP feature to guest\n\nThis patch exposes SMAP feature to guest\n\nSigned-off-by: Feng Wu <feng.wu@intel.com>\nSigned-off-by: Marcelo Tosatti <mtosatti@redhat.com>","Feng Wu",true],["66386ade2aa7f5fcf0dda4171df7b4d4c274d2d6","521451f4bfda9a96135570722c9f0cfa4b647f81@intel.com","KVM: Rename variable smep to cr4_smep\n\nRename variable smep to cr4_smep, which can better reflect the\nmeaning of the variable.\n\nSigned-off-by: Feng Wu <feng.wu@intel.com>\nSigned-off-by: Marcelo Tosatti <mtosatti@redhat.com>","Feng Wu",true],["b351c39cc9e0151cee9b8d52a1e714928faabb38","958bcd1f4a7a8c36dca09fe3fa9cb5f1483adf51@redhat.com","KVM: x86: remove WARN_ON from get_kernel_ns()\n\nFunction and callers can be preempted.\n\nhttps://bugzilla.kernel.org/show_bug.cgi?id=73721\n\nSigned-off-by: Marcelo Tosatti <mtosatti@redhat.com>\nReviewed-by: Paolo Bonzini <pbonzini@redhat.com>","Marcelo Tosatti",true],["e79323bd87808fdfbc68ce6c5371bd224d9672ee","52f8f9962b7f38d8269c63c0859d68147c8d10f0@redhat.com","user namespace: fix incorrect memory barriers\n\nsmp_read_barrier_depends() can be used if there is data dependency between\nthe readers - i.e. if the read operation after the barrier uses address\nthat was obtained from the read operation before the barrier.\n\nIn this file, there is only control dependency, no data dependecy, so the\nuse of smp_read_barrier_depends() is incorrect. The code could fail in the\nfollowing way:\n* the cpu predicts that idx < entries is true and starts executing the\n  body of the for loop\n* the cpu fetches map->extent[0].first and map->extent[0].count\n* the cpu fetches map->nr_extents\n* the cpu verifies that idx < extents is true, so it commits the\n  instructions in the body of the for loop\n\nThe problem is that in this scenario, the cpu read map->extent[0].first\nand map->nr_extents in the wrong order. We need a full read memory barrier\nto prevent it.\n\nSigned-off-by: Mikulas Patocka <mpatocka@redhat.com>\nCc: stable@vger.kernel.org\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>","Mikulas Patocka",true],["dafe344d2288f0ebc0e3d4c6a5eb15bc82189c53","69652caca27c8b940640ad396ab71f93cacec34f@linux-foundation.org","Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6\n\nPull bmc2835 crypto fix from Herbert Xu:\n \"This fixes a potential boot crash on bcm2835 due to the recent change\n  that now causes hardware RNGs to be accessed on registration\"\n\n* git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:\n  hwrng: bcm2835 - fix oops when rng h/w is accessed during registration","Linus Torvalds",true],["55101e2d6ce1c780f6ee8fee5f37306971aac6cd","69652caca27c8b940640ad396ab71f93cacec34f@linux-foundation.org","Merge git://git.kernel.org/pub/scm/virt/kvm/kvm\n\nPull KVM fixes from Marcelo Tosatti:\n - Fix for guest triggerable BUG_ON (CVE-2014-0155)\n - CR4.SMAP support\n - Spurious WARN_ON() fix\n\n* git://git.kernel.org/pub/scm/virt/kvm/kvm:\n  KVM: x86: remove WARN_ON from get_kernel_ns()\n  KVM: Rename variable smep to cr4_smep\n  KVM: expose SMAP feature to guest\n  KVM: Disable SMAP for guests in EPT realmode and EPT unpaging mode\n  KVM: Add SMAP support when setting CR4\n  KVM: Remove SMAP bit from CR4_RESERVED_BITS\n  KVM: ioapic: try to recover if pending_eoi goes out of range\n  KVM: ioapic: fix assignment of ioapic->rtc_status.pending_eoi (CVE-2014-0155)","Linus Torvalds",true]],"size":12,"ref":"refs/heads/master","head":"55101e2d6ce1c780f6ee8fee5f37306971aac6cd"}