Contents of /trunk/kernel-alx-legacy/patches-4.9/0381-4.9.282-all-fixes.patch
Parent Directory | Revision Log
Revision 3683 -
(show annotations)
(download)
Mon Oct 24 14:07:59 2022 UTC (23 months ago) by niro
File size: 12792 byte(s)
Mon Oct 24 14:07:59 2022 UTC (23 months ago) by niro
File size: 12792 byte(s)
-linux-4.9.282
1 | diff --git a/Makefile b/Makefile |
2 | index 08bbebb4acbf1..ca08ef26f416b 100644 |
3 | --- a/Makefile |
4 | +++ b/Makefile |
5 | @@ -1,6 +1,6 @@ |
6 | VERSION = 4 |
7 | PATCHLEVEL = 9 |
8 | -SUBLEVEL = 281 |
9 | +SUBLEVEL = 282 |
10 | EXTRAVERSION = |
11 | NAME = Roaring Lionus |
12 | |
13 | diff --git a/arch/arc/kernel/vmlinux.lds.S b/arch/arc/kernel/vmlinux.lds.S |
14 | index f35ed578e007e..4d823d3f65bb3 100644 |
15 | --- a/arch/arc/kernel/vmlinux.lds.S |
16 | +++ b/arch/arc/kernel/vmlinux.lds.S |
17 | @@ -92,6 +92,8 @@ SECTIONS |
18 | CPUIDLE_TEXT |
19 | LOCK_TEXT |
20 | KPROBES_TEXT |
21 | + IRQENTRY_TEXT |
22 | + SOFTIRQENTRY_TEXT |
23 | *(.fixup) |
24 | *(.gnu.warning) |
25 | } |
26 | diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c |
27 | index 5cbc6591fa1d3..c16d24ad83560 100644 |
28 | --- a/arch/x86/kvm/mmu.c |
29 | +++ b/arch/x86/kvm/mmu.c |
30 | @@ -3927,7 +3927,16 @@ static void reset_rsvds_bits_mask_ept(struct kvm_vcpu *vcpu, |
31 | void |
32 | reset_shadow_zero_bits_mask(struct kvm_vcpu *vcpu, struct kvm_mmu *context) |
33 | { |
34 | - bool uses_nx = context->nx || context->base_role.smep_andnot_wp; |
35 | + /* |
36 | + * KVM uses NX when TDP is disabled to handle a variety of scenarios, |
37 | + * notably for huge SPTEs if iTLB multi-hit mitigation is enabled and |
38 | + * to generate correct permissions for CR0.WP=0/CR4.SMEP=1/EFER.NX=0. |
39 | + * The iTLB multi-hit workaround can be toggled at any time, so assume |
40 | + * NX can be used by any non-nested shadow MMU to avoid having to reset |
41 | + * MMU contexts. Note, KVM forces EFER.NX=1 when TDP is disabled. |
42 | + */ |
43 | + bool uses_nx = context->nx || !tdp_enabled || |
44 | + context->base_role.smep_andnot_wp; |
45 | |
46 | /* |
47 | * Passing "true" to the last argument is okay; it adds a check |
48 | diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c |
49 | index 64a3dae5381ef..4496e7a492352 100644 |
50 | --- a/drivers/block/floppy.c |
51 | +++ b/drivers/block/floppy.c |
52 | @@ -4067,22 +4067,21 @@ static int floppy_open(struct block_device *bdev, fmode_t mode) |
53 | if (UFDCS->rawcmd == 1) |
54 | UFDCS->rawcmd = 2; |
55 | |
56 | - if (mode & (FMODE_READ|FMODE_WRITE)) { |
57 | - UDRS->last_checked = 0; |
58 | - clear_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags); |
59 | - check_disk_change(bdev); |
60 | - if (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags)) |
61 | - goto out; |
62 | - if (test_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags)) |
63 | + if (!(mode & FMODE_NDELAY)) { |
64 | + if (mode & (FMODE_READ|FMODE_WRITE)) { |
65 | + UDRS->last_checked = 0; |
66 | + clear_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags); |
67 | + check_disk_change(bdev); |
68 | + if (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags)) |
69 | + goto out; |
70 | + if (test_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags)) |
71 | + goto out; |
72 | + } |
73 | + res = -EROFS; |
74 | + if ((mode & FMODE_WRITE) && |
75 | + !test_bit(FD_DISK_WRITABLE_BIT, &UDRS->flags)) |
76 | goto out; |
77 | } |
78 | - |
79 | - res = -EROFS; |
80 | - |
81 | - if ((mode & FMODE_WRITE) && |
82 | - !test_bit(FD_DISK_WRITABLE_BIT, &UDRS->flags)) |
83 | - goto out; |
84 | - |
85 | mutex_unlock(&open_lock); |
86 | mutex_unlock(&floppy_mutex); |
87 | return 0; |
88 | diff --git a/drivers/infiniband/hw/hfi1/sdma.c b/drivers/infiniband/hw/hfi1/sdma.c |
89 | index 76e63c88a87a8..e9313e6f4b0e3 100644 |
90 | --- a/drivers/infiniband/hw/hfi1/sdma.c |
91 | +++ b/drivers/infiniband/hw/hfi1/sdma.c |
92 | @@ -3028,6 +3028,7 @@ static void __sdma_process_event(struct sdma_engine *sde, |
93 | static int _extend_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx) |
94 | { |
95 | int i; |
96 | + struct sdma_desc *descp; |
97 | |
98 | /* Handle last descriptor */ |
99 | if (unlikely((tx->num_desc == (MAX_DESC - 1)))) { |
100 | @@ -3048,12 +3049,10 @@ static int _extend_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx) |
101 | if (unlikely(tx->num_desc == MAX_DESC)) |
102 | goto enomem; |
103 | |
104 | - tx->descp = kmalloc_array( |
105 | - MAX_DESC, |
106 | - sizeof(struct sdma_desc), |
107 | - GFP_ATOMIC); |
108 | - if (!tx->descp) |
109 | + descp = kmalloc_array(MAX_DESC, sizeof(struct sdma_desc), GFP_ATOMIC); |
110 | + if (!descp) |
111 | goto enomem; |
112 | + tx->descp = descp; |
113 | |
114 | /* reserve last descriptor for coalescing */ |
115 | tx->desc_limit = MAX_DESC - 1; |
116 | diff --git a/drivers/net/can/usb/esd_usb2.c b/drivers/net/can/usb/esd_usb2.c |
117 | index 592c6e7f3dca4..fbe1173b2651f 100644 |
118 | --- a/drivers/net/can/usb/esd_usb2.c |
119 | +++ b/drivers/net/can/usb/esd_usb2.c |
120 | @@ -236,8 +236,8 @@ static void esd_usb2_rx_event(struct esd_usb2_net_priv *priv, |
121 | if (id == ESD_EV_CAN_ERROR_EXT) { |
122 | u8 state = msg->msg.rx.data[0]; |
123 | u8 ecc = msg->msg.rx.data[1]; |
124 | - u8 txerr = msg->msg.rx.data[2]; |
125 | - u8 rxerr = msg->msg.rx.data[3]; |
126 | + u8 rxerr = msg->msg.rx.data[2]; |
127 | + u8 txerr = msg->msg.rx.data[3]; |
128 | |
129 | skb = alloc_can_err_skb(priv->netdev, &cf); |
130 | if (skb == NULL) { |
131 | diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c |
132 | index 625008e8cb0df..500016209ae0c 100644 |
133 | --- a/drivers/net/ethernet/intel/e1000e/ich8lan.c |
134 | +++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c |
135 | @@ -1010,6 +1010,8 @@ static s32 e1000_platform_pm_pch_lpt(struct e1000_hw *hw, bool link) |
136 | { |
137 | u32 reg = link << (E1000_LTRV_REQ_SHIFT + E1000_LTRV_NOSNOOP_SHIFT) | |
138 | link << E1000_LTRV_REQ_SHIFT | E1000_LTRV_SEND; |
139 | + u16 max_ltr_enc_d = 0; /* maximum LTR decoded by platform */ |
140 | + u16 lat_enc_d = 0; /* latency decoded */ |
141 | u16 lat_enc = 0; /* latency encoded */ |
142 | |
143 | if (link) { |
144 | @@ -1063,7 +1065,17 @@ static s32 e1000_platform_pm_pch_lpt(struct e1000_hw *hw, bool link) |
145 | E1000_PCI_LTR_CAP_LPT + 2, &max_nosnoop); |
146 | max_ltr_enc = max_t(u16, max_snoop, max_nosnoop); |
147 | |
148 | - if (lat_enc > max_ltr_enc) |
149 | + lat_enc_d = (lat_enc & E1000_LTRV_VALUE_MASK) * |
150 | + (1U << (E1000_LTRV_SCALE_FACTOR * |
151 | + ((lat_enc & E1000_LTRV_SCALE_MASK) |
152 | + >> E1000_LTRV_SCALE_SHIFT))); |
153 | + |
154 | + max_ltr_enc_d = (max_ltr_enc & E1000_LTRV_VALUE_MASK) * |
155 | + (1U << (E1000_LTRV_SCALE_FACTOR * |
156 | + ((max_ltr_enc & E1000_LTRV_SCALE_MASK) |
157 | + >> E1000_LTRV_SCALE_SHIFT))); |
158 | + |
159 | + if (lat_enc_d > max_ltr_enc_d) |
160 | lat_enc = max_ltr_enc; |
161 | } |
162 | |
163 | diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.h b/drivers/net/ethernet/intel/e1000e/ich8lan.h |
164 | index 6374c8fc76a8d..9957a4ffdc6dc 100644 |
165 | --- a/drivers/net/ethernet/intel/e1000e/ich8lan.h |
166 | +++ b/drivers/net/ethernet/intel/e1000e/ich8lan.h |
167 | @@ -291,8 +291,11 @@ |
168 | |
169 | /* Latency Tolerance Reporting */ |
170 | #define E1000_LTRV 0x000F8 |
171 | +#define E1000_LTRV_VALUE_MASK 0x000003FF |
172 | #define E1000_LTRV_SCALE_MAX 5 |
173 | #define E1000_LTRV_SCALE_FACTOR 5 |
174 | +#define E1000_LTRV_SCALE_SHIFT 10 |
175 | +#define E1000_LTRV_SCALE_MASK 0x00001C00 |
176 | #define E1000_LTRV_REQ_SHIFT 15 |
177 | #define E1000_LTRV_NOSNOOP_SHIFT 16 |
178 | #define E1000_LTRV_SEND (1 << 30) |
179 | diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c |
180 | index bb6bc84995a2f..ccacdcfb59321 100644 |
181 | --- a/drivers/net/ethernet/marvell/mvneta.c |
182 | +++ b/drivers/net/ethernet/marvell/mvneta.c |
183 | @@ -100,7 +100,7 @@ |
184 | #define MVNETA_DESC_SWAP BIT(6) |
185 | #define MVNETA_TX_BRST_SZ_MASK(burst) ((burst) << 22) |
186 | #define MVNETA_PORT_STATUS 0x2444 |
187 | -#define MVNETA_TX_IN_PRGRS BIT(1) |
188 | +#define MVNETA_TX_IN_PRGRS BIT(0) |
189 | #define MVNETA_TX_FIFO_EMPTY BIT(8) |
190 | #define MVNETA_RX_MIN_FRAME_SIZE 0x247c |
191 | #define MVNETA_SERDES_CFG 0x24A0 |
192 | diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c |
193 | index 9206fd2489353..e1c1627a3356b 100644 |
194 | --- a/drivers/tty/vt/vt_ioctl.c |
195 | +++ b/drivers/tty/vt/vt_ioctl.c |
196 | @@ -487,16 +487,19 @@ int vt_ioctl(struct tty_struct *tty, |
197 | ret = -EINVAL; |
198 | goto out; |
199 | } |
200 | - /* FIXME: this needs the console lock extending */ |
201 | - if (vc->vc_mode == (unsigned char) arg) |
202 | + console_lock(); |
203 | + if (vc->vc_mode == (unsigned char) arg) { |
204 | + console_unlock(); |
205 | break; |
206 | + } |
207 | vc->vc_mode = (unsigned char) arg; |
208 | - if (console != fg_console) |
209 | + if (console != fg_console) { |
210 | + console_unlock(); |
211 | break; |
212 | + } |
213 | /* |
214 | * explicitly blank/unblank the screen if switching modes |
215 | */ |
216 | - console_lock(); |
217 | if (arg == KD_TEXT) |
218 | do_unblank_screen(1); |
219 | else |
220 | diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c |
221 | index cca51553e0fb0..e340ef67321e5 100644 |
222 | --- a/drivers/usb/dwc3/gadget.c |
223 | +++ b/drivers/usb/dwc3/gadget.c |
224 | @@ -928,19 +928,19 @@ static struct dwc3_trb *dwc3_ep_prev_trb(struct dwc3_ep *dep, u8 index) |
225 | |
226 | static u32 dwc3_calc_trbs_left(struct dwc3_ep *dep) |
227 | { |
228 | - struct dwc3_trb *tmp; |
229 | u8 trbs_left; |
230 | |
231 | /* |
232 | - * If enqueue & dequeue are equal than it is either full or empty. |
233 | - * |
234 | - * One way to know for sure is if the TRB right before us has HWO bit |
235 | - * set or not. If it has, then we're definitely full and can't fit any |
236 | - * more transfers in our ring. |
237 | + * If the enqueue & dequeue are equal then the TRB ring is either full |
238 | + * or empty. It's considered full when there are DWC3_TRB_NUM-1 of TRBs |
239 | + * pending to be processed by the driver. |
240 | */ |
241 | if (dep->trb_enqueue == dep->trb_dequeue) { |
242 | - tmp = dwc3_ep_prev_trb(dep, dep->trb_enqueue); |
243 | - if (tmp->ctrl & DWC3_TRB_CTRL_HWO) |
244 | + /* |
245 | + * If there is any request remained in the started_list at |
246 | + * this point, that means there is no TRB available. |
247 | + */ |
248 | + if (!list_empty(&dep->started_list)) |
249 | return 0; |
250 | |
251 | return DWC3_TRB_NUM - 1; |
252 | diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c |
253 | index 2e92c6fef683f..c6ff79360302f 100644 |
254 | --- a/drivers/usb/serial/ch341.c |
255 | +++ b/drivers/usb/serial/ch341.c |
256 | @@ -585,7 +585,6 @@ static struct usb_serial_driver ch341_device = { |
257 | .owner = THIS_MODULE, |
258 | .name = "ch341-uart", |
259 | }, |
260 | - .bulk_in_size = 512, |
261 | .id_table = id_table, |
262 | .num_ports = 1, |
263 | .open = ch341_open, |
264 | diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c |
265 | index b3336a7c09e0b..02ded56bcbc6b 100644 |
266 | --- a/drivers/usb/serial/option.c |
267 | +++ b/drivers/usb/serial/option.c |
268 | @@ -2058,6 +2058,8 @@ static const struct usb_device_id option_ids[] = { |
269 | .driver_info = RSVD(4) | RSVD(5) }, |
270 | { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0105, 0xff), /* Fibocom NL678 series */ |
271 | .driver_info = RSVD(6) }, |
272 | + { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0xff, 0x30) }, /* Fibocom FG150 Diag */ |
273 | + { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0, 0) }, /* Fibocom FG150 AT */ |
274 | { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a0, 0xff) }, /* Fibocom NL668-AM/NL652-EU (laptop MBIM) */ |
275 | { USB_DEVICE_INTERFACE_CLASS(0x2df3, 0x9d03, 0xff) }, /* LongSung M5710 */ |
276 | { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) }, /* GosunCn GM500 RNDIS */ |
277 | diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c |
278 | index d56736655dec4..da47542496cc3 100644 |
279 | --- a/drivers/vhost/vringh.c |
280 | +++ b/drivers/vhost/vringh.c |
281 | @@ -329,7 +329,7 @@ __vringh_iov(struct vringh *vrh, u16 i, |
282 | iov = wiov; |
283 | else { |
284 | iov = riov; |
285 | - if (unlikely(wiov && wiov->i)) { |
286 | + if (unlikely(wiov && wiov->used)) { |
287 | vringh_bad("Readable desc %p after writable", |
288 | &descs[i]); |
289 | err = -EINVAL; |
290 | diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c |
291 | index ae623cd04d6ca..16f5f56332433 100644 |
292 | --- a/drivers/video/fbdev/core/fbmem.c |
293 | +++ b/drivers/video/fbdev/core/fbmem.c |
294 | @@ -1001,6 +1001,10 @@ fb_set_var(struct fb_info *info, struct fb_var_screeninfo *var) |
295 | goto done; |
296 | } |
297 | |
298 | + /* bitfill_aligned() assumes that it's at least 8x8 */ |
299 | + if (var->xres < 8 || var->yres < 8) |
300 | + return -EINVAL; |
301 | + |
302 | ret = info->fbops->fb_check_var(var, info); |
303 | |
304 | if (ret) |
305 | diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c |
306 | index 5cad9f41c238b..cf7eccfe3469b 100644 |
307 | --- a/drivers/virtio/virtio_ring.c |
308 | +++ b/drivers/virtio/virtio_ring.c |
309 | @@ -1150,7 +1150,7 @@ bool virtqueue_is_broken(struct virtqueue *_vq) |
310 | { |
311 | struct vring_virtqueue *vq = to_vvq(_vq); |
312 | |
313 | - return vq->broken; |
314 | + return READ_ONCE(vq->broken); |
315 | } |
316 | EXPORT_SYMBOL_GPL(virtqueue_is_broken); |
317 | |
318 | @@ -1164,7 +1164,9 @@ void virtio_break_device(struct virtio_device *dev) |
319 | |
320 | list_for_each_entry(_vq, &dev->vqs, list) { |
321 | struct vring_virtqueue *vq = to_vvq(_vq); |
322 | - vq->broken = true; |
323 | + |
324 | + /* Pairs with READ_ONCE() in virtqueue_is_broken(). */ |
325 | + WRITE_ONCE(vq->broken, true); |
326 | } |
327 | } |
328 | EXPORT_SYMBOL_GPL(virtio_break_device); |
329 | diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c |
330 | index 9609ad71dd260..fe1801d9f0598 100644 |
331 | --- a/net/ipv4/ip_gre.c |
332 | +++ b/net/ipv4/ip_gre.c |
333 | @@ -353,6 +353,8 @@ static void __gre_xmit(struct sk_buff *skb, struct net_device *dev, |
334 | |
335 | static int gre_handle_offloads(struct sk_buff *skb, bool csum) |
336 | { |
337 | + if (csum && skb_checksum_start(skb) < skb->data) |
338 | + return -EINVAL; |
339 | return iptunnel_handle_offloads(skb, csum ? SKB_GSO_GRE_CSUM : SKB_GSO_GRE); |
340 | } |
341 | |
342 | diff --git a/net/rds/ib_frmr.c b/net/rds/ib_frmr.c |
343 | index 3d9c4c6397c3d..20d045faf07c6 100644 |
344 | --- a/net/rds/ib_frmr.c |
345 | +++ b/net/rds/ib_frmr.c |
346 | @@ -112,9 +112,9 @@ static int rds_ib_post_reg_frmr(struct rds_ib_mr *ibmr) |
347 | cpu_relax(); |
348 | } |
349 | |
350 | - ret = ib_map_mr_sg_zbva(frmr->mr, ibmr->sg, ibmr->sg_len, |
351 | + ret = ib_map_mr_sg_zbva(frmr->mr, ibmr->sg, ibmr->sg_dma_len, |
352 | &off, PAGE_SIZE); |
353 | - if (unlikely(ret != ibmr->sg_len)) |
354 | + if (unlikely(ret != ibmr->sg_dma_len)) |
355 | return ret < 0 ? ret : -EINVAL; |
356 | |
357 | /* Perform a WR for the fast_reg_mr. Each individual page |