kernel-alx/patches-3.10/0181-3.10.82-all-fixes.patch

diff --git a/Makefile b/Makefile
index 6d19e37d36d5..5e3e665a10b7 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 3
 PATCHLEVEL = 10
-SUBLEVEL = 81
+SUBLEVEL = 82
 EXTRAVERSION =
 NAME = TOSSUG Baby Fish
 
diff --git a/drivers/crypto/caam/caamrng.c b/drivers/crypto/caam/caamrng.c
index d1939a9539c0..04aefffb4dd9 100644
--- a/drivers/crypto/caam/caamrng.c
+++ b/drivers/crypto/caam/caamrng.c
@@ -56,7 +56,7 @@
 
 /* Buffer, its dma address and lock */
 struct buf_data {
-	u8 buf[RN_BUF_SIZE];
+	u8 buf[RN_BUF_SIZE] ____cacheline_aligned;
 	dma_addr_t addr;
 	struct completion filled;
 	u32 hw_desc[DESC_JOB_O_LEN];
diff --git a/drivers/gpu/drm/mgag200/mgag200_mode.c b/drivers/gpu/drm/mgag200/mgag200_mode.c
index f6341e8622ee..7bd2acce9f81 100644
--- a/drivers/gpu/drm/mgag200/mgag200_mode.c
+++ b/drivers/gpu/drm/mgag200/mgag200_mode.c
@@ -1487,6 +1487,11 @@ static int mga_vga_mode_valid(struct drm_connector *connector,
 		return MODE_BANDWIDTH;
 	}
 
+	if ((mode->hdisplay % 8) != 0 || (mode->hsync_start % 8) != 0 ||
+	    (mode->hsync_end % 8) != 0 || (mode->htotal % 8) != 0) {
+		return MODE_H_ILLEGAL;
+	}
+
 	if (mode->crtc_hdisplay > 2048 || mode->crtc_hsync_start > 4096 ||
 	    mode->crtc_hsync_end > 4096 || mode->crtc_htotal > 4096 ||
 	    mode->crtc_vdisplay > 2048 || mode->crtc_vsync_start > 4096 ||
diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
index 572579f87de4..90861416b9e9 100644
--- a/drivers/scsi/lpfc/lpfc_sli.c
+++ b/drivers/scsi/lpfc/lpfc_sli.c
@@ -263,6 +263,16 @@ lpfc_sli4_eq_get(struct lpfc_queue *q)
 		return NULL;
 
 	q->hba_index = idx;
+
+	/*
+	 * insert barrier for instruction interlock : data from the hardware
+	 * must have the valid bit checked before it can be copied and acted
+	 * upon. Given what was seen in lpfc_sli4_cq_get() of speculative
+	 * instructions allowing action on content before valid bit checked,
+	 * add barrier here as well. May not be needed as "content" is a
+	 * single 32-bit entity here (vs multi word structure for cq's).
+	 */
+	mb();
 	return eqe;
 }
 
@@ -368,6 +378,17 @@ lpfc_sli4_cq_get(struct lpfc_queue *q)
 
 	cqe = q->qe[q->hba_index].cqe;
 	q->hba_index = idx;
+
+	/*
+	 * insert barrier for instruction interlock : data from the hardware
+	 * must have the valid bit checked before it can be copied and acted
+	 * upon. Speculative instructions were allowing a bcopy at the start
+	 * of lpfc_sli4_fp_handle_wcqe(), which is called immediately
+	 * after our return, to copy data before the valid bit check above
+	 * was done. As such, some of the copied data was stale. The barrier
+	 * ensures the check is before any data is copied.
+	 */
+	mb();
 	return cqe;
 }
 
diff --git a/fs/pipe.c b/fs/pipe.c
index 0e0752ef2715..3e7ab278bb0c 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -117,25 +117,27 @@ void pipe_wait(struct pipe_inode_info *pipe)
 }
 
 static int
-pipe_iov_copy_from_user(void *to, struct iovec *iov, unsigned long len,
-			int atomic)
+pipe_iov_copy_from_user(void *addr, int *offset, struct iovec *iov,
+			size_t *remaining, int atomic)
 {
 	unsigned long copy;
 
-	while (len > 0) {
+	while (*remaining > 0) {
 		while (!iov->iov_len)
 			iov++;
-		copy = min_t(unsigned long, len, iov->iov_len);
+		copy = min_t(unsigned long, *remaining, iov->iov_len);
 
 		if (atomic) {
-			if (__copy_from_user_inatomic(to, iov->iov_base, copy))
+			if (__copy_from_user_inatomic(addr + *offset,
+						      iov->iov_base, copy))
 				return -EFAULT;
 		} else {
-			if (copy_from_user(to, iov->iov_base, copy))
+			if (copy_from_user(addr + *offset,
+					   iov->iov_base, copy))
 				return -EFAULT;
 		}
-		to += copy;
-		len -= copy;
+		*offset += copy;
+		*remaining -= copy;
 		iov->iov_base += copy;
 		iov->iov_len -= copy;
 	}
@@ -143,25 +145,27 @@ pipe_iov_copy_from_user(void *to, struct iovec *iov, unsigned long len,
 }
 
 static int
-pipe_iov_copy_to_user(struct iovec *iov, const void *from, unsigned long len,
-		      int atomic)
+pipe_iov_copy_to_user(struct iovec *iov, void *addr, int *offset,
+		      size_t *remaining, int atomic)
 {
 	unsigned long copy;
 
-	while (len > 0) {
+	while (*remaining > 0) {
 		while (!iov->iov_len)
 			iov++;
-		copy = min_t(unsigned long, len, iov->iov_len);
+		copy = min_t(unsigned long, *remaining, iov->iov_len);
 
 		if (atomic) {
-			if (__copy_to_user_inatomic(iov->iov_base, from, copy))
+			if (__copy_to_user_inatomic(iov->iov_base,
+						    addr + *offset, copy))
 				return -EFAULT;
 		} else {
-			if (copy_to_user(iov->iov_base, from, copy))
+			if (copy_to_user(iov->iov_base,
+					 addr + *offset, copy))
 				return -EFAULT;
 		}
-		from += copy;
-		len -= copy;
+		*offset += copy;
+		*remaining -= copy;
 		iov->iov_base += copy;
 		iov->iov_len -= copy;
 	}
@@ -395,7 +399,7 @@ pipe_read(struct kiocb *iocb, const struct iovec *_iov,
 			struct pipe_buffer *buf = pipe->bufs + curbuf;
 			const struct pipe_buf_operations *ops = buf->ops;
 			void *addr;
-			size_t chars = buf->len;
+			size_t chars = buf->len, remaining;
 			int error, atomic;
 
 			if (chars > total_len)
@@ -409,9 +413,11 @@ pipe_read(struct kiocb *iocb, const struct iovec *_iov,
 			}
 
 			atomic = !iov_fault_in_pages_write(iov, chars);
+			remaining = chars;
 redo:
 			addr = ops->map(pipe, buf, atomic);
-			error = pipe_iov_copy_to_user(iov, addr + buf->offset, chars, atomic);
+			error = pipe_iov_copy_to_user(iov, addr, &buf->offset,
+						      &remaining, atomic);
 			ops->unmap(pipe, buf, addr);
 			if (unlikely(error)) {
 				/*
@@ -426,7 +432,6 @@ redo:
 				break;
 			}
 			ret += chars;
-			buf->offset += chars;
 			buf->len -= chars;
 
 			/* Was it a packet buffer? Clean up and exit */
@@ -531,6 +536,7 @@ pipe_write(struct kiocb *iocb, const struct iovec *_iov,
 		if (ops->can_merge && offset + chars <= PAGE_SIZE) {
 			int error, atomic = 1;
 			void *addr;
+			size_t remaining = chars;
 
 			error = ops->confirm(pipe, buf);
 			if (error)
@@ -539,8 +545,8 @@ pipe_write(struct kiocb *iocb, const struct iovec *_iov,
 			iov_fault_in_pages_read(iov, chars);
 redo1:
 			addr = ops->map(pipe, buf, atomic);
-			error = pipe_iov_copy_from_user(offset + addr, iov,
-							chars, atomic);
+			error = pipe_iov_copy_from_user(addr, &offset, iov,
+							&remaining, atomic);
 			ops->unmap(pipe, buf, addr);
 			ret = error;
 			do_wakeup = 1;
@@ -575,6 +581,8 @@ redo1:
 			struct page *page = pipe->tmp_page;
 			char *src;
 			int error, atomic = 1;
+			int offset = 0;
+			size_t remaining;
 
 			if (!page) {
 				page = alloc_page(GFP_HIGHUSER);
@@ -595,14 +603,15 @@ redo1:
 				chars = total_len;
 
 			iov_fault_in_pages_read(iov, chars);
+			remaining = chars;
 redo2:
 			if (atomic)
 				src = kmap_atomic(page);
 			else
 				src = kmap(page);
 
-			error = pipe_iov_copy_from_user(src, iov, chars,
-							atomic);
+			error = pipe_iov_copy_from_user(src, &offset, iov,
+							&remaining, atomic);
 			if (atomic)
 				kunmap_atomic(src);
 			else
diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
index 0a1edc694d67..fe3e086d38e9 100644
--- a/kernel/trace/trace_events_filter.c
+++ b/kernel/trace/trace_events_filter.c
@@ -1328,19 +1328,24 @@ static int check_preds(struct filter_parse_state *ps)
 {
 	int n_normal_preds = 0, n_logical_preds = 0;
 	struct postfix_elt *elt;
+	int cnt = 0;
 
 	list_for_each_entry(elt, &ps->postfix, list) {
-		if (elt->op == OP_NONE)
+		if (elt->op == OP_NONE) {
+			cnt++;
 			continue;
+		}
 
+		cnt--;
 		if (elt->op == OP_AND || elt->op == OP_OR) {
 			n_logical_preds++;
 			continue;
 		}
 		n_normal_preds++;
+		WARN_ON_ONCE(cnt < 0);
 	}
 
-	if (!n_normal_preds || n_logical_preds >= n_normal_preds) {
+	if (cnt != 1 || !n_normal_preds || n_logical_preds >= n_normal_preds) {
 		parse_error(ps, FILT_ERR_INVALID_FILTER, 0);
 		return -EINVAL;
 	}
1	niro	2669	diff --git a/Makefile b/Makefile
2			index 6d19e37d36d5..5e3e665a10b7 100644
3			--- a/Makefile
4			+++ b/Makefile
5			@@ -1,6 +1,6 @@
6			VERSION = 3
7			PATCHLEVEL = 10
8			-SUBLEVEL = 81
9			+SUBLEVEL = 82
10			EXTRAVERSION =
11			NAME = TOSSUG Baby Fish
12
13			diff --git a/drivers/crypto/caam/caamrng.c b/drivers/crypto/caam/caamrng.c
14			index d1939a9539c0..04aefffb4dd9 100644
15			--- a/drivers/crypto/caam/caamrng.c
16			+++ b/drivers/crypto/caam/caamrng.c
17			@@ -56,7 +56,7 @@
18
19			/* Buffer, its dma address and lock */
20			struct buf_data {
21			- u8 buf[RN_BUF_SIZE];
22			+ u8 buf[RN_BUF_SIZE] ____cacheline_aligned;
23			dma_addr_t addr;
24			struct completion filled;
25			u32 hw_desc[DESC_JOB_O_LEN];
26			diff --git a/drivers/gpu/drm/mgag200/mgag200_mode.c b/drivers/gpu/drm/mgag200/mgag200_mode.c
27			index f6341e8622ee..7bd2acce9f81 100644
28			--- a/drivers/gpu/drm/mgag200/mgag200_mode.c
29			+++ b/drivers/gpu/drm/mgag200/mgag200_mode.c
30			@@ -1487,6 +1487,11 @@ static int mga_vga_mode_valid(struct drm_connector *connector,
31			return MODE_BANDWIDTH;
32			}
33
34			+ if ((mode->hdisplay % 8) != 0 \|\| (mode->hsync_start % 8) != 0 \|\|
35			+ (mode->hsync_end % 8) != 0 \|\| (mode->htotal % 8) != 0) {
36			+ return MODE_H_ILLEGAL;
37			+ }
38			+
39			if (mode->crtc_hdisplay > 2048 \|\| mode->crtc_hsync_start > 4096 \|\|
40			mode->crtc_hsync_end > 4096 \|\| mode->crtc_htotal > 4096 \|\|
41			mode->crtc_vdisplay > 2048 \|\| mode->crtc_vsync_start > 4096 \|\|
42			diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
43			index 572579f87de4..90861416b9e9 100644
44			--- a/drivers/scsi/lpfc/lpfc_sli.c
45			+++ b/drivers/scsi/lpfc/lpfc_sli.c
46			@@ -263,6 +263,16 @@ lpfc_sli4_eq_get(struct lpfc_queue *q)
47			return NULL;
48
49			q->hba_index = idx;
50			+
51			+ /*
52			+ * insert barrier for instruction interlock : data from the hardware
53			+ * must have the valid bit checked before it can be copied and acted
54			+ * upon. Given what was seen in lpfc_sli4_cq_get() of speculative
55			+ * instructions allowing action on content before valid bit checked,
56			+ * add barrier here as well. May not be needed as "content" is a
57			+ * single 32-bit entity here (vs multi word structure for cq's).
58			+ */
59			+ mb();
60			return eqe;
61			}
62
63			@@ -368,6 +378,17 @@ lpfc_sli4_cq_get(struct lpfc_queue *q)
64
65			cqe = q->qe[q->hba_index].cqe;
66			q->hba_index = idx;
67			+
68			+ /*
69			+ * insert barrier for instruction interlock : data from the hardware
70			+ * must have the valid bit checked before it can be copied and acted
71			+ * upon. Speculative instructions were allowing a bcopy at the start
72			+ * of lpfc_sli4_fp_handle_wcqe(), which is called immediately
73			+ * after our return, to copy data before the valid bit check above
74			+ * was done. As such, some of the copied data was stale. The barrier
75			+ * ensures the check is before any data is copied.
76			+ */
77			+ mb();
78			return cqe;
79			}
80
81			diff --git a/fs/pipe.c b/fs/pipe.c
82			index 0e0752ef2715..3e7ab278bb0c 100644
83			--- a/fs/pipe.c
84			+++ b/fs/pipe.c
85			@@ -117,25 +117,27 @@ void pipe_wait(struct pipe_inode_info *pipe)
86			}
87
88			static int
89			-pipe_iov_copy_from_user(void to, struct iovec iov, unsigned long len,
90			- int atomic)
91			+pipe_iov_copy_from_user(void addr, int offset, struct iovec *iov,
92			+ size_t *remaining, int atomic)
93			{
94			unsigned long copy;
95
96			- while (len > 0) {
97			+ while (*remaining > 0) {
98			while (!iov->iov_len)
99			iov++;
100			- copy = min_t(unsigned long, len, iov->iov_len);
101			+ copy = min_t(unsigned long, *remaining, iov->iov_len);
102
103			if (atomic) {
104			- if (__copy_from_user_inatomic(to, iov->iov_base, copy))
105			+ if (__copy_from_user_inatomic(addr + *offset,
106			+ iov->iov_base, copy))
107			return -EFAULT;
108			} else {
109			- if (copy_from_user(to, iov->iov_base, copy))
110			+ if (copy_from_user(addr + *offset,
111			+ iov->iov_base, copy))
112			return -EFAULT;
113			}
114			- to += copy;
115			- len -= copy;
116			+ *offset += copy;
117			+ *remaining -= copy;
118			iov->iov_base += copy;
119			iov->iov_len -= copy;
120			}
121			@@ -143,25 +145,27 @@ pipe_iov_copy_from_user(void to, struct iovec iov, unsigned long len,
122			}
123
124			static int
125			-pipe_iov_copy_to_user(struct iovec iov, const void from, unsigned long len,
126			- int atomic)
127			+pipe_iov_copy_to_user(struct iovec iov, void addr, int *offset,
128			+ size_t *remaining, int atomic)
129			{
130			unsigned long copy;
131
132			- while (len > 0) {
133			+ while (*remaining > 0) {
134			while (!iov->iov_len)
135			iov++;
136			- copy = min_t(unsigned long, len, iov->iov_len);
137			+ copy = min_t(unsigned long, *remaining, iov->iov_len);
138
139			if (atomic) {
140			- if (__copy_to_user_inatomic(iov->iov_base, from, copy))
141			+ if (__copy_to_user_inatomic(iov->iov_base,
142			+ addr + *offset, copy))
143			return -EFAULT;
144			} else {
145			- if (copy_to_user(iov->iov_base, from, copy))
146			+ if (copy_to_user(iov->iov_base,
147			+ addr + *offset, copy))
148			return -EFAULT;
149			}
150			- from += copy;
151			- len -= copy;
152			+ *offset += copy;
153			+ *remaining -= copy;
154			iov->iov_base += copy;
155			iov->iov_len -= copy;
156			}
157			@@ -395,7 +399,7 @@ pipe_read(struct kiocb iocb, const struct iovec _iov,
158			struct pipe_buffer *buf = pipe->bufs + curbuf;
159			const struct pipe_buf_operations *ops = buf->ops;
160			void *addr;
161			- size_t chars = buf->len;
162			+ size_t chars = buf->len, remaining;
163			int error, atomic;
164
165			if (chars > total_len)
166			@@ -409,9 +413,11 @@ pipe_read(struct kiocb iocb, const struct iovec _iov,
167			}
168
169			atomic = !iov_fault_in_pages_write(iov, chars);
170			+ remaining = chars;
171			redo:
172			addr = ops->map(pipe, buf, atomic);
173			- error = pipe_iov_copy_to_user(iov, addr + buf->offset, chars, atomic);
174			+ error = pipe_iov_copy_to_user(iov, addr, &buf->offset,
175			+ &remaining, atomic);
176			ops->unmap(pipe, buf, addr);
177			if (unlikely(error)) {
178			/*
179			@@ -426,7 +432,6 @@ redo:
180			break;
181			}
182			ret += chars;
183			- buf->offset += chars;
184			buf->len -= chars;
185
186			/* Was it a packet buffer? Clean up and exit */
187			@@ -531,6 +536,7 @@ pipe_write(struct kiocb iocb, const struct iovec _iov,
188			if (ops->can_merge && offset + chars <= PAGE_SIZE) {
189			int error, atomic = 1;
190			void *addr;
191			+ size_t remaining = chars;
192
193			error = ops->confirm(pipe, buf);
194			if (error)
195			@@ -539,8 +545,8 @@ pipe_write(struct kiocb iocb, const struct iovec _iov,
196			iov_fault_in_pages_read(iov, chars);
197			redo1:
198			addr = ops->map(pipe, buf, atomic);
199			- error = pipe_iov_copy_from_user(offset + addr, iov,
200			- chars, atomic);
201			+ error = pipe_iov_copy_from_user(addr, &offset, iov,
202			+ &remaining, atomic);
203			ops->unmap(pipe, buf, addr);
204			ret = error;
205			do_wakeup = 1;
206			@@ -575,6 +581,8 @@ redo1:
207			struct page *page = pipe->tmp_page;
208			char *src;
209			int error, atomic = 1;
210			+ int offset = 0;
211			+ size_t remaining;
212
213			if (!page) {
214			page = alloc_page(GFP_HIGHUSER);
215			@@ -595,14 +603,15 @@ redo1:
216			chars = total_len;
217
218			iov_fault_in_pages_read(iov, chars);
219			+ remaining = chars;
220			redo2:
221			if (atomic)
222			src = kmap_atomic(page);
223			else
224			src = kmap(page);
225
226			- error = pipe_iov_copy_from_user(src, iov, chars,
227			- atomic);
228			+ error = pipe_iov_copy_from_user(src, &offset, iov,
229			+ &remaining, atomic);
230			if (atomic)
231			kunmap_atomic(src);
232			else
233			diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
234			index 0a1edc694d67..fe3e086d38e9 100644
235			--- a/kernel/trace/trace_events_filter.c
236			+++ b/kernel/trace/trace_events_filter.c
237			@@ -1328,19 +1328,24 @@ static int check_preds(struct filter_parse_state *ps)
238			{
239			int n_normal_preds = 0, n_logical_preds = 0;
240			struct postfix_elt *elt;
241			+ int cnt = 0;
242
243			list_for_each_entry(elt, &ps->postfix, list) {
244			- if (elt->op == OP_NONE)
245			+ if (elt->op == OP_NONE) {
246			+ cnt++;
247			continue;
248			+ }
249
250			+ cnt--;
251			if (elt->op == OP_AND \|\| elt->op == OP_OR) {
252			n_logical_preds++;
253			continue;
254			}
255			n_normal_preds++;
256			+ WARN_ON_ONCE(cnt < 0);
257			}
258
259			- if (!n_normal_preds \|\| n_logical_preds >= n_normal_preds) {
260			+ if (cnt != 1 \|\| !n_normal_preds \|\| n_logical_preds >= n_normal_preds) {
261			parse_error(ps, FILT_ERR_INVALID_FILTER, 0);
262			return -EINVAL;
263			}