--- /dev/null
+From 52f6f9d74f31078964ca1574f7bb612da7877ac8 Mon Sep 17 00:00:00 2001
+From: Jann Horn <jannh@google.com>
+Date: Tue, 26 Mar 2019 23:03:48 +0100
+Subject: floppy: fix usercopy direction
+
+From: Jann Horn <jannh@google.com>
+
+commit 52f6f9d74f31078964ca1574f7bb612da7877ac8 upstream.
+
+As sparse points out, these two copy_from_user() should actually be
+copy_to_user().
+
+Fixes: 229b53c9bf4e ("take floppy compat ioctls to sodding floppy.c")
+Cc: stable@vger.kernel.org
+Acked-by: Alexander Popov <alex.popov@linux.com>
+Reviewed-by: Mukesh Ojha <mojha@codeaurora.org>
+Signed-off-by: Jann Horn <jannh@google.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/block/floppy.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/block/floppy.c
++++ b/drivers/block/floppy.c
+@@ -3780,7 +3780,7 @@ static int compat_getdrvprm(int drive,
+ v.native_format = UDP->native_format;
+ mutex_unlock(&floppy_mutex);
+
+- if (copy_from_user(arg, &v, sizeof(struct compat_floppy_drive_params)))
++ if (copy_to_user(arg, &v, sizeof(struct compat_floppy_drive_params)))
+ return -EFAULT;
+ return 0;
+ }
+@@ -3816,7 +3816,7 @@ static int compat_getdrvstat(int drive,
+ v.bufblocks = UDRS->bufblocks;
+ mutex_unlock(&floppy_mutex);
+
+- if (copy_from_user(arg, &v, sizeof(struct compat_floppy_drive_struct)))
++ if (copy_to_user(arg, &v, sizeof(struct compat_floppy_drive_struct)))
+ return -EFAULT;
+ return 0;
+ Eintr:
--- /dev/null
+From 0be0bfd2de9dfdd2098a9c5b14bdd8f739c9165d Mon Sep 17 00:00:00 2001
+From: Amir Goldstein <amir73il@gmail.com>
+Date: Fri, 12 Jul 2019 15:24:34 +0300
+Subject: ovl: fix regression caused by overlapping layers detection
+
+From: Amir Goldstein <amir73il@gmail.com>
+
+commit 0be0bfd2de9dfdd2098a9c5b14bdd8f739c9165d upstream.
+
+Once upon a time, commit 2cac0c00a6cd ("ovl: get exclusive ownership on
+upper/work dirs") in v4.13 added some sanity checks on overlayfs layers.
+This change caused a docker regression. The root cause was mount leaks
+by docker, which as far as I know, still exist.
+
+To mitigate the regression, commit 85fdee1eef1a ("ovl: fix regression
+caused by exclusive upper/work dir protection") in v4.14 turned the
+mount errors into warnings for the default index=off configuration.
+
+Recently, commit 146d62e5a586 ("ovl: detect overlapping layers") in
+v5.2, re-introduced exclusive upper/work dir checks regardless of
+index=off configuration.
+
+This changes the status quo and mount leak related bug reports have
+started to re-surface. Restore the status quo to fix the regressions.
+To clarify, index=off does NOT relax overlapping layers check for this
+ovelayfs mount. index=off only relaxes exclusive upper/work dir checks
+with another overlayfs mount.
+
+To cover the part of overlapping layers detection that used the
+exclusive upper/work dir checks to detect overlap with self upper/work
+dir, add a trap also on the work base dir.
+
+Link: https://github.com/moby/moby/issues/34672
+Link: https://lore.kernel.org/linux-fsdevel/20171006121405.GA32700@veci.piliscsaba.szeredi.hu/
+Link: https://github.com/containers/libpod/issues/3540
+Fixes: 146d62e5a586 ("ovl: detect overlapping layers")
+Cc: <stable@vger.kernel.org> # v4.19+
+Signed-off-by: Amir Goldstein <amir73il@gmail.com>
+Tested-by: Colin Walters <walters@verbum.org>
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ Documentation/filesystems/overlayfs.txt | 2
+ fs/overlayfs/ovl_entry.h | 1
+ fs/overlayfs/super.c | 73 ++++++++++++++++++++------------
+ 3 files changed, 49 insertions(+), 27 deletions(-)
+
+--- a/Documentation/filesystems/overlayfs.txt
++++ b/Documentation/filesystems/overlayfs.txt
+@@ -302,7 +302,7 @@ beneath or above the path of another ove
+
+ Using an upper layer path and/or a workdir path that are already used by
+ another overlay mount is not allowed and may fail with EBUSY. Using
+-partially overlapping paths is not allowed but will not fail with EBUSY.
++partially overlapping paths is not allowed and may fail with EBUSY.
+ If files are accessed from two overlayfs mounts which share or overlap the
+ upper layer and/or workdir path the behavior of the overlay is undefined,
+ though it will not result in a crash or deadlock.
+--- a/fs/overlayfs/ovl_entry.h
++++ b/fs/overlayfs/ovl_entry.h
+@@ -66,6 +66,7 @@ struct ovl_fs {
+ bool workdir_locked;
+ /* Traps in ovl inode cache */
+ struct inode *upperdir_trap;
++ struct inode *workbasedir_trap;
+ struct inode *workdir_trap;
+ struct inode *indexdir_trap;
+ /* Inode numbers in all layers do not use the high xino_bits */
+--- a/fs/overlayfs/super.c
++++ b/fs/overlayfs/super.c
+@@ -212,6 +212,7 @@ static void ovl_free_fs(struct ovl_fs *o
+ {
+ unsigned i;
+
++ iput(ofs->workbasedir_trap);
+ iput(ofs->indexdir_trap);
+ iput(ofs->workdir_trap);
+ iput(ofs->upperdir_trap);
+@@ -1003,6 +1004,25 @@ static int ovl_setup_trap(struct super_b
+ return 0;
+ }
+
++/*
++ * Determine how we treat concurrent use of upperdir/workdir based on the
++ * index feature. This is papering over mount leaks of container runtimes,
++ * for example, an old overlay mount is leaked and now its upperdir is
++ * attempted to be used as a lower layer in a new overlay mount.
++ */
++static int ovl_report_in_use(struct ovl_fs *ofs, const char *name)
++{
++ if (ofs->config.index) {
++ pr_err("overlayfs: %s is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection.\n",
++ name);
++ return -EBUSY;
++ } else {
++ pr_warn("overlayfs: %s is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior.\n",
++ name);
++ return 0;
++ }
++}
++
+ static int ovl_get_upper(struct super_block *sb, struct ovl_fs *ofs,
+ struct path *upperpath)
+ {
+@@ -1040,14 +1060,12 @@ static int ovl_get_upper(struct super_bl
+ upper_mnt->mnt_flags &= ~(MNT_NOATIME | MNT_NODIRATIME | MNT_RELATIME);
+ ofs->upper_mnt = upper_mnt;
+
+- err = -EBUSY;
+ if (ovl_inuse_trylock(ofs->upper_mnt->mnt_root)) {
+ ofs->upperdir_locked = true;
+- } else if (ofs->config.index) {
+- pr_err("overlayfs: upperdir is in-use by another mount, mount with '-o index=off' to override exclusive upperdir protection.\n");
+- goto out;
+ } else {
+- pr_warn("overlayfs: upperdir is in-use by another mount, accessing files from both mounts will result in undefined behavior.\n");
++ err = ovl_report_in_use(ofs, "upperdir");
++ if (err)
++ goto out;
+ }
+
+ err = 0;
+@@ -1157,16 +1175,19 @@ static int ovl_get_workdir(struct super_
+
+ ofs->workbasedir = dget(workpath.dentry);
+
+- err = -EBUSY;
+ if (ovl_inuse_trylock(ofs->workbasedir)) {
+ ofs->workdir_locked = true;
+- } else if (ofs->config.index) {
+- pr_err("overlayfs: workdir is in-use by another mount, mount with '-o index=off' to override exclusive workdir protection.\n");
+- goto out;
+ } else {
+- pr_warn("overlayfs: workdir is in-use by another mount, accessing files from both mounts will result in undefined behavior.\n");
++ err = ovl_report_in_use(ofs, "workdir");
++ if (err)
++ goto out;
+ }
+
++ err = ovl_setup_trap(sb, ofs->workbasedir, &ofs->workbasedir_trap,
++ "workdir");
++ if (err)
++ goto out;
++
+ err = ovl_make_workdir(sb, ofs, &workpath);
+
+ out:
+@@ -1313,16 +1334,16 @@ static int ovl_get_lower_layers(struct s
+ if (err < 0)
+ goto out;
+
+- err = -EBUSY;
+- if (ovl_is_inuse(stack[i].dentry)) {
+- pr_err("overlayfs: lowerdir is in-use as upperdir/workdir\n");
+- goto out;
+- }
+-
+ err = ovl_setup_trap(sb, stack[i].dentry, &trap, "lowerdir");
+ if (err)
+ goto out;
+
++ if (ovl_is_inuse(stack[i].dentry)) {
++ err = ovl_report_in_use(ofs, "lowerdir");
++ if (err)
++ goto out;
++ }
++
+ mnt = clone_private_mount(&stack[i]);
+ err = PTR_ERR(mnt);
+ if (IS_ERR(mnt)) {
+@@ -1469,8 +1490,8 @@ out_err:
+ * - another layer of this overlayfs instance
+ * - upper/work dir of any overlayfs instance
+ */
+-static int ovl_check_layer(struct super_block *sb, struct dentry *dentry,
+- const char *name)
++static int ovl_check_layer(struct super_block *sb, struct ovl_fs *ofs,
++ struct dentry *dentry, const char *name)
+ {
+ struct dentry *next = dentry, *parent;
+ int err = 0;
+@@ -1482,13 +1503,11 @@ static int ovl_check_layer(struct super_
+
+ /* Walk back ancestors to root (inclusive) looking for traps */
+ while (!err && parent != next) {
+- if (ovl_is_inuse(parent)) {
+- err = -EBUSY;
+- pr_err("overlayfs: %s path overlapping in-use upperdir/workdir\n",
+- name);
+- } else if (ovl_lookup_trap_inode(sb, parent)) {
++ if (ovl_lookup_trap_inode(sb, parent)) {
+ err = -ELOOP;
+ pr_err("overlayfs: overlapping %s path\n", name);
++ } else if (ovl_is_inuse(parent)) {
++ err = ovl_report_in_use(ofs, name);
+ }
+ next = parent;
+ parent = dget_parent(next);
+@@ -1509,7 +1528,8 @@ static int ovl_check_overlapping_layers(
+ int i, err;
+
+ if (ofs->upper_mnt) {
+- err = ovl_check_layer(sb, ofs->upper_mnt->mnt_root, "upperdir");
++ err = ovl_check_layer(sb, ofs, ofs->upper_mnt->mnt_root,
++ "upperdir");
+ if (err)
+ return err;
+
+@@ -1520,13 +1540,14 @@ static int ovl_check_overlapping_layers(
+ * workbasedir. In that case, we already have their traps in
+ * inode cache and we will catch that case on lookup.
+ */
+- err = ovl_check_layer(sb, ofs->workbasedir, "workdir");
++ err = ovl_check_layer(sb, ofs, ofs->workbasedir, "workdir");
+ if (err)
+ return err;
+ }
+
+ for (i = 0; i < ofs->numlower; i++) {
+- err = ovl_check_layer(sb, ofs->lower_layers[i].mnt->mnt_root,
++ err = ovl_check_layer(sb, ofs,
++ ofs->lower_layers[i].mnt->mnt_root,
+ "lowerdir");
+ if (err)
+ return err;
--- /dev/null
+From 14ced7e3a1ae9bed7051df3718c8c7b583854a5c Mon Sep 17 00:00:00 2001
+From: Bjorn Andersson <bjorn.andersson@linaro.org>
+Date: Mon, 5 Aug 2019 17:42:56 -0700
+Subject: phy: qcom-qmp: Correct ready status, again
+
+From: Bjorn Andersson <bjorn.andersson@linaro.org>
+
+commit 14ced7e3a1ae9bed7051df3718c8c7b583854a5c upstream.
+
+Despite extensive testing of commit 885bd765963b ("phy: qcom-qmp: Correct
+READY_STATUS poll break condition") I failed to conclude that the
+PHYSTATUS bit of the PCS_STATUS register used in PCIe and USB3 falls as
+the PHY gets ready. Similar to the prior bug with UFS the code will
+generally get past the check before the transition and thereby
+"succeed".
+
+Correct the name of the register used PCIe and USB3 PHYs, replace
+mask_pcs_ready with a constant expression depending on the type of the
+PHY and check for the appropriate ready state.
+
+Cc: stable@vger.kernel.org
+Cc: Vivek Gautam <vivek.gautam@codeaurora.org>
+Cc: Evan Green <evgreen@chromium.org>
+Cc: Niklas Cassel <niklas.cassel@linaro.org>
+Reported-by: Marc Gonzalez <marc.w.gonzalez@free.fr>
+Fixes: 885bd765963b ("phy: qcom-qmp: Correct READY_STATUS poll break condition")
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Tested-by: Marc Gonzalez <marc.w.gonzalez@free.fr>
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/phy/qualcomm/phy-qcom-qmp.c | 33 ++++++++++++++++-----------------
+ 1 file changed, 16 insertions(+), 17 deletions(-)
+
+--- a/drivers/phy/qualcomm/phy-qcom-qmp.c
++++ b/drivers/phy/qualcomm/phy-qcom-qmp.c
+@@ -35,7 +35,7 @@
+ #define PLL_READY_GATE_EN BIT(3)
+ /* QPHY_PCS_STATUS bit */
+ #define PHYSTATUS BIT(6)
+-/* QPHY_COM_PCS_READY_STATUS bit */
++/* QPHY_PCS_READY_STATUS & QPHY_COM_PCS_READY_STATUS bit */
+ #define PCS_READY BIT(0)
+
+ /* QPHY_V3_DP_COM_RESET_OVRD_CTRL register bits */
+@@ -115,6 +115,7 @@ enum qphy_reg_layout {
+ QPHY_SW_RESET,
+ QPHY_START_CTRL,
+ QPHY_PCS_READY_STATUS,
++ QPHY_PCS_STATUS,
+ QPHY_PCS_AUTONOMOUS_MODE_CTRL,
+ QPHY_PCS_LFPS_RXTERM_IRQ_CLEAR,
+ QPHY_PCS_LFPS_RXTERM_IRQ_STATUS,
+@@ -133,7 +134,7 @@ static const unsigned int pciephy_regs_l
+ [QPHY_FLL_MAN_CODE] = 0xd4,
+ [QPHY_SW_RESET] = 0x00,
+ [QPHY_START_CTRL] = 0x08,
+- [QPHY_PCS_READY_STATUS] = 0x174,
++ [QPHY_PCS_STATUS] = 0x174,
+ };
+
+ static const unsigned int usb3phy_regs_layout[] = {
+@@ -144,7 +145,7 @@ static const unsigned int usb3phy_regs_l
+ [QPHY_FLL_MAN_CODE] = 0xd0,
+ [QPHY_SW_RESET] = 0x00,
+ [QPHY_START_CTRL] = 0x08,
+- [QPHY_PCS_READY_STATUS] = 0x17c,
++ [QPHY_PCS_STATUS] = 0x17c,
+ [QPHY_PCS_AUTONOMOUS_MODE_CTRL] = 0x0d4,
+ [QPHY_PCS_LFPS_RXTERM_IRQ_CLEAR] = 0x0d8,
+ [QPHY_PCS_LFPS_RXTERM_IRQ_STATUS] = 0x178,
+@@ -153,7 +154,7 @@ static const unsigned int usb3phy_regs_l
+ static const unsigned int qmp_v3_usb3phy_regs_layout[] = {
+ [QPHY_SW_RESET] = 0x00,
+ [QPHY_START_CTRL] = 0x08,
+- [QPHY_PCS_READY_STATUS] = 0x174,
++ [QPHY_PCS_STATUS] = 0x174,
+ [QPHY_PCS_AUTONOMOUS_MODE_CTRL] = 0x0d8,
+ [QPHY_PCS_LFPS_RXTERM_IRQ_CLEAR] = 0x0dc,
+ [QPHY_PCS_LFPS_RXTERM_IRQ_STATUS] = 0x170,
+@@ -911,7 +912,6 @@ struct qmp_phy_cfg {
+
+ unsigned int start_ctrl;
+ unsigned int pwrdn_ctrl;
+- unsigned int mask_pcs_ready;
+ unsigned int mask_com_pcs_ready;
+
+ /* true, if PHY has a separate PHY_COM control block */
+@@ -1074,7 +1074,6 @@ static const struct qmp_phy_cfg msm8996_
+
+ .start_ctrl = PCS_START | PLL_READY_GATE_EN,
+ .pwrdn_ctrl = SW_PWRDN | REFCLK_DRV_DSBL,
+- .mask_pcs_ready = PHYSTATUS,
+ .mask_com_pcs_ready = PCS_READY,
+
+ .has_phy_com_ctrl = true,
+@@ -1106,7 +1105,6 @@ static const struct qmp_phy_cfg msm8996_
+
+ .start_ctrl = SERDES_START | PCS_START,
+ .pwrdn_ctrl = SW_PWRDN,
+- .mask_pcs_ready = PHYSTATUS,
+ };
+
+ /* list of resets */
+@@ -1136,7 +1134,6 @@ static const struct qmp_phy_cfg ipq8074_
+
+ .start_ctrl = SERDES_START | PCS_START,
+ .pwrdn_ctrl = SW_PWRDN | REFCLK_DRV_DSBL,
+- .mask_pcs_ready = PHYSTATUS,
+
+ .has_phy_com_ctrl = false,
+ .has_lane_rst = false,
+@@ -1167,7 +1164,6 @@ static const struct qmp_phy_cfg qmp_v3_u
+
+ .start_ctrl = SERDES_START | PCS_START,
+ .pwrdn_ctrl = SW_PWRDN,
+- .mask_pcs_ready = PHYSTATUS,
+
+ .has_pwrdn_delay = true,
+ .pwrdn_delay_min = POWER_DOWN_DELAY_US_MIN,
+@@ -1199,7 +1195,6 @@ static const struct qmp_phy_cfg qmp_v3_u
+
+ .start_ctrl = SERDES_START | PCS_START,
+ .pwrdn_ctrl = SW_PWRDN,
+- .mask_pcs_ready = PHYSTATUS,
+
+ .has_pwrdn_delay = true,
+ .pwrdn_delay_min = POWER_DOWN_DELAY_US_MIN,
+@@ -1226,7 +1221,6 @@ static const struct qmp_phy_cfg sdm845_u
+
+ .start_ctrl = SERDES_START,
+ .pwrdn_ctrl = SW_PWRDN,
+- .mask_pcs_ready = PCS_READY,
+
+ .is_dual_lane_phy = true,
+ .no_pcs_sw_reset = true,
+@@ -1254,7 +1248,6 @@ static const struct qmp_phy_cfg msm8998_
+
+ .start_ctrl = SERDES_START | PCS_START,
+ .pwrdn_ctrl = SW_PWRDN | REFCLK_DRV_DSBL,
+- .mask_pcs_ready = PHYSTATUS,
+ };
+
+ static const struct qmp_phy_cfg msm8998_usb3phy_cfg = {
+@@ -1279,7 +1272,6 @@ static const struct qmp_phy_cfg msm8998_
+
+ .start_ctrl = SERDES_START | PCS_START,
+ .pwrdn_ctrl = SW_PWRDN,
+- .mask_pcs_ready = PHYSTATUS,
+
+ .is_dual_lane_phy = true,
+ };
+@@ -1457,7 +1449,7 @@ static int qcom_qmp_phy_enable(struct ph
+ void __iomem *pcs = qphy->pcs;
+ void __iomem *dp_com = qmp->dp_com;
+ void __iomem *status;
+- unsigned int mask, val;
++ unsigned int mask, val, ready;
+ int ret;
+
+ dev_vdbg(qmp->dev, "Initializing QMP phy\n");
+@@ -1545,10 +1537,17 @@ static int qcom_qmp_phy_enable(struct ph
+ /* start SerDes and Phy-Coding-Sublayer */
+ qphy_setbits(pcs, cfg->regs[QPHY_START_CTRL], cfg->start_ctrl);
+
+- status = pcs + cfg->regs[QPHY_PCS_READY_STATUS];
+- mask = cfg->mask_pcs_ready;
++ if (cfg->type == PHY_TYPE_UFS) {
++ status = pcs + cfg->regs[QPHY_PCS_READY_STATUS];
++ mask = PCS_READY;
++ ready = PCS_READY;
++ } else {
++ status = pcs + cfg->regs[QPHY_PCS_STATUS];
++ mask = PHYSTATUS;
++ ready = 0;
++ }
+
+- ret = readl_poll_timeout(status, val, val & mask, 10,
++ ret = readl_poll_timeout(status, val, (val & mask) == ready, 10,
+ PHY_INIT_COMPLETE_TIMEOUT);
+ if (ret) {
+ dev_err(qmp->dev, "phy initialization timed-out\n");
--- /dev/null
+From d0b7a302d58abe24ed0f32a0672dd4c356bb73db Mon Sep 17 00:00:00 2001
+From: Will Deacon <will@kernel.org>
+Date: Thu, 22 Aug 2019 14:58:37 +0100
+Subject: Revert "arm64: Remove unnecessary ISBs from set_{pte,pmd,pud}"
+
+From: Will Deacon <will@kernel.org>
+
+commit d0b7a302d58abe24ed0f32a0672dd4c356bb73db upstream.
+
+This reverts commit 24fe1b0efad4fcdd32ce46cffeab297f22581707.
+
+Commit 24fe1b0efad4fcdd ("arm64: Remove unnecessary ISBs from
+set_{pte,pmd,pud}") removed ISB instructions immediately following updates
+to the page table, on the grounds that they are not required by the
+architecture and a DSB alone is sufficient to ensure that subsequent data
+accesses use the new translation:
+
+ DDI0487E_a, B2-128:
+
+ | ... no instruction that appears in program order after the DSB
+ | instruction can alter any state of the system or perform any part of
+ | its functionality until the DSB completes other than:
+ |
+ | * Being fetched from memory and decoded
+ | * Reading the general-purpose, SIMD and floating-point,
+ | Special-purpose, or System registers that are directly or indirectly
+ | read without causing side-effects.
+
+However, the same document also states the following:
+
+ DDI0487E_a, B2-125:
+
+ | DMB and DSB instructions affect reads and writes to the memory system
+ | generated by Load/Store instructions and data or unified cache
+ | maintenance instructions being executed by the PE. Instruction fetches
+ | or accesses caused by a hardware translation table access are not
+ | explicit accesses.
+
+which appears to claim that the DSB alone is insufficient. Unfortunately,
+some CPU designers have followed the second clause above, whereas in Linux
+we've been relying on the first. This means that our mapping sequence:
+
+ MOV X0, <valid pte>
+ STR X0, [Xptep] // Store new PTE to page table
+ DSB ISHST
+ LDR X1, [X2] // Translates using the new PTE
+
+can actually raise a translation fault on the load instruction because the
+translation can be performed speculatively before the page table update and
+then marked as "faulting" by the CPU. For user PTEs, this is ok because we
+can handle the spurious fault, but for kernel PTEs and intermediate table
+entries this results in a panic().
+
+Revert the offending commit to reintroduce the missing barriers.
+
+Cc: <stable@vger.kernel.org>
+Fixes: 24fe1b0efad4fcdd ("arm64: Remove unnecessary ISBs from set_{pte,pmd,pud}")
+Reviewed-by: Mark Rutland <mark.rutland@arm.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/include/asm/pgtable.h | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+--- a/arch/arm64/include/asm/pgtable.h
++++ b/arch/arm64/include/asm/pgtable.h
+@@ -220,8 +220,10 @@ static inline void set_pte(pte_t *ptep,
+ * Only if the new pte is valid and kernel, otherwise TLB maintenance
+ * or update_mmu_cache() have the necessary barriers.
+ */
+- if (pte_valid_not_user(pte))
++ if (pte_valid_not_user(pte)) {
+ dsb(ishst);
++ isb();
++ }
+ }
+
+ extern void __sync_icache_dcache(pte_t pteval);
+@@ -484,8 +486,10 @@ static inline void set_pmd(pmd_t *pmdp,
+
+ WRITE_ONCE(*pmdp, pmd);
+
+- if (pmd_valid(pmd))
++ if (pmd_valid(pmd)) {
+ dsb(ishst);
++ isb();
++ }
+ }
+
+ static inline void pmd_clear(pmd_t *pmdp)
+@@ -543,8 +547,10 @@ static inline void set_pud(pud_t *pudp,
+
+ WRITE_ONCE(*pudp, pud);
+
+- if (pud_valid(pud))
++ if (pud_valid(pud)) {
+ dsb(ishst);
++ isb();
++ }
+ }
+
+ static inline void pud_clear(pud_t *pudp)
serial-sprd-correct-the-wrong-sequence-of-arguments.patch
tty-serial-atmel-reschedule-tx-after-rx-was-started.patch
nl80211-fix-possible-spectre-v1-for-cqm-rssi-thresholds.patch
+revert-arm64-remove-unnecessary-isbs-from-set_-pte-pmd-pud.patch
+ovl-fix-regression-caused-by-overlapping-layers-detection.patch
+phy-qcom-qmp-correct-ready-status-again.patch
+floppy-fix-usercopy-direction.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
