]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
4.4-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 7 Mar 2018 03:54:55 +0000 (19:54 -0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 7 Mar 2018 03:54:55 +0000 (19:54 -0800)
added patches:
arm-mvebu-fix-broken-pl310_errata_753970-selects.patch
kvm-mmu-fix-overlap-between-public-and-private-memslots.patch
kvm-x86-fix-smram-accessing-even-if-vm-is-shutdown.patch
media-m88ds3103-don-t-call-a-non-initalized-function.patch
nospec-allow-index-argument-to-have-const-qualified-type.patch

queue-4.4/arm-mvebu-fix-broken-pl310_errata_753970-selects.patch [new file with mode: 0644]
queue-4.4/kvm-mmu-fix-overlap-between-public-and-private-memslots.patch [new file with mode: 0644]
queue-4.4/kvm-x86-fix-smram-accessing-even-if-vm-is-shutdown.patch [new file with mode: 0644]
queue-4.4/media-m88ds3103-don-t-call-a-non-initalized-function.patch [new file with mode: 0644]
queue-4.4/nospec-allow-index-argument-to-have-const-qualified-type.patch [new file with mode: 0644]
queue-4.4/series

diff --git a/queue-4.4/arm-mvebu-fix-broken-pl310_errata_753970-selects.patch b/queue-4.4/arm-mvebu-fix-broken-pl310_errata_753970-selects.patch
new file mode 100644 (file)
index 0000000..3021724
--- /dev/null
@@ -0,0 +1,49 @@
+From 8aa36a8dcde3183d84db7b0d622ffddcebb61077 Mon Sep 17 00:00:00 2001
+From: Ulf Magnusson <ulfalizer@gmail.com>
+Date: Mon, 5 Feb 2018 02:21:13 +0100
+Subject: ARM: mvebu: Fix broken PL310_ERRATA_753970 selects
+
+From: Ulf Magnusson <ulfalizer@gmail.com>
+
+commit 8aa36a8dcde3183d84db7b0d622ffddcebb61077 upstream.
+
+The MACH_ARMADA_375 and MACH_ARMADA_38X boards select ARM_ERRATA_753970,
+but it was renamed to PL310_ERRATA_753970 by commit fa0ce4035d48 ("ARM:
+7162/1: errata: tidy up Kconfig options for PL310 errata workarounds").
+
+Fix the selects to use the new name.
+
+Discovered with the
+https://github.com/ulfalizer/Kconfiglib/blob/master/examples/list_undefined.py
+script.
+Fixes: fa0ce4035d48 ("ARM: 7162/1: errata: tidy up Kconfig options for
+PL310 errata workarounds"
+cc: stable@vger.kernel.org
+Signed-off-by: Ulf Magnusson <ulfalizer@gmail.com>
+Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-mvebu/Kconfig |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/mach-mvebu/Kconfig
++++ b/arch/arm/mach-mvebu/Kconfig
+@@ -37,7 +37,7 @@ config MACH_ARMADA_370
+ config MACH_ARMADA_375
+       bool "Marvell Armada 375 boards" if ARCH_MULTI_V7
+       select ARM_ERRATA_720789
+-      select ARM_ERRATA_753970
++      select PL310_ERRATA_753970
+       select ARM_GIC
+       select ARMADA_375_CLK
+       select HAVE_ARM_SCU
+@@ -52,7 +52,7 @@ config MACH_ARMADA_375
+ config MACH_ARMADA_38X
+       bool "Marvell Armada 380/385 boards" if ARCH_MULTI_V7
+       select ARM_ERRATA_720789
+-      select ARM_ERRATA_753970
++      select PL310_ERRATA_753970
+       select ARM_GIC
+       select ARMADA_38X_CLK
+       select HAVE_ARM_SCU
diff --git a/queue-4.4/kvm-mmu-fix-overlap-between-public-and-private-memslots.patch b/queue-4.4/kvm-mmu-fix-overlap-between-public-and-private-memslots.patch
new file mode 100644 (file)
index 0000000..d0bb749
--- /dev/null
@@ -0,0 +1,113 @@
+From b28676bb8ae4569cced423dc2a88f7cb319d5379 Mon Sep 17 00:00:00 2001
+From: Wanpeng Li <wanpeng.li@hotmail.com>
+Date: Tue, 13 Feb 2018 15:36:00 +0100
+Subject: KVM: mmu: Fix overlap between public and private memslots
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Wanpeng Li <wanpeng.li@hotmail.com>
+
+commit b28676bb8ae4569cced423dc2a88f7cb319d5379 upstream.
+
+Reported by syzkaller:
+
+    pte_list_remove: ffff9714eb1f8078 0->BUG
+    ------------[ cut here ]------------
+    kernel BUG at arch/x86/kvm/mmu.c:1157!
+    invalid opcode: 0000 [#1] SMP
+    RIP: 0010:pte_list_remove+0x11b/0x120 [kvm]
+    Call Trace:
+     drop_spte+0x83/0xb0 [kvm]
+     mmu_page_zap_pte+0xcc/0xe0 [kvm]
+     kvm_mmu_prepare_zap_page+0x81/0x4a0 [kvm]
+     kvm_mmu_invalidate_zap_all_pages+0x159/0x220 [kvm]
+     kvm_arch_flush_shadow_all+0xe/0x10 [kvm]
+     kvm_mmu_notifier_release+0x6c/0xa0 [kvm]
+     ? kvm_mmu_notifier_release+0x5/0xa0 [kvm]
+     __mmu_notifier_release+0x79/0x110
+     ? __mmu_notifier_release+0x5/0x110
+     exit_mmap+0x15a/0x170
+     ? do_exit+0x281/0xcb0
+     mmput+0x66/0x160
+     do_exit+0x2c9/0xcb0
+     ? __context_tracking_exit.part.5+0x4a/0x150
+     do_group_exit+0x50/0xd0
+     SyS_exit_group+0x14/0x20
+     do_syscall_64+0x73/0x1f0
+     entry_SYSCALL64_slow_path+0x25/0x25
+
+The reason is that when creates new memslot, there is no guarantee for new
+memslot not overlap with private memslots. This can be triggered by the
+following program:
+
+   #include <fcntl.h>
+   #include <pthread.h>
+   #include <setjmp.h>
+   #include <signal.h>
+   #include <stddef.h>
+   #include <stdint.h>
+   #include <stdio.h>
+   #include <stdlib.h>
+   #include <string.h>
+   #include <sys/ioctl.h>
+   #include <sys/stat.h>
+   #include <sys/syscall.h>
+   #include <sys/types.h>
+   #include <unistd.h>
+   #include <linux/kvm.h>
+
+   long r[16];
+
+   int main()
+   {
+       void *p = valloc(0x4000);
+
+       r[2] = open("/dev/kvm", 0);
+       r[3] = ioctl(r[2], KVM_CREATE_VM, 0x0ul);
+
+       uint64_t addr = 0xf000;
+       ioctl(r[3], KVM_SET_IDENTITY_MAP_ADDR, &addr);
+       r[6] = ioctl(r[3], KVM_CREATE_VCPU, 0x0ul);
+       ioctl(r[3], KVM_SET_TSS_ADDR, 0x0ul);
+       ioctl(r[6], KVM_RUN, 0);
+       ioctl(r[6], KVM_RUN, 0);
+
+       struct kvm_userspace_memory_region mr = {
+               .slot = 0,
+               .flags = KVM_MEM_LOG_DIRTY_PAGES,
+               .guest_phys_addr = 0xf000,
+               .memory_size = 0x4000,
+               .userspace_addr = (uintptr_t) p
+       };
+       ioctl(r[3], KVM_SET_USER_MEMORY_REGION, &mr);
+       return 0;
+   }
+
+This patch fixes the bug by not adding a new memslot even if it
+overlaps with private memslots.
+
+Reported-by: Dmitry Vyukov <dvyukov@google.com>
+Cc: Paolo Bonzini <pbonzini@redhat.com>
+Cc: Radim Krčmář <rkrcmar@redhat.com>
+Cc: Dmitry Vyukov <dvyukov@google.com>
+Cc: Eric Biggers <ebiggers3@gmail.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Wanpeng Li <wanpeng.li@hotmail.com>
+---
+ virt/kvm/kvm_main.c |    3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -902,8 +902,7 @@ int __kvm_set_memory_region(struct kvm *
+               /* Check for overlaps */
+               r = -EEXIST;
+               kvm_for_each_memslot(slot, __kvm_memslots(kvm, as_id)) {
+-                      if ((slot->id >= KVM_USER_MEM_SLOTS) ||
+-                          (slot->id == id))
++                      if (slot->id == id)
+                               continue;
+                       if (!((base_gfn + npages <= slot->base_gfn) ||
+                             (base_gfn >= slot->base_gfn + slot->npages)))
diff --git a/queue-4.4/kvm-x86-fix-smram-accessing-even-if-vm-is-shutdown.patch b/queue-4.4/kvm-x86-fix-smram-accessing-even-if-vm-is-shutdown.patch
new file mode 100644 (file)
index 0000000..10a94cb
--- /dev/null
@@ -0,0 +1,57 @@
+From 95e057e25892eaa48cad1e2d637b80d0f1a4fac5 Mon Sep 17 00:00:00 2001
+From: Wanpeng Li <wanpengli@tencent.com>
+Date: Thu, 8 Feb 2018 15:32:45 +0800
+Subject: KVM: X86: Fix SMRAM accessing even if VM is shutdown
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Wanpeng Li <wanpengli@tencent.com>
+
+commit 95e057e25892eaa48cad1e2d637b80d0f1a4fac5 upstream.
+
+Reported by syzkaller:
+
+   WARNING: CPU: 6 PID: 2434 at arch/x86/kvm/vmx.c:6660 handle_ept_misconfig+0x54/0x1e0 [kvm_intel]
+   CPU: 6 PID: 2434 Comm: repro_test Not tainted 4.15.0+ #4
+   RIP: 0010:handle_ept_misconfig+0x54/0x1e0 [kvm_intel]
+   Call Trace:
+    vmx_handle_exit+0xbd/0xe20 [kvm_intel]
+    kvm_arch_vcpu_ioctl_run+0xdaf/0x1d50 [kvm]
+    kvm_vcpu_ioctl+0x3e9/0x720 [kvm]
+    do_vfs_ioctl+0xa4/0x6a0
+    SyS_ioctl+0x79/0x90
+    entry_SYSCALL_64_fastpath+0x25/0x9c
+
+The testcase creates a first thread to issue KVM_SMI ioctl, and then creates
+a second thread to mmap and operate on the same vCPU.  This triggers a race
+condition when running the testcase with multiple threads. Sometimes one thread
+exits with a triple fault while another thread mmaps and operates on the same
+vCPU.  Because CS=0x3000/IP=0x8000 is not mapped, accessing the SMI handler
+results in an EPT misconfig. This patch fixes it by returning RET_PF_EMULATE
+in kvm_handle_bad_page(), which will go on to cause an emulation failure and an
+exit with KVM_EXIT_INTERNAL_ERROR.
+
+Reported-by: syzbot+c1d9517cab094dae65e446c0c5b4de6c40f4dc58@syzkaller.appspotmail.com
+Cc: Paolo Bonzini <pbonzini@redhat.com>
+Cc: Radim Krčmář <rkrcmar@redhat.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Wanpeng Li <wanpengli@tencent.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kvm/mmu.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kvm/mmu.c
++++ b/arch/x86/kvm/mmu.c
+@@ -2775,7 +2775,7 @@ static int kvm_handle_bad_page(struct kv
+               return 0;
+       }
+-      return -EFAULT;
++      return RET_PF_EMULATE;
+ }
+ static void transparent_hugepage_adjust(struct kvm_vcpu *vcpu,
diff --git a/queue-4.4/media-m88ds3103-don-t-call-a-non-initalized-function.patch b/queue-4.4/media-m88ds3103-don-t-call-a-non-initalized-function.patch
new file mode 100644 (file)
index 0000000..564c939
--- /dev/null
@@ -0,0 +1,123 @@
+From b9c97c67fd19262c002d94ced2bfb513083e161e Mon Sep 17 00:00:00 2001
+From: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Date: Sat, 10 Feb 2018 06:14:10 -0500
+Subject: media: m88ds3103: don't call a non-initalized function
+
+From: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+
+commit b9c97c67fd19262c002d94ced2bfb513083e161e upstream.
+
+If m88d3103 chip ID is not recognized, the device is not initialized.
+
+However, it returns from probe without any error, causing this OOPS:
+
+[    7.689289] Unable to handle kernel NULL pointer dereference at virtual address 00000000
+[    7.689297] pgd = 7b0bd7a7
+[    7.689302] [00000000] *pgd=00000000
+[    7.689318] Internal error: Oops: 80000005 [#1] SMP ARM
+[    7.689322] Modules linked in: dvb_usb_dvbsky(+) m88ds3103 dvb_usb_v2 dvb_core videobuf2_vmalloc videobuf2_memops videobuf2_core crc32_arm_ce videodev media
+[    7.689358] CPU: 3 PID: 197 Comm: systemd-udevd Not tainted 4.15.0-mcc+ #23
+[    7.689361] Hardware name: BCM2835
+[    7.689367] PC is at 0x0
+[    7.689382] LR is at m88ds3103_attach+0x194/0x1d0 [m88ds3103]
+[    7.689386] pc : [<00000000>]    lr : [<bf0ae1ec>]    psr: 60000013
+[    7.689391] sp : ed8e5c20  ip : ed8c1e00  fp : ed8945c0
+[    7.689395] r10: ed894000  r9 : ed894378  r8 : eda736c0
+[    7.689400] r7 : ed894070  r6 : ed8e5c44  r5 : bf0bb040  r4 : eda77600
+[    7.689405] r3 : 00000000  r2 : 00000000  r1 : 00000000  r0 : eda77600
+[    7.689412] Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
+[    7.689417] Control: 10c5383d  Table: 2d8e806a  DAC: 00000051
+[    7.689423] Process systemd-udevd (pid: 197, stack limit = 0xe9dbfb63)
+[    7.689428] Stack: (0xed8e5c20 to 0xed8e6000)
+[    7.689439] 5c20: ed853a80 eda73640 ed894000 ed8942c0 ed853a80 bf0b9e98 ed894070 bf0b9f10
+[    7.689449] 5c40: 00000000 00000000 bf08c17c c08dfc50 00000000 00000000 00000000 00000000
+[    7.689459] 5c60: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
+[    7.689468] 5c80: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
+[    7.689479] 5ca0: 00000000 00000000 ed8945c0 ed8942c0 ed894000 ed894830 bf0b9e98 00000000
+[    7.689490] 5cc0: ed894378 bf0a3cb4 bf0bc3b0 0000533b ed920540 00000000 00000034 bf0a6434
+[    7.689500] 5ce0: ee952070 ed826600 bf0a7038 bf0a2dd8 00000001 bf0a6768 bf0a2f90 ed8943c0
+[    7.689511] 5d00: 00000000 c08eca68 ed826620 ed826620 00000000 ee952070 bf0bc034 ee952000
+[    7.689521] 5d20: ed826600 bf0bb080 ffffffed c0aa9e9c c0aa9dac ed826620 c16edf6c c168c2c8
+[    7.689531] 5d40: c16edf70 00000000 bf0bc034 0000000d 00000000 c08e268c bf0bb080 ed826600
+[    7.689541] 5d60: bf0bc034 ed826654 ed826620 bf0bc034 c164c8bc 00000000 00000001 00000000
+[    7.689553] 5d80: 00000028 c08e2948 00000000 bf0bc034 c08e2848 c08e0778 ee9f0a58 ed88bab4
+[    7.689563] 5da0: bf0bc034 ed90ba80 c168c1f0 c08e1934 bf0bb3bc c17045ac bf0bc034 c164c8bc
+[    7.689574] 5dc0: bf0bc034 bf0bb3bc ed91f564 c08e34ec bf0bc000 c164c8bc bf0bc034 c0aa8dc4
+[    7.689584] 5de0: ffffe000 00000000 bf0bf000 ed91f600 ed91f564 c03021e4 00000001 00000000
+[    7.689595] 5e00: c166e040 8040003f ed853a80 bf0bc448 00000000 c1678174 ed853a80 f0f22000
+[    7.689605] 5e20: f0f21fff 8040003f 014000c0 ed91e700 ed91e700 c16d8e68 00000001 ed91e6c0
+[    7.689615] 5e40: bf0bc400 00000001 bf0bc400 ed91f564 00000001 00000000 00000028 c03c9a24
+[    7.689625] 5e60: 00000001 c03c8c94 ed8e5f50 ed8e5f50 00000001 bf0bc400 ed91f540 c03c8cb0
+[    7.689637] 5e80: bf0bc40c 00007fff bf0bc400 c03c60b0 00000000 bf0bc448 00000028 c0e09684
+[    7.689647] 5ea0: 00000002 bf0bc530 c1234bf8 bf0bc5dc bf0bc514 c10ebbe8 ffffe000 bf000000
+[    7.689657] 5ec0: 00011538 00000000 ed8e5f48 00000000 00000000 00000000 00000000 00000000
+[    7.689666] 5ee0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
+[    7.689676] 5f00: 00000000 00000000 7fffffff 00000000 00000013 b6e55a18 0000017b c0309104
+[    7.689686] 5f20: ed8e4000 00000000 00510af0 c03c9430 7fffffff 00000000 00000003 00000000
+[    7.689697] 5f40: 00000000 f0f0f000 00011538 00000000 f0f107b0 f0f0f000 00011538 f0f1fdb8
+[    7.689707] 5f60: f0f1fbe8 f0f1b974 00004000 000041e0 bf0bc3d0 00000001 00000000 000024c4
+[    7.689717] 5f80: 0000002d 0000002e 00000019 00000000 00000010 00000000 16894000 00000000
+[    7.689727] 5fa0: 00000000 c0308f20 16894000 00000000 00000013 b6e55a18 00000000 b6e5652c
+[    7.689737] 5fc0: 16894000 00000000 00000000 0000017b 00020000 00508110 00000000 00510af0
+[    7.689748] 5fe0: bef68948 bef68938 b6e4d3d0 b6d32590 60000010 00000013 00000000 00000000
+[    7.689790] [<bf0ae1ec>] (m88ds3103_attach [m88ds3103]) from [<bf0b9f10>] (dvbsky_s960c_attach+0x78/0x280 [dvb_usb_dvbsky])
+[    7.689821] [<bf0b9f10>] (dvbsky_s960c_attach [dvb_usb_dvbsky]) from [<bf0a3cb4>] (dvb_usbv2_probe+0xa3c/0x1024 [dvb_usb_v2])
+[    7.689849] [<bf0a3cb4>] (dvb_usbv2_probe [dvb_usb_v2]) from [<c0aa9e9c>] (usb_probe_interface+0xf0/0x2a8)
+[    7.689869] [<c0aa9e9c>] (usb_probe_interface) from [<c08e268c>] (driver_probe_device+0x2f8/0x4b4)
+[    7.689881] [<c08e268c>] (driver_probe_device) from [<c08e2948>] (__driver_attach+0x100/0x11c)
+[    7.689895] [<c08e2948>] (__driver_attach) from [<c08e0778>] (bus_for_each_dev+0x4c/0x9c)
+[    7.689909] [<c08e0778>] (bus_for_each_dev) from [<c08e1934>] (bus_add_driver+0x1c0/0x264)
+[    7.689919] [<c08e1934>] (bus_add_driver) from [<c08e34ec>] (driver_register+0x78/0xf4)
+[    7.689931] [<c08e34ec>] (driver_register) from [<c0aa8dc4>] (usb_register_driver+0x70/0x134)
+[    7.689946] [<c0aa8dc4>] (usb_register_driver) from [<c03021e4>] (do_one_initcall+0x44/0x168)
+[    7.689963] [<c03021e4>] (do_one_initcall) from [<c03c9a24>] (do_init_module+0x64/0x1f4)
+[    7.689979] [<c03c9a24>] (do_init_module) from [<c03c8cb0>] (load_module+0x20a0/0x25c8)
+[    7.689993] [<c03c8cb0>] (load_module) from [<c03c9430>] (SyS_finit_module+0xb4/0xec)
+[    7.690007] [<c03c9430>] (SyS_finit_module) from [<c0308f20>] (ret_fast_syscall+0x0/0x54)
+[    7.690018] Code: bad PC value
+
+This may happen on normal circumstances, if, for some reason, the demod
+hangs and start returning an invalid chip ID:
+
+[   10.394395] m88ds3103 3-0068: Unknown device. Chip_id=00
+
+So, change the logic to cause probe to fail with -ENODEV, preventing
+the OOPS.
+
+Detected while testing DVB MMAP patches on Raspberry Pi 3 with
+DVBSky S960CI.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/dvb-frontends/m88ds3103.c |    7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/dvb-frontends/m88ds3103.c
++++ b/drivers/media/dvb-frontends/m88ds3103.c
+@@ -1281,11 +1281,12 @@ static int m88ds3103_select(struct i2c_a
+  * New users must use I2C client binding directly!
+  */
+ struct dvb_frontend *m88ds3103_attach(const struct m88ds3103_config *cfg,
+-              struct i2c_adapter *i2c, struct i2c_adapter **tuner_i2c_adapter)
++                                    struct i2c_adapter *i2c,
++                                    struct i2c_adapter **tuner_i2c_adapter)
+ {
+       struct i2c_client *client;
+       struct i2c_board_info board_info;
+-      struct m88ds3103_platform_data pdata;
++      struct m88ds3103_platform_data pdata = {};
+       pdata.clk = cfg->clock;
+       pdata.i2c_wr_max = cfg->i2c_wr_max;
+@@ -1428,6 +1429,8 @@ static int m88ds3103_probe(struct i2c_cl
+       case M88DS3103_CHIP_ID:
+               break;
+       default:
++              ret = -ENODEV;
++              dev_err(&client->dev, "Unknown device. Chip_id=%02x\n", dev->chip_id);
+               goto err_kfree;
+       }
diff --git a/queue-4.4/nospec-allow-index-argument-to-have-const-qualified-type.patch b/queue-4.4/nospec-allow-index-argument-to-have-const-qualified-type.patch
new file mode 100644 (file)
index 0000000..653e56f
--- /dev/null
@@ -0,0 +1,65 @@
+From b98c6a160a057d5686a8c54c79cc6c8c94a7d0c8 Mon Sep 17 00:00:00 2001
+From: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+Date: Fri, 16 Feb 2018 13:20:48 -0800
+Subject: nospec: Allow index argument to have const-qualified type
+
+From: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+
+commit b98c6a160a057d5686a8c54c79cc6c8c94a7d0c8 upstream.
+
+The last expression in a statement expression need not be a bare
+variable, quoting gcc docs
+
+  The last thing in the compound statement should be an expression
+  followed by a semicolon; the value of this subexpression serves as the
+  value of the entire construct.
+
+and we already use that in e.g. the min/max macros which end with a
+ternary expression.
+
+This way, we can allow index to have const-qualified type, which will in
+some cases avoid the need for introducing a local copy of index of
+non-const qualified type. That, in turn, can prevent readers not
+familiar with the internals of array_index_nospec from wondering about
+the seemingly redundant extra variable, and I think that's worthwhile
+considering how confusing the whole _nospec business is.
+
+The expression _i&_mask has type unsigned long (since that is the type
+of _mask, and the BUILD_BUG_ONs guarantee that _i will get promoted to
+that), so in order not to change the type of the whole expression, add
+a cast back to typeof(_i).
+
+Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Acked-by: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Arjan van de Ven <arjan@linux.intel.com>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: Dave Hansen <dave.hansen@linux.intel.com>
+Cc: David Woodhouse <dwmw2@infradead.org>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Will Deacon <will.deacon@arm.com>
+Cc: linux-arch@vger.kernel.org
+Cc: stable@vger.kernel.org
+Link: http://lkml.kernel.org/r/151881604837.17395.10812767547837568328.stgit@dwillia2-desk3.amr.corp.intel.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/nospec.h |    3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/include/linux/nospec.h
++++ b/include/linux/nospec.h
+@@ -66,7 +66,6 @@ static inline unsigned long array_index_
+       BUILD_BUG_ON(sizeof(_i) > sizeof(long));                        \
+       BUILD_BUG_ON(sizeof(_s) > sizeof(long));                        \
+                                                                       \
+-      _i &= _mask;                                                    \
+-      _i;                                                             \
++      (typeof(_i)) (_i & _mask);                                      \
+ })
+ #endif /* _LINUX_NOSPEC_H */
index b9bdbd470f51e4e5c7ed5bba03027047ba98f650..19e1d0096eae7daad6825e79d3f514a8b0efae38 100644 (file)
@@ -4,3 +4,8 @@ tpm_i2c_nuvoton-fix-potential-buffer-overruns-caused-by-bit-glitches-on-the-bus.
 alsa-usb-audio-add-a-quirck-for-b-w-px-headphones.patch
 alsa-hda-add-a-power_save-blacklist.patch
 cpufreq-s3c24xx-fix-broken-s3c_cpufreq_init.patch
+media-m88ds3103-don-t-call-a-non-initalized-function.patch
+nospec-allow-index-argument-to-have-const-qualified-type.patch
+arm-mvebu-fix-broken-pl310_errata_753970-selects.patch
+kvm-x86-fix-smram-accessing-even-if-vm-is-shutdown.patch
+kvm-mmu-fix-overlap-between-public-and-private-memslots.patch