--- /dev/null
+From fd6b6d9b82f97a851fb0078201ddc38fe9728cda Mon Sep 17 00:00:00 2001
+From: Sean Christopherson <sean.j.christopherson@intel.com>
+Date: Mon, 1 Oct 2018 14:25:34 -0700
+Subject: KVM: VMX: check for existence of secondary exec controls before accessing
+
+From: Sean Christopherson <sean.j.christopherson@intel.com>
+
+commit fd6b6d9b82f97a851fb0078201ddc38fe9728cda upstream.
+
+Return early from vmx_set_virtual_apic_mode() if the processor doesn't
+support VIRTUALIZE_APIC_ACCESSES or VIRTUALIZE_X2APIC_MODE, both of
+which reside in SECONDARY_VM_EXEC_CONTROL. This eliminates warnings
+due to VMWRITEs to SECONDARY_VM_EXEC_CONTROL (VMCS field 401e) failing
+on processors without secondary exec controls.
+
+Remove the similar check for TPR shadowing as it is incorporated in the
+flexpriority_enabled check and the APIC-related code in
+vmx_update_msr_bitmap() is further gated by VIRTUALIZE_X2APIC_MODE.
+
+Reported-by: Gerhard Wiesinger <redhat@wiesinger.com>
+Fixes: 8d860bbeedef ("kvm: vmx: Basic APIC virtualization controls have three settings")
+Cc: Jim Mattson <jmattson@google.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Cc: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kvm/vmx.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -9280,15 +9280,16 @@ static void vmx_set_virtual_apic_mode(st
+ if (!lapic_in_kernel(vcpu))
+ return;
+
++ if (!flexpriority_enabled &&
++ !cpu_has_vmx_virtualize_x2apic_mode())
++ return;
++
+ /* Postpone execution until vmcs01 is the current VMCS. */
+ if (is_guest_mode(vcpu)) {
+ to_vmx(vcpu)->nested.change_vmcs01_virtual_apic_mode = true;
+ return;
+ }
+
+- if (!cpu_need_tpr_shadow(vcpu))
+- return;
+-
+ sec_exec_control = vmcs_read32(SECONDARY_VM_EXEC_CONTROL);
+ sec_exec_control &= ~(SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES |
+ SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE);
--- /dev/null
+From 6ade20327dbb808882888ed8ccded71e93067cf9 Mon Sep 17 00:00:00 2001
+From: Liviu Dudau <liviu@dudau.co.uk>
+Date: Tue, 5 Mar 2019 15:42:54 -0800
+Subject: mm/vmalloc.c: don't dereference possible NULL pointer in __vunmap()
+
+From: Liviu Dudau <liviu@dudau.co.uk>
+
+commit 6ade20327dbb808882888ed8ccded71e93067cf9 upstream.
+
+find_vmap_area() can return a NULL pointer and we're going to
+dereference it without checking it first. Use the existing
+find_vm_area() function which does exactly what we want and checks for
+the NULL pointer.
+
+Link: http://lkml.kernel.org/r/20181228171009.22269-1-liviu@dudau.co.uk
+Fixes: f3c01d2f3ade ("mm: vmalloc: avoid racy handling of debugobjects in vunmap")
+Signed-off-by: Liviu Dudau <liviu@dudau.co.uk>
+Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: Chintan Pandya <cpandya@codeaurora.org>
+Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/vmalloc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/vmalloc.c
++++ b/mm/vmalloc.c
+@@ -1524,7 +1524,7 @@ static void __vunmap(const void *addr, i
+ addr))
+ return;
+
+- area = find_vmap_area((unsigned long)addr)->vm;
++ area = find_vm_area(addr);
+ if (unlikely(!area)) {
+ WARN(1, KERN_ERR "Trying to vfree() nonexistent vm area (%p)\n",
+ addr);
--- /dev/null
+From ea401685a20b5d631957f024bda86e1f6118eb20 Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Fri, 5 Apr 2019 14:59:16 +0100
+Subject: net: hns: fix unsigned comparison to less than zero
+
+From: Colin Ian King <colin.king@canonical.com>
+
+commit ea401685a20b5d631957f024bda86e1f6118eb20 upstream.
+
+Currently mskid is unsigned and hence comparisons with negative
+error return values are always false. Fix this by making mskid an
+int.
+
+Fixes: f058e46855dc ("net: hns: fix ICMP6 neighbor solicitation messages discard problem")
+Addresses-Coverity: ("Operands don't affect result")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Reviewed-by: Mukesh Ojha <mojha@codeaurora.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Cc: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
+@@ -2770,7 +2770,7 @@ static void set_promisc_tcam_enable(stru
+ struct hns_mac_cb *mac_cb;
+ u8 addr[ETH_ALEN] = {0};
+ u8 port_num;
+- u16 mskid;
++ int mskid;
+
+ /* promisc use vague table match with vlanid = 0 & macaddr = 0 */
+ hns_dsaf_set_mac_key(dsaf_dev, &mac_key, 0x00, port, addr);
--- /dev/null
+From 4d96e13ee9cd1f7f801e8c7f4b12f09d1da4a5d8 Mon Sep 17 00:00:00 2001
+From: Salil Mehta <salil.mehta@huawei.com>
+Date: Mon, 18 Feb 2019 17:40:32 +0000
+Subject: net: hns: Fixes the missing put_device in positive leg for roce reset
+
+From: Salil Mehta <salil.mehta@huawei.com>
+
+commit 4d96e13ee9cd1f7f801e8c7f4b12f09d1da4a5d8 upstream.
+
+This patch fixes the missing device reference release-after-use in
+the positive leg of the roce reset API of the HNS DSAF.
+
+Fixes: c969c6e7ab8c ("net: hns: Fix object reference leaks in hns_dsaf_roce_reset()")
+Reported-by: John Garry <john.garry@huawei.com>
+Signed-off-by: Salil Mehta <salil.mehta@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
+@@ -3142,6 +3142,9 @@ int hns_dsaf_roce_reset(struct fwnode_ha
+ dsaf_set_bit(credit, DSAF_SBM_ROCEE_CFG_CRD_EN_B, 1);
+ dsaf_write_dev(dsaf_dev, DSAF_SBM_ROCEE_CFG_REG_REG, credit);
+ }
++
++ put_device(&pdev->dev);
++
+ return 0;
+ }
+ EXPORT_SYMBOL(hns_dsaf_roce_reset);
--- /dev/null
+From 37a675e768d7606fe8a53e0c459c9b53e121ac20 Mon Sep 17 00:00:00 2001
+From: David Howells <dhowells@redhat.com>
+Date: Thu, 27 Sep 2018 15:13:09 +0100
+Subject: rxrpc: Fix transport sockopts to get IPv4 errors on an IPv6 socket
+
+From: David Howells <dhowells@redhat.com>
+
+commit 37a675e768d7606fe8a53e0c459c9b53e121ac20 upstream.
+
+It seems that enabling IPV6_RECVERR on an IPv6 socket doesn't also turn on
+IP_RECVERR, so neither local errors nor ICMP-transported remote errors from
+IPv4 peer addresses are returned to the AF_RXRPC protocol.
+
+Make the sockopt setting code in rxrpc_open_socket() fall through from the
+AF_INET6 case to the AF_INET case to turn on all the AF_INET options too in
+the AF_INET6 case.
+
+Fixes: f2aeed3a591f ("rxrpc: Fix error reception on AF_INET6 sockets")
+Signed-off-by: David Howells <dhowells@redhat.com>
+Cc: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/rxrpc/local_object.c | 23 +++++++++++++----------
+ 1 file changed, 13 insertions(+), 10 deletions(-)
+
+--- a/net/rxrpc/local_object.c
++++ b/net/rxrpc/local_object.c
+@@ -134,10 +134,10 @@ static int rxrpc_open_socket(struct rxrp
+ }
+
+ switch (local->srx.transport.family) {
+- case AF_INET:
+- /* we want to receive ICMP errors */
++ case AF_INET6:
++ /* we want to receive ICMPv6 errors */
+ opt = 1;
+- ret = kernel_setsockopt(local->socket, SOL_IP, IP_RECVERR,
++ ret = kernel_setsockopt(local->socket, SOL_IPV6, IPV6_RECVERR,
+ (char *) &opt, sizeof(opt));
+ if (ret < 0) {
+ _debug("setsockopt failed");
+@@ -145,19 +145,22 @@ static int rxrpc_open_socket(struct rxrp
+ }
+
+ /* we want to set the don't fragment bit */
+- opt = IP_PMTUDISC_DO;
+- ret = kernel_setsockopt(local->socket, SOL_IP, IP_MTU_DISCOVER,
++ opt = IPV6_PMTUDISC_DO;
++ ret = kernel_setsockopt(local->socket, SOL_IPV6, IPV6_MTU_DISCOVER,
+ (char *) &opt, sizeof(opt));
+ if (ret < 0) {
+ _debug("setsockopt failed");
+ goto error;
+ }
+- break;
+
+- case AF_INET6:
++ /* Fall through and set IPv4 options too otherwise we don't get
++ * errors from IPv4 packets sent through the IPv6 socket.
++ */
++
++ case AF_INET:
+ /* we want to receive ICMP errors */
+ opt = 1;
+- ret = kernel_setsockopt(local->socket, SOL_IPV6, IPV6_RECVERR,
++ ret = kernel_setsockopt(local->socket, SOL_IP, IP_RECVERR,
+ (char *) &opt, sizeof(opt));
+ if (ret < 0) {
+ _debug("setsockopt failed");
+@@ -165,8 +168,8 @@ static int rxrpc_open_socket(struct rxrp
+ }
+
+ /* we want to set the don't fragment bit */
+- opt = IPV6_PMTUDISC_DO;
+- ret = kernel_setsockopt(local->socket, SOL_IPV6, IPV6_MTU_DISCOVER,
++ opt = IP_PMTUDISC_DO;
++ ret = kernel_setsockopt(local->socket, SOL_IP, IP_MTU_DISCOVER,
+ (char *) &opt, sizeof(opt));
+ if (ret < 0) {
+ _debug("setsockopt failed");
--- /dev/null
+From e00164a0f000de893944981f41a568c981aca658 Mon Sep 17 00:00:00 2001
+From: Guoqing Jiang <gqjiang@suse.com>
+Date: Tue, 9 Apr 2019 16:16:38 +0800
+Subject: sc16is7xx: move label 'err_spi' to correct section
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Guoqing Jiang <gqjiang@suse.com>
+
+commit e00164a0f000de893944981f41a568c981aca658 upstream.
+
+err_spi is used when SERIAL_SC16IS7XX_SPI is enabled, so make
+the label only available under SERIAL_SC16IS7XX_SPI option.
+Otherwise, the below warning appears.
+
+drivers/tty/serial/sc16is7xx.c:1523:1: warning: label ‘err_spi’ defined but not used [-Wunused-label]
+ err_spi:
+ ^~~~~~~
+
+Signed-off-by: Guoqing Jiang <gqjiang@suse.com>
+Fixes: ac0cdb3d9901 ("sc16is7xx: missing unregister/delete driver on error in sc16is7xx_init()")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Cc: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/sc16is7xx.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/tty/serial/sc16is7xx.c
++++ b/drivers/tty/serial/sc16is7xx.c
+@@ -1524,10 +1524,12 @@ static int __init sc16is7xx_init(void)
+ #endif
+ return ret;
+
++#ifdef CONFIG_SERIAL_SC16IS7XX_SPI
+ err_spi:
+ #ifdef CONFIG_SERIAL_SC16IS7XX_I2C
+ i2c_del_driver(&sc16is7xx_i2c_uart_driver);
+ #endif
++#endif
+ err_i2c:
+ uart_unregister_driver(&sc16is7xx_uart);
+ return ret;
bonding-fix-reference-count-leak-in-bond_sysfs_slave_add.patch
revert-input-i8042-add-thinkpad-s230u-to-i8042-nomux-list.patch
netfilter-nf_conntrack_pptp-fix-compilation-warning-with-w-1-build.patch
+mm-vmalloc.c-don-t-dereference-possible-null-pointer-in-__vunmap.patch
+sc16is7xx-move-label-err_spi-to-correct-section.patch
+rxrpc-fix-transport-sockopts-to-get-ipv4-errors-on-an-ipv6-socket.patch
+kvm-vmx-check-for-existence-of-secondary-exec-controls-before-accessing.patch
+net-hns-fix-unsigned-comparison-to-less-than-zero.patch
+net-hns-fixes-the-missing-put_device-in-positive-leg-for-roce-reset.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
