From: Greg Kroah-Hartman Date: Wed, 7 Mar 2018 03:54:55 +0000 (-0800) Subject: 4.4-stable patches X-Git-Tag: v4.14.25~31 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=43c4cf5ab3614263ff141a81279f307d65341c43;p=thirdparty%2Fkernel%2Fstable-queue.git 4.4-stable patches added patches: arm-mvebu-fix-broken-pl310_errata_753970-selects.patch kvm-mmu-fix-overlap-between-public-and-private-memslots.patch kvm-x86-fix-smram-accessing-even-if-vm-is-shutdown.patch media-m88ds3103-don-t-call-a-non-initalized-function.patch nospec-allow-index-argument-to-have-const-qualified-type.patch --- diff --git a/queue-4.4/arm-mvebu-fix-broken-pl310_errata_753970-selects.patch b/queue-4.4/arm-mvebu-fix-broken-pl310_errata_753970-selects.patch new file mode 100644 index 00000000000..3021724bbcc --- /dev/null +++ b/queue-4.4/arm-mvebu-fix-broken-pl310_errata_753970-selects.patch @@ -0,0 +1,49 @@ +From 8aa36a8dcde3183d84db7b0d622ffddcebb61077 Mon Sep 17 00:00:00 2001 +From: Ulf Magnusson +Date: Mon, 5 Feb 2018 02:21:13 +0100 +Subject: ARM: mvebu: Fix broken PL310_ERRATA_753970 selects + +From: Ulf Magnusson + +commit 8aa36a8dcde3183d84db7b0d622ffddcebb61077 upstream. + +The MACH_ARMADA_375 and MACH_ARMADA_38X boards select ARM_ERRATA_753970, +but it was renamed to PL310_ERRATA_753970 by commit fa0ce4035d48 ("ARM: +7162/1: errata: tidy up Kconfig options for PL310 errata workarounds"). + +Fix the selects to use the new name. + +Discovered with the +https://github.com/ulfalizer/Kconfiglib/blob/master/examples/list_undefined.py +script. +Fixes: fa0ce4035d48 ("ARM: 7162/1: errata: tidy up Kconfig options for +PL310 errata workarounds" +cc: stable@vger.kernel.org +Signed-off-by: Ulf Magnusson +Signed-off-by: Gregory CLEMENT +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-mvebu/Kconfig | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/arm/mach-mvebu/Kconfig ++++ b/arch/arm/mach-mvebu/Kconfig +@@ -37,7 +37,7 @@ config MACH_ARMADA_370 + config MACH_ARMADA_375 + bool "Marvell Armada 375 boards" if ARCH_MULTI_V7 + select ARM_ERRATA_720789 +- select ARM_ERRATA_753970 ++ select PL310_ERRATA_753970 + select ARM_GIC + select ARMADA_375_CLK + select HAVE_ARM_SCU +@@ -52,7 +52,7 @@ config MACH_ARMADA_375 + config MACH_ARMADA_38X + bool "Marvell Armada 380/385 boards" if ARCH_MULTI_V7 + select ARM_ERRATA_720789 +- select ARM_ERRATA_753970 ++ select PL310_ERRATA_753970 + select ARM_GIC + select ARMADA_38X_CLK + select HAVE_ARM_SCU diff --git a/queue-4.4/kvm-mmu-fix-overlap-between-public-and-private-memslots.patch b/queue-4.4/kvm-mmu-fix-overlap-between-public-and-private-memslots.patch new file mode 100644 index 00000000000..d0bb7498b8f --- /dev/null +++ b/queue-4.4/kvm-mmu-fix-overlap-between-public-and-private-memslots.patch @@ -0,0 +1,113 @@ +From b28676bb8ae4569cced423dc2a88f7cb319d5379 Mon Sep 17 00:00:00 2001 +From: Wanpeng Li +Date: Tue, 13 Feb 2018 15:36:00 +0100 +Subject: KVM: mmu: Fix overlap between public and private memslots +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Wanpeng Li + +commit b28676bb8ae4569cced423dc2a88f7cb319d5379 upstream. + +Reported by syzkaller: + + pte_list_remove: ffff9714eb1f8078 0->BUG + ------------[ cut here ]------------ + kernel BUG at arch/x86/kvm/mmu.c:1157! + invalid opcode: 0000 [#1] SMP + RIP: 0010:pte_list_remove+0x11b/0x120 [kvm] + Call Trace: + drop_spte+0x83/0xb0 [kvm] + mmu_page_zap_pte+0xcc/0xe0 [kvm] + kvm_mmu_prepare_zap_page+0x81/0x4a0 [kvm] + kvm_mmu_invalidate_zap_all_pages+0x159/0x220 [kvm] + kvm_arch_flush_shadow_all+0xe/0x10 [kvm] + kvm_mmu_notifier_release+0x6c/0xa0 [kvm] + ? kvm_mmu_notifier_release+0x5/0xa0 [kvm] + __mmu_notifier_release+0x79/0x110 + ? __mmu_notifier_release+0x5/0x110 + exit_mmap+0x15a/0x170 + ? do_exit+0x281/0xcb0 + mmput+0x66/0x160 + do_exit+0x2c9/0xcb0 + ? __context_tracking_exit.part.5+0x4a/0x150 + do_group_exit+0x50/0xd0 + SyS_exit_group+0x14/0x20 + do_syscall_64+0x73/0x1f0 + entry_SYSCALL64_slow_path+0x25/0x25 + +The reason is that when creates new memslot, there is no guarantee for new +memslot not overlap with private memslots. This can be triggered by the +following program: + + #include + #include + #include + #include + #include + #include + #include + #include + #include + #include + #include + #include + #include + #include + #include + + long r[16]; + + int main() + { + void *p = valloc(0x4000); + + r[2] = open("/dev/kvm", 0); + r[3] = ioctl(r[2], KVM_CREATE_VM, 0x0ul); + + uint64_t addr = 0xf000; + ioctl(r[3], KVM_SET_IDENTITY_MAP_ADDR, &addr); + r[6] = ioctl(r[3], KVM_CREATE_VCPU, 0x0ul); + ioctl(r[3], KVM_SET_TSS_ADDR, 0x0ul); + ioctl(r[6], KVM_RUN, 0); + ioctl(r[6], KVM_RUN, 0); + + struct kvm_userspace_memory_region mr = { + .slot = 0, + .flags = KVM_MEM_LOG_DIRTY_PAGES, + .guest_phys_addr = 0xf000, + .memory_size = 0x4000, + .userspace_addr = (uintptr_t) p + }; + ioctl(r[3], KVM_SET_USER_MEMORY_REGION, &mr); + return 0; + } + +This patch fixes the bug by not adding a new memslot even if it +overlaps with private memslots. + +Reported-by: Dmitry Vyukov +Cc: Paolo Bonzini +Cc: Radim Krčmář +Cc: Dmitry Vyukov +Cc: Eric Biggers +Cc: stable@vger.kernel.org +Signed-off-by: Wanpeng Li +--- + virt/kvm/kvm_main.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) +Signed-off-by: Greg Kroah-Hartman + +--- a/virt/kvm/kvm_main.c ++++ b/virt/kvm/kvm_main.c +@@ -902,8 +902,7 @@ int __kvm_set_memory_region(struct kvm * + /* Check for overlaps */ + r = -EEXIST; + kvm_for_each_memslot(slot, __kvm_memslots(kvm, as_id)) { +- if ((slot->id >= KVM_USER_MEM_SLOTS) || +- (slot->id == id)) ++ if (slot->id == id) + continue; + if (!((base_gfn + npages <= slot->base_gfn) || + (base_gfn >= slot->base_gfn + slot->npages))) diff --git a/queue-4.4/kvm-x86-fix-smram-accessing-even-if-vm-is-shutdown.patch b/queue-4.4/kvm-x86-fix-smram-accessing-even-if-vm-is-shutdown.patch new file mode 100644 index 00000000000..10a94cb4f9c --- /dev/null +++ b/queue-4.4/kvm-x86-fix-smram-accessing-even-if-vm-is-shutdown.patch @@ -0,0 +1,57 @@ +From 95e057e25892eaa48cad1e2d637b80d0f1a4fac5 Mon Sep 17 00:00:00 2001 +From: Wanpeng Li +Date: Thu, 8 Feb 2018 15:32:45 +0800 +Subject: KVM: X86: Fix SMRAM accessing even if VM is shutdown +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Wanpeng Li + +commit 95e057e25892eaa48cad1e2d637b80d0f1a4fac5 upstream. + +Reported by syzkaller: + + WARNING: CPU: 6 PID: 2434 at arch/x86/kvm/vmx.c:6660 handle_ept_misconfig+0x54/0x1e0 [kvm_intel] + CPU: 6 PID: 2434 Comm: repro_test Not tainted 4.15.0+ #4 + RIP: 0010:handle_ept_misconfig+0x54/0x1e0 [kvm_intel] + Call Trace: + vmx_handle_exit+0xbd/0xe20 [kvm_intel] + kvm_arch_vcpu_ioctl_run+0xdaf/0x1d50 [kvm] + kvm_vcpu_ioctl+0x3e9/0x720 [kvm] + do_vfs_ioctl+0xa4/0x6a0 + SyS_ioctl+0x79/0x90 + entry_SYSCALL_64_fastpath+0x25/0x9c + +The testcase creates a first thread to issue KVM_SMI ioctl, and then creates +a second thread to mmap and operate on the same vCPU. This triggers a race +condition when running the testcase with multiple threads. Sometimes one thread +exits with a triple fault while another thread mmaps and operates on the same +vCPU. Because CS=0x3000/IP=0x8000 is not mapped, accessing the SMI handler +results in an EPT misconfig. This patch fixes it by returning RET_PF_EMULATE +in kvm_handle_bad_page(), which will go on to cause an emulation failure and an +exit with KVM_EXIT_INTERNAL_ERROR. + +Reported-by: syzbot+c1d9517cab094dae65e446c0c5b4de6c40f4dc58@syzkaller.appspotmail.com +Cc: Paolo Bonzini +Cc: Radim Krčmář +Cc: stable@vger.kernel.org +Signed-off-by: Wanpeng Li +Signed-off-by: Paolo Bonzini +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kvm/mmu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/kvm/mmu.c ++++ b/arch/x86/kvm/mmu.c +@@ -2775,7 +2775,7 @@ static int kvm_handle_bad_page(struct kv + return 0; + } + +- return -EFAULT; ++ return RET_PF_EMULATE; + } + + static void transparent_hugepage_adjust(struct kvm_vcpu *vcpu, diff --git a/queue-4.4/media-m88ds3103-don-t-call-a-non-initalized-function.patch b/queue-4.4/media-m88ds3103-don-t-call-a-non-initalized-function.patch new file mode 100644 index 00000000000..564c939a2e2 --- /dev/null +++ b/queue-4.4/media-m88ds3103-don-t-call-a-non-initalized-function.patch @@ -0,0 +1,123 @@ +From b9c97c67fd19262c002d94ced2bfb513083e161e Mon Sep 17 00:00:00 2001 +From: Mauro Carvalho Chehab +Date: Sat, 10 Feb 2018 06:14:10 -0500 +Subject: media: m88ds3103: don't call a non-initalized function + +From: Mauro Carvalho Chehab + +commit b9c97c67fd19262c002d94ced2bfb513083e161e upstream. + +If m88d3103 chip ID is not recognized, the device is not initialized. + +However, it returns from probe without any error, causing this OOPS: + +[ 7.689289] Unable to handle kernel NULL pointer dereference at virtual address 00000000 +[ 7.689297] pgd = 7b0bd7a7 +[ 7.689302] [00000000] *pgd=00000000 +[ 7.689318] Internal error: Oops: 80000005 [#1] SMP ARM +[ 7.689322] Modules linked in: dvb_usb_dvbsky(+) m88ds3103 dvb_usb_v2 dvb_core videobuf2_vmalloc videobuf2_memops videobuf2_core crc32_arm_ce videodev media +[ 7.689358] CPU: 3 PID: 197 Comm: systemd-udevd Not tainted 4.15.0-mcc+ #23 +[ 7.689361] Hardware name: BCM2835 +[ 7.689367] PC is at 0x0 +[ 7.689382] LR is at m88ds3103_attach+0x194/0x1d0 [m88ds3103] +[ 7.689386] pc : [<00000000>] lr : [] psr: 60000013 +[ 7.689391] sp : ed8e5c20 ip : ed8c1e00 fp : ed8945c0 +[ 7.689395] r10: ed894000 r9 : ed894378 r8 : eda736c0 +[ 7.689400] r7 : ed894070 r6 : ed8e5c44 r5 : bf0bb040 r4 : eda77600 +[ 7.689405] r3 : 00000000 r2 : 00000000 r1 : 00000000 r0 : eda77600 +[ 7.689412] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none +[ 7.689417] Control: 10c5383d Table: 2d8e806a DAC: 00000051 +[ 7.689423] Process systemd-udevd (pid: 197, stack limit = 0xe9dbfb63) +[ 7.689428] Stack: (0xed8e5c20 to 0xed8e6000) +[ 7.689439] 5c20: ed853a80 eda73640 ed894000 ed8942c0 ed853a80 bf0b9e98 ed894070 bf0b9f10 +[ 7.689449] 5c40: 00000000 00000000 bf08c17c c08dfc50 00000000 00000000 00000000 00000000 +[ 7.689459] 5c60: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 +[ 7.689468] 5c80: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 +[ 7.689479] 5ca0: 00000000 00000000 ed8945c0 ed8942c0 ed894000 ed894830 bf0b9e98 00000000 +[ 7.689490] 5cc0: ed894378 bf0a3cb4 bf0bc3b0 0000533b ed920540 00000000 00000034 bf0a6434 +[ 7.689500] 5ce0: ee952070 ed826600 bf0a7038 bf0a2dd8 00000001 bf0a6768 bf0a2f90 ed8943c0 +[ 7.689511] 5d00: 00000000 c08eca68 ed826620 ed826620 00000000 ee952070 bf0bc034 ee952000 +[ 7.689521] 5d20: ed826600 bf0bb080 ffffffed c0aa9e9c c0aa9dac ed826620 c16edf6c c168c2c8 +[ 7.689531] 5d40: c16edf70 00000000 bf0bc034 0000000d 00000000 c08e268c bf0bb080 ed826600 +[ 7.689541] 5d60: bf0bc034 ed826654 ed826620 bf0bc034 c164c8bc 00000000 00000001 00000000 +[ 7.689553] 5d80: 00000028 c08e2948 00000000 bf0bc034 c08e2848 c08e0778 ee9f0a58 ed88bab4 +[ 7.689563] 5da0: bf0bc034 ed90ba80 c168c1f0 c08e1934 bf0bb3bc c17045ac bf0bc034 c164c8bc +[ 7.689574] 5dc0: bf0bc034 bf0bb3bc ed91f564 c08e34ec bf0bc000 c164c8bc bf0bc034 c0aa8dc4 +[ 7.689584] 5de0: ffffe000 00000000 bf0bf000 ed91f600 ed91f564 c03021e4 00000001 00000000 +[ 7.689595] 5e00: c166e040 8040003f ed853a80 bf0bc448 00000000 c1678174 ed853a80 f0f22000 +[ 7.689605] 5e20: f0f21fff 8040003f 014000c0 ed91e700 ed91e700 c16d8e68 00000001 ed91e6c0 +[ 7.689615] 5e40: bf0bc400 00000001 bf0bc400 ed91f564 00000001 00000000 00000028 c03c9a24 +[ 7.689625] 5e60: 00000001 c03c8c94 ed8e5f50 ed8e5f50 00000001 bf0bc400 ed91f540 c03c8cb0 +[ 7.689637] 5e80: bf0bc40c 00007fff bf0bc400 c03c60b0 00000000 bf0bc448 00000028 c0e09684 +[ 7.689647] 5ea0: 00000002 bf0bc530 c1234bf8 bf0bc5dc bf0bc514 c10ebbe8 ffffe000 bf000000 +[ 7.689657] 5ec0: 00011538 00000000 ed8e5f48 00000000 00000000 00000000 00000000 00000000 +[ 7.689666] 5ee0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 +[ 7.689676] 5f00: 00000000 00000000 7fffffff 00000000 00000013 b6e55a18 0000017b c0309104 +[ 7.689686] 5f20: ed8e4000 00000000 00510af0 c03c9430 7fffffff 00000000 00000003 00000000 +[ 7.689697] 5f40: 00000000 f0f0f000 00011538 00000000 f0f107b0 f0f0f000 00011538 f0f1fdb8 +[ 7.689707] 5f60: f0f1fbe8 f0f1b974 00004000 000041e0 bf0bc3d0 00000001 00000000 000024c4 +[ 7.689717] 5f80: 0000002d 0000002e 00000019 00000000 00000010 00000000 16894000 00000000 +[ 7.689727] 5fa0: 00000000 c0308f20 16894000 00000000 00000013 b6e55a18 00000000 b6e5652c +[ 7.689737] 5fc0: 16894000 00000000 00000000 0000017b 00020000 00508110 00000000 00510af0 +[ 7.689748] 5fe0: bef68948 bef68938 b6e4d3d0 b6d32590 60000010 00000013 00000000 00000000 +[ 7.689790] [] (m88ds3103_attach [m88ds3103]) from [] (dvbsky_s960c_attach+0x78/0x280 [dvb_usb_dvbsky]) +[ 7.689821] [] (dvbsky_s960c_attach [dvb_usb_dvbsky]) from [] (dvb_usbv2_probe+0xa3c/0x1024 [dvb_usb_v2]) +[ 7.689849] [] (dvb_usbv2_probe [dvb_usb_v2]) from [] (usb_probe_interface+0xf0/0x2a8) +[ 7.689869] [] (usb_probe_interface) from [] (driver_probe_device+0x2f8/0x4b4) +[ 7.689881] [] (driver_probe_device) from [] (__driver_attach+0x100/0x11c) +[ 7.689895] [] (__driver_attach) from [] (bus_for_each_dev+0x4c/0x9c) +[ 7.689909] [] (bus_for_each_dev) from [] (bus_add_driver+0x1c0/0x264) +[ 7.689919] [] (bus_add_driver) from [] (driver_register+0x78/0xf4) +[ 7.689931] [] (driver_register) from [] (usb_register_driver+0x70/0x134) +[ 7.689946] [] (usb_register_driver) from [] (do_one_initcall+0x44/0x168) +[ 7.689963] [] (do_one_initcall) from [] (do_init_module+0x64/0x1f4) +[ 7.689979] [] (do_init_module) from [] (load_module+0x20a0/0x25c8) +[ 7.689993] [] (load_module) from [] (SyS_finit_module+0xb4/0xec) +[ 7.690007] [] (SyS_finit_module) from [] (ret_fast_syscall+0x0/0x54) +[ 7.690018] Code: bad PC value + +This may happen on normal circumstances, if, for some reason, the demod +hangs and start returning an invalid chip ID: + +[ 10.394395] m88ds3103 3-0068: Unknown device. Chip_id=00 + +So, change the logic to cause probe to fail with -ENODEV, preventing +the OOPS. + +Detected while testing DVB MMAP patches on Raspberry Pi 3 with +DVBSky S960CI. + +Cc: stable@vger.kernel.org +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/dvb-frontends/m88ds3103.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/media/dvb-frontends/m88ds3103.c ++++ b/drivers/media/dvb-frontends/m88ds3103.c +@@ -1281,11 +1281,12 @@ static int m88ds3103_select(struct i2c_a + * New users must use I2C client binding directly! + */ + struct dvb_frontend *m88ds3103_attach(const struct m88ds3103_config *cfg, +- struct i2c_adapter *i2c, struct i2c_adapter **tuner_i2c_adapter) ++ struct i2c_adapter *i2c, ++ struct i2c_adapter **tuner_i2c_adapter) + { + struct i2c_client *client; + struct i2c_board_info board_info; +- struct m88ds3103_platform_data pdata; ++ struct m88ds3103_platform_data pdata = {}; + + pdata.clk = cfg->clock; + pdata.i2c_wr_max = cfg->i2c_wr_max; +@@ -1428,6 +1429,8 @@ static int m88ds3103_probe(struct i2c_cl + case M88DS3103_CHIP_ID: + break; + default: ++ ret = -ENODEV; ++ dev_err(&client->dev, "Unknown device. Chip_id=%02x\n", dev->chip_id); + goto err_kfree; + } + diff --git a/queue-4.4/nospec-allow-index-argument-to-have-const-qualified-type.patch b/queue-4.4/nospec-allow-index-argument-to-have-const-qualified-type.patch new file mode 100644 index 00000000000..653e56f2780 --- /dev/null +++ b/queue-4.4/nospec-allow-index-argument-to-have-const-qualified-type.patch @@ -0,0 +1,65 @@ +From b98c6a160a057d5686a8c54c79cc6c8c94a7d0c8 Mon Sep 17 00:00:00 2001 +From: Rasmus Villemoes +Date: Fri, 16 Feb 2018 13:20:48 -0800 +Subject: nospec: Allow index argument to have const-qualified type + +From: Rasmus Villemoes + +commit b98c6a160a057d5686a8c54c79cc6c8c94a7d0c8 upstream. + +The last expression in a statement expression need not be a bare +variable, quoting gcc docs + + The last thing in the compound statement should be an expression + followed by a semicolon; the value of this subexpression serves as the + value of the entire construct. + +and we already use that in e.g. the min/max macros which end with a +ternary expression. + +This way, we can allow index to have const-qualified type, which will in +some cases avoid the need for introducing a local copy of index of +non-const qualified type. That, in turn, can prevent readers not +familiar with the internals of array_index_nospec from wondering about +the seemingly redundant extra variable, and I think that's worthwhile +considering how confusing the whole _nospec business is. + +The expression _i&_mask has type unsigned long (since that is the type +of _mask, and the BUILD_BUG_ONs guarantee that _i will get promoted to +that), so in order not to change the type of the whole expression, add +a cast back to typeof(_i). + +Signed-off-by: Rasmus Villemoes +Signed-off-by: Dan Williams +Acked-by: Linus Torvalds +Cc: Andy Lutomirski +Cc: Arjan van de Ven +Cc: Borislav Petkov +Cc: Dave Hansen +Cc: David Woodhouse +Cc: Greg Kroah-Hartman +Cc: Josh Poimboeuf +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: Will Deacon +Cc: linux-arch@vger.kernel.org +Cc: stable@vger.kernel.org +Link: http://lkml.kernel.org/r/151881604837.17395.10812767547837568328.stgit@dwillia2-desk3.amr.corp.intel.com +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/nospec.h | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/include/linux/nospec.h ++++ b/include/linux/nospec.h +@@ -66,7 +66,6 @@ static inline unsigned long array_index_ + BUILD_BUG_ON(sizeof(_i) > sizeof(long)); \ + BUILD_BUG_ON(sizeof(_s) > sizeof(long)); \ + \ +- _i &= _mask; \ +- _i; \ ++ (typeof(_i)) (_i & _mask); \ + }) + #endif /* _LINUX_NOSPEC_H */ diff --git a/queue-4.4/series b/queue-4.4/series index b9bdbd470f5..19e1d0096ea 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -4,3 +4,8 @@ tpm_i2c_nuvoton-fix-potential-buffer-overruns-caused-by-bit-glitches-on-the-bus. alsa-usb-audio-add-a-quirck-for-b-w-px-headphones.patch alsa-hda-add-a-power_save-blacklist.patch cpufreq-s3c24xx-fix-broken-s3c_cpufreq_init.patch +media-m88ds3103-don-t-call-a-non-initalized-function.patch +nospec-allow-index-argument-to-have-const-qualified-type.patch +arm-mvebu-fix-broken-pl310_errata_753970-selects.patch +kvm-x86-fix-smram-accessing-even-if-vm-is-shutdown.patch +kvm-mmu-fix-overlap-between-public-and-private-memslots.patch