From: Greg Kroah-Hartman Date: Mon, 1 Jun 2020 17:01:32 +0000 (+0200) Subject: 4.14-stable patches X-Git-Tag: v4.4.226~14 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=59c61a85f6a667679c2ca7500c40dd268de47d18;p=thirdparty%2Fkernel%2Fstable-queue.git 4.14-stable patches added patches: kvm-vmx-check-for-existence-of-secondary-exec-controls-before-accessing.patch mm-vmalloc.c-don-t-dereference-possible-null-pointer-in-__vunmap.patch net-hns-fix-unsigned-comparison-to-less-than-zero.patch net-hns-fixes-the-missing-put_device-in-positive-leg-for-roce-reset.patch rxrpc-fix-transport-sockopts-to-get-ipv4-errors-on-an-ipv6-socket.patch sc16is7xx-move-label-err_spi-to-correct-section.patch --- diff --git a/queue-4.14/kvm-vmx-check-for-existence-of-secondary-exec-controls-before-accessing.patch b/queue-4.14/kvm-vmx-check-for-existence-of-secondary-exec-controls-before-accessing.patch new file mode 100644 index 00000000000..56788794bbb --- /dev/null +++ b/queue-4.14/kvm-vmx-check-for-existence-of-secondary-exec-controls-before-accessing.patch @@ -0,0 +1,54 @@ +From fd6b6d9b82f97a851fb0078201ddc38fe9728cda Mon Sep 17 00:00:00 2001 +From: Sean Christopherson +Date: Mon, 1 Oct 2018 14:25:34 -0700 +Subject: KVM: VMX: check for existence of secondary exec controls before accessing + +From: Sean Christopherson + +commit fd6b6d9b82f97a851fb0078201ddc38fe9728cda upstream. + +Return early from vmx_set_virtual_apic_mode() if the processor doesn't +support VIRTUALIZE_APIC_ACCESSES or VIRTUALIZE_X2APIC_MODE, both of +which reside in SECONDARY_VM_EXEC_CONTROL. This eliminates warnings +due to VMWRITEs to SECONDARY_VM_EXEC_CONTROL (VMCS field 401e) failing +on processors without secondary exec controls. + +Remove the similar check for TPR shadowing as it is incorporated in the +flexpriority_enabled check and the APIC-related code in +vmx_update_msr_bitmap() is further gated by VIRTUALIZE_X2APIC_MODE. + +Reported-by: Gerhard Wiesinger +Fixes: 8d860bbeedef ("kvm: vmx: Basic APIC virtualization controls have three settings") +Cc: Jim Mattson +Cc: stable@vger.kernel.org +Signed-off-by: Sean Christopherson +Signed-off-by: Paolo Bonzini +Cc: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kvm/vmx.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -9280,15 +9280,16 @@ static void vmx_set_virtual_apic_mode(st + if (!lapic_in_kernel(vcpu)) + return; + ++ if (!flexpriority_enabled && ++ !cpu_has_vmx_virtualize_x2apic_mode()) ++ return; ++ + /* Postpone execution until vmcs01 is the current VMCS. */ + if (is_guest_mode(vcpu)) { + to_vmx(vcpu)->nested.change_vmcs01_virtual_apic_mode = true; + return; + } + +- if (!cpu_need_tpr_shadow(vcpu)) +- return; +- + sec_exec_control = vmcs_read32(SECONDARY_VM_EXEC_CONTROL); + sec_exec_control &= ~(SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES | + SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE); diff --git a/queue-4.14/mm-vmalloc.c-don-t-dereference-possible-null-pointer-in-__vunmap.patch b/queue-4.14/mm-vmalloc.c-don-t-dereference-possible-null-pointer-in-__vunmap.patch new file mode 100644 index 00000000000..8cfd7b5280f --- /dev/null +++ b/queue-4.14/mm-vmalloc.c-don-t-dereference-possible-null-pointer-in-__vunmap.patch @@ -0,0 +1,40 @@ +From 6ade20327dbb808882888ed8ccded71e93067cf9 Mon Sep 17 00:00:00 2001 +From: Liviu Dudau +Date: Tue, 5 Mar 2019 15:42:54 -0800 +Subject: mm/vmalloc.c: don't dereference possible NULL pointer in __vunmap() + +From: Liviu Dudau + +commit 6ade20327dbb808882888ed8ccded71e93067cf9 upstream. + +find_vmap_area() can return a NULL pointer and we're going to +dereference it without checking it first. Use the existing +find_vm_area() function which does exactly what we want and checks for +the NULL pointer. + +Link: http://lkml.kernel.org/r/20181228171009.22269-1-liviu@dudau.co.uk +Fixes: f3c01d2f3ade ("mm: vmalloc: avoid racy handling of debugobjects in vunmap") +Signed-off-by: Liviu Dudau +Reviewed-by: Andrew Morton +Cc: Chintan Pandya +Cc: Andrey Ryabinin +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Cc: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + mm/vmalloc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/mm/vmalloc.c ++++ b/mm/vmalloc.c +@@ -1524,7 +1524,7 @@ static void __vunmap(const void *addr, i + addr)) + return; + +- area = find_vmap_area((unsigned long)addr)->vm; ++ area = find_vm_area(addr); + if (unlikely(!area)) { + WARN(1, KERN_ERR "Trying to vfree() nonexistent vm area (%p)\n", + addr); diff --git a/queue-4.14/net-hns-fix-unsigned-comparison-to-less-than-zero.patch b/queue-4.14/net-hns-fix-unsigned-comparison-to-less-than-zero.patch new file mode 100644 index 00000000000..aea5d264723 --- /dev/null +++ b/queue-4.14/net-hns-fix-unsigned-comparison-to-less-than-zero.patch @@ -0,0 +1,36 @@ +From ea401685a20b5d631957f024bda86e1f6118eb20 Mon Sep 17 00:00:00 2001 +From: Colin Ian King +Date: Fri, 5 Apr 2019 14:59:16 +0100 +Subject: net: hns: fix unsigned comparison to less than zero + +From: Colin Ian King + +commit ea401685a20b5d631957f024bda86e1f6118eb20 upstream. + +Currently mskid is unsigned and hence comparisons with negative +error return values are always false. Fix this by making mskid an +int. + +Fixes: f058e46855dc ("net: hns: fix ICMP6 neighbor solicitation messages discard problem") +Addresses-Coverity: ("Operands don't affect result") +Signed-off-by: Colin Ian King +Reviewed-by: Mukesh Ojha +Signed-off-by: David S. Miller +Cc: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c ++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c +@@ -2770,7 +2770,7 @@ static void set_promisc_tcam_enable(stru + struct hns_mac_cb *mac_cb; + u8 addr[ETH_ALEN] = {0}; + u8 port_num; +- u16 mskid; ++ int mskid; + + /* promisc use vague table match with vlanid = 0 & macaddr = 0 */ + hns_dsaf_set_mac_key(dsaf_dev, &mac_key, 0x00, port, addr); diff --git a/queue-4.14/net-hns-fixes-the-missing-put_device-in-positive-leg-for-roce-reset.patch b/queue-4.14/net-hns-fixes-the-missing-put_device-in-positive-leg-for-roce-reset.patch new file mode 100644 index 00000000000..d59e5c3b1ab --- /dev/null +++ b/queue-4.14/net-hns-fixes-the-missing-put_device-in-positive-leg-for-roce-reset.patch @@ -0,0 +1,34 @@ +From 4d96e13ee9cd1f7f801e8c7f4b12f09d1da4a5d8 Mon Sep 17 00:00:00 2001 +From: Salil Mehta +Date: Mon, 18 Feb 2019 17:40:32 +0000 +Subject: net: hns: Fixes the missing put_device in positive leg for roce reset + +From: Salil Mehta + +commit 4d96e13ee9cd1f7f801e8c7f4b12f09d1da4a5d8 upstream. + +This patch fixes the missing device reference release-after-use in +the positive leg of the roce reset API of the HNS DSAF. + +Fixes: c969c6e7ab8c ("net: hns: Fix object reference leaks in hns_dsaf_roce_reset()") +Reported-by: John Garry +Signed-off-by: Salil Mehta +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c ++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c +@@ -3142,6 +3142,9 @@ int hns_dsaf_roce_reset(struct fwnode_ha + dsaf_set_bit(credit, DSAF_SBM_ROCEE_CFG_CRD_EN_B, 1); + dsaf_write_dev(dsaf_dev, DSAF_SBM_ROCEE_CFG_REG_REG, credit); + } ++ ++ put_device(&pdev->dev); ++ + return 0; + } + EXPORT_SYMBOL(hns_dsaf_roce_reset); diff --git a/queue-4.14/rxrpc-fix-transport-sockopts-to-get-ipv4-errors-on-an-ipv6-socket.patch b/queue-4.14/rxrpc-fix-transport-sockopts-to-get-ipv4-errors-on-an-ipv6-socket.patch new file mode 100644 index 00000000000..4f9e37a9711 --- /dev/null +++ b/queue-4.14/rxrpc-fix-transport-sockopts-to-get-ipv4-errors-on-an-ipv6-socket.patch @@ -0,0 +1,81 @@ +From 37a675e768d7606fe8a53e0c459c9b53e121ac20 Mon Sep 17 00:00:00 2001 +From: David Howells +Date: Thu, 27 Sep 2018 15:13:09 +0100 +Subject: rxrpc: Fix transport sockopts to get IPv4 errors on an IPv6 socket + +From: David Howells + +commit 37a675e768d7606fe8a53e0c459c9b53e121ac20 upstream. + +It seems that enabling IPV6_RECVERR on an IPv6 socket doesn't also turn on +IP_RECVERR, so neither local errors nor ICMP-transported remote errors from +IPv4 peer addresses are returned to the AF_RXRPC protocol. + +Make the sockopt setting code in rxrpc_open_socket() fall through from the +AF_INET6 case to the AF_INET case to turn on all the AF_INET options too in +the AF_INET6 case. + +Fixes: f2aeed3a591f ("rxrpc: Fix error reception on AF_INET6 sockets") +Signed-off-by: David Howells +Cc: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + net/rxrpc/local_object.c | 23 +++++++++++++---------- + 1 file changed, 13 insertions(+), 10 deletions(-) + +--- a/net/rxrpc/local_object.c ++++ b/net/rxrpc/local_object.c +@@ -134,10 +134,10 @@ static int rxrpc_open_socket(struct rxrp + } + + switch (local->srx.transport.family) { +- case AF_INET: +- /* we want to receive ICMP errors */ ++ case AF_INET6: ++ /* we want to receive ICMPv6 errors */ + opt = 1; +- ret = kernel_setsockopt(local->socket, SOL_IP, IP_RECVERR, ++ ret = kernel_setsockopt(local->socket, SOL_IPV6, IPV6_RECVERR, + (char *) &opt, sizeof(opt)); + if (ret < 0) { + _debug("setsockopt failed"); +@@ -145,19 +145,22 @@ static int rxrpc_open_socket(struct rxrp + } + + /* we want to set the don't fragment bit */ +- opt = IP_PMTUDISC_DO; +- ret = kernel_setsockopt(local->socket, SOL_IP, IP_MTU_DISCOVER, ++ opt = IPV6_PMTUDISC_DO; ++ ret = kernel_setsockopt(local->socket, SOL_IPV6, IPV6_MTU_DISCOVER, + (char *) &opt, sizeof(opt)); + if (ret < 0) { + _debug("setsockopt failed"); + goto error; + } +- break; + +- case AF_INET6: ++ /* Fall through and set IPv4 options too otherwise we don't get ++ * errors from IPv4 packets sent through the IPv6 socket. ++ */ ++ ++ case AF_INET: + /* we want to receive ICMP errors */ + opt = 1; +- ret = kernel_setsockopt(local->socket, SOL_IPV6, IPV6_RECVERR, ++ ret = kernel_setsockopt(local->socket, SOL_IP, IP_RECVERR, + (char *) &opt, sizeof(opt)); + if (ret < 0) { + _debug("setsockopt failed"); +@@ -165,8 +168,8 @@ static int rxrpc_open_socket(struct rxrp + } + + /* we want to set the don't fragment bit */ +- opt = IPV6_PMTUDISC_DO; +- ret = kernel_setsockopt(local->socket, SOL_IPV6, IPV6_MTU_DISCOVER, ++ opt = IP_PMTUDISC_DO; ++ ret = kernel_setsockopt(local->socket, SOL_IP, IP_MTU_DISCOVER, + (char *) &opt, sizeof(opt)); + if (ret < 0) { + _debug("setsockopt failed"); diff --git a/queue-4.14/sc16is7xx-move-label-err_spi-to-correct-section.patch b/queue-4.14/sc16is7xx-move-label-err_spi-to-correct-section.patch new file mode 100644 index 00000000000..d3b46bbde19 --- /dev/null +++ b/queue-4.14/sc16is7xx-move-label-err_spi-to-correct-section.patch @@ -0,0 +1,45 @@ +From e00164a0f000de893944981f41a568c981aca658 Mon Sep 17 00:00:00 2001 +From: Guoqing Jiang +Date: Tue, 9 Apr 2019 16:16:38 +0800 +Subject: sc16is7xx: move label 'err_spi' to correct section +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Guoqing Jiang + +commit e00164a0f000de893944981f41a568c981aca658 upstream. + +err_spi is used when SERIAL_SC16IS7XX_SPI is enabled, so make +the label only available under SERIAL_SC16IS7XX_SPI option. +Otherwise, the below warning appears. + +drivers/tty/serial/sc16is7xx.c:1523:1: warning: label ‘err_spi’ defined but not used [-Wunused-label] + err_spi: + ^~~~~~~ + +Signed-off-by: Guoqing Jiang +Fixes: ac0cdb3d9901 ("sc16is7xx: missing unregister/delete driver on error in sc16is7xx_init()") +Signed-off-by: Arnd Bergmann +Cc: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/sc16is7xx.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/tty/serial/sc16is7xx.c ++++ b/drivers/tty/serial/sc16is7xx.c +@@ -1524,10 +1524,12 @@ static int __init sc16is7xx_init(void) + #endif + return ret; + ++#ifdef CONFIG_SERIAL_SC16IS7XX_SPI + err_spi: + #ifdef CONFIG_SERIAL_SC16IS7XX_I2C + i2c_del_driver(&sc16is7xx_i2c_uart_driver); + #endif ++#endif + err_i2c: + uart_unregister_driver(&sc16is7xx_uart); + return ret; diff --git a/queue-4.14/series b/queue-4.14/series index b881bc881d7..9c2c8abc4ff 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -69,3 +69,9 @@ qlcnic-fix-missing-release-in-qlcnic_83xx_interrupt_test.patch bonding-fix-reference-count-leak-in-bond_sysfs_slave_add.patch revert-input-i8042-add-thinkpad-s230u-to-i8042-nomux-list.patch netfilter-nf_conntrack_pptp-fix-compilation-warning-with-w-1-build.patch +mm-vmalloc.c-don-t-dereference-possible-null-pointer-in-__vunmap.patch +sc16is7xx-move-label-err_spi-to-correct-section.patch +rxrpc-fix-transport-sockopts-to-get-ipv4-errors-on-an-ipv6-socket.patch +kvm-vmx-check-for-existence-of-secondary-exec-controls-before-accessing.patch +net-hns-fix-unsigned-comparison-to-less-than-zero.patch +net-hns-fixes-the-missing-put_device-in-positive-leg-for-roce-reset.patch