From: Greg Kroah-Hartman Date: Wed, 7 Mar 2018 03:55:13 +0000 (-0800) Subject: 4.9-stable patches X-Git-Tag: v4.14.25~30 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=5ae27dc0dc958931dd69d65d7b3487a3d0752182;p=thirdparty%2Fkernel%2Fstable-queue.git 4.9-stable patches added patches: arm-kvm-fix-building-with-gcc-8.patch arm-mvebu-fix-broken-pl310_errata_753970-selects.patch kvm-mmu-fix-overlap-between-public-and-private-memslots.patch kvm-vmx-optimize-vmx_vcpu_run-and-svm_vcpu_run-by-marking-the-rdmsr-path-as-unlikely.patch kvm-x86-fix-smram-accessing-even-if-vm-is-shutdown.patch kvm-x86-remove-indirect-msr-op-calls-from-spec_ctrl.patch media-m88ds3103-don-t-call-a-non-initalized-function.patch nospec-allow-index-argument-to-have-const-qualified-type.patch --- diff --git a/queue-4.9/arm-kvm-fix-building-with-gcc-8.patch b/queue-4.9/arm-kvm-fix-building-with-gcc-8.patch new file mode 100644 index 00000000000..8913dd63dea --- /dev/null +++ b/queue-4.9/arm-kvm-fix-building-with-gcc-8.patch @@ -0,0 +1,79 @@ +From 67870eb1204223598ea6d8a4467b482e9f5875b5 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Fri, 2 Feb 2018 16:07:34 +0100 +Subject: ARM: kvm: fix building with gcc-8 + +From: Arnd Bergmann + +commit 67870eb1204223598ea6d8a4467b482e9f5875b5 upstream. + +In banked-sr.c, we use a top-level '__asm__(".arch_extension virt")' +statement to allow compilation of a multi-CPU kernel for ARMv6 +and older ARMv7-A that don't normally support access to the banked +registers. + +This is considered to be a programming error by the gcc developers +and will no longer work in gcc-8, where we now get a build error: + +/tmp/cc4Qy7GR.s:34: Error: Banked registers are not available with this architecture. -- `mrs r3,SP_usr' +/tmp/cc4Qy7GR.s:41: Error: Banked registers are not available with this architecture. -- `mrs r3,ELR_hyp' +/tmp/cc4Qy7GR.s:55: Error: Banked registers are not available with this architecture. -- `mrs r3,SP_svc' +/tmp/cc4Qy7GR.s:62: Error: Banked registers are not available with this architecture. -- `mrs r3,LR_svc' +/tmp/cc4Qy7GR.s:69: Error: Banked registers are not available with this architecture. -- `mrs r3,SPSR_svc' +/tmp/cc4Qy7GR.s:76: Error: Banked registers are not available with this architecture. -- `mrs r3,SP_abt' + +Passign the '-march-armv7ve' flag to gcc works, and is ok here, because +we know the functions won't ever be called on pre-ARMv7VE machines. +Unfortunately, older compiler versions (4.8 and earlier) do not understand +that flag, so we still need to keep the asm around. + +Backporting to stable kernels (4.6+) is needed to allow those to be built +with future compilers as well. + +Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=84129 +Fixes: 33280b4cd1dc ("ARM: KVM: Add banked registers save/restore") +Cc: stable@vger.kernel.org +Signed-off-by: Arnd Bergmann +Signed-off-by: Christoffer Dall +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/kvm/hyp/Makefile | 5 +++++ + arch/arm/kvm/hyp/banked-sr.c | 4 ++++ + 2 files changed, 9 insertions(+) + +--- a/arch/arm/kvm/hyp/Makefile ++++ b/arch/arm/kvm/hyp/Makefile +@@ -6,6 +6,8 @@ ccflags-y += -fno-stack-protector -DDISA + + KVM=../../../../virt/kvm + ++CFLAGS_ARMV7VE :=$(call cc-option, -march=armv7ve) ++ + obj-$(CONFIG_KVM_ARM_HOST) += $(KVM)/arm/hyp/vgic-v2-sr.o + obj-$(CONFIG_KVM_ARM_HOST) += $(KVM)/arm/hyp/vgic-v3-sr.o + obj-$(CONFIG_KVM_ARM_HOST) += $(KVM)/arm/hyp/timer-sr.o +@@ -14,7 +16,10 @@ obj-$(CONFIG_KVM_ARM_HOST) += tlb.o + obj-$(CONFIG_KVM_ARM_HOST) += cp15-sr.o + obj-$(CONFIG_KVM_ARM_HOST) += vfp.o + obj-$(CONFIG_KVM_ARM_HOST) += banked-sr.o ++CFLAGS_banked-sr.o += $(CFLAGS_ARMV7VE) ++ + obj-$(CONFIG_KVM_ARM_HOST) += entry.o + obj-$(CONFIG_KVM_ARM_HOST) += hyp-entry.o + obj-$(CONFIG_KVM_ARM_HOST) += switch.o ++CFLAGS_switch.o += $(CFLAGS_ARMV7VE) + obj-$(CONFIG_KVM_ARM_HOST) += s2-setup.o +--- a/arch/arm/kvm/hyp/banked-sr.c ++++ b/arch/arm/kvm/hyp/banked-sr.c +@@ -20,6 +20,10 @@ + + #include + ++/* ++ * gcc before 4.9 doesn't understand -march=armv7ve, so we have to ++ * trick the assembler. ++ */ + __asm__(".arch_extension virt"); + + void __hyp_text __banked_save_state(struct kvm_cpu_context *ctxt) diff --git a/queue-4.9/arm-mvebu-fix-broken-pl310_errata_753970-selects.patch b/queue-4.9/arm-mvebu-fix-broken-pl310_errata_753970-selects.patch new file mode 100644 index 00000000000..43164603716 --- /dev/null +++ b/queue-4.9/arm-mvebu-fix-broken-pl310_errata_753970-selects.patch @@ -0,0 +1,49 @@ +From 8aa36a8dcde3183d84db7b0d622ffddcebb61077 Mon Sep 17 00:00:00 2001 +From: Ulf Magnusson +Date: Mon, 5 Feb 2018 02:21:13 +0100 +Subject: ARM: mvebu: Fix broken PL310_ERRATA_753970 selects + +From: Ulf Magnusson + +commit 8aa36a8dcde3183d84db7b0d622ffddcebb61077 upstream. + +The MACH_ARMADA_375 and MACH_ARMADA_38X boards select ARM_ERRATA_753970, +but it was renamed to PL310_ERRATA_753970 by commit fa0ce4035d48 ("ARM: +7162/1: errata: tidy up Kconfig options for PL310 errata workarounds"). + +Fix the selects to use the new name. + +Discovered with the +https://github.com/ulfalizer/Kconfiglib/blob/master/examples/list_undefined.py +script. +Fixes: fa0ce4035d48 ("ARM: 7162/1: errata: tidy up Kconfig options for +PL310 errata workarounds" +cc: stable@vger.kernel.org +Signed-off-by: Ulf Magnusson +Signed-off-by: Gregory CLEMENT +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-mvebu/Kconfig | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/arm/mach-mvebu/Kconfig ++++ b/arch/arm/mach-mvebu/Kconfig +@@ -42,7 +42,7 @@ config MACH_ARMADA_375 + depends on ARCH_MULTI_V7 + select ARMADA_370_XP_IRQ + select ARM_ERRATA_720789 +- select ARM_ERRATA_753970 ++ select PL310_ERRATA_753970 + select ARM_GIC + select ARMADA_375_CLK + select HAVE_ARM_SCU +@@ -58,7 +58,7 @@ config MACH_ARMADA_38X + bool "Marvell Armada 380/385 boards" + depends on ARCH_MULTI_V7 + select ARM_ERRATA_720789 +- select ARM_ERRATA_753970 ++ select PL310_ERRATA_753970 + select ARM_GIC + select ARMADA_370_XP_IRQ + select ARMADA_38X_CLK diff --git a/queue-4.9/kvm-mmu-fix-overlap-between-public-and-private-memslots.patch b/queue-4.9/kvm-mmu-fix-overlap-between-public-and-private-memslots.patch new file mode 100644 index 00000000000..805df8a8439 --- /dev/null +++ b/queue-4.9/kvm-mmu-fix-overlap-between-public-and-private-memslots.patch @@ -0,0 +1,113 @@ +From b28676bb8ae4569cced423dc2a88f7cb319d5379 Mon Sep 17 00:00:00 2001 +From: Wanpeng Li +Date: Tue, 13 Feb 2018 15:36:00 +0100 +Subject: KVM: mmu: Fix overlap between public and private memslots +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Wanpeng Li + +commit b28676bb8ae4569cced423dc2a88f7cb319d5379 upstream. + +Reported by syzkaller: + + pte_list_remove: ffff9714eb1f8078 0->BUG + ------------[ cut here ]------------ + kernel BUG at arch/x86/kvm/mmu.c:1157! + invalid opcode: 0000 [#1] SMP + RIP: 0010:pte_list_remove+0x11b/0x120 [kvm] + Call Trace: + drop_spte+0x83/0xb0 [kvm] + mmu_page_zap_pte+0xcc/0xe0 [kvm] + kvm_mmu_prepare_zap_page+0x81/0x4a0 [kvm] + kvm_mmu_invalidate_zap_all_pages+0x159/0x220 [kvm] + kvm_arch_flush_shadow_all+0xe/0x10 [kvm] + kvm_mmu_notifier_release+0x6c/0xa0 [kvm] + ? kvm_mmu_notifier_release+0x5/0xa0 [kvm] + __mmu_notifier_release+0x79/0x110 + ? __mmu_notifier_release+0x5/0x110 + exit_mmap+0x15a/0x170 + ? do_exit+0x281/0xcb0 + mmput+0x66/0x160 + do_exit+0x2c9/0xcb0 + ? __context_tracking_exit.part.5+0x4a/0x150 + do_group_exit+0x50/0xd0 + SyS_exit_group+0x14/0x20 + do_syscall_64+0x73/0x1f0 + entry_SYSCALL64_slow_path+0x25/0x25 + +The reason is that when creates new memslot, there is no guarantee for new +memslot not overlap with private memslots. This can be triggered by the +following program: + + #include + #include + #include + #include + #include + #include + #include + #include + #include + #include + #include + #include + #include + #include + #include + + long r[16]; + + int main() + { + void *p = valloc(0x4000); + + r[2] = open("/dev/kvm", 0); + r[3] = ioctl(r[2], KVM_CREATE_VM, 0x0ul); + + uint64_t addr = 0xf000; + ioctl(r[3], KVM_SET_IDENTITY_MAP_ADDR, &addr); + r[6] = ioctl(r[3], KVM_CREATE_VCPU, 0x0ul); + ioctl(r[3], KVM_SET_TSS_ADDR, 0x0ul); + ioctl(r[6], KVM_RUN, 0); + ioctl(r[6], KVM_RUN, 0); + + struct kvm_userspace_memory_region mr = { + .slot = 0, + .flags = KVM_MEM_LOG_DIRTY_PAGES, + .guest_phys_addr = 0xf000, + .memory_size = 0x4000, + .userspace_addr = (uintptr_t) p + }; + ioctl(r[3], KVM_SET_USER_MEMORY_REGION, &mr); + return 0; + } + +This patch fixes the bug by not adding a new memslot even if it +overlaps with private memslots. + +Reported-by: Dmitry Vyukov +Cc: Paolo Bonzini +Cc: Radim Krčmář +Cc: Dmitry Vyukov +Cc: Eric Biggers +Cc: stable@vger.kernel.org +Signed-off-by: Wanpeng Li +--- + virt/kvm/kvm_main.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) +Signed-off-by: Greg Kroah-Hartman + +--- a/virt/kvm/kvm_main.c ++++ b/virt/kvm/kvm_main.c +@@ -976,8 +976,7 @@ int __kvm_set_memory_region(struct kvm * + /* Check for overlaps */ + r = -EEXIST; + kvm_for_each_memslot(slot, __kvm_memslots(kvm, as_id)) { +- if ((slot->id >= KVM_USER_MEM_SLOTS) || +- (slot->id == id)) ++ if (slot->id == id) + continue; + if (!((base_gfn + npages <= slot->base_gfn) || + (base_gfn >= slot->base_gfn + slot->npages))) diff --git a/queue-4.9/kvm-vmx-optimize-vmx_vcpu_run-and-svm_vcpu_run-by-marking-the-rdmsr-path-as-unlikely.patch b/queue-4.9/kvm-vmx-optimize-vmx_vcpu_run-and-svm_vcpu_run-by-marking-the-rdmsr-path-as-unlikely.patch new file mode 100644 index 00000000000..613dba334b7 --- /dev/null +++ b/queue-4.9/kvm-vmx-optimize-vmx_vcpu_run-and-svm_vcpu_run-by-marking-the-rdmsr-path-as-unlikely.patch @@ -0,0 +1,60 @@ +From 946fbbc13dce68902f64515b610eeb2a6c3d7a64 Mon Sep 17 00:00:00 2001 +From: Paolo Bonzini +Date: Thu, 22 Feb 2018 16:43:18 +0100 +Subject: KVM/VMX: Optimize vmx_vcpu_run() and svm_vcpu_run() by marking the RDMSR path as unlikely() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Paolo Bonzini + +commit 946fbbc13dce68902f64515b610eeb2a6c3d7a64 upstream. + +vmx_vcpu_run() and svm_vcpu_run() are large functions, and giving +branch hints to the compiler can actually make a substantial cycle +difference by keeping the fast path contiguous in memory. + +With this optimization, the retpoline-guest/retpoline-host case is +about 50 cycles faster. + +Signed-off-by: Paolo Bonzini +Reviewed-by: Jim Mattson +Cc: David Woodhouse +Cc: KarimAllah Ahmed +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Radim Krčmář +Cc: Thomas Gleixner +Cc: kvm@vger.kernel.org +Cc: stable@vger.kernel.org +Link: http://lkml.kernel.org/r/20180222154318.20361-3-pbonzini@redhat.com +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kvm/svm.c | 2 +- + arch/x86/kvm/vmx.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/x86/kvm/svm.c ++++ b/arch/x86/kvm/svm.c +@@ -5029,7 +5029,7 @@ static void svm_vcpu_run(struct kvm_vcpu + * If the L02 MSR bitmap does not intercept the MSR, then we need to + * save it. + */ +- if (!msr_write_intercepted(vcpu, MSR_IA32_SPEC_CTRL)) ++ if (unlikely(!msr_write_intercepted(vcpu, MSR_IA32_SPEC_CTRL))) + svm->spec_ctrl = native_read_msr(MSR_IA32_SPEC_CTRL); + + if (svm->spec_ctrl) +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -9042,7 +9042,7 @@ static void __noclone vmx_vcpu_run(struc + * If the L02 MSR bitmap does not intercept the MSR, then we need to + * save it. + */ +- if (!msr_write_intercepted(vcpu, MSR_IA32_SPEC_CTRL)) ++ if (unlikely(!msr_write_intercepted(vcpu, MSR_IA32_SPEC_CTRL))) + vmx->spec_ctrl = native_read_msr(MSR_IA32_SPEC_CTRL); + + if (vmx->spec_ctrl) diff --git a/queue-4.9/kvm-x86-fix-smram-accessing-even-if-vm-is-shutdown.patch b/queue-4.9/kvm-x86-fix-smram-accessing-even-if-vm-is-shutdown.patch new file mode 100644 index 00000000000..cf51c28a9f6 --- /dev/null +++ b/queue-4.9/kvm-x86-fix-smram-accessing-even-if-vm-is-shutdown.patch @@ -0,0 +1,57 @@ +From 95e057e25892eaa48cad1e2d637b80d0f1a4fac5 Mon Sep 17 00:00:00 2001 +From: Wanpeng Li +Date: Thu, 8 Feb 2018 15:32:45 +0800 +Subject: KVM: X86: Fix SMRAM accessing even if VM is shutdown +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Wanpeng Li + +commit 95e057e25892eaa48cad1e2d637b80d0f1a4fac5 upstream. + +Reported by syzkaller: + + WARNING: CPU: 6 PID: 2434 at arch/x86/kvm/vmx.c:6660 handle_ept_misconfig+0x54/0x1e0 [kvm_intel] + CPU: 6 PID: 2434 Comm: repro_test Not tainted 4.15.0+ #4 + RIP: 0010:handle_ept_misconfig+0x54/0x1e0 [kvm_intel] + Call Trace: + vmx_handle_exit+0xbd/0xe20 [kvm_intel] + kvm_arch_vcpu_ioctl_run+0xdaf/0x1d50 [kvm] + kvm_vcpu_ioctl+0x3e9/0x720 [kvm] + do_vfs_ioctl+0xa4/0x6a0 + SyS_ioctl+0x79/0x90 + entry_SYSCALL_64_fastpath+0x25/0x9c + +The testcase creates a first thread to issue KVM_SMI ioctl, and then creates +a second thread to mmap and operate on the same vCPU. This triggers a race +condition when running the testcase with multiple threads. Sometimes one thread +exits with a triple fault while another thread mmaps and operates on the same +vCPU. Because CS=0x3000/IP=0x8000 is not mapped, accessing the SMI handler +results in an EPT misconfig. This patch fixes it by returning RET_PF_EMULATE +in kvm_handle_bad_page(), which will go on to cause an emulation failure and an +exit with KVM_EXIT_INTERNAL_ERROR. + +Reported-by: syzbot+c1d9517cab094dae65e446c0c5b4de6c40f4dc58@syzkaller.appspotmail.com +Cc: Paolo Bonzini +Cc: Radim Krčmář +Cc: stable@vger.kernel.org +Signed-off-by: Wanpeng Li +Signed-off-by: Paolo Bonzini +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kvm/mmu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/kvm/mmu.c ++++ b/arch/x86/kvm/mmu.c +@@ -2808,7 +2808,7 @@ static int kvm_handle_bad_page(struct kv + return 0; + } + +- return -EFAULT; ++ return RET_PF_EMULATE; + } + + static void transparent_hugepage_adjust(struct kvm_vcpu *vcpu, diff --git a/queue-4.9/kvm-x86-remove-indirect-msr-op-calls-from-spec_ctrl.patch b/queue-4.9/kvm-x86-remove-indirect-msr-op-calls-from-spec_ctrl.patch new file mode 100644 index 00000000000..42f41e33776 --- /dev/null +++ b/queue-4.9/kvm-x86-remove-indirect-msr-op-calls-from-spec_ctrl.patch @@ -0,0 +1,101 @@ +From ecb586bd29c99fb4de599dec388658e74388daad Mon Sep 17 00:00:00 2001 +From: Paolo Bonzini +Date: Thu, 22 Feb 2018 16:43:17 +0100 +Subject: KVM/x86: Remove indirect MSR op calls from SPEC_CTRL +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Paolo Bonzini + +commit ecb586bd29c99fb4de599dec388658e74388daad upstream. + +Having a paravirt indirect call in the IBRS restore path is not a +good idea, since we are trying to protect from speculative execution +of bogus indirect branch targets. It is also slower, so use +native_wrmsrl() on the vmentry path too. + +Signed-off-by: Paolo Bonzini +Reviewed-by: Jim Mattson +Cc: David Woodhouse +Cc: KarimAllah Ahmed +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Radim Krčmář +Cc: Thomas Gleixner +Cc: kvm@vger.kernel.org +Cc: stable@vger.kernel.org +Fixes: d28b387fb74da95d69d2615732f50cceb38e9a4d +Link: http://lkml.kernel.org/r/20180222154318.20361-2-pbonzini@redhat.com +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kvm/svm.c | 7 ++++--- + arch/x86/kvm/vmx.c | 7 ++++--- + 2 files changed, 8 insertions(+), 6 deletions(-) + +--- a/arch/x86/kvm/svm.c ++++ b/arch/x86/kvm/svm.c +@@ -44,6 +44,7 @@ + #include + #include + #include ++#include + #include + + #include +@@ -4919,7 +4920,7 @@ static void svm_vcpu_run(struct kvm_vcpu + * being speculatively taken. + */ + if (svm->spec_ctrl) +- wrmsrl(MSR_IA32_SPEC_CTRL, svm->spec_ctrl); ++ native_wrmsrl(MSR_IA32_SPEC_CTRL, svm->spec_ctrl); + + asm volatile ( + "push %%" _ASM_BP "; \n\t" +@@ -5029,10 +5030,10 @@ static void svm_vcpu_run(struct kvm_vcpu + * save it. + */ + if (!msr_write_intercepted(vcpu, MSR_IA32_SPEC_CTRL)) +- rdmsrl(MSR_IA32_SPEC_CTRL, svm->spec_ctrl); ++ svm->spec_ctrl = native_read_msr(MSR_IA32_SPEC_CTRL); + + if (svm->spec_ctrl) +- wrmsrl(MSR_IA32_SPEC_CTRL, 0); ++ native_wrmsrl(MSR_IA32_SPEC_CTRL, 0); + + /* Eliminate branch target predictions from guest mode */ + vmexit_fill_RSB(); +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -49,6 +49,7 @@ + #include + #include + #include ++#include + #include + + #include "trace.h" +@@ -8906,7 +8907,7 @@ static void __noclone vmx_vcpu_run(struc + * being speculatively taken. + */ + if (vmx->spec_ctrl) +- wrmsrl(MSR_IA32_SPEC_CTRL, vmx->spec_ctrl); ++ native_wrmsrl(MSR_IA32_SPEC_CTRL, vmx->spec_ctrl); + + vmx->__launched = vmx->loaded_vmcs->launched; + asm( +@@ -9042,10 +9043,10 @@ static void __noclone vmx_vcpu_run(struc + * save it. + */ + if (!msr_write_intercepted(vcpu, MSR_IA32_SPEC_CTRL)) +- rdmsrl(MSR_IA32_SPEC_CTRL, vmx->spec_ctrl); ++ vmx->spec_ctrl = native_read_msr(MSR_IA32_SPEC_CTRL); + + if (vmx->spec_ctrl) +- wrmsrl(MSR_IA32_SPEC_CTRL, 0); ++ native_wrmsrl(MSR_IA32_SPEC_CTRL, 0); + + /* Eliminate branch target predictions from guest mode */ + vmexit_fill_RSB(); diff --git a/queue-4.9/media-m88ds3103-don-t-call-a-non-initalized-function.patch b/queue-4.9/media-m88ds3103-don-t-call-a-non-initalized-function.patch new file mode 100644 index 00000000000..47de3dd09bb --- /dev/null +++ b/queue-4.9/media-m88ds3103-don-t-call-a-non-initalized-function.patch @@ -0,0 +1,123 @@ +From b9c97c67fd19262c002d94ced2bfb513083e161e Mon Sep 17 00:00:00 2001 +From: Mauro Carvalho Chehab +Date: Sat, 10 Feb 2018 06:14:10 -0500 +Subject: media: m88ds3103: don't call a non-initalized function + +From: Mauro Carvalho Chehab + +commit b9c97c67fd19262c002d94ced2bfb513083e161e upstream. + +If m88d3103 chip ID is not recognized, the device is not initialized. + +However, it returns from probe without any error, causing this OOPS: + +[ 7.689289] Unable to handle kernel NULL pointer dereference at virtual address 00000000 +[ 7.689297] pgd = 7b0bd7a7 +[ 7.689302] [00000000] *pgd=00000000 +[ 7.689318] Internal error: Oops: 80000005 [#1] SMP ARM +[ 7.689322] Modules linked in: dvb_usb_dvbsky(+) m88ds3103 dvb_usb_v2 dvb_core videobuf2_vmalloc videobuf2_memops videobuf2_core crc32_arm_ce videodev media +[ 7.689358] CPU: 3 PID: 197 Comm: systemd-udevd Not tainted 4.15.0-mcc+ #23 +[ 7.689361] Hardware name: BCM2835 +[ 7.689367] PC is at 0x0 +[ 7.689382] LR is at m88ds3103_attach+0x194/0x1d0 [m88ds3103] +[ 7.689386] pc : [<00000000>] lr : [] psr: 60000013 +[ 7.689391] sp : ed8e5c20 ip : ed8c1e00 fp : ed8945c0 +[ 7.689395] r10: ed894000 r9 : ed894378 r8 : eda736c0 +[ 7.689400] r7 : ed894070 r6 : ed8e5c44 r5 : bf0bb040 r4 : eda77600 +[ 7.689405] r3 : 00000000 r2 : 00000000 r1 : 00000000 r0 : eda77600 +[ 7.689412] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none +[ 7.689417] Control: 10c5383d Table: 2d8e806a DAC: 00000051 +[ 7.689423] Process systemd-udevd (pid: 197, stack limit = 0xe9dbfb63) +[ 7.689428] Stack: (0xed8e5c20 to 0xed8e6000) +[ 7.689439] 5c20: ed853a80 eda73640 ed894000 ed8942c0 ed853a80 bf0b9e98 ed894070 bf0b9f10 +[ 7.689449] 5c40: 00000000 00000000 bf08c17c c08dfc50 00000000 00000000 00000000 00000000 +[ 7.689459] 5c60: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 +[ 7.689468] 5c80: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 +[ 7.689479] 5ca0: 00000000 00000000 ed8945c0 ed8942c0 ed894000 ed894830 bf0b9e98 00000000 +[ 7.689490] 5cc0: ed894378 bf0a3cb4 bf0bc3b0 0000533b ed920540 00000000 00000034 bf0a6434 +[ 7.689500] 5ce0: ee952070 ed826600 bf0a7038 bf0a2dd8 00000001 bf0a6768 bf0a2f90 ed8943c0 +[ 7.689511] 5d00: 00000000 c08eca68 ed826620 ed826620 00000000 ee952070 bf0bc034 ee952000 +[ 7.689521] 5d20: ed826600 bf0bb080 ffffffed c0aa9e9c c0aa9dac ed826620 c16edf6c c168c2c8 +[ 7.689531] 5d40: c16edf70 00000000 bf0bc034 0000000d 00000000 c08e268c bf0bb080 ed826600 +[ 7.689541] 5d60: bf0bc034 ed826654 ed826620 bf0bc034 c164c8bc 00000000 00000001 00000000 +[ 7.689553] 5d80: 00000028 c08e2948 00000000 bf0bc034 c08e2848 c08e0778 ee9f0a58 ed88bab4 +[ 7.689563] 5da0: bf0bc034 ed90ba80 c168c1f0 c08e1934 bf0bb3bc c17045ac bf0bc034 c164c8bc +[ 7.689574] 5dc0: bf0bc034 bf0bb3bc ed91f564 c08e34ec bf0bc000 c164c8bc bf0bc034 c0aa8dc4 +[ 7.689584] 5de0: ffffe000 00000000 bf0bf000 ed91f600 ed91f564 c03021e4 00000001 00000000 +[ 7.689595] 5e00: c166e040 8040003f ed853a80 bf0bc448 00000000 c1678174 ed853a80 f0f22000 +[ 7.689605] 5e20: f0f21fff 8040003f 014000c0 ed91e700 ed91e700 c16d8e68 00000001 ed91e6c0 +[ 7.689615] 5e40: bf0bc400 00000001 bf0bc400 ed91f564 00000001 00000000 00000028 c03c9a24 +[ 7.689625] 5e60: 00000001 c03c8c94 ed8e5f50 ed8e5f50 00000001 bf0bc400 ed91f540 c03c8cb0 +[ 7.689637] 5e80: bf0bc40c 00007fff bf0bc400 c03c60b0 00000000 bf0bc448 00000028 c0e09684 +[ 7.689647] 5ea0: 00000002 bf0bc530 c1234bf8 bf0bc5dc bf0bc514 c10ebbe8 ffffe000 bf000000 +[ 7.689657] 5ec0: 00011538 00000000 ed8e5f48 00000000 00000000 00000000 00000000 00000000 +[ 7.689666] 5ee0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 +[ 7.689676] 5f00: 00000000 00000000 7fffffff 00000000 00000013 b6e55a18 0000017b c0309104 +[ 7.689686] 5f20: ed8e4000 00000000 00510af0 c03c9430 7fffffff 00000000 00000003 00000000 +[ 7.689697] 5f40: 00000000 f0f0f000 00011538 00000000 f0f107b0 f0f0f000 00011538 f0f1fdb8 +[ 7.689707] 5f60: f0f1fbe8 f0f1b974 00004000 000041e0 bf0bc3d0 00000001 00000000 000024c4 +[ 7.689717] 5f80: 0000002d 0000002e 00000019 00000000 00000010 00000000 16894000 00000000 +[ 7.689727] 5fa0: 00000000 c0308f20 16894000 00000000 00000013 b6e55a18 00000000 b6e5652c +[ 7.689737] 5fc0: 16894000 00000000 00000000 0000017b 00020000 00508110 00000000 00510af0 +[ 7.689748] 5fe0: bef68948 bef68938 b6e4d3d0 b6d32590 60000010 00000013 00000000 00000000 +[ 7.689790] [] (m88ds3103_attach [m88ds3103]) from [] (dvbsky_s960c_attach+0x78/0x280 [dvb_usb_dvbsky]) +[ 7.689821] [] (dvbsky_s960c_attach [dvb_usb_dvbsky]) from [] (dvb_usbv2_probe+0xa3c/0x1024 [dvb_usb_v2]) +[ 7.689849] [] (dvb_usbv2_probe [dvb_usb_v2]) from [] (usb_probe_interface+0xf0/0x2a8) +[ 7.689869] [] (usb_probe_interface) from [] (driver_probe_device+0x2f8/0x4b4) +[ 7.689881] [] (driver_probe_device) from [] (__driver_attach+0x100/0x11c) +[ 7.689895] [] (__driver_attach) from [] (bus_for_each_dev+0x4c/0x9c) +[ 7.689909] [] (bus_for_each_dev) from [] (bus_add_driver+0x1c0/0x264) +[ 7.689919] [] (bus_add_driver) from [] (driver_register+0x78/0xf4) +[ 7.689931] [] (driver_register) from [] (usb_register_driver+0x70/0x134) +[ 7.689946] [] (usb_register_driver) from [] (do_one_initcall+0x44/0x168) +[ 7.689963] [] (do_one_initcall) from [] (do_init_module+0x64/0x1f4) +[ 7.689979] [] (do_init_module) from [] (load_module+0x20a0/0x25c8) +[ 7.689993] [] (load_module) from [] (SyS_finit_module+0xb4/0xec) +[ 7.690007] [] (SyS_finit_module) from [] (ret_fast_syscall+0x0/0x54) +[ 7.690018] Code: bad PC value + +This may happen on normal circumstances, if, for some reason, the demod +hangs and start returning an invalid chip ID: + +[ 10.394395] m88ds3103 3-0068: Unknown device. Chip_id=00 + +So, change the logic to cause probe to fail with -ENODEV, preventing +the OOPS. + +Detected while testing DVB MMAP patches on Raspberry Pi 3 with +DVBSky S960CI. + +Cc: stable@vger.kernel.org +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/dvb-frontends/m88ds3103.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/media/dvb-frontends/m88ds3103.c ++++ b/drivers/media/dvb-frontends/m88ds3103.c +@@ -1262,11 +1262,12 @@ static int m88ds3103_select(struct i2c_m + * New users must use I2C client binding directly! + */ + struct dvb_frontend *m88ds3103_attach(const struct m88ds3103_config *cfg, +- struct i2c_adapter *i2c, struct i2c_adapter **tuner_i2c_adapter) ++ struct i2c_adapter *i2c, ++ struct i2c_adapter **tuner_i2c_adapter) + { + struct i2c_client *client; + struct i2c_board_info board_info; +- struct m88ds3103_platform_data pdata; ++ struct m88ds3103_platform_data pdata = {}; + + pdata.clk = cfg->clock; + pdata.i2c_wr_max = cfg->i2c_wr_max; +@@ -1409,6 +1410,8 @@ static int m88ds3103_probe(struct i2c_cl + case M88DS3103_CHIP_ID: + break; + default: ++ ret = -ENODEV; ++ dev_err(&client->dev, "Unknown device. Chip_id=%02x\n", dev->chip_id); + goto err_kfree; + } + diff --git a/queue-4.9/nospec-allow-index-argument-to-have-const-qualified-type.patch b/queue-4.9/nospec-allow-index-argument-to-have-const-qualified-type.patch new file mode 100644 index 00000000000..ac69d9b3f88 --- /dev/null +++ b/queue-4.9/nospec-allow-index-argument-to-have-const-qualified-type.patch @@ -0,0 +1,65 @@ +From b98c6a160a057d5686a8c54c79cc6c8c94a7d0c8 Mon Sep 17 00:00:00 2001 +From: Rasmus Villemoes +Date: Fri, 16 Feb 2018 13:20:48 -0800 +Subject: nospec: Allow index argument to have const-qualified type + +From: Rasmus Villemoes + +commit b98c6a160a057d5686a8c54c79cc6c8c94a7d0c8 upstream. + +The last expression in a statement expression need not be a bare +variable, quoting gcc docs + + The last thing in the compound statement should be an expression + followed by a semicolon; the value of this subexpression serves as the + value of the entire construct. + +and we already use that in e.g. the min/max macros which end with a +ternary expression. + +This way, we can allow index to have const-qualified type, which will in +some cases avoid the need for introducing a local copy of index of +non-const qualified type. That, in turn, can prevent readers not +familiar with the internals of array_index_nospec from wondering about +the seemingly redundant extra variable, and I think that's worthwhile +considering how confusing the whole _nospec business is. + +The expression _i&_mask has type unsigned long (since that is the type +of _mask, and the BUILD_BUG_ONs guarantee that _i will get promoted to +that), so in order not to change the type of the whole expression, add +a cast back to typeof(_i). + +Signed-off-by: Rasmus Villemoes +Signed-off-by: Dan Williams +Acked-by: Linus Torvalds +Cc: Andy Lutomirski +Cc: Arjan van de Ven +Cc: Borislav Petkov +Cc: Dave Hansen +Cc: David Woodhouse +Cc: Greg Kroah-Hartman +Cc: Josh Poimboeuf +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: Will Deacon +Cc: linux-arch@vger.kernel.org +Cc: stable@vger.kernel.org +Link: http://lkml.kernel.org/r/151881604837.17395.10812767547837568328.stgit@dwillia2-desk3.amr.corp.intel.com +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/nospec.h | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/include/linux/nospec.h ++++ b/include/linux/nospec.h +@@ -72,7 +72,6 @@ static inline unsigned long array_index_ + BUILD_BUG_ON(sizeof(_i) > sizeof(long)); \ + BUILD_BUG_ON(sizeof(_s) > sizeof(long)); \ + \ +- _i &= _mask; \ +- _i; \ ++ (typeof(_i)) (_i & _mask); \ + }) + #endif /* _LINUX_NOSPEC_H */ diff --git a/queue-4.9/series b/queue-4.9/series index 401ce88a8e6..c8f8f2d03f3 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -14,3 +14,11 @@ cpufreq-s3c24xx-fix-broken-s3c_cpufreq_init.patch dax-fix-vma_is_fsdax-helper.patch x86-xen-zero-msr_ia32_spec_ctrl-before-suspend.patch x86-platform-intel-mid-handle-intel-edison-reboot-correctly.patch +media-m88ds3103-don-t-call-a-non-initalized-function.patch +nospec-allow-index-argument-to-have-const-qualified-type.patch +arm-mvebu-fix-broken-pl310_errata_753970-selects.patch +arm-kvm-fix-building-with-gcc-8.patch +kvm-x86-fix-smram-accessing-even-if-vm-is-shutdown.patch +kvm-mmu-fix-overlap-between-public-and-private-memslots.patch +kvm-x86-remove-indirect-msr-op-calls-from-spec_ctrl.patch +kvm-vmx-optimize-vmx_vcpu_run-and-svm_vcpu_run-by-marking-the-rdmsr-path-as-unlikely.patch