| 1 |
commit: f24fa29fe8e70c34ad53adcc5fb899d84d1269c7 |
| 2 |
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> |
| 3 |
AuthorDate: Fri Sep 3 11:24:29 2021 +0000 |
| 4 |
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> |
| 5 |
CommitDate: Fri Sep 3 11:24:29 2021 +0000 |
| 6 |
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=f24fa29f |
| 7 |
|
| 8 |
Linux patch 4.9.282 |
| 9 |
|
| 10 |
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org> |
| 11 |
|
| 12 |
1281_linux-4.9.282.patch | 357 +++++++++++++++++++++++++++++++++++++++++++++++ |
| 13 |
1 file changed, 357 insertions(+) |
| 14 |
|
| 15 |
diff --git a/1281_linux-4.9.282.patch b/1281_linux-4.9.282.patch |
| 16 |
new file mode 100644 |
| 17 |
index 0000000..0e7dfba |
| 18 |
--- /dev/null |
| 19 |
+++ b/1281_linux-4.9.282.patch |
| 20 |
@@ -0,0 +1,357 @@ |
| 21 |
+diff --git a/Makefile b/Makefile |
| 22 |
+index 08bbebb4acbf1..ca08ef26f416b 100644 |
| 23 |
+--- a/Makefile |
| 24 |
++++ b/Makefile |
| 25 |
+@@ -1,6 +1,6 @@ |
| 26 |
+ VERSION = 4 |
| 27 |
+ PATCHLEVEL = 9 |
| 28 |
+-SUBLEVEL = 281 |
| 29 |
++SUBLEVEL = 282 |
| 30 |
+ EXTRAVERSION = |
| 31 |
+ NAME = Roaring Lionus |
| 32 |
+ |
| 33 |
+diff --git a/arch/arc/kernel/vmlinux.lds.S b/arch/arc/kernel/vmlinux.lds.S |
| 34 |
+index f35ed578e007e..4d823d3f65bb3 100644 |
| 35 |
+--- a/arch/arc/kernel/vmlinux.lds.S |
| 36 |
++++ b/arch/arc/kernel/vmlinux.lds.S |
| 37 |
+@@ -92,6 +92,8 @@ SECTIONS |
| 38 |
+ CPUIDLE_TEXT |
| 39 |
+ LOCK_TEXT |
| 40 |
+ KPROBES_TEXT |
| 41 |
++ IRQENTRY_TEXT |
| 42 |
++ SOFTIRQENTRY_TEXT |
| 43 |
+ *(.fixup) |
| 44 |
+ *(.gnu.warning) |
| 45 |
+ } |
| 46 |
+diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c |
| 47 |
+index 5cbc6591fa1d3..c16d24ad83560 100644 |
| 48 |
+--- a/arch/x86/kvm/mmu.c |
| 49 |
++++ b/arch/x86/kvm/mmu.c |
| 50 |
+@@ -3927,7 +3927,16 @@ static void reset_rsvds_bits_mask_ept(struct kvm_vcpu *vcpu, |
| 51 |
+ void |
| 52 |
+ reset_shadow_zero_bits_mask(struct kvm_vcpu *vcpu, struct kvm_mmu *context) |
| 53 |
+ { |
| 54 |
+- bool uses_nx = context->nx || context->base_role.smep_andnot_wp; |
| 55 |
++ /* |
| 56 |
++ * KVM uses NX when TDP is disabled to handle a variety of scenarios, |
| 57 |
++ * notably for huge SPTEs if iTLB multi-hit mitigation is enabled and |
| 58 |
++ * to generate correct permissions for CR0.WP=0/CR4.SMEP=1/EFER.NX=0. |
| 59 |
++ * The iTLB multi-hit workaround can be toggled at any time, so assume |
| 60 |
++ * NX can be used by any non-nested shadow MMU to avoid having to reset |
| 61 |
++ * MMU contexts. Note, KVM forces EFER.NX=1 when TDP is disabled. |
| 62 |
++ */ |
| 63 |
++ bool uses_nx = context->nx || !tdp_enabled || |
| 64 |
++ context->base_role.smep_andnot_wp; |
| 65 |
+ |
| 66 |
+ /* |
| 67 |
+ * Passing "true" to the last argument is okay; it adds a check |
| 68 |
+diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c |
| 69 |
+index 64a3dae5381ef..4496e7a492352 100644 |
| 70 |
+--- a/drivers/block/floppy.c |
| 71 |
++++ b/drivers/block/floppy.c |
| 72 |
+@@ -4067,22 +4067,21 @@ static int floppy_open(struct block_device *bdev, fmode_t mode) |
| 73 |
+ if (UFDCS->rawcmd == 1) |
| 74 |
+ UFDCS->rawcmd = 2; |
| 75 |
+ |
| 76 |
+- if (mode & (FMODE_READ|FMODE_WRITE)) { |
| 77 |
+- UDRS->last_checked = 0; |
| 78 |
+- clear_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags); |
| 79 |
+- check_disk_change(bdev); |
| 80 |
+- if (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags)) |
| 81 |
+- goto out; |
| 82 |
+- if (test_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags)) |
| 83 |
++ if (!(mode & FMODE_NDELAY)) { |
| 84 |
++ if (mode & (FMODE_READ|FMODE_WRITE)) { |
| 85 |
++ UDRS->last_checked = 0; |
| 86 |
++ clear_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags); |
| 87 |
++ check_disk_change(bdev); |
| 88 |
++ if (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags)) |
| 89 |
++ goto out; |
| 90 |
++ if (test_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags)) |
| 91 |
++ goto out; |
| 92 |
++ } |
| 93 |
++ res = -EROFS; |
| 94 |
++ if ((mode & FMODE_WRITE) && |
| 95 |
++ !test_bit(FD_DISK_WRITABLE_BIT, &UDRS->flags)) |
| 96 |
+ goto out; |
| 97 |
+ } |
| 98 |
+- |
| 99 |
+- res = -EROFS; |
| 100 |
+- |
| 101 |
+- if ((mode & FMODE_WRITE) && |
| 102 |
+- !test_bit(FD_DISK_WRITABLE_BIT, &UDRS->flags)) |
| 103 |
+- goto out; |
| 104 |
+- |
| 105 |
+ mutex_unlock(&open_lock); |
| 106 |
+ mutex_unlock(&floppy_mutex); |
| 107 |
+ return 0; |
| 108 |
+diff --git a/drivers/infiniband/hw/hfi1/sdma.c b/drivers/infiniband/hw/hfi1/sdma.c |
| 109 |
+index 76e63c88a87a8..e9313e6f4b0e3 100644 |
| 110 |
+--- a/drivers/infiniband/hw/hfi1/sdma.c |
| 111 |
++++ b/drivers/infiniband/hw/hfi1/sdma.c |
| 112 |
+@@ -3028,6 +3028,7 @@ static void __sdma_process_event(struct sdma_engine *sde, |
| 113 |
+ static int _extend_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx) |
| 114 |
+ { |
| 115 |
+ int i; |
| 116 |
++ struct sdma_desc *descp; |
| 117 |
+ |
| 118 |
+ /* Handle last descriptor */ |
| 119 |
+ if (unlikely((tx->num_desc == (MAX_DESC - 1)))) { |
| 120 |
+@@ -3048,12 +3049,10 @@ static int _extend_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx) |
| 121 |
+ if (unlikely(tx->num_desc == MAX_DESC)) |
| 122 |
+ goto enomem; |
| 123 |
+ |
| 124 |
+- tx->descp = kmalloc_array( |
| 125 |
+- MAX_DESC, |
| 126 |
+- sizeof(struct sdma_desc), |
| 127 |
+- GFP_ATOMIC); |
| 128 |
+- if (!tx->descp) |
| 129 |
++ descp = kmalloc_array(MAX_DESC, sizeof(struct sdma_desc), GFP_ATOMIC); |
| 130 |
++ if (!descp) |
| 131 |
+ goto enomem; |
| 132 |
++ tx->descp = descp; |
| 133 |
+ |
| 134 |
+ /* reserve last descriptor for coalescing */ |
| 135 |
+ tx->desc_limit = MAX_DESC - 1; |
| 136 |
+diff --git a/drivers/net/can/usb/esd_usb2.c b/drivers/net/can/usb/esd_usb2.c |
| 137 |
+index 592c6e7f3dca4..fbe1173b2651f 100644 |
| 138 |
+--- a/drivers/net/can/usb/esd_usb2.c |
| 139 |
++++ b/drivers/net/can/usb/esd_usb2.c |
| 140 |
+@@ -236,8 +236,8 @@ static void esd_usb2_rx_event(struct esd_usb2_net_priv *priv, |
| 141 |
+ if (id == ESD_EV_CAN_ERROR_EXT) { |
| 142 |
+ u8 state = msg->msg.rx.data[0]; |
| 143 |
+ u8 ecc = msg->msg.rx.data[1]; |
| 144 |
+- u8 txerr = msg->msg.rx.data[2]; |
| 145 |
+- u8 rxerr = msg->msg.rx.data[3]; |
| 146 |
++ u8 rxerr = msg->msg.rx.data[2]; |
| 147 |
++ u8 txerr = msg->msg.rx.data[3]; |
| 148 |
+ |
| 149 |
+ skb = alloc_can_err_skb(priv->netdev, &cf); |
| 150 |
+ if (skb == NULL) { |
| 151 |
+diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c |
| 152 |
+index 625008e8cb0df..500016209ae0c 100644 |
| 153 |
+--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c |
| 154 |
++++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c |
| 155 |
+@@ -1010,6 +1010,8 @@ static s32 e1000_platform_pm_pch_lpt(struct e1000_hw *hw, bool link) |
| 156 |
+ { |
| 157 |
+ u32 reg = link << (E1000_LTRV_REQ_SHIFT + E1000_LTRV_NOSNOOP_SHIFT) | |
| 158 |
+ link << E1000_LTRV_REQ_SHIFT | E1000_LTRV_SEND; |
| 159 |
++ u16 max_ltr_enc_d = 0; /* maximum LTR decoded by platform */ |
| 160 |
++ u16 lat_enc_d = 0; /* latency decoded */ |
| 161 |
+ u16 lat_enc = 0; /* latency encoded */ |
| 162 |
+ |
| 163 |
+ if (link) { |
| 164 |
+@@ -1063,7 +1065,17 @@ static s32 e1000_platform_pm_pch_lpt(struct e1000_hw *hw, bool link) |
| 165 |
+ E1000_PCI_LTR_CAP_LPT + 2, &max_nosnoop); |
| 166 |
+ max_ltr_enc = max_t(u16, max_snoop, max_nosnoop); |
| 167 |
+ |
| 168 |
+- if (lat_enc > max_ltr_enc) |
| 169 |
++ lat_enc_d = (lat_enc & E1000_LTRV_VALUE_MASK) * |
| 170 |
++ (1U << (E1000_LTRV_SCALE_FACTOR * |
| 171 |
++ ((lat_enc & E1000_LTRV_SCALE_MASK) |
| 172 |
++ >> E1000_LTRV_SCALE_SHIFT))); |
| 173 |
++ |
| 174 |
++ max_ltr_enc_d = (max_ltr_enc & E1000_LTRV_VALUE_MASK) * |
| 175 |
++ (1U << (E1000_LTRV_SCALE_FACTOR * |
| 176 |
++ ((max_ltr_enc & E1000_LTRV_SCALE_MASK) |
| 177 |
++ >> E1000_LTRV_SCALE_SHIFT))); |
| 178 |
++ |
| 179 |
++ if (lat_enc_d > max_ltr_enc_d) |
| 180 |
+ lat_enc = max_ltr_enc; |
| 181 |
+ } |
| 182 |
+ |
| 183 |
+diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.h b/drivers/net/ethernet/intel/e1000e/ich8lan.h |
| 184 |
+index 6374c8fc76a8d..9957a4ffdc6dc 100644 |
| 185 |
+--- a/drivers/net/ethernet/intel/e1000e/ich8lan.h |
| 186 |
++++ b/drivers/net/ethernet/intel/e1000e/ich8lan.h |
| 187 |
+@@ -291,8 +291,11 @@ |
| 188 |
+ |
| 189 |
+ /* Latency Tolerance Reporting */ |
| 190 |
+ #define E1000_LTRV 0x000F8 |
| 191 |
++#define E1000_LTRV_VALUE_MASK 0x000003FF |
| 192 |
+ #define E1000_LTRV_SCALE_MAX 5 |
| 193 |
+ #define E1000_LTRV_SCALE_FACTOR 5 |
| 194 |
++#define E1000_LTRV_SCALE_SHIFT 10 |
| 195 |
++#define E1000_LTRV_SCALE_MASK 0x00001C00 |
| 196 |
+ #define E1000_LTRV_REQ_SHIFT 15 |
| 197 |
+ #define E1000_LTRV_NOSNOOP_SHIFT 16 |
| 198 |
+ #define E1000_LTRV_SEND (1 << 30) |
| 199 |
+diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c |
| 200 |
+index bb6bc84995a2f..ccacdcfb59321 100644 |
| 201 |
+--- a/drivers/net/ethernet/marvell/mvneta.c |
| 202 |
++++ b/drivers/net/ethernet/marvell/mvneta.c |
| 203 |
+@@ -100,7 +100,7 @@ |
| 204 |
+ #define MVNETA_DESC_SWAP BIT(6) |
| 205 |
+ #define MVNETA_TX_BRST_SZ_MASK(burst) ((burst) << 22) |
| 206 |
+ #define MVNETA_PORT_STATUS 0x2444 |
| 207 |
+-#define MVNETA_TX_IN_PRGRS BIT(1) |
| 208 |
++#define MVNETA_TX_IN_PRGRS BIT(0) |
| 209 |
+ #define MVNETA_TX_FIFO_EMPTY BIT(8) |
| 210 |
+ #define MVNETA_RX_MIN_FRAME_SIZE 0x247c |
| 211 |
+ #define MVNETA_SERDES_CFG 0x24A0 |
| 212 |
+diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c |
| 213 |
+index 9206fd2489353..e1c1627a3356b 100644 |
| 214 |
+--- a/drivers/tty/vt/vt_ioctl.c |
| 215 |
++++ b/drivers/tty/vt/vt_ioctl.c |
| 216 |
+@@ -487,16 +487,19 @@ int vt_ioctl(struct tty_struct *tty, |
| 217 |
+ ret = -EINVAL; |
| 218 |
+ goto out; |
| 219 |
+ } |
| 220 |
+- /* FIXME: this needs the console lock extending */ |
| 221 |
+- if (vc->vc_mode == (unsigned char) arg) |
| 222 |
++ console_lock(); |
| 223 |
++ if (vc->vc_mode == (unsigned char) arg) { |
| 224 |
++ console_unlock(); |
| 225 |
+ break; |
| 226 |
++ } |
| 227 |
+ vc->vc_mode = (unsigned char) arg; |
| 228 |
+- if (console != fg_console) |
| 229 |
++ if (console != fg_console) { |
| 230 |
++ console_unlock(); |
| 231 |
+ break; |
| 232 |
++ } |
| 233 |
+ /* |
| 234 |
+ * explicitly blank/unblank the screen if switching modes |
| 235 |
+ */ |
| 236 |
+- console_lock(); |
| 237 |
+ if (arg == KD_TEXT) |
| 238 |
+ do_unblank_screen(1); |
| 239 |
+ else |
| 240 |
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c |
| 241 |
+index cca51553e0fb0..e340ef67321e5 100644 |
| 242 |
+--- a/drivers/usb/dwc3/gadget.c |
| 243 |
++++ b/drivers/usb/dwc3/gadget.c |
| 244 |
+@@ -928,19 +928,19 @@ static struct dwc3_trb *dwc3_ep_prev_trb(struct dwc3_ep *dep, u8 index) |
| 245 |
+ |
| 246 |
+ static u32 dwc3_calc_trbs_left(struct dwc3_ep *dep) |
| 247 |
+ { |
| 248 |
+- struct dwc3_trb *tmp; |
| 249 |
+ u8 trbs_left; |
| 250 |
+ |
| 251 |
+ /* |
| 252 |
+- * If enqueue & dequeue are equal than it is either full or empty. |
| 253 |
+- * |
| 254 |
+- * One way to know for sure is if the TRB right before us has HWO bit |
| 255 |
+- * set or not. If it has, then we're definitely full and can't fit any |
| 256 |
+- * more transfers in our ring. |
| 257 |
++ * If the enqueue & dequeue are equal then the TRB ring is either full |
| 258 |
++ * or empty. It's considered full when there are DWC3_TRB_NUM-1 of TRBs |
| 259 |
++ * pending to be processed by the driver. |
| 260 |
+ */ |
| 261 |
+ if (dep->trb_enqueue == dep->trb_dequeue) { |
| 262 |
+- tmp = dwc3_ep_prev_trb(dep, dep->trb_enqueue); |
| 263 |
+- if (tmp->ctrl & DWC3_TRB_CTRL_HWO) |
| 264 |
++ /* |
| 265 |
++ * If there is any request remained in the started_list at |
| 266 |
++ * this point, that means there is no TRB available. |
| 267 |
++ */ |
| 268 |
++ if (!list_empty(&dep->started_list)) |
| 269 |
+ return 0; |
| 270 |
+ |
| 271 |
+ return DWC3_TRB_NUM - 1; |
| 272 |
+diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c |
| 273 |
+index 2e92c6fef683f..c6ff79360302f 100644 |
| 274 |
+--- a/drivers/usb/serial/ch341.c |
| 275 |
++++ b/drivers/usb/serial/ch341.c |
| 276 |
+@@ -585,7 +585,6 @@ static struct usb_serial_driver ch341_device = { |
| 277 |
+ .owner = THIS_MODULE, |
| 278 |
+ .name = "ch341-uart", |
| 279 |
+ }, |
| 280 |
+- .bulk_in_size = 512, |
| 281 |
+ .id_table = id_table, |
| 282 |
+ .num_ports = 1, |
| 283 |
+ .open = ch341_open, |
| 284 |
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c |
| 285 |
+index b3336a7c09e0b..02ded56bcbc6b 100644 |
| 286 |
+--- a/drivers/usb/serial/option.c |
| 287 |
++++ b/drivers/usb/serial/option.c |
| 288 |
+@@ -2058,6 +2058,8 @@ static const struct usb_device_id option_ids[] = { |
| 289 |
+ .driver_info = RSVD(4) | RSVD(5) }, |
| 290 |
+ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0105, 0xff), /* Fibocom NL678 series */ |
| 291 |
+ .driver_info = RSVD(6) }, |
| 292 |
++ { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0xff, 0x30) }, /* Fibocom FG150 Diag */ |
| 293 |
++ { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0, 0) }, /* Fibocom FG150 AT */ |
| 294 |
+ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a0, 0xff) }, /* Fibocom NL668-AM/NL652-EU (laptop MBIM) */ |
| 295 |
+ { USB_DEVICE_INTERFACE_CLASS(0x2df3, 0x9d03, 0xff) }, /* LongSung M5710 */ |
| 296 |
+ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) }, /* GosunCn GM500 RNDIS */ |
| 297 |
+diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c |
| 298 |
+index d56736655dec4..da47542496cc3 100644 |
| 299 |
+--- a/drivers/vhost/vringh.c |
| 300 |
++++ b/drivers/vhost/vringh.c |
| 301 |
+@@ -329,7 +329,7 @@ __vringh_iov(struct vringh *vrh, u16 i, |
| 302 |
+ iov = wiov; |
| 303 |
+ else { |
| 304 |
+ iov = riov; |
| 305 |
+- if (unlikely(wiov && wiov->i)) { |
| 306 |
++ if (unlikely(wiov && wiov->used)) { |
| 307 |
+ vringh_bad("Readable desc %p after writable", |
| 308 |
+ &descs[i]); |
| 309 |
+ err = -EINVAL; |
| 310 |
+diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c |
| 311 |
+index ae623cd04d6ca..16f5f56332433 100644 |
| 312 |
+--- a/drivers/video/fbdev/core/fbmem.c |
| 313 |
++++ b/drivers/video/fbdev/core/fbmem.c |
| 314 |
+@@ -1001,6 +1001,10 @@ fb_set_var(struct fb_info *info, struct fb_var_screeninfo *var) |
| 315 |
+ goto done; |
| 316 |
+ } |
| 317 |
+ |
| 318 |
++ /* bitfill_aligned() assumes that it's at least 8x8 */ |
| 319 |
++ if (var->xres < 8 || var->yres < 8) |
| 320 |
++ return -EINVAL; |
| 321 |
++ |
| 322 |
+ ret = info->fbops->fb_check_var(var, info); |
| 323 |
+ |
| 324 |
+ if (ret) |
| 325 |
+diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c |
| 326 |
+index 5cad9f41c238b..cf7eccfe3469b 100644 |
| 327 |
+--- a/drivers/virtio/virtio_ring.c |
| 328 |
++++ b/drivers/virtio/virtio_ring.c |
| 329 |
+@@ -1150,7 +1150,7 @@ bool virtqueue_is_broken(struct virtqueue *_vq) |
| 330 |
+ { |
| 331 |
+ struct vring_virtqueue *vq = to_vvq(_vq); |
| 332 |
+ |
| 333 |
+- return vq->broken; |
| 334 |
++ return READ_ONCE(vq->broken); |
| 335 |
+ } |
| 336 |
+ EXPORT_SYMBOL_GPL(virtqueue_is_broken); |
| 337 |
+ |
| 338 |
+@@ -1164,7 +1164,9 @@ void virtio_break_device(struct virtio_device *dev) |
| 339 |
+ |
| 340 |
+ list_for_each_entry(_vq, &dev->vqs, list) { |
| 341 |
+ struct vring_virtqueue *vq = to_vvq(_vq); |
| 342 |
+- vq->broken = true; |
| 343 |
++ |
| 344 |
++ /* Pairs with READ_ONCE() in virtqueue_is_broken(). */ |
| 345 |
++ WRITE_ONCE(vq->broken, true); |
| 346 |
+ } |
| 347 |
+ } |
| 348 |
+ EXPORT_SYMBOL_GPL(virtio_break_device); |
| 349 |
+diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c |
| 350 |
+index 9609ad71dd260..fe1801d9f0598 100644 |
| 351 |
+--- a/net/ipv4/ip_gre.c |
| 352 |
++++ b/net/ipv4/ip_gre.c |
| 353 |
+@@ -353,6 +353,8 @@ static void __gre_xmit(struct sk_buff *skb, struct net_device *dev, |
| 354 |
+ |
| 355 |
+ static int gre_handle_offloads(struct sk_buff *skb, bool csum) |
| 356 |
+ { |
| 357 |
++ if (csum && skb_checksum_start(skb) < skb->data) |
| 358 |
++ return -EINVAL; |
| 359 |
+ return iptunnel_handle_offloads(skb, csum ? SKB_GSO_GRE_CSUM : SKB_GSO_GRE); |
| 360 |
+ } |
| 361 |
+ |
| 362 |
+diff --git a/net/rds/ib_frmr.c b/net/rds/ib_frmr.c |
| 363 |
+index 3d9c4c6397c3d..20d045faf07c6 100644 |
| 364 |
+--- a/net/rds/ib_frmr.c |
| 365 |
++++ b/net/rds/ib_frmr.c |
| 366 |
+@@ -112,9 +112,9 @@ static int rds_ib_post_reg_frmr(struct rds_ib_mr *ibmr) |
| 367 |
+ cpu_relax(); |
| 368 |
+ } |
| 369 |
+ |
| 370 |
+- ret = ib_map_mr_sg_zbva(frmr->mr, ibmr->sg, ibmr->sg_len, |
| 371 |
++ ret = ib_map_mr_sg_zbva(frmr->mr, ibmr->sg, ibmr->sg_dma_len, |
| 372 |
+ &off, PAGE_SIZE); |
| 373 |
+- if (unlikely(ret != ibmr->sg_len)) |
| 374 |
++ if (unlikely(ret != ibmr->sg_dma_len)) |
| 375 |
+ return ret < 0 ? ret : -EINVAL; |
| 376 |
+ |
| 377 |
+ /* Perform a WR for the fast_reg_mr. Each individual page |
Archives