linux.git, branch v4.12.3

Linux 4.12.3

2017-07-21T04:59:24+00:00

kvm: vmx: allow host to access guest MSR_IA32_BNDCFGS

2017-07-21T04:59:13+00:00

commit 691bd4340bef49cf7e5855d06cf24444b5bf2d85 upstream.

It's easier for host applications, such as QEMU, if they can always
access guest MSR_IA32_BNDCFGS in VMCS, even though MPX is disabled in
guest cpuid.

Signed-off-by: Haozhong Zhang 
Signed-off-by: Paolo Bonzini 
Signed-off-by: Greg Kroah-Hartman

kvm: vmx: Check value written to IA32_BNDCFGS

2017-07-21T04:59:13+00:00

commit 4531662d1abf6c1f0e5c2b86ddb60e61509786c8 upstream.

Bits 11:2 must be zero and the linear addess in bits 63:12 must be
canonical. Otherwise, WRMSR(BNDCFGS) should raise #GP.

Fixes: 0dd376e709975779 ("KVM: x86: add MSR_IA32_BNDCFGS to msrs_to_save")
Signed-off-by: Jim Mattson 
Signed-off-by: Radim Krčmář 
Signed-off-by: Greg Kroah-Hartman

kvm: x86: Guest BNDCFGS requires guest MPX support

2017-07-21T04:59:13+00:00

commit 4439af9f911ae0243ffe4e2dfc12bace49605d8b upstream.

The BNDCFGS MSR should only be exposed to the guest if the guest
supports MPX. (cf. the TSC_AUX MSR and RDTSCP.)

Fixes: 0dd376e709975779 ("KVM: x86: add MSR_IA32_BNDCFGS to msrs_to_save")
Change-Id: I3ad7c01bda616715137ceac878f3fa7e66b6b387
Signed-off-by: Jim Mattson 
Signed-off-by: Radim Krčmář 
Signed-off-by: Greg Kroah-Hartman

kvm: vmx: Do not disable intercepts for BNDCFGS

2017-07-21T04:59:13+00:00

commit a8b6fda38f80e75afa3b125c9e7f2550b579454b upstream.

The MSR permission bitmaps are shared by all VMs. However, some VMs
may not be configured to support MPX, even when the host does. If the
host supports VMX and the guest does not, we should intercept accesses
to the BNDCFGS MSR, so that we can synthesize a #GP
fault. Furthermore, if the host does not support MPX and the
"ignore_msrs" kvm kernel parameter is set, then we should intercept
accesses to the BNDCFGS MSR, so that we can skip over the rdmsr/wrmsr
without raising a #GP fault.

Fixes: da8999d31818fdc8 ("KVM: x86: Intel MPX vmx and msr handle")
Signed-off-by: Jim Mattson 
Signed-off-by: Radim Krčmář 
Signed-off-by: Greg Kroah-Hartman

PM / QoS: return -EINVAL for bogus strings

2017-07-21T04:59:13+00:00

commit 2ca30331c156ca9e97643ad05dd8930b8fe78b01 upstream.

In the current code, if the user accidentally writes a bogus command to
this sysfs file, then we set the latency tolerance to an uninitialized
variable.

Fixes: 2d984ad132a8 (PM / QoS: Introcuce latency tolerance device PM QoS type)
Signed-off-by: Dan Carpenter 
Acked-by: Pavel Machek 
Signed-off-by: Rafael J. Wysocki 
Signed-off-by: Greg Kroah-Hartman

ALSA: hda/realtek - change the location for one of two front microphones

2017-07-21T04:59:13+00:00

commit f33f79f3d0e5caf04dd889cd7cf636261970f009 upstream.

On this Lenovo machine, there are two front mics, and both of them are
assigned the same name "Mic", but pulseaudio can't support two mics
with the same name, as a workaround, we change the location for one of
them, then the driver will assign "Front Mic" and "Mic" for them.

Signed-off-by: Hui Wang 
Signed-off-by: Takashi Iwai 
Signed-off-by: Greg Kroah-Hartman

ALSA: x86: Clear the pdata.notify_lpe_audio pointer before teardown

2017-07-21T04:59:12+00:00

commit 8d5c30308d7c5a17db96fa5452c0232f633377c2 upstream.

Clear the notify function pointer in the platform data before we tear
down the driver. Otherwise i915 would end up calling a stale function
pointer and possibly explode.

Cc: Takashi Iwai 
Cc: Pierre-Louis Bossart 
Signed-off-by: Ville Syrjälä 
Link: http://patchwork.freedesktop.org/patch/msgid/20170427160231.13337-3-ville.syrjala@linux.intel.com
Reviewed-by: Takashi Iwai 
Signed-off-by: Greg Kroah-Hartman

pstore: Fix leaked pstore_record in pstore_get_backend_records()

2017-07-21T04:59:12+00:00

commit f6525b96dd9f68efe374e5aef864975e628de991 upstream.

When the "if (record->size <= 0)" test is true in
pstore_get_backend_records() it's pretty clear that nobody holds a
reference to the allocated pstore_record, yet we don't free it.

Let's free it.

Fixes: 2a2b0acf768c ("pstore: Allocate records on heap instead of stack")
Signed-off-by: Douglas Anderson 
Signed-off-by: Kees Cook 
Signed-off-by: Greg Kroah-Hartman

PM / wakeirq: Convert to SRCU

2017-07-21T04:59:12+00:00

commit ea0212f40c6bc0594c8eff79266759e3ecd4bacc upstream.

The wakeirq infrastructure uses RCU to protect the list of wakeirqs. That
breaks the irq bus locking infrastructure, which is allows sleeping
functions to be called so interrupt controllers behind slow busses,
e.g. i2c, can be handled.

The wakeirq functions hold rcu_read_lock and call into irq functions, which
in case of interrupts using the irq bus locking will trigger a
might_sleep() splat.

Convert the wakeirq infrastructure to Sleepable RCU and unbreak it.

Fixes: 4990d4fe327b (PM / Wakeirq: Add automated device wake IRQ handling)
Reported-by: Brian Norris 
Suggested-by: Paul E. McKenney 
Signed-off-by: Thomas Gleixner 
Reviewed-by: Paul E. McKenney 
Tested-by: Tony Lindgren 
Tested-by: Brian Norris 
Signed-off-by: Rafael J. Wysocki 
Signed-off-by: Greg Kroah-Hartman