Merge 4.14-rc4 into staging-next

We want the staging/iio fixes in here as well to handle merge issues.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

4 files changed, 15 insertions, 6 deletions

diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index 917cc04a0a94..7b62df86be1d 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -1022,7 +1022,7 @@ select_insn:
                 struct bpf_map *map = (struct bpf_map *) (unsigned long) BPF_R2;
                 struct bpf_array *array = container_of(map, struct bpf_array, map);
                 struct bpf_prog *prog;
-                u64 index = BPF_R3;
+                u32 index = BPF_R3;
 
                 if (unlikely(index >= array->map.max_entries))
                         goto out;
diff --git a/kernel/bpf/devmap.c b/kernel/bpf/devmap.c
index 959c9a07f318..e093d9a2c4dd 100644
--- a/kernel/bpf/devmap.c
+++ b/kernel/bpf/devmap.c
@@ -75,8 +75,8 @@ static u64 dev_map_bitmap_size(const union bpf_attr *attr)
 static struct bpf_map *dev_map_alloc(union bpf_attr *attr)
 {
         struct bpf_dtab *dtab;
+        int err = -EINVAL;
         u64 cost;
-        int err;
 
         /* check sanity of attributes */
         if (attr->max_entries == 0 || attr->key_size != 4 ||
@@ -108,6 +108,8 @@ static struct bpf_map *dev_map_alloc(union bpf_attr *attr)
         if (err)
                 goto free_dtab;
 
+        err = -ENOMEM;
+
         /* A per cpu bitfield with a bit per possible net device */
         dtab->flush_needed = __alloc_percpu(dev_map_bitmap_size(attr),
                                             __alignof__(unsigned long));
@@ -128,7 +130,7 @@ static struct bpf_map *dev_map_alloc(union bpf_attr *attr)
 free_dtab:
         free_percpu(dtab->flush_needed);
         kfree(dtab);
-        return ERR_PTR(-ENOMEM);
+        return ERR_PTR(err);
 }
 
 static void dev_map_free(struct bpf_map *map)
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index cb17e1cd1d43..25d074920a00 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -186,15 +186,17 @@ static int bpf_map_alloc_id(struct bpf_map *map)
 
 static void bpf_map_free_id(struct bpf_map *map, bool do_idr_lock)
 {
+        unsigned long flags;
+
         if (do_idr_lock)
-                spin_lock_bh(&map_idr_lock);
+                spin_lock_irqsave(&map_idr_lock, flags);
         else
                 __acquire(&map_idr_lock);
 
         idr_remove(&map_idr, map->id);
 
         if (do_idr_lock)
-                spin_unlock_bh(&map_idr_lock);
+                spin_unlock_irqrestore(&map_idr_lock, flags);
         else
                 __release(&map_idr_lock);
 }
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 799b2451ef2d..b914fbe1383e 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -4205,7 +4205,12 @@ static int fixup_bpf_calls(struct bpf_verifier_env *env)
                 }
 
                 if (insn->imm == BPF_FUNC_redirect_map) {
-                        u64 addr = (unsigned long)prog;
+                        /* Note, we cannot use prog directly as imm as subsequent
+                         * rewrites would still change the prog pointer. The only
+                         * stable address we can use is aux, which also works with
+                         * prog clones during blinding.
+                         */
+                        u64 addr = (unsigned long)prog->aux;
                         struct bpf_insn r4_ld[] = {
                                 BPF_LD_IMM64(BPF_REG_4, addr),
                                 *insn,