Merge remote-tracking branch 'origin/f25' into f25-user-thl-vanilla-fedora

25 files changed, 26 insertions, 324 deletions

diff --git a/1-2-media-cxusb-Use-a-dma-capable-buffer-also-for-reading.patch b/1-2-media-cxusb-Use-a-dma-capable-buffer-also-for-reading.patch
deleted file mode 100644
index a3dec80d2..000000000
--- a/1-2-media-cxusb-Use-a-dma-capable-buffer-also-for-reading.patch
+++ /dev/null
@@ -1,63 +0,0 @@
-From patchwork Sun Feb  5 14:57:59 2017
-Content-Type: text/plain; charset="utf-8"
-MIME-Version: 1.0
-Content-Transfer-Encoding: 8bit
-Subject: [1/2,media] cxusb: Use a dma capable buffer also for reading
-From: =?utf-8?q?Stefan_Br=C3=BCns?= <stefan.bruens@rwth-aachen.de>
-X-Patchwork-Id: 39207
-Message-Id: <b638428812af41e080ccfc7cf7ad6963@rwthex-w2-b.rwth-ad.de>
-To: <linux-media@vger.kernel.org>
-Cc: <linux-kernel@vger.kernel.org>, Mauro Carvalho Chehab <mchehab@kernel.org>,
- Michael Krufky <mkrufky@linuxtv.org>,
- =?UTF-8?q?Stefan=20Br=C3=BCns?= <stefan.bruens@rwth-aachen.de>
-Date: Sun, 5 Feb 2017 15:57:59 +0100
-
-Commit 17ce039b4e54 ("[media] cxusb: don't do DMA on stack")
-added a kmalloc'ed bounce buffer for writes, but missed to do the same
-for reads. As the read only happens after the write is finished, we can
-reuse the same buffer.
-
-As dvb_usb_generic_rw handles a read length of 0 by itself, avoid calling
-it using the dvb_usb_generic_read wrapper function.
-
-Signed-off-by: Stefan Brüns <stefan.bruens@rwth-aachen.de>
----
- drivers/media/usb/dvb-usb/cxusb.c | 15 ++++++++-------
- 1 file changed, 8 insertions(+), 7 deletions(-)
-
-diff --git a/drivers/media/usb/dvb-usb/cxusb.c b/drivers/media/usb/dvb-usb/cxusb.c
-index 9b8c82d94b3f..8f28a63597bd 100644
---- a/drivers/media/usb/dvb-usb/cxusb.c
-+++ b/drivers/media/usb/dvb-usb/cxusb.c
-@@ -59,23 +59,24 @@ static int cxusb_ctrl_msg(struct dvb_usb_device *d,
- 			  u8 cmd, u8 *wbuf, int wlen, u8 *rbuf, int rlen)
- {
- 	struct cxusb_state *st = d->priv;
--	int ret, wo;
-+	int ret;
- 
- 	if (1 + wlen > MAX_XFER_SIZE) {
- 		warn("i2c wr: len=%d is too big!\n", wlen);
- 		return -EOPNOTSUPP;
- 	}
- 
--	wo = (rbuf == NULL || rlen == 0); /* write-only */
-+	if (rlen > MAX_XFER_SIZE) {
-+		warn("i2c rd: len=%d is too big!\n", rlen);
-+		return -EOPNOTSUPP;
-+	}
- 
- 	mutex_lock(&d->data_mutex);
- 	st->data[0] = cmd;
- 	memcpy(&st->data[1], wbuf, wlen);
--	if (wo)
--		ret = dvb_usb_generic_write(d, st->data, 1 + wlen);
--	else
--		ret = dvb_usb_generic_rw(d, st->data, 1 + wlen,
--					 rbuf, rlen, 0);
-+	ret = dvb_usb_generic_rw(d, st->data, 1 + wlen, st->data, rlen, 0);
-+	if (!ret && rbuf && rlen)
-+		memcpy(rbuf, st->data, rlen);
- 
- 	mutex_unlock(&d->data_mutex);
- 	return ret;
diff --git a/CVE-2017-7618.patch b/CVE-2017-7618.patch
deleted file mode 100644
index 4e06b1d9a..000000000
--- a/CVE-2017-7618.patch
+++ /dev/null
@@ -1,254 +0,0 @@
-From:       Herbert Xu <herbert@gondor.apana.org.au>
-Date:       2017-04-10 9:27:57
-Subject:    [PATCH v2] crypto: ahash - Fix EINPROGRESS notification callback
-
-On Mon, Apr 10, 2017 at 11:21:27AM +0200, Sabrina Dubroca wrote:
->
-> > Cc: <vger@stable.kernel.org>
-> 
-> Should that be stable@vger.kernel.org?
-
-Oops :)
-
-> > Reported-by: Sabrina Dubroca <sdubroca@redhat.com>
-> > Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
-> 
-> The definition of ahash_request_flags() was missing, so I added:
-> 
->     static inline u32 ahash_request_flags(struct ahash_request *req)
->     {
->            return req->base.flags;
->     }
-> 
-> And with this, my tests seem fine.
-> 
-> Tested-by: Sabrina Dubroca <sd@queasysnail.net>
-> Could also you change the 'Reported-by:' to that email address?
-
-OK, here is v2.
-
----8<---
-The ahash API modifies the request's callback function in order
-to clean up after itself in some corner cases (unaligned final
-and missing finup).
-
-When the request is complete ahash will restore the original
-callback and everything is fine.  However, when the request gets
-an EBUSY on a full queue, an EINPROGRESS callback is made while
-the request is still ongoing.
-
-In this case the ahash API will incorrectly call its own callback.
-
-This patch fixes the problem by creating a temporary request
-object on the stack which is used to relay EINPROGRESS back to
-the original completion function.
-
-This patch also adds code to preserve the original flags value.
-
-Fixes: ab6bf4e5e5e4 ("crypto: hash - Fix the pointer voodoo in...")
-Cc: <stable@vger.kernel.org>
-Reported-by: Sabrina Dubroca <sd@queasysnail.net>
-Tested-by: Sabrina Dubroca <sd@queasysnail.net>
-Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
-
-diff --git a/crypto/ahash.c b/crypto/ahash.c
-index e58c497..1810feb 100644
---- a/crypto/ahash.c
-+++ b/crypto/ahash.c
-@@ -32,6 +32,7 @@ struct ahash_request_priv {
- 	crypto_completion_t complete;
- 	void *data;
- 	u8 *result;
-+	u32 flags;
- 	void *ubuf[] CRYPTO_MINALIGN_ATTR;
- };
- 
-@@ -253,6 +254,8 @@ static int ahash_save_req(struct ahash_request *req, crypto_completion_t cplt)
- 	priv->result = req->result;
- 	priv->complete = req->base.complete;
- 	priv->data = req->base.data;
-+	priv->flags = req->base.flags;
-+
- 	/*
- 	 * WARNING: We do not backup req->priv here! The req->priv
- 	 *          is for internal use of the Crypto API and the
-@@ -267,38 +270,44 @@ static int ahash_save_req(struct ahash_request *req, crypto_completion_t cplt)
- 	return 0;
- }
- 
--static void ahash_restore_req(struct ahash_request *req)
-+static void ahash_restore_req(struct ahash_request *req, int err)
- {
- 	struct ahash_request_priv *priv = req->priv;
- 
-+	if (!err)
-+		memcpy(priv->result, req->result,
-+		       crypto_ahash_digestsize(crypto_ahash_reqtfm(req)));
-+
- 	/* Restore the original crypto request. */
- 	req->result = priv->result;
--	req->base.complete = priv->complete;
--	req->base.data = priv->data;
-+
-+	ahash_request_set_callback(req, priv->flags,
-+				   priv->complete, priv->data);
- 	req->priv = NULL;
- 
- 	/* Free the req->priv.priv from the ADJUSTED request. */
- 	kzfree(priv);
- }
- 
--static void ahash_op_unaligned_finish(struct ahash_request *req, int err)
-+static void ahash_notify_einprogress(struct ahash_request *req)
- {
- 	struct ahash_request_priv *priv = req->priv;
-+	struct crypto_async_request oreq;
- 
--	if (err == -EINPROGRESS)
--		return;
-+	oreq.data = priv->data;
- 
--	if (!err)
--		memcpy(priv->result, req->result,
--		       crypto_ahash_digestsize(crypto_ahash_reqtfm(req)));
--
--	ahash_restore_req(req);
-+	priv->complete(&oreq, -EINPROGRESS);
- }
- 
- static void ahash_op_unaligned_done(struct crypto_async_request *req, int err)
- {
- 	struct ahash_request *areq = req->data;
- 
-+	if (err == -EINPROGRESS) {
-+		ahash_notify_einprogress(areq);
-+		return;
-+	}
-+
- 	/*
- 	 * Restore the original request, see ahash_op_unaligned() for what
- 	 * goes where.
-@@ -309,7 +318,7 @@ static void ahash_op_unaligned_done(struct crypto_async_request *req, int err)
- 	 */
- 
- 	/* First copy req->result into req->priv.result */
--	ahash_op_unaligned_finish(areq, err);
-+	ahash_restore_req(areq, err);
- 
- 	/* Complete the ORIGINAL request. */
- 	areq->base.complete(&areq->base, err);
-@@ -325,7 +334,12 @@ static int ahash_op_unaligned(struct ahash_request *req,
- 		return err;
- 
- 	err = op(req);
--	ahash_op_unaligned_finish(req, err);
-+	if (err == -EINPROGRESS ||
-+	    (err == -EBUSY && (ahash_request_flags(req) &
-+			       CRYPTO_TFM_REQ_MAY_BACKLOG)))
-+ 		return err;
-+
-+	ahash_restore_req(req, err);
- 
- 	return err;
- }
-@@ -360,25 +374,14 @@ int crypto_ahash_digest(struct ahash_request *req)
- }
- EXPORT_SYMBOL_GPL(crypto_ahash_digest);
- 
--static void ahash_def_finup_finish2(struct ahash_request *req, int err)
-+static void ahash_def_finup_done2(struct crypto_async_request *req, int err)
- {
--	struct ahash_request_priv *priv = req->priv;
-+	struct ahash_request *areq = req->data;
- 
- 	if (err == -EINPROGRESS)
- 		return;
- 
--	if (!err)
--		memcpy(priv->result, req->result,
--		       crypto_ahash_digestsize(crypto_ahash_reqtfm(req)));
--
--	ahash_restore_req(req);
--}
--
--static void ahash_def_finup_done2(struct crypto_async_request *req, int err)
--{
--	struct ahash_request *areq = req->data;
--
--	ahash_def_finup_finish2(areq, err);
-+	ahash_restore_req(areq, err);
- 
- 	areq->base.complete(&areq->base, err);
- }
-@@ -389,11 +392,15 @@ static int ahash_def_finup_finish1(struct ahash_request *req, int err)
- 		goto out;
- 
- 	req->base.complete = ahash_def_finup_done2;
--	req->base.flags &= ~CRYPTO_TFM_REQ_MAY_SLEEP;
-+
- 	err = crypto_ahash_reqtfm(req)->final(req);
-+	if (err == -EINPROGRESS ||
-+	    (err == -EBUSY && (ahash_request_flags(req) &
-+			       CRYPTO_TFM_REQ_MAY_BACKLOG)))
-+		return err;
- 
- out:
--	ahash_def_finup_finish2(req, err);
-+	ahash_restore_req(req, err);
- 	return err;
- }
- 
-@@ -401,7 +408,16 @@ static void ahash_def_finup_done1(struct crypto_async_request *req, int err)
- {
- 	struct ahash_request *areq = req->data;
- 
-+	if (err == -EINPROGRESS) {
-+		ahash_notify_einprogress(areq);
-+		return;
-+	}
-+
-+	areq->base.flags &= ~CRYPTO_TFM_REQ_MAY_SLEEP;
-+
- 	err = ahash_def_finup_finish1(areq, err);
-+	if (areq->priv)
-+		return;
- 
- 	areq->base.complete(&areq->base, err);
- }
-@@ -416,6 +432,11 @@ static int ahash_def_finup(struct ahash_request *req)
- 		return err;
- 
- 	err = tfm->update(req);
-+	if (err == -EINPROGRESS ||
-+	    (err == -EBUSY && (ahash_request_flags(req) &
-+			       CRYPTO_TFM_REQ_MAY_BACKLOG)))
-+ 		return err;
-+
- 	return ahash_def_finup_finish1(req, err);
- }
- 
-diff --git a/include/crypto/internal/hash.h b/include/crypto/internal/hash.h
-index 1d4f365..f6d9af3e 100644
---- a/include/crypto/internal/hash.h
-+++ b/include/crypto/internal/hash.h
-@@ -166,6 +166,16 @@ static inline struct ahash_instance *ahash_alloc_instance(
- 	return crypto_alloc_instance2(name, alg, ahash_instance_headroom());
- }
- 
-+static inline void ahash_request_complete(struct ahash_request *req, int err)
-+{
-+	req->base.complete(&req->base, err);
-+}
-+
-+static inline u32 ahash_request_flags(struct ahash_request *req)
-+{
-+	return req->base.flags;
-+}
-+
- static inline struct crypto_ahash *crypto_spawn_ahash(
- 	struct crypto_ahash_spawn *spawn)
- {
--- 
-Email: Herbert Xu <herbert@gondor.apana.org.au>
-Home Page: http://gondor.apana.org.au/~herbert/
-PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
diff --git a/baseconfig/CONFIG_DEVPORT b/baseconfig/CONFIG_DEVPORT
new file mode 100644
index 000000000..555cf4be4
--- /dev/null
+++ b/baseconfig/CONFIG_DEVPORT
@@ -0,0 +1 @@
+# CONFIG_DEVPORT is not set
diff --git a/kernel-aarch64-debug.config b/kernel-aarch64-debug.config
index 7f084c7c2..968ed9315 100644
--- a/kernel-aarch64-debug.config
+++ b/kernel-aarch64-debug.config
@@ -1126,6 +1126,7 @@ CONFIG_DEVFREQ_GOV_SIMPLE_ONDEMAND=m
 CONFIG_DEVFREQ_THERMAL=y
 # CONFIG_DEVKMEM is not set
 CONFIG_DEVMEM=y
+# CONFIG_DEVPORT is not set
 CONFIG_DEVTMPFS_MOUNT=y
 CONFIG_DEVTMPFS=y
 # CONFIG_DGAP is not set
diff --git a/kernel-aarch64.config b/kernel-aarch64.config
index 8af5c11d0..8e2264045 100644
--- a/kernel-aarch64.config
+++ b/kernel-aarch64.config
@@ -1117,6 +1117,7 @@ CONFIG_DEVFREQ_GOV_SIMPLE_ONDEMAND=m
 CONFIG_DEVFREQ_THERMAL=y
 # CONFIG_DEVKMEM is not set
 CONFIG_DEVMEM=y
+# CONFIG_DEVPORT is not set
 CONFIG_DEVTMPFS_MOUNT=y
 CONFIG_DEVTMPFS=y
 # CONFIG_DGAP is not set
diff --git a/kernel-armv7hl-debug.config b/kernel-armv7hl-debug.config
index 12c8a4f20..299eba11c 100644
--- a/kernel-armv7hl-debug.config
+++ b/kernel-armv7hl-debug.config
@@ -1205,6 +1205,7 @@ CONFIG_DEVFREQ_GOV_SIMPLE_ONDEMAND=m
 CONFIG_DEVFREQ_THERMAL=y
 # CONFIG_DEVKMEM is not set
 CONFIG_DEVMEM=y
+# CONFIG_DEVPORT is not set
 CONFIG_DEVTMPFS_MOUNT=y
 CONFIG_DEVTMPFS=y
 # CONFIG_DGAP is not set
diff --git a/kernel-armv7hl-lpae-debug.config b/kernel-armv7hl-lpae-debug.config
index 04c6d88f1..3029b8591 100644
--- a/kernel-armv7hl-lpae-debug.config
+++ b/kernel-armv7hl-lpae-debug.config
@@ -1159,6 +1159,7 @@ CONFIG_DEVFREQ_GOV_SIMPLE_ONDEMAND=m
 CONFIG_DEVFREQ_THERMAL=y
 # CONFIG_DEVKMEM is not set
 CONFIG_DEVMEM=y
+# CONFIG_DEVPORT is not set
 CONFIG_DEVTMPFS_MOUNT=y
 CONFIG_DEVTMPFS=y
 # CONFIG_DGAP is not set
diff --git a/kernel-armv7hl-lpae.config b/kernel-armv7hl-lpae.config
index 493546405..236035c11 100644
--- a/kernel-armv7hl-lpae.config
+++ b/kernel-armv7hl-lpae.config
@@ -1150,6 +1150,7 @@ CONFIG_DEVFREQ_GOV_SIMPLE_ONDEMAND=m
 CONFIG_DEVFREQ_THERMAL=y
 # CONFIG_DEVKMEM is not set
 CONFIG_DEVMEM=y
+# CONFIG_DEVPORT is not set
 CONFIG_DEVTMPFS_MOUNT=y
 CONFIG_DEVTMPFS=y
 # CONFIG_DGAP is not set
diff --git a/kernel-armv7hl.config b/kernel-armv7hl.config
index ca72b40df..30d46cad8 100644
--- a/kernel-armv7hl.config
+++ b/kernel-armv7hl.config
@@ -1196,6 +1196,7 @@ CONFIG_DEVFREQ_GOV_SIMPLE_ONDEMAND=m
 CONFIG_DEVFREQ_THERMAL=y
 # CONFIG_DEVKMEM is not set
 CONFIG_DEVMEM=y
+# CONFIG_DEVPORT is not set
 CONFIG_DEVTMPFS_MOUNT=y
 CONFIG_DEVTMPFS=y
 # CONFIG_DGAP is not set
diff --git a/kernel-i686-PAE.config b/kernel-i686-PAE.config
index 8ad0bc288..fb4ea2473 100644
--- a/kernel-i686-PAE.config
+++ b/kernel-i686-PAE.config
@@ -1016,6 +1016,7 @@ CONFIG_DEVFREQ_GOV_SIMPLE_ONDEMAND=m
 # CONFIG_DEVFREQ_GOV_USERSPACE is not set
 # CONFIG_DEVKMEM is not set
 CONFIG_DEVMEM=y
+# CONFIG_DEVPORT is not set
 CONFIG_DEVTMPFS_MOUNT=y
 CONFIG_DEVTMPFS=y
 # CONFIG_DGAP is not set
diff --git a/kernel-i686-PAEdebug.config b/kernel-i686-PAEdebug.config
index 70973d0e2..f950ff72c 100644
--- a/kernel-i686-PAEdebug.config
+++ b/kernel-i686-PAEdebug.config
@@ -1025,6 +1025,7 @@ CONFIG_DEVFREQ_GOV_SIMPLE_ONDEMAND=m
 # CONFIG_DEVFREQ_GOV_USERSPACE is not set
 # CONFIG_DEVKMEM is not set
 CONFIG_DEVMEM=y
+# CONFIG_DEVPORT is not set
 CONFIG_DEVTMPFS_MOUNT=y
 CONFIG_DEVTMPFS=y
 # CONFIG_DGAP is not set
diff --git a/kernel-i686-debug.config b/kernel-i686-debug.config
index 1931dc048..0ba3ebfe6 100644
--- a/kernel-i686-debug.config
+++ b/kernel-i686-debug.config
@@ -1025,6 +1025,7 @@ CONFIG_DEVFREQ_GOV_SIMPLE_ONDEMAND=m
 # CONFIG_DEVFREQ_GOV_USERSPACE is not set
 # CONFIG_DEVKMEM is not set
 CONFIG_DEVMEM=y
+# CONFIG_DEVPORT is not set
 CONFIG_DEVTMPFS_MOUNT=y
 CONFIG_DEVTMPFS=y
 # CONFIG_DGAP is not set
diff --git a/kernel-i686.config b/kernel-i686.config
index c0811c97a..87df775bc 100644
--- a/kernel-i686.config
+++ b/kernel-i686.config
@@ -1016,6 +1016,7 @@ CONFIG_DEVFREQ_GOV_SIMPLE_ONDEMAND=m
 # CONFIG_DEVFREQ_GOV_USERSPACE is not set
 # CONFIG_DEVKMEM is not set
 CONFIG_DEVMEM=y
+# CONFIG_DEVPORT is not set
 CONFIG_DEVTMPFS_MOUNT=y
 CONFIG_DEVTMPFS=y
 # CONFIG_DGAP is not set
diff --git a/kernel-ppc64-debug.config b/kernel-ppc64-debug.config
index 65553ea78..5050e08c0 100644
--- a/kernel-ppc64-debug.config
+++ b/kernel-ppc64-debug.config
@@ -996,6 +996,7 @@ CONFIG_DEVFREQ_GOV_SIMPLE_ONDEMAND=m
 # CONFIG_DEVFREQ_GOV_USERSPACE is not set
 # CONFIG_DEVKMEM is not set
 CONFIG_DEVMEM=y
+# CONFIG_DEVPORT is not set
 CONFIG_DEVTMPFS_MOUNT=y
 CONFIG_DEVTMPFS=y
 # CONFIG_DGAP is not set
diff --git a/kernel-ppc64.config b/kernel-ppc64.config
index b760ea929..22d377c2d 100644
--- a/kernel-ppc64.config
+++ b/kernel-ppc64.config
@@ -987,6 +987,7 @@ CONFIG_DEVFREQ_GOV_SIMPLE_ONDEMAND=m
 # CONFIG_DEVFREQ_GOV_USERSPACE is not set
 # CONFIG_DEVKMEM is not set
 CONFIG_DEVMEM=y
+# CONFIG_DEVPORT is not set
 CONFIG_DEVTMPFS_MOUNT=y
 CONFIG_DEVTMPFS=y
 # CONFIG_DGAP is not set
diff --git a/kernel-ppc64le-debug.config b/kernel-ppc64le-debug.config
index b2eb1be09..e26bff1c9 100644
--- a/kernel-ppc64le-debug.config
+++ b/kernel-ppc64le-debug.config
@@ -951,6 +951,7 @@ CONFIG_DEVFREQ_GOV_SIMPLE_ONDEMAND=m
 # CONFIG_DEVFREQ_GOV_USERSPACE is not set
 # CONFIG_DEVKMEM is not set
 CONFIG_DEVMEM=y
+# CONFIG_DEVPORT is not set
 CONFIG_DEVTMPFS_MOUNT=y
 CONFIG_DEVTMPFS=y
 # CONFIG_DGAP is not set
diff --git a/kernel-ppc64le.config b/kernel-ppc64le.config
index d2bb881c2..3d7deb1dc 100644
--- a/kernel-ppc64le.config
+++ b/kernel-ppc64le.config
@@ -942,6 +942,7 @@ CONFIG_DEVFREQ_GOV_SIMPLE_ONDEMAND=m
 # CONFIG_DEVFREQ_GOV_USERSPACE is not set
 # CONFIG_DEVKMEM is not set
 CONFIG_DEVMEM=y
+# CONFIG_DEVPORT is not set
 CONFIG_DEVTMPFS_MOUNT=y
 CONFIG_DEVTMPFS=y
 # CONFIG_DGAP is not set
diff --git a/kernel-ppc64p7-debug.config b/kernel-ppc64p7-debug.config
index 84fd40d09..b30959d66 100644
--- a/kernel-ppc64p7-debug.config
+++ b/kernel-ppc64p7-debug.config
@@ -951,6 +951,7 @@ CONFIG_DEVFREQ_GOV_SIMPLE_ONDEMAND=m
 # CONFIG_DEVFREQ_GOV_USERSPACE is not set
 # CONFIG_DEVKMEM is not set
 CONFIG_DEVMEM=y
+# CONFIG_DEVPORT is not set
 CONFIG_DEVTMPFS_MOUNT=y
 CONFIG_DEVTMPFS=y
 # CONFIG_DGAP is not set
diff --git a/kernel-ppc64p7.config b/kernel-ppc64p7.config
index 9c032c8b5..26942a3a3 100644
--- a/kernel-ppc64p7.config
+++ b/kernel-ppc64p7.config
@@ -942,6 +942,7 @@ CONFIG_DEVFREQ_GOV_SIMPLE_ONDEMAND=m
 # CONFIG_DEVFREQ_GOV_USERSPACE is not set
 # CONFIG_DEVKMEM is not set
 CONFIG_DEVMEM=y
+# CONFIG_DEVPORT is not set
 CONFIG_DEVTMPFS_MOUNT=y
 CONFIG_DEVTMPFS=y
 # CONFIG_DGAP is not set
diff --git a/kernel-s390x-debug.config b/kernel-s390x-debug.config
index c305568d2..9d80de3f0 100644
--- a/kernel-s390x-debug.config
+++ b/kernel-s390x-debug.config
@@ -946,6 +946,7 @@ CONFIG_DEVFREQ_GOV_SIMPLE_ONDEMAND=m
 # CONFIG_DEVFREQ_GOV_USERSPACE is not set
 # CONFIG_DEVKMEM is not set
 CONFIG_DEVMEM=y
+# CONFIG_DEVPORT is not set
 CONFIG_DEVTMPFS_MOUNT=y
 CONFIG_DEVTMPFS=y
 # CONFIG_DGAP is not set
diff --git a/kernel-s390x.config b/kernel-s390x.config
index b82aac843..ba3c06f49 100644
--- a/kernel-s390x.config
+++ b/kernel-s390x.config
@@ -937,6 +937,7 @@ CONFIG_DEVFREQ_GOV_SIMPLE_ONDEMAND=m
 # CONFIG_DEVFREQ_GOV_USERSPACE is not set
 # CONFIG_DEVKMEM is not set
 CONFIG_DEVMEM=y
+# CONFIG_DEVPORT is not set
 CONFIG_DEVTMPFS_MOUNT=y
 CONFIG_DEVTMPFS=y
 # CONFIG_DGAP is not set
diff --git a/kernel-x86_64-debug.config b/kernel-x86_64-debug.config
index 3afcba16f..54bcb2a83 100644
--- a/kernel-x86_64-debug.config
+++ b/kernel-x86_64-debug.config
@@ -1055,6 +1055,7 @@ CONFIG_DEVFREQ_GOV_SIMPLE_ONDEMAND=m
 # CONFIG_DEVFREQ_GOV_USERSPACE is not set
 # CONFIG_DEVKMEM is not set
 CONFIG_DEVMEM=y
+# CONFIG_DEVPORT is not set
 CONFIG_DEVTMPFS_MOUNT=y
 CONFIG_DEVTMPFS=y
 # CONFIG_DGAP is not set
diff --git a/kernel-x86_64.config b/kernel-x86_64.config
index 28319571b..fe1d82d0f 100644
--- a/kernel-x86_64.config
+++ b/kernel-x86_64.config
@@ -1046,6 +1046,7 @@ CONFIG_DEVFREQ_GOV_SIMPLE_ONDEMAND=m
 # CONFIG_DEVFREQ_GOV_USERSPACE is not set
 # CONFIG_DEVKMEM is not set
 CONFIG_DEVMEM=y
+# CONFIG_DEVPORT is not set
 CONFIG_DEVTMPFS_MOUNT=y
 CONFIG_DEVTMPFS=y
 # CONFIG_DGAP is not set
diff --git a/kernel.spec b/kernel.spec
index e36501ef9..74ff55367 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -624,15 +624,9 @@ Patch860: 0001-ping-implement-proper-locking.patch
 
 Patch861: 0001-efi-libstub-Treat-missing-SecureBoot-variable-as-Sec.patch
 
-#rhbz 1439613
-Patch862: 1-2-media-cxusb-Use-a-dma-capable-buffer-also-for-reading.patch
-
 #rhbz 1441310
 Patch863: rhbz_1441310.patch
 
-# CVE-2017-7618.patch rhbz 1441095 1441093
-Patch865: CVE-2017-7618.patch
-
 # CVE-2017-7645 rhbz 1443615 1443617
 Patch866: CVE-2017-7645.patch
 
@@ -2208,6 +2202,10 @@ fi
 #
 #
 %changelog
+* Fri Apr 21 2017 Justin M. Forbes <jforbes@fedoraproject.org> - 4.10.12-200
+- Linux v4.10.12 (rhbz 1438117 1440736)
+- Fixes CVE-2017-7889 (rhbz 1444493 1444496)
+
 * Wed Apr 19 2017 Justin M. Forbes <jforbes@fedoraproject.org>
 - Fix CVE-2017-7645 (rhbz 1443615 1443617)
 
diff --git a/sources b/sources
index 4836a3572..f083b5ea1 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
 SHA512 (linux-4.10.tar.xz) = c3690125a8402df638095bd98a613fcf1a257b81de7611c84711d315cd11e2634ab4636302b3742aedf1e3ba9ce0fea53fe8c7d48e37865d8ee5db3565220d90
 SHA512 (perf-man-4.10.tar.gz) = 2c830e06f47211d70a8330961487af73a8bc01073019475e6b6131d3bb8c95658b77ca0ae5f1b44371accf103658bc5a3a4366b3e017a4088a8fd408dd6867e8
-SHA512 (patch-4.10.11.xz) = a3515be12639f12c4433c122615e841eea4a70ae1557eb305f9c175ae2fec16439a34f3a79a4d1976c19b4068bf6ff1a7b75ff600c9b6c467cfa0edb1f24fdab
+SHA512 (patch-4.10.12.xz) = 39dacec6f9ed28a3bf3339d98c9f0cc86b977252c8d2cabf5d39572cc1dff078bf8f52afdd7e6bc3213d00f7b42474d9c6a4ba641497d091b122e748a48ff0f9