diff options
author | Thorsten Leemhuis <fedora@leemhuis.info> | 2017-03-29 07:43:21 +0200 |
---|---|---|
committer | Thorsten Leemhuis <fedora@leemhuis.info> | 2017-03-29 07:43:21 +0200 |
commit | a6dcfee2bf285fdc55960ebfba0b29407a9e2601 (patch) | |
tree | 72a87d9abd3c3b2868f475ed6ec1a95d10b5830a | |
parent | bcf120f819f906ebe52c380edd6080b2e136c080 (diff) | |
parent | c762bd18e3ed5a078827a0a3420d310f41f301c1 (diff) | |
download | kernel-4.11.0-0.rc4.git1.1.vanilla.knurd.1.fc26.tar.gz kernel-4.11.0-0.rc4.git1.1.vanilla.knurd.1.fc26.tar.xz kernel-4.11.0-0.rc4.git1.1.vanilla.knurd.1.fc26.zip |
Merge remote-tracking branch 'origin/master'kernel-4.11.0-0.rc4.git1.1.vanilla.knurd.1.fc26kernel-4.11.0-0.rc4.git1.1.vanilla.knurd.1.fc25
-rw-r--r-- | baseconfig/x86/x86_64/CONFIG_EDAC_PND2 | 1 | ||||
-rw-r--r-- | gitrev | 2 | ||||
-rw-r--r-- | kernel-x86_64-debug.config | 1 | ||||
-rw-r--r-- | kernel-x86_64.config | 1 | ||||
-rw-r--r-- | kernel.spec | 16 | ||||
-rw-r--r-- | sources | 1 | ||||
-rw-r--r-- | vmwgfx-check-that-number-of-mip-levels-is-above-zero.patch | 33 |
7 files changed, 52 insertions, 3 deletions
diff --git a/baseconfig/x86/x86_64/CONFIG_EDAC_PND2 b/baseconfig/x86/x86_64/CONFIG_EDAC_PND2 new file mode 100644 index 000000000..d0b59df60 --- /dev/null +++ b/baseconfig/x86/x86_64/CONFIG_EDAC_PND2 @@ -0,0 +1 @@ +CONFIG_EDAC_PND2=m @@ -1 +1 @@ -ebe64824e9de4b3ab3bd3928312b4b2bc57b4b7e +ad0376eb1483bd9880770b346f6592aece669e4c diff --git a/kernel-x86_64-debug.config b/kernel-x86_64-debug.config index a458b1634..5cbc52f62 100644 --- a/kernel-x86_64-debug.config +++ b/kernel-x86_64-debug.config @@ -1321,6 +1321,7 @@ CONFIG_EDAC_I82975X=m CONFIG_EDAC_IE31200=m CONFIG_EDAC_LEGACY_SYSFS=y CONFIG_EDAC_MM_EDAC=m +CONFIG_EDAC_PND2=m CONFIG_EDAC_R82600=m CONFIG_EDAC_SBRIDGE=m CONFIG_EDAC_SKX=m diff --git a/kernel-x86_64.config b/kernel-x86_64.config index a1225d4fa..8ecda716c 100644 --- a/kernel-x86_64.config +++ b/kernel-x86_64.config @@ -1310,6 +1310,7 @@ CONFIG_EDAC_I82975X=m CONFIG_EDAC_IE31200=m CONFIG_EDAC_LEGACY_SYSFS=y CONFIG_EDAC_MM_EDAC=m +CONFIG_EDAC_PND2=m CONFIG_EDAC_R82600=m CONFIG_EDAC_SBRIDGE=m CONFIG_EDAC_SKX=m diff --git a/kernel.spec b/kernel.spec index 413994282..43238923b 100644 --- a/kernel.spec +++ b/kernel.spec @@ -77,7 +77,7 @@ Summary: The Linux kernel # The rc snapshot level %global rcrev 4 # The git snapshot level -%define gitrev 0 +%define gitrev 1 # Set rpm version accordingly %define rpmversion 4.%{upstream_sublevel}.0 %endif @@ -133,7 +133,7 @@ Summary: The Linux kernel # Set debugbuildsenabled to 1 for production (build separate debug kernels) # and 0 for rawhide (all kernels are debug kernels). # See also 'make debug' and 'make release'. -%define debugbuildsenabled 1 +%define debugbuildsenabled 0 # Want to build a vanilla kernel build without any non-upstream patches? %define with_vanilla %{?_without_vanilla: 0} %{?!_without_vanilla: 1} @@ -622,6 +622,9 @@ Patch665: netfilter-x_tables-deal-with-bogus-nextoffset-values.patch # Fix virtio devices rhbz 1430297 Patch669: virtio_pci-fix-out-of-bound-access-for-msix_names.patch +#CVE-2017-7261 rhbz 1435719 1435740 +Patch670: vmwgfx-check-that-number-of-mip-levels-is-above-zero.patch + # END OF PATCH DEFINITIONS %endif @@ -2189,6 +2192,15 @@ fi # # %changelog +* Tue Mar 28 2017 Laura Abbott <labbott@fedoraproject.org> - 4.11.0-0.rc4.git1.1 +- Linux v4.11-rc4-18-gad0376e + +* Tue Mar 28 2017 Laura Abbott <labbott@fedoraproject.org> +- Reenable debugging options. + +* Mon Mar 27 2017 Justin M. Forbes <jforbes@fedoraproject.org> +- CVE-2017-7261 vmwgfx: check that number of mip levels is above zero (rhbz 1435719 1435740) + * Mon Mar 27 2017 Laura Abbott <labbott@fedoraproject.org> - 4.11.0-0.rc4.git0.1 - Linux v4.11-rc4 @@ -1,3 +1,4 @@ SHA512 (linux-4.10.tar.xz) = c3690125a8402df638095bd98a613fcf1a257b81de7611c84711d315cd11e2634ab4636302b3742aedf1e3ba9ce0fea53fe8c7d48e37865d8ee5db3565220d90 SHA512 (perf-man-4.10.tar.gz) = 2c830e06f47211d70a8330961487af73a8bc01073019475e6b6131d3bb8c95658b77ca0ae5f1b44371accf103658bc5a3a4366b3e017a4088a8fd408dd6867e8 SHA512 (patch-4.11-rc4.xz) = d92866ffe4997a5e489c034fc1c378d7e588f76cfa18d642854ce0bf412cdbc82d8e850d6665fa5175084ec0b7662b0f53435231d2b46b13cefbb9ba63f73791 +SHA512 (patch-4.11-rc4-git1.xz) = 734f0d07977641fd9d41946d2800d98c6e0363df500d8b75c00ebf6dd35ca19392bfdf8655ed6488bad1a94fe29c532f9f44233c8ec5d54e9fc50faa83c924b7 diff --git a/vmwgfx-check-that-number-of-mip-levels-is-above-zero.patch b/vmwgfx-check-that-number-of-mip-levels-is-above-zero.patch new file mode 100644 index 000000000..1ede96c60 --- /dev/null +++ b/vmwgfx-check-that-number-of-mip-levels-is-above-zero.patch @@ -0,0 +1,33 @@ +From: Vladis Dronov <vdronov@redhat.com> +Subject: [PATCH] drm/vmwgfx: Check check that number of mip levels is above zero in vmw_surface_define_ioctl() +Date: 2017-03-24 15:37:10 + +In vmw_surface_define_ioctl(), a num_sizes parameter is assigned a +user-controlled value which is not checked for zero. It is used in +a call to kmalloc() which returns ZERO_SIZE_PTR. Later ZERO_SIZE_PTR +is dereferenced which leads to a GPF and possibly to a kernel panic. +Add the check for zero to avoid this. + +Reference: https://bugzilla.redhat.com/show_bug.cgi?id=1435719 +Signed-off-by: Vladis Dronov <vdronov@redhat.com> +--- + drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c +index b445ce9..42840cc 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c +@@ -716,8 +716,8 @@ int vmw_surface_define_ioctl(struct drm_device *dev, void *data, + for (i = 0; i < DRM_VMW_MAX_SURFACE_FACES; ++i) + num_sizes += req->mip_levels[i]; + +- if (num_sizes > DRM_VMW_MAX_SURFACE_FACES * +- DRM_VMW_MAX_MIP_LEVELS) ++ if (num_sizes <= 0 || ++ num_sizes > DRM_VMW_MAX_SURFACE_FACES * DRM_VMW_MAX_MIP_LEVELS) + return -EINVAL; + + size = vmw_user_surface_size + 128 + +-- +2.9.3 |