Merge remote-tracking branch 'origin/master'kernel-4.11.0-0.rc4.git1.1.vanilla.knurd.1.fc26kernel-4.11.0-0.rc4.git1.1.vanilla.knurd.1.fc25

7 files changed, 52 insertions, 3 deletions

diff --git a/baseconfig/x86/x86_64/CONFIG_EDAC_PND2 b/baseconfig/x86/x86_64/CONFIG_EDAC_PND2
new file mode 100644
index 000000000..d0b59df60
--- /dev/null
+++ b/baseconfig/x86/x86_64/CONFIG_EDAC_PND2
@@ -0,0 +1 @@
+CONFIG_EDAC_PND2=m
diff --git a/gitrev b/gitrev
index defc91fb9..fcdf8f531 100644
--- a/gitrev
+++ b/gitrev
@@ -1 +1 @@
-ebe64824e9de4b3ab3bd3928312b4b2bc57b4b7e
+ad0376eb1483bd9880770b346f6592aece669e4c
diff --git a/kernel-x86_64-debug.config b/kernel-x86_64-debug.config
index a458b1634..5cbc52f62 100644
--- a/kernel-x86_64-debug.config
+++ b/kernel-x86_64-debug.config
@@ -1321,6 +1321,7 @@ CONFIG_EDAC_I82975X=m
 CONFIG_EDAC_IE31200=m
 CONFIG_EDAC_LEGACY_SYSFS=y
 CONFIG_EDAC_MM_EDAC=m
+CONFIG_EDAC_PND2=m
 CONFIG_EDAC_R82600=m
 CONFIG_EDAC_SBRIDGE=m
 CONFIG_EDAC_SKX=m
diff --git a/kernel-x86_64.config b/kernel-x86_64.config
index a1225d4fa..8ecda716c 100644
--- a/kernel-x86_64.config
+++ b/kernel-x86_64.config
@@ -1310,6 +1310,7 @@ CONFIG_EDAC_I82975X=m
 CONFIG_EDAC_IE31200=m
 CONFIG_EDAC_LEGACY_SYSFS=y
 CONFIG_EDAC_MM_EDAC=m
+CONFIG_EDAC_PND2=m
 CONFIG_EDAC_R82600=m
 CONFIG_EDAC_SBRIDGE=m
 CONFIG_EDAC_SKX=m
diff --git a/kernel.spec b/kernel.spec
index 413994282..43238923b 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -77,7 +77,7 @@ Summary: The Linux kernel
 # The rc snapshot level
 %global rcrev 4
 # The git snapshot level
-%define gitrev 0
+%define gitrev 1
 # Set rpm version accordingly
 %define rpmversion 4.%{upstream_sublevel}.0
 %endif
@@ -133,7 +133,7 @@ Summary: The Linux kernel
 # Set debugbuildsenabled to 1 for production (build separate debug kernels)
 #  and 0 for rawhide (all kernels are debug kernels).
 # See also 'make debug' and 'make release'.
-%define debugbuildsenabled 1
+%define debugbuildsenabled 0
 
 # Want to build a vanilla kernel build without any non-upstream patches?
 %define with_vanilla %{?_without_vanilla: 0} %{?!_without_vanilla: 1}
@@ -622,6 +622,9 @@ Patch665: netfilter-x_tables-deal-with-bogus-nextoffset-values.patch
 # Fix virtio devices rhbz 1430297
 Patch669: virtio_pci-fix-out-of-bound-access-for-msix_names.patch
 
+#CVE-2017-7261 rhbz 1435719 1435740
+Patch670: vmwgfx-check-that-number-of-mip-levels-is-above-zero.patch
+
 # END OF PATCH DEFINITIONS
 
 %endif
@@ -2189,6 +2192,15 @@ fi
 #
 #
 %changelog
+* Tue Mar 28 2017 Laura Abbott <labbott@fedoraproject.org> - 4.11.0-0.rc4.git1.1
+- Linux v4.11-rc4-18-gad0376e
+
+* Tue Mar 28 2017 Laura Abbott <labbott@fedoraproject.org>
+- Reenable debugging options.
+
+* Mon Mar 27 2017 Justin M. Forbes <jforbes@fedoraproject.org>
+- CVE-2017-7261 vmwgfx: check that number of mip levels is above zero (rhbz 1435719 1435740)
+
 * Mon Mar 27 2017 Laura Abbott <labbott@fedoraproject.org> - 4.11.0-0.rc4.git0.1
 - Linux v4.11-rc4
 
diff --git a/sources b/sources
index 45086ad7d..6b5943b73 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,4 @@
 SHA512 (linux-4.10.tar.xz) = c3690125a8402df638095bd98a613fcf1a257b81de7611c84711d315cd11e2634ab4636302b3742aedf1e3ba9ce0fea53fe8c7d48e37865d8ee5db3565220d90
 SHA512 (perf-man-4.10.tar.gz) = 2c830e06f47211d70a8330961487af73a8bc01073019475e6b6131d3bb8c95658b77ca0ae5f1b44371accf103658bc5a3a4366b3e017a4088a8fd408dd6867e8
 SHA512 (patch-4.11-rc4.xz) = d92866ffe4997a5e489c034fc1c378d7e588f76cfa18d642854ce0bf412cdbc82d8e850d6665fa5175084ec0b7662b0f53435231d2b46b13cefbb9ba63f73791
+SHA512 (patch-4.11-rc4-git1.xz) = 734f0d07977641fd9d41946d2800d98c6e0363df500d8b75c00ebf6dd35ca19392bfdf8655ed6488bad1a94fe29c532f9f44233c8ec5d54e9fc50faa83c924b7
diff --git a/vmwgfx-check-that-number-of-mip-levels-is-above-zero.patch b/vmwgfx-check-that-number-of-mip-levels-is-above-zero.patch
new file mode 100644
index 000000000..1ede96c60
--- /dev/null
+++ b/vmwgfx-check-that-number-of-mip-levels-is-above-zero.patch
@@ -0,0 +1,33 @@
+From:       Vladis Dronov <vdronov@redhat.com>
+Subject:    [PATCH] drm/vmwgfx: Check check that number of mip levels is above zero in vmw_surface_define_ioctl()
+Date:       2017-03-24 15:37:10
+
+In vmw_surface_define_ioctl(), a num_sizes parameter is assigned a
+user-controlled value which is not checked for zero. It is used in
+a call to kmalloc() which returns ZERO_SIZE_PTR. Later ZERO_SIZE_PTR
+is dereferenced which leads to a GPF and possibly to a kernel panic.
+Add the check for zero to avoid this.
+
+Reference: https://bugzilla.redhat.com/show_bug.cgi?id=1435719
+Signed-off-by: Vladis Dronov <vdronov@redhat.com>
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
+index b445ce9..42840cc 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
+@@ -716,8 +716,8 @@ int vmw_surface_define_ioctl(struct drm_device *dev, void *data,
+ 	for (i = 0; i < DRM_VMW_MAX_SURFACE_FACES; ++i)
+ 		num_sizes += req->mip_levels[i];
+ 
+-	if (num_sizes > DRM_VMW_MAX_SURFACE_FACES *
+-	    DRM_VMW_MAX_MIP_LEVELS)
++	if (num_sizes <= 0 ||
++	    num_sizes > DRM_VMW_MAX_SURFACE_FACES * DRM_VMW_MAX_MIP_LEVELS)
+ 		return -EINVAL;
+ 
+ 	size = vmw_user_surface_size + 128 +
+-- 
+2.9.3