Merge remote-tracking branch 'origin/f25' into f25-user-thl-vanilla-fedora

4 files changed, 5 insertions, 406 deletions

diff --git a/bluetooth-properly-check-l2cap-config-option-output-buffer-length.patch b/bluetooth-properly-check-l2cap-config-option-output-buffer-length.patch
deleted file mode 100644
index fe18f57ca..000000000
--- a/bluetooth-properly-check-l2cap-config-option-output-buffer-length.patch
+++ /dev/null
@@ -1,357 +0,0 @@
-From e860d2c904d1a9f38a24eb44c9f34b8f915a6ea3 Mon Sep 17 00:00:00 2001
-From: Ben Seri <ben@armis.com>
-Date: Sat, 9 Sep 2017 23:15:59 +0200
-Subject: Bluetooth: Properly check L2CAP config option output buffer length
-
-From: Ben Seri <ben@armis.com>
-
-commit e860d2c904d1a9f38a24eb44c9f34b8f915a6ea3 upstream.
-
-Validate the output buffer length for L2CAP config requests and responses
-to avoid overflowing the stack buffer used for building the option blocks.
-
-Signed-off-by: Ben Seri <ben@armis.com>
-Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
-Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
----
- net/bluetooth/l2cap_core.c |   80 ++++++++++++++++++++++++---------------------
- 1 file changed, 43 insertions(+), 37 deletions(-)
-
---- a/net/bluetooth/l2cap_core.c
-+++ b/net/bluetooth/l2cap_core.c
-@@ -58,7 +58,7 @@ static struct sk_buff *l2cap_build_cmd(s
- 				       u8 code, u8 ident, u16 dlen, void *data);
- static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
- 			   void *data);
--static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data);
-+static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data, size_t data_size);
- static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err);
- 
- static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
-@@ -1473,7 +1473,7 @@ static void l2cap_conn_start(struct l2ca
- 
- 			set_bit(CONF_REQ_SENT, &chan->conf_state);
- 			l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
--				       l2cap_build_conf_req(chan, buf), buf);
-+				       l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
- 			chan->num_conf_req++;
- 		}
- 
-@@ -2987,12 +2987,15 @@ static inline int l2cap_get_conf_opt(voi
- 	return len;
- }
- 
--static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val)
-+static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val, size_t size)
- {
- 	struct l2cap_conf_opt *opt = *ptr;
- 
- 	BT_DBG("type 0x%2.2x len %u val 0x%lx", type, len, val);
- 
-+	if (size < L2CAP_CONF_OPT_SIZE + len)
-+		return;
-+
- 	opt->type = type;
- 	opt->len  = len;
- 
-@@ -3017,7 +3020,7 @@ static void l2cap_add_conf_opt(void **pt
- 	*ptr += L2CAP_CONF_OPT_SIZE + len;
- }
- 
--static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan)
-+static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan, size_t size)
- {
- 	struct l2cap_conf_efs efs;
- 
-@@ -3045,7 +3048,7 @@ static void l2cap_add_opt_efs(void **ptr
- 	}
- 
- 	l2cap_add_conf_opt(ptr, L2CAP_CONF_EFS, sizeof(efs),
--			   (unsigned long) &efs);
-+			   (unsigned long) &efs, size);
- }
- 
- static void l2cap_ack_timeout(struct work_struct *work)
-@@ -3191,11 +3194,12 @@ static inline void l2cap_txwin_setup(str
- 	chan->ack_win = chan->tx_win;
- }
- 
--static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data)
-+static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data, size_t data_size)
- {
- 	struct l2cap_conf_req *req = data;
- 	struct l2cap_conf_rfc rfc = { .mode = chan->mode };
- 	void *ptr = req->data;
-+	void *endptr = data + data_size;
- 	u16 size;
- 
- 	BT_DBG("chan %p", chan);
-@@ -3220,7 +3224,7 @@ static int l2cap_build_conf_req(struct l
- 
- done:
- 	if (chan->imtu != L2CAP_DEFAULT_MTU)
--		l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu);
-+		l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu, endptr - ptr);
- 
- 	switch (chan->mode) {
- 	case L2CAP_MODE_BASIC:
-@@ -3239,7 +3243,7 @@ done:
- 		rfc.max_pdu_size    = 0;
- 
- 		l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
--				   (unsigned long) &rfc);
-+				   (unsigned long) &rfc, endptr - ptr);
- 		break;
- 
- 	case L2CAP_MODE_ERTM:
-@@ -3259,21 +3263,21 @@ done:
- 				       L2CAP_DEFAULT_TX_WINDOW);
- 
- 		l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
--				   (unsigned long) &rfc);
-+				   (unsigned long) &rfc, endptr - ptr);
- 
- 		if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
--			l2cap_add_opt_efs(&ptr, chan);
-+			l2cap_add_opt_efs(&ptr, chan, endptr - ptr);
- 
- 		if (test_bit(FLAG_EXT_CTRL, &chan->flags))
- 			l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
--					   chan->tx_win);
-+					   chan->tx_win, endptr - ptr);
- 
- 		if (chan->conn->feat_mask & L2CAP_FEAT_FCS)
- 			if (chan->fcs == L2CAP_FCS_NONE ||
- 			    test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) {
- 				chan->fcs = L2CAP_FCS_NONE;
- 				l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1,
--						   chan->fcs);
-+						   chan->fcs, endptr - ptr);
- 			}
- 		break;
- 
-@@ -3291,17 +3295,17 @@ done:
- 		rfc.max_pdu_size = cpu_to_le16(size);
- 
- 		l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
--				   (unsigned long) &rfc);
-+				   (unsigned long) &rfc, endptr - ptr);
- 
- 		if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
--			l2cap_add_opt_efs(&ptr, chan);
-+			l2cap_add_opt_efs(&ptr, chan, endptr - ptr);
- 
- 		if (chan->conn->feat_mask & L2CAP_FEAT_FCS)
- 			if (chan->fcs == L2CAP_FCS_NONE ||
- 			    test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) {
- 				chan->fcs = L2CAP_FCS_NONE;
- 				l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1,
--						   chan->fcs);
-+						   chan->fcs, endptr - ptr);
- 			}
- 		break;
- 	}
-@@ -3312,10 +3316,11 @@ done:
- 	return ptr - data;
- }
- 
--static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data)
-+static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data_size)
- {
- 	struct l2cap_conf_rsp *rsp = data;
- 	void *ptr = rsp->data;
-+	void *endptr = data + data_size;
- 	void *req = chan->conf_req;
- 	int len = chan->conf_len;
- 	int type, hint, olen;
-@@ -3417,7 +3422,7 @@ done:
- 			return -ECONNREFUSED;
- 
- 		l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
--				   (unsigned long) &rfc);
-+				   (unsigned long) &rfc, endptr - ptr);
- 	}
- 
- 	if (result == L2CAP_CONF_SUCCESS) {
-@@ -3430,7 +3435,7 @@ done:
- 			chan->omtu = mtu;
- 			set_bit(CONF_MTU_DONE, &chan->conf_state);
- 		}
--		l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu);
-+		l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu, endptr - ptr);
- 
- 		if (remote_efs) {
- 			if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
-@@ -3444,7 +3449,7 @@ done:
- 
- 				l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
- 						   sizeof(efs),
--						   (unsigned long) &efs);
-+						   (unsigned long) &efs, endptr - ptr);
- 			} else {
- 				/* Send PENDING Conf Rsp */
- 				result = L2CAP_CONF_PENDING;
-@@ -3477,7 +3482,7 @@ done:
- 			set_bit(CONF_MODE_DONE, &chan->conf_state);
- 
- 			l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
--					   sizeof(rfc), (unsigned long) &rfc);
-+					   sizeof(rfc), (unsigned long) &rfc, endptr - ptr);
- 
- 			if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
- 				chan->remote_id = efs.id;
-@@ -3491,7 +3496,7 @@ done:
- 					le32_to_cpu(efs.sdu_itime);
- 				l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
- 						   sizeof(efs),
--						   (unsigned long) &efs);
-+						   (unsigned long) &efs, endptr - ptr);
- 			}
- 			break;
- 
-@@ -3505,7 +3510,7 @@ done:
- 			set_bit(CONF_MODE_DONE, &chan->conf_state);
- 
- 			l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
--					   (unsigned long) &rfc);
-+					   (unsigned long) &rfc, endptr - ptr);
- 
- 			break;
- 
-@@ -3527,10 +3532,11 @@ done:
- }
- 
- static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len,
--				void *data, u16 *result)
-+				void *data, size_t size, u16 *result)
- {
- 	struct l2cap_conf_req *req = data;
- 	void *ptr = req->data;
-+	void *endptr = data + size;
- 	int type, olen;
- 	unsigned long val;
- 	struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
-@@ -3548,13 +3554,13 @@ static int l2cap_parse_conf_rsp(struct l
- 				chan->imtu = L2CAP_DEFAULT_MIN_MTU;
- 			} else
- 				chan->imtu = val;
--			l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu);
-+			l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu, endptr - ptr);
- 			break;
- 
- 		case L2CAP_CONF_FLUSH_TO:
- 			chan->flush_to = val;
- 			l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO,
--					   2, chan->flush_to);
-+					   2, chan->flush_to, endptr - ptr);
- 			break;
- 
- 		case L2CAP_CONF_RFC:
-@@ -3568,13 +3574,13 @@ static int l2cap_parse_conf_rsp(struct l
- 			chan->fcs = 0;
- 
- 			l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
--					   sizeof(rfc), (unsigned long) &rfc);
-+					   sizeof(rfc), (unsigned long) &rfc, endptr - ptr);
- 			break;
- 
- 		case L2CAP_CONF_EWS:
- 			chan->ack_win = min_t(u16, val, chan->ack_win);
- 			l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
--					   chan->tx_win);
-+					   chan->tx_win, endptr - ptr);
- 			break;
- 
- 		case L2CAP_CONF_EFS:
-@@ -3587,7 +3593,7 @@ static int l2cap_parse_conf_rsp(struct l
- 				return -ECONNREFUSED;
- 
- 			l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs),
--					   (unsigned long) &efs);
-+					   (unsigned long) &efs, endptr - ptr);
- 			break;
- 
- 		case L2CAP_CONF_FCS:
-@@ -3692,7 +3698,7 @@ void __l2cap_connect_rsp_defer(struct l2
- 		return;
- 
- 	l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
--		       l2cap_build_conf_req(chan, buf), buf);
-+		       l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
- 	chan->num_conf_req++;
- }
- 
-@@ -3900,7 +3906,7 @@ sendresp:
- 		u8 buf[128];
- 		set_bit(CONF_REQ_SENT, &chan->conf_state);
- 		l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
--			       l2cap_build_conf_req(chan, buf), buf);
-+			       l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
- 		chan->num_conf_req++;
- 	}
- 
-@@ -3978,7 +3984,7 @@ static int l2cap_connect_create_rsp(stru
- 			break;
- 
- 		l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
--			       l2cap_build_conf_req(chan, req), req);
-+			       l2cap_build_conf_req(chan, req, sizeof(req)), req);
- 		chan->num_conf_req++;
- 		break;
- 
-@@ -4090,7 +4096,7 @@ static inline int l2cap_config_req(struc
- 	}
- 
- 	/* Complete config. */
--	len = l2cap_parse_conf_req(chan, rsp);
-+	len = l2cap_parse_conf_req(chan, rsp, sizeof(rsp));
- 	if (len < 0) {
- 		l2cap_send_disconn_req(chan, ECONNRESET);
- 		goto unlock;
-@@ -4124,7 +4130,7 @@ static inline int l2cap_config_req(struc
- 	if (!test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) {
- 		u8 buf[64];
- 		l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
--			       l2cap_build_conf_req(chan, buf), buf);
-+			       l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
- 		chan->num_conf_req++;
- 	}
- 
-@@ -4184,7 +4190,7 @@ static inline int l2cap_config_rsp(struc
- 			char buf[64];
- 
- 			len = l2cap_parse_conf_rsp(chan, rsp->data, len,
--						   buf, &result);
-+						   buf, sizeof(buf), &result);
- 			if (len < 0) {
- 				l2cap_send_disconn_req(chan, ECONNRESET);
- 				goto done;
-@@ -4214,7 +4220,7 @@ static inline int l2cap_config_rsp(struc
- 			/* throw out any old stored conf requests */
- 			result = L2CAP_CONF_SUCCESS;
- 			len = l2cap_parse_conf_rsp(chan, rsp->data, len,
--						   req, &result);
-+						   req, sizeof(req), &result);
- 			if (len < 0) {
- 				l2cap_send_disconn_req(chan, ECONNRESET);
- 				goto done;
-@@ -4791,7 +4797,7 @@ static void l2cap_do_create(struct l2cap
- 			set_bit(CONF_REQ_SENT, &chan->conf_state);
- 			l2cap_send_cmd(chan->conn, l2cap_get_ident(chan->conn),
- 				       L2CAP_CONF_REQ,
--				       l2cap_build_conf_req(chan, buf), buf);
-+				       l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
- 			chan->num_conf_req++;
- 		}
- 	}
-@@ -7465,7 +7471,7 @@ static void l2cap_security_cfm(struct hc
- 				set_bit(CONF_REQ_SENT, &chan->conf_state);
- 				l2cap_send_cmd(conn, l2cap_get_ident(conn),
- 					       L2CAP_CONF_REQ,
--					       l2cap_build_conf_req(chan, buf),
-+					       l2cap_build_conf_req(chan, buf, sizeof(buf)),
- 					       buf);
- 				chan->num_conf_req++;
- 			}
diff --git a/kernel.spec b/kernel.spec
index 0cd14c1e0..5e8b61d52 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -44,7 +44,7 @@ Summary: The Linux kernel
 # For non-released -rc kernels, this will be appended after the rcX and
 # gitX tags, so a 3 here would become part of release "0.rcX.gitX.3"
 #
-%global baserelease 201
+%global baserelease 200
 %global fedora_build %{baserelease}
 
 # base_sublevel is the kernel version we're starting with and patching
@@ -689,9 +689,6 @@ Patch706: Fix-for-module-sig-verification.patch
 # rhbz 1485086
 Patch710: pci-mark-amd-stoney-gpu-ats-as-broken.patch
 
-# rhbz 1480829
-Patch711: rt2800-fix-TX_PIN_CFG-setting-for-non-MT7620-chips.patch
-
 # CVE-2017-7558 rhbz 1480266 1484810
 Patch712: net-sctp-Avoid-out-of-bounds-reads-from-address-storage.patch
 
@@ -722,9 +719,6 @@ Patch720: kvm-nVMX-Don-t-allow-L2-to-access-the-hardware-CR8.patch
 # CVE-2017-12153 rhbz 1491046 1491057
 Patch721: nl80211-check-for-the-required-netlink-attributes-presence.patch
 
-# CVE-2017-1000251 rhbz 1489716 1490906
-Patch722: bluetooth-properly-check-l2cap-config-option-output-buffer-length.patch
-
 # END OF PATCH DEFINITIONS
 
 %endif
@@ -2302,6 +2296,9 @@ fi
 #
 #
 %changelog
+* Thu Sep 14 2017 Justin M. Forbes <jforbes@redhat.com> - 4.12.13-200
+- Linux v4.12.13
+
 * Wed Sep 13 2017 Justin M. Forbes <jforbes@fedoraproject.org>
 - Fix CVE-2017-12154 (rhbz 1491224 1491231)
 - Fix CVE-2017-12153 (rhbz 1491046 1491057)
diff --git a/rt2800-fix-TX_PIN_CFG-setting-for-non-MT7620-chips.patch b/rt2800-fix-TX_PIN_CFG-setting-for-non-MT7620-chips.patch
deleted file mode 100644
index 6c3662103..000000000
--- a/rt2800-fix-TX_PIN_CFG-setting-for-non-MT7620-chips.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From patchwork Fri Aug 25 11:38:29 2017
-Content-Type: text/plain; charset="utf-8"
-MIME-Version: 1.0
-Content-Transfer-Encoding: 7bit
-Subject: rt2800: fix TX_PIN_CFG setting for non MT7620 chips
-From: Stanislaw Gruszka <sgruszka@redhat.com>
-X-Patchwork-Id: 9921831
-Message-Id: <20170825113828.GA3959@redhat.com>
-To: linux-wireless@vger.kernel.org
-Cc: Daniel Golle <daniel@makrotopia.org>
-Date: Fri, 25 Aug 2017 13:38:29 +0200
-
-Since commit 41977e86c984 ("rt2x00: add support for MT7620") we do not
-initialize TX_PIN_CFG setting. This cause breakage at least on some
-RT3573 devices. To fix the problem patch restores previous behaviour
-for non MT7620 chips.
-
-Fixes: 41977e86c984 ("rt2x00: add support for MT7620")
-Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1480829
-Reported-and-tested-by: Jussi Eloranta <jussi.eloranta@csun.edu>
-Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
----
- drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-index d11c7b2..5672aec 100644
---- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -3699,7 +3699,10 @@ static void rt2800_config_channel(struct rt2x00_dev *rt2x00dev,
- 	if (rt2x00_rt(rt2x00dev, RT3572))
- 		rt2800_rfcsr_write(rt2x00dev, 8, 0);
- 
--	rt2800_register_read(rt2x00dev, TX_PIN_CFG, &tx_pin);
-+	if (rt2x00_rt(rt2x00dev, RT6352))
-+		rt2800_register_read(rt2x00dev, TX_PIN_CFG, &tx_pin);
-+	else
-+		tx_pin = 0;
- 
- 	switch (rt2x00dev->default_ant.tx_chain_num) {
- 	case 3:
diff --git a/sources b/sources
index 85d2d204e..03a00b9e0 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
 SHA512 (perf-man-4.12.tar.gz) = 4d3bbda1f520dba0007c351af46f45085fe4842074eb2e01aee736fd369df595f8f72ed6c1192715f1120bf3353279777f9dca1178fe93bffe5be2de700d409c
 SHA512 (linux-4.12.tar.xz) = 8e81b41b253e63233e92948941f44c6482acb52aa3a3fd172f03a38a86f2c35b2ad4fd407acd1bc3964673eba344fe104d3a03e3ff4bf9cd1f22bd44263bd728
-SHA512 (patch-4.12.12.xz) = 5c61d2f761385f24a64f218011ac4e0d620666aa19fa0b92eb3169f9a059d1d9a06cd6dd56bd4dff9d2d331c82b5f76b58349bdbf48e4e01e0c56932aaf5a7a7
+SHA512 (patch-4.12.13.xz) = c7991705a0f76a09c22777159c93c0c4c0c60c5663432da41ebefdd93ed220abec5584a02c39f12ef46148b9cb23aa50723b3159ba3467effffcf3cf1bf4f6cd