Linux v4.5.1

22 files changed, 7 insertions, 1204 deletions

diff --git a/0001-Input-synaptics-handle-spurious-release-of-trackstic.patch b/0001-Input-synaptics-handle-spurious-release-of-trackstic.patch
deleted file mode 100644
index 52b082b36..000000000
--- a/0001-Input-synaptics-handle-spurious-release-of-trackstic.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From cb6fcfe5a7e9197ceb7e9eec56e9c526e4e76354 Mon Sep 17 00:00:00 2001
-From: Benjamin Tissoires <benjamin.tissoires@redhat.com>
-Date: Mon, 14 Mar 2016 19:37:12 +0100
-Subject: [PATCH] Input: synaptics - handle spurious release of trackstick
- buttons, again
-
-Looks like the fimware 8.2 stall has the extra buttons spurious release
-bug.
-
-Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
----
- drivers/input/mouse/synaptics.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
-index 6025eb4..4ef8d7a 100644
---- a/drivers/input/mouse/synaptics.c
-+++ b/drivers/input/mouse/synaptics.c
-@@ -863,7 +863,8 @@ static void synaptics_report_ext_buttons(struct psmouse *psmouse,
- 		return;
- 
- 	/* Bug in FW 8.1, buttons are reported only when ExtBit is 1 */
--	if (SYN_ID_FULL(priv->identity) == 0x801 &&
-+	if ((SYN_ID_FULL(priv->identity) == 0x801 ||
-+	     SYN_ID_FULL(priv->identity) == 0x802) &&
- 	    !((psmouse->packet[0] ^ psmouse->packet[3]) & 0x02))
- 		return;
- 
--- 
-2.5.0
-
diff --git a/ALSA-usb-audio-Add-sanity-checks-for-endpoint-access.patch b/ALSA-usb-audio-Add-sanity-checks-for-endpoint-access.patch
deleted file mode 100644
index 801434a26..000000000
--- a/ALSA-usb-audio-Add-sanity-checks-for-endpoint-access.patch
+++ /dev/null
@@ -1,80 +0,0 @@
-From 873156565ca67779bbf5a3475ccd08ea3bb92522 Mon Sep 17 00:00:00 2001
-From: Takashi Iwai <tiwai@suse.de>
-Date: Tue, 15 Mar 2016 15:20:58 +0100
-Subject: [PATCH 2/2] ALSA: usb-audio: Add sanity checks for endpoint accesses
-
-Add some sanity check codes before actually accessing the endpoint via
-get_endpoint() in order to avoid the invalid access through a
-malformed USB descriptor.  Mostly just checking bNumEndpoints, but in
-one place (snd_microii_spdif_default_get()), the validity of iface and
-altsetting index is checked as well.
-
-Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=971125
-Cc: <stable@vger.kernel.org>
-Signed-off-by: Takashi Iwai <tiwai@suse.de>
----
- sound/usb/clock.c        | 2 ++
- sound/usb/endpoint.c     | 3 +++
- sound/usb/mixer_quirks.c | 4 ++++
- sound/usb/pcm.c          | 2 ++
- 4 files changed, 11 insertions(+)
-
-diff --git a/sound/usb/clock.c b/sound/usb/clock.c
-index 2ed260b10f6d..7ccbcaf6a147 100644
---- a/sound/usb/clock.c
-+++ b/sound/usb/clock.c
-@@ -285,6 +285,8 @@ static int set_sample_rate_v1(struct snd_usb_audio *chip, int iface,
- 	unsigned char data[3];
- 	int err, crate;
- 
-+	if (get_iface_desc(alts)->bNumEndpoints < 1)
-+		return -EINVAL;
- 	ep = get_endpoint(alts, 0)->bEndpointAddress;
- 
- 	/* if endpoint doesn't have sampling rate control, bail out */
-diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c
-index e6f71894ecdc..c2131b851602 100644
---- a/sound/usb/endpoint.c
-+++ b/sound/usb/endpoint.c
-@@ -415,6 +415,9 @@ exit_clear:
-  *
-  * New endpoints will be added to chip->ep_list and must be freed by
-  * calling snd_usb_endpoint_free().
-+ *
-+ * For SND_USB_ENDPOINT_TYPE_SYNC, the caller needs to guarantee that
-+ * bNumEndpoints > 1 beforehand.
-  */
- struct snd_usb_endpoint *snd_usb_add_endpoint(struct snd_usb_audio *chip,
- 					      struct usb_host_interface *alts,
-diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
-index d3608c0a29f3..2d724e3c4cc0 100644
---- a/sound/usb/mixer_quirks.c
-+++ b/sound/usb/mixer_quirks.c
-@@ -1518,7 +1518,11 @@ static int snd_microii_spdif_default_get(struct snd_kcontrol *kcontrol,
- 
- 	/* use known values for that card: interface#1 altsetting#1 */
- 	iface = usb_ifnum_to_if(chip->dev, 1);
-+	if (!iface || iface->num_altsetting < 2)
-+		return -EINVAL;
- 	alts = &iface->altsetting[1];
-+	if (get_iface_desc(alts)->bNumEndpoints < 1)
-+		return -EINVAL;
- 	ep = get_endpoint(alts, 0)->bEndpointAddress;
- 
- 	err = snd_usb_ctl_msg(chip->dev,
-diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
-index cdac5179db3f..4da64896df6d 100644
---- a/sound/usb/pcm.c
-+++ b/sound/usb/pcm.c
-@@ -159,6 +159,8 @@ static int init_pitch_v1(struct snd_usb_audio *chip, int iface,
- 	unsigned char data[1];
- 	int err;
- 
-+	if (get_iface_desc(alts)->bNumEndpoints < 1)
-+		return -EINVAL;
- 	ep = get_endpoint(alts, 0)->bEndpointAddress;
- 
- 	data[0] = 1;
--- 
-2.5.0
-
diff --git a/ALSA-usb-audio-Fix-NULL-dereference-in-create_fixed_.patch b/ALSA-usb-audio-Fix-NULL-dereference-in-create_fixed_.patch
deleted file mode 100644
index 37cdb213a..000000000
--- a/ALSA-usb-audio-Fix-NULL-dereference-in-create_fixed_.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From b0bb5691b38e2f439b071e226bad9f699c33b77d Mon Sep 17 00:00:00 2001
-From: Takashi Iwai <tiwai@suse.de>
-Date: Tue, 15 Mar 2016 12:09:10 +0100
-Subject: [PATCH 1/2] ALSA: usb-audio: Fix NULL dereference in
- create_fixed_stream_quirk()
-
-create_fixed_stream_quirk() may cause a NULL-pointer dereference by
-accessing the non-existing endpoint when a USB device with a malformed
-USB descriptor is used.
-
-This patch avoids it simply by adding a sanity check of bNumEndpoints
-before the accesses.
-
-Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=971125
-Cc: <stable@vger.kernel.org>
-Signed-off-by: Takashi Iwai <tiwai@suse.de>
----
- sound/usb/quirks.c | 6 ++++++
- 1 file changed, 6 insertions(+)
-
-diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
-index eef9b8e4b949..e128ca62eb44 100644
---- a/sound/usb/quirks.c
-+++ b/sound/usb/quirks.c
-@@ -177,6 +177,12 @@ static int create_fixed_stream_quirk(struct snd_usb_audio *chip,
- 	}
- 	alts = &iface->altsetting[fp->altset_idx];
- 	altsd = get_iface_desc(alts);
-+	if (altsd->bNumEndpoints < 1) {
-+		kfree(fp);
-+		kfree(rate_table);
-+		return -EINVAL;
-+	}
-+
- 	fp->protocol = altsd->bInterfaceProtocol;
- 
- 	if (fp->datainterval == 0)
--- 
-2.5.0
-
diff --git a/ALSA-usb-audio-Fix-double-free-in-error-paths-after-.patch b/ALSA-usb-audio-Fix-double-free-in-error-paths-after-.patch
deleted file mode 100644
index c1c72f9bf..000000000
--- a/ALSA-usb-audio-Fix-double-free-in-error-paths-after-.patch
+++ /dev/null
@@ -1,100 +0,0 @@
-From 1b9e866417f77622b03f5b9c4e2845133054e670 Mon Sep 17 00:00:00 2001
-From: Vladis Dronov <vdronov@redhat.com>
-Date: Thu, 31 Mar 2016 12:05:43 -0400
-Subject: [PATCH 2/2] ALSA: usb-audio: Fix double-free in error paths after
- snd_usb_add_audio_stream() call
-
-create_fixed_stream_quirk(), snd_usb_parse_audio_interface() and
-create_uaxx_quirk() functions allocate the audioformat object by themselves
-and free it upon error before returning. However, once the object is linked
-to a stream, it's freed again in snd_usb_audio_pcm_free(), thus it'll be
-double-freed, eventually resulting in a memory corruption.
-
-This patch fixes these failures in the error paths by unlinking the audioformat
-object before freeing it.
-
-Based on a patch by Takashi Iwai" <tiwai@suse.de>
-
-[Note for stable backports:
- this patch requires the commit 902eb7fd1e4a ('ALSA: usb-audio: Minor
- code cleanup in create_fixed_stream_quirk()')]
-
-Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1283358
-Reported-by: Ralf Spenneberg <ralf@spenneberg.net>
-Cc: <stable@vger.kernel.org> # see the note above
-Signed-off-by: Vladis Dronov <vdronov@redhat.com>
----
- sound/usb/quirks.c | 4 ++++
- sound/usb/stream.c | 6 +++++-
- 2 files changed, 9 insertions(+), 1 deletion(-)
-
-diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
-index 2f0bbc43f902..6f68ba9bda8a 100644
---- a/sound/usb/quirks.c
-+++ b/sound/usb/quirks.c
-@@ -150,6 +150,7 @@ static int create_fixed_stream_quirk(struct snd_usb_audio *chip,
- 		usb_audio_err(chip, "cannot memdup\n");
- 		return -ENOMEM;
- 	}
-+	INIT_LIST_HEAD(&fp->list);
- 	if (fp->nr_rates > MAX_NR_RATES) {
- 		kfree(fp);
- 		return -EINVAL;
-@@ -193,6 +194,7 @@ static int create_fixed_stream_quirk(struct snd_usb_audio *chip,
- 	return 0;
- 
-  error:
-+	list_del(&fp->list); /* unlink for avoiding double-free */
- 	kfree(fp);
- 	kfree(rate_table);
- 	return err;
-@@ -468,6 +470,7 @@ static int create_uaxx_quirk(struct snd_usb_audio *chip,
- 	fp->ep_attr = get_endpoint(alts, 0)->bmAttributes;
- 	fp->datainterval = 0;
- 	fp->maxpacksize = le16_to_cpu(get_endpoint(alts, 0)->wMaxPacketSize);
-+	INIT_LIST_HEAD(&fp->list);
- 
- 	switch (fp->maxpacksize) {
- 	case 0x120:
-@@ -491,6 +494,7 @@ static int create_uaxx_quirk(struct snd_usb_audio *chip,
- 		? SNDRV_PCM_STREAM_CAPTURE : SNDRV_PCM_STREAM_PLAYBACK;
- 	err = snd_usb_add_audio_stream(chip, stream, fp);
- 	if (err < 0) {
-+		list_del(&fp->list); /* unlink for avoiding double-free */
- 		kfree(fp);
- 		return err;
- 	}
-diff --git a/sound/usb/stream.c b/sound/usb/stream.c
-index 8ee14f2365e7..3b23102230c0 100644
---- a/sound/usb/stream.c
-+++ b/sound/usb/stream.c
-@@ -316,7 +316,9 @@ static struct snd_pcm_chmap_elem *convert_chmap(int channels, unsigned int bits,
- /*
-  * add this endpoint to the chip instance.
-  * if a stream with the same endpoint already exists, append to it.
-- * if not, create a new pcm stream.
-+ * if not, create a new pcm stream. note, fp is added to the substream
-+ * fmt_list and will be freed on the chip instance release. do not free
-+ * fp or do remove it from the substream fmt_list to avoid double-free.
-  */
- int snd_usb_add_audio_stream(struct snd_usb_audio *chip,
- 			     int stream,
-@@ -677,6 +679,7 @@ int snd_usb_parse_audio_interface(struct snd_usb_audio *chip, int iface_no)
- 					* (fp->maxpacksize & 0x7ff);
- 		fp->attributes = parse_uac_endpoint_attributes(chip, alts, protocol, iface_no);
- 		fp->clock = clock;
-+		INIT_LIST_HEAD(&fp->list);
- 
- 		/* some quirks for attributes here */
- 
-@@ -725,6 +728,7 @@ int snd_usb_parse_audio_interface(struct snd_usb_audio *chip, int iface_no)
- 		dev_dbg(&dev->dev, "%u:%d: add audio endpoint %#x\n", iface_no, altno, fp->endpoint);
- 		err = snd_usb_add_audio_stream(chip, stream, fp);
- 		if (err < 0) {
-+			list_del(&fp->list); /* unlink for avoiding double-free */
- 			kfree(fp->rate_table);
- 			kfree(fp->chmap);
- 			kfree(fp);
--- 
-2.5.5
-
diff --git a/ALSA-usb-audio-Minor-code-cleanup-in-create_fixed_st.patch b/ALSA-usb-audio-Minor-code-cleanup-in-create_fixed_st.patch
deleted file mode 100644
index 65f88553b..000000000
--- a/ALSA-usb-audio-Minor-code-cleanup-in-create_fixed_st.patch
+++ /dev/null
@@ -1,62 +0,0 @@
-From aa6c68ed429ba354b904554d396326bfd9ab96bf Mon Sep 17 00:00:00 2001
-From: Takashi Iwai <tiwai@suse.de>
-Date: Tue, 15 Mar 2016 12:14:49 +0100
-Subject: [PATCH 1/2] ALSA: usb-audio: Minor code cleanup in
- create_fixed_stream_quirk()
-
-Just a minor code cleanup: unify the error paths.
-
-Signed-off-by: Takashi Iwai <tiwai@suse.de>
----
- sound/usb/quirks.c | 22 +++++++++++-----------
- 1 file changed, 11 insertions(+), 11 deletions(-)
-
-diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
-index f2e4eebdf76d..2f0bbc43f902 100644
---- a/sound/usb/quirks.c
-+++ b/sound/usb/quirks.c
-@@ -167,23 +167,18 @@ static int create_fixed_stream_quirk(struct snd_usb_audio *chip,
- 	stream = (fp->endpoint & USB_DIR_IN)
- 		? SNDRV_PCM_STREAM_CAPTURE : SNDRV_PCM_STREAM_PLAYBACK;
- 	err = snd_usb_add_audio_stream(chip, stream, fp);
--	if (err < 0) {
--		kfree(fp);
--		kfree(rate_table);
--		return err;
--	}
-+	if (err < 0)
-+		goto error;
- 	if (fp->iface != get_iface_desc(&iface->altsetting[0])->bInterfaceNumber ||
- 	    fp->altset_idx >= iface->num_altsetting) {
--		kfree(fp);
--		kfree(rate_table);
--		return -EINVAL;
-+		err = -EINVAL;
-+		goto error;
- 	}
- 	alts = &iface->altsetting[fp->altset_idx];
- 	altsd = get_iface_desc(alts);
- 	if (altsd->bNumEndpoints < 1) {
--		kfree(fp);
--		kfree(rate_table);
--		return -EINVAL;
-+		err = -EINVAL;
-+		goto error;
- 	}
- 
- 	fp->protocol = altsd->bInterfaceProtocol;
-@@ -196,6 +191,11 @@ static int create_fixed_stream_quirk(struct snd_usb_audio *chip,
- 	snd_usb_init_pitch(chip, fp->iface, alts, fp);
- 	snd_usb_init_sample_rate(chip, fp->iface, alts, fp, fp->rate_max);
- 	return 0;
-+
-+ error:
-+	kfree(fp);
-+	kfree(rate_table);
-+	return err;
- }
- 
- static int create_auto_pcm_quirk(struct snd_usb_audio *chip,
--- 
-2.5.5
-
diff --git a/Input-ati_remote2-fix-crashes-on-detecting-device-wi.patch b/Input-ati_remote2-fix-crashes-on-detecting-device-wi.patch
deleted file mode 100644
index c7a461de8..000000000
--- a/Input-ati_remote2-fix-crashes-on-detecting-device-wi.patch
+++ /dev/null
@@ -1,107 +0,0 @@
-From 0f8536022831faaba3a952fa633902d9686f535f Mon Sep 17 00:00:00 2001
-From: Vladis Dronov <vdronov@redhat.com>
-Date: Wed, 23 Mar 2016 15:53:07 -0400
-Subject: [PATCH] Input: ati_remote2: fix crashes on detecting device with
- invalid descriptor
-
-The ati_remote2 driver expects at least two interfaces with one
-endpoint each. If given malicious descriptor that specify one
-interface or no endpoints, it will crash in the probe function.
-Ensure there is at least two interfaces and one endpoint for each
-interface before using it.
-
-The full disclosure: http://seclists.org/bugtraq/2016/Mar/90
-
-Reported-by: Ralf Spenneberg <ralf@spenneberg.net>
-Signed-off-by: Vladis Dronov <vdronov@redhat.com>
----
- drivers/input/misc/ati_remote2.c | 36 ++++++++++++++++++++++++++++++------
- 1 file changed, 30 insertions(+), 6 deletions(-)
-
-diff --git a/drivers/input/misc/ati_remote2.c b/drivers/input/misc/ati_remote2.c
-index cfd58e87da26..cf5d1e8d92c7 100644
---- a/drivers/input/misc/ati_remote2.c
-+++ b/drivers/input/misc/ati_remote2.c
-@@ -817,26 +817,49 @@ static int ati_remote2_probe(struct usb_interface *interface, const struct usb_d
- 
- 	ar2->udev = udev;
- 
-+	/* Sanity check, first interface must have an endpoint */
-+	if ((alt->desc.bNumEndpoints < 1) || !alt->endpoint) {
-+		dev_err(&interface->dev,
-+			"%s(): interface 0 must have an endpoint\n", __func__);
-+		r = -ENODEV;
-+		goto fail1;
-+	}
- 	ar2->intf[0] = interface;
- 	ar2->ep[0] = &alt->endpoint[0].desc;
- 
-+	/* Sanity check, the device must have two interfaces */
- 	ar2->intf[1] = usb_ifnum_to_if(udev, 1);
-+	if ((udev->actconfig->desc.bNumInterfaces < 2) || !ar2->intf[1]) {
-+		dev_err(&interface->dev, "%s(): need 2 interfaces, found %d\n",
-+			__func__, udev->actconfig->desc.bNumInterfaces);
-+		r = -ENODEV;
-+		goto fail1;
-+	}
-+
- 	r = usb_driver_claim_interface(&ati_remote2_driver, ar2->intf[1], ar2);
- 	if (r)
- 		goto fail1;
-+
-+	/* Sanity check, second interface must have an endpoint */
- 	alt = ar2->intf[1]->cur_altsetting;
-+	if ((alt->desc.bNumEndpoints < 1) || !alt->endpoint) {
-+		dev_err(&interface->dev,
-+			"%s(): interface 1 must have an endpoint\n", __func__);
-+		r = -ENODEV;
-+		goto fail2;
-+	}
- 	ar2->ep[1] = &alt->endpoint[0].desc;
- 
- 	r = ati_remote2_urb_init(ar2);
- 	if (r)
--		goto fail2;
-+		goto fail3;
- 
- 	ar2->channel_mask = channel_mask;
- 	ar2->mode_mask = mode_mask;
- 
- 	r = ati_remote2_setup(ar2, ar2->channel_mask);
- 	if (r)
--		goto fail2;
-+		goto fail3;
- 
- 	usb_make_path(udev, ar2->phys, sizeof(ar2->phys));
- 	strlcat(ar2->phys, "/input0", sizeof(ar2->phys));
-@@ -845,11 +868,11 @@ static int ati_remote2_probe(struct usb_interface *interface, const struct usb_d
- 
- 	r = sysfs_create_group(&udev->dev.kobj, &ati_remote2_attr_group);
- 	if (r)
--		goto fail2;
-+		goto fail3;
- 
- 	r = ati_remote2_input_init(ar2);
- 	if (r)
--		goto fail3;
-+		goto fail4;
- 
- 	usb_set_intfdata(interface, ar2);
- 
-@@ -857,10 +880,11 @@ static int ati_remote2_probe(struct usb_interface *interface, const struct usb_d
- 
- 	return 0;
- 
-- fail3:
-+ fail4:
- 	sysfs_remove_group(&udev->dev.kobj, &ati_remote2_attr_group);
-- fail2:
-+ fail3:
- 	ati_remote2_urb_cleanup(ar2);
-+ fail2:
- 	usb_driver_release_interface(&ati_remote2_driver, ar2->intf[1]);
-  fail1:
- 	kfree(ar2);
--- 
-2.5.0
-
diff --git a/USB-input-powermate-fix-oops-with-malicious-USB-desc.patch b/USB-input-powermate-fix-oops-with-malicious-USB-desc.patch
deleted file mode 100644
index 7de890e1b..000000000
--- a/USB-input-powermate-fix-oops-with-malicious-USB-desc.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From 0383ff3ba89d3e6c604138e3ba46685621d71f98 Mon Sep 17 00:00:00 2001
-From: Josh Boyer <jwboyer@fedoraproject.org>
-Date: Mon, 14 Mar 2016 10:02:51 -0400
-Subject: [PATCH] USB: input: powermate: fix oops with malicious USB
- descriptors
-
-The powermate driver expects at least one valid USB endpoint in its
-probe function.  If given malicious descriptors that specify 0 for
-the number of endpoints, it will crash.  Validate the number of
-endpoints on the interface before using them.
-
-The full report for this issue can be found here:
-http://seclists.org/bugtraq/2016/Mar/85
-
-Reported-by: Ralf Spenneberg <ralf@spenneberg.net>
-Cc: stable <stable@vger.kernel.org>
-Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org>
----
- drivers/input/misc/powermate.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/drivers/input/misc/powermate.c b/drivers/input/misc/powermate.c
-index 63b539d3daba..84909a12ff36 100644
---- a/drivers/input/misc/powermate.c
-+++ b/drivers/input/misc/powermate.c
-@@ -307,6 +307,9 @@ static int powermate_probe(struct usb_interface *intf, const struct usb_device_i
- 	int error = -ENOMEM;
- 
- 	interface = intf->cur_altsetting;
-+	if (interface->desc.bNumEndpoints < 1)
-+		return -EINVAL;
-+
- 	endpoint = &interface->endpoint[0].desc;
- 	if (!usb_endpoint_is_int_in(endpoint))
- 		return -EIO;
--- 
-2.5.0
-
diff --git a/USB-iowarrior-fix-oops-with-malicious-USB-descriptor.patch b/USB-iowarrior-fix-oops-with-malicious-USB-descriptor.patch
deleted file mode 100644
index 7df3af2b1..000000000
--- a/USB-iowarrior-fix-oops-with-malicious-USB-descriptor.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From 3620ebad64a327113bed34edefd45c3605086fc6 Mon Sep 17 00:00:00 2001
-From: Josh Boyer <jwboyer@fedoraproject.org>
-Date: Mon, 14 Mar 2016 10:38:31 -0400
-Subject: [PATCH] USB: iowarrior: fix oops with malicious USB descriptors
-
-The iowarrior driver expects at least one valid endpoint.  If given
-malicious descriptors that specify 0 for the number of endpoints,
-it will crash in the probe function.  Ensure there is at least
-one endpoint on the interface before using it.
-
-The full report of this issue can be found here:
-http://seclists.org/bugtraq/2016/Mar/87
-
-Reported-by: Ralf Spenneberg <ralf@spenneberg.net>
-Cc: stable <stable@vger.kernel.org>
-Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org>
----
- drivers/usb/misc/iowarrior.c | 6 ++++++
- 1 file changed, 6 insertions(+)
-
-diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c
-index c6bfd13f6c92..1950e87b4219 100644
---- a/drivers/usb/misc/iowarrior.c
-+++ b/drivers/usb/misc/iowarrior.c
-@@ -787,6 +787,12 @@ static int iowarrior_probe(struct usb_interface *interface,
- 	iface_desc = interface->cur_altsetting;
- 	dev->product_id = le16_to_cpu(udev->descriptor.idProduct);
- 
-+	if (iface_desc->desc.bNumEndpoints < 1) {
-+		dev_err(&interface->dev, "Invalid number of endpoints\n");
-+		retval = -EINVAL;
-+		goto error;
-+	}
-+
- 	/* set up the endpoint information */
- 	for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
- 		endpoint = &iface_desc->endpoint[i].desc;
--- 
-2.5.0
-
diff --git a/USB-serial-ftdi_sio-Add-support-for-ICP-DAS-I-756xU-.patch b/USB-serial-ftdi_sio-Add-support-for-ICP-DAS-I-756xU-.patch
deleted file mode 100644
index ac8e71c72..000000000
--- a/USB-serial-ftdi_sio-Add-support-for-ICP-DAS-I-756xU-.patch
+++ /dev/null
@@ -1,59 +0,0 @@
-From 94c78c81df3056e573fb84000a32512e9c16e555 Mon Sep 17 00:00:00 2001
-From: Josh Boyer <jwboyer@fedoraproject.org>
-Date: Thu, 10 Mar 2016 08:49:02 -0500
-Subject: [PATCH] USB: serial: ftdi_sio: Add support for ICP DAS I-756xU
- devices
-
-A Fedora user reports that the ftdi_sio driver works properly for the
-ICP DAS I-7561U device.  Further, the user manual for these devices
-instructs users to load the driver and add the ids using the sysfs
-interface.
-
-Add support for these in the driver directly so that the devices work
-out of the box instead of needing manual configuration.
-
-Reported-by: <thesource@mail.ru>
-CC: stable <stable@vger.kernel.org>
-Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org>
----
- drivers/usb/serial/ftdi_sio.c     | 4 ++++
- drivers/usb/serial/ftdi_sio_ids.h | 8 ++++++++
- 2 files changed, 12 insertions(+)
-
-diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
-index 8c660ae401d8..b61f12160d37 100644
---- a/drivers/usb/serial/ftdi_sio.c
-+++ b/drivers/usb/serial/ftdi_sio.c
-@@ -1004,6 +1004,10 @@ static const struct usb_device_id id_table_combined[] = {
- 	{ USB_DEVICE(FTDI_VID, CHETCO_SEASMART_DISPLAY_PID) },
- 	{ USB_DEVICE(FTDI_VID, CHETCO_SEASMART_LITE_PID) },
- 	{ USB_DEVICE(FTDI_VID, CHETCO_SEASMART_ANALOG_PID) },
-+	/* ICP DAS I-756xU devices */
-+	{ USB_DEVICE(ICPDAS_VID, ICPDAS_I7560U_PID) },
-+	{ USB_DEVICE(ICPDAS_VID, ICPDAS_I7561U_PID) },
-+	{ USB_DEVICE(ICPDAS_VID, ICPDAS_I7563U_PID) },
- 	{ }					/* Terminating entry */
- };
- 
-diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
-index a84df2513994..a4ec24ce6a11 100644
---- a/drivers/usb/serial/ftdi_sio_ids.h
-+++ b/drivers/usb/serial/ftdi_sio_ids.h
-@@ -872,6 +872,14 @@
- #define NOVITUS_BONO_E_PID		0x6010
- 
- /*
-+ * ICPDAS I-756*U devices
-+ */
-+#define ICPDAS_VID				0x1b5c
-+#define ICPDAS_I7560U_PID			0x0103
-+#define ICPDAS_I7561U_PID			0x0104
-+#define ICPDAS_I7563U_PID			0x0105
-+
-+/*
-  * RT Systems programming cables for various ham radios
-  */
- #define RTSYSTEMS_VID		0x2100	/* Vendor ID */
--- 
-2.5.0
-
diff --git a/bcm283x-Pull-upstream-fixes-plus-iproc-mmc-driver.patch b/bcm283x-Pull-upstream-fixes-plus-iproc-mmc-driver.patch
index 56f2a3981..092e7206a 100644
--- a/bcm283x-Pull-upstream-fixes-plus-iproc-mmc-driver.patch
+++ b/bcm283x-Pull-upstream-fixes-plus-iproc-mmc-driver.patch
@@ -2288,46 +2288,6 @@ index 6bcf51d..d8b8649 100644
 -- 
 2.7.3
 
-From d258332b618af0136386d4fb8f738caedae8c71d Mon Sep 17 00:00:00 2001
-From: Dan Carpenter <dan.carpenter@oracle.com>
-Date: Tue, 8 Mar 2016 15:09:41 +0300
-Subject: [PATCH 18/36] drm/vc4: Return -EFAULT on copy_from_user() failure
-
-The copy_from_user() function returns the number of bytes not copied but
-we want to return a negative error code.
-
-Fixes: 463873d57014 ('drm/vc4: Add an API for creating GPU shaders in GEM BOs.')
-Cc: stable@vger.kernel.org
-Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
-Reviewed-by: Eric Anholt <eric@anholt.net>
-Signed-off-by: Eric Anholt <eric@anholt.net>
----
- drivers/gpu/drm/vc4/vc4_bo.c | 7 ++++---
- 1 file changed, 4 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/gpu/drm/vc4/vc4_bo.c b/drivers/gpu/drm/vc4/vc4_bo.c
-index 22278bc..ac8eafe 100644
---- a/drivers/gpu/drm/vc4/vc4_bo.c
-+++ b/drivers/gpu/drm/vc4/vc4_bo.c
-@@ -499,11 +499,12 @@ vc4_create_shader_bo_ioctl(struct drm_device *dev, void *data,
- 	if (IS_ERR(bo))
- 		return PTR_ERR(bo);
- 
--	ret = copy_from_user(bo->base.vaddr,
-+	if (copy_from_user(bo->base.vaddr,
- 			     (void __user *)(uintptr_t)args->data,
--			     args->size);
--	if (ret != 0)
-+			     args->size)) {
-+		ret = -EFAULT;
- 		goto fail;
-+	}
- 	/* Clear the rest of the memory from allocating from the BO
- 	 * cache.
- 	 */
--- 
-2.7.3
-
 From ed6836e411dd559a811dd063509a01772f4fe00f Mon Sep 17 00:00:00 2001
 From: Eric Anholt <eric@anholt.net>
 Date: Fri, 4 Mar 2016 12:32:07 -0800
@@ -2361,54 +2321,6 @@ index 31de5d1..e6d3c60 100644
 -- 
 2.7.3
 
-From 142ad4bd29558b85f269a02b74c5149b514acf88 Mon Sep 17 00:00:00 2001
-From: Eric Anholt <eric@anholt.net>
-Date: Mon, 15 Feb 2016 19:03:57 -0800
-Subject: [PATCH 20/36] clk: bcm2835: Fix setting of PLL divider clock rates
-
-Our dividers weren't being set successfully because CM_PASSWORD wasn't
-included in the register write.  It looks easier to just compute the
-divider to write ourselves than to update clk-divider for the ability
-to OR in some arbitrary bits on write.
-
-Fixes about half of the video modes on my HDMI monitor (everything
-except 720x400).
-
-Cc: stable@vger.kernel.org
-Signed-off-by: Eric Anholt <eric@anholt.net>
-Signed-off-by: Michael Turquette <mturquette@baylibre.com>
----
- drivers/clk/bcm/clk-bcm2835.c | 12 +++++++-----
- 1 file changed, 7 insertions(+), 5 deletions(-)
-
-diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c
-index 015e687..9f4df8f 100644
---- a/drivers/clk/bcm/clk-bcm2835.c
-+++ b/drivers/clk/bcm/clk-bcm2835.c
-@@ -1107,13 +1107,15 @@ static int bcm2835_pll_divider_set_rate(struct clk_hw *hw,
- 	struct bcm2835_pll_divider *divider = bcm2835_pll_divider_from_hw(hw);
- 	struct bcm2835_cprman *cprman = divider->cprman;
- 	const struct bcm2835_pll_divider_data *data = divider->data;
--	u32 cm;
--	int ret;
-+	u32 cm, div, max_div = 1 << A2W_PLL_DIV_BITS;
- 
--	ret = clk_divider_ops.set_rate(hw, rate, parent_rate);
--	if (ret)
--		return ret;
-+	div = DIV_ROUND_UP_ULL(parent_rate, rate);
-+
-+	div = min(div, max_div);
-+	if (div == max_div)
-+		div = 0;
- 
-+	cprman_write(cprman, data->a2w_reg, div);
- 	cm = cprman_read(cprman, data->cm_reg);
- 	cprman_write(cprman, data->cm_reg, cm | data->load_mask);
- 	cprman_write(cprman, data->cm_reg, cm & ~data->load_mask);
--- 
-2.7.3
-
 From 55acd7db60c8247d926969b705373765c26c1f44 Mon Sep 17 00:00:00 2001
 From: Martin Sperl <kernel@martin.sperl.org>
 Date: Fri, 11 Sep 2015 11:22:05 +0000
diff --git a/cdc-acm-more-sanity-checking.patch b/cdc-acm-more-sanity-checking.patch
deleted file mode 100644
index 99ad43416..000000000
--- a/cdc-acm-more-sanity-checking.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From e6a87f147002fa16adcbafebbc458ff90a463474 Mon Sep 17 00:00:00 2001
-From: Oliver Neukum <oneukum@suse.com>
-Date: Tue, 15 Mar 2016 10:14:04 +0100
-Subject: [PATCH] cdc-acm: more sanity checking
-
-An attack has become available which pretends to be a quirky
-device circumventing normal sanity checks and crashes the kernel
-by an insufficient number of interfaces. This patch adds a check
-to the code path for quirky devices.
-
-Signed-off-by: Oliver Neukum <ONeukum@suse.com>
-CC: stable@vger.kernel.org
----
- drivers/usb/class/cdc-acm.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
-index 26ca4f910cb0..a7732f80a912 100644
---- a/drivers/usb/class/cdc-acm.c
-+++ b/drivers/usb/class/cdc-acm.c
-@@ -1113,6 +1113,9 @@ static int acm_probe(struct usb_interface *intf,
- 	if (quirks == NO_UNION_NORMAL) {
- 		data_interface = usb_ifnum_to_if(usb_dev, 1);
- 		control_interface = usb_ifnum_to_if(usb_dev, 0);
-+		/* we would crash */
-+		if (!data_interface || !control_interface)
-+			return -ENODEV;
- 		goto skip_normal_probe;
- 	}
- 
--- 
-2.5.0
-
diff --git a/cypress_m8-add-sanity-checking.patch b/cypress_m8-add-sanity-checking.patch
deleted file mode 100644
index fa8513f94..000000000
--- a/cypress_m8-add-sanity-checking.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-From f7a3aa353011e38e119adebd845b38551587a26a Mon Sep 17 00:00:00 2001
-From: Oliver Neukum <oneukum@suse.com>
-Date: Thu, 17 Mar 2016 16:25:33 +0100
-Subject: [PATCH] cypress_m8: add sanity checking
-
-An attack using missing endpoints exists.
-CVE-2016-3137
-
-Signed-off-by: Oliver Neukum <ONeukum@suse.com>
-CC: stable@vger.kernel.org
-
-v1 - add sanity check
-v2 - add error logging
-v3 - correct error message
----
- drivers/usb/serial/cypress_m8.c | 11 +++++------
- 1 file changed, 5 insertions(+), 6 deletions(-)
-
-diff --git a/drivers/usb/serial/cypress_m8.c b/drivers/usb/serial/cypress_m8.c
-index 01bf53392819..5e25443fe4ef 100644
---- a/drivers/usb/serial/cypress_m8.c
-+++ b/drivers/usb/serial/cypress_m8.c
-@@ -447,6 +447,11 @@ static int cypress_generic_port_probe(struct usb_serial_port *port)
- 	struct usb_serial *serial = port->serial;
- 	struct cypress_private *priv;
- 
-+	if (!port->interrupt_out_urb || !port->interrupt_in_urb) {
-+		dev_err(&port->dev, "A required endpoint is missing\n");
-+		return -ENODEV;
-+	}
-+
- 	priv = kzalloc(sizeof(struct cypress_private), GFP_KERNEL);
- 	if (!priv)
- 		return -ENOMEM;
-@@ -606,12 +611,6 @@ static int cypress_open(struct tty_struct *tty, struct usb_serial_port *port)
- 		cypress_set_termios(tty, port, &priv->tmp_termios);
- 
- 	/* setup the port and start reading from the device */
--	if (!port->interrupt_in_urb) {
--		dev_err(&port->dev, "%s - interrupt_in_urb is empty!\n",
--			__func__);
--		return -1;
--	}
--
- 	usb_fill_int_urb(port->interrupt_in_urb, serial->dev,
- 		usb_rcvintpipe(serial->dev, port->interrupt_in_endpointAddress),
- 		port->interrupt_in_urb->transfer_buffer,
--- 
-2.5.0
-
diff --git a/digi_acceleport-do-sanity-checking-for-the-number-of.patch b/digi_acceleport-do-sanity-checking-for-the-number-of.patch
deleted file mode 100644
index eb060eb08..000000000
--- a/digi_acceleport-do-sanity-checking-for-the-number-of.patch
+++ /dev/null
@@ -1,70 +0,0 @@
-From e9c2a3972496927631a1a98fef43e9538e9fd5d5 Mon Sep 17 00:00:00 2001
-From: Oliver Neukum <oneukum@suse.com>
-Date: Mon, 14 Mar 2016 15:53:38 +0100
-Subject: [PATCH v2] digi_acceleport: do sanity checking for the number of ports
-
-The driver can be crashed with devices that expose crafted
-descriptors with too few endpoints.
-See:
-http://seclists.org/bugtraq/2016/Mar/61
-
-Signed-off-by: Oliver Neukum <ONeukum@suse.com>
-
-v1 - added sanity checks
-v2 - moved them to probe() to fix problems Johan pointed out
----
- drivers/usb/serial/digi_acceleport.c | 24 +++++++++++++++++++-----
- 1 file changed, 19 insertions(+), 5 deletions(-)
-
-diff --git a/drivers/usb/serial/digi_acceleport.c b/drivers/usb/serial/digi_acceleport.c
-index 12b0e67..dab1dcf 100644
---- a/drivers/usb/serial/digi_acceleport.c
-+++ b/drivers/usb/serial/digi_acceleport.c
-@@ -1252,7 +1252,8 @@ static int digi_port_init(struct usb_serial_port *port, unsigned port_num)
- static int digi_startup(struct usb_serial *serial)
- {
- 	struct digi_serial *serial_priv;
--	int ret;
-+	int ret = -ENODEV;
-+	int i;
- 
- 	serial_priv = kzalloc(sizeof(*serial_priv), GFP_KERNEL);
- 	if (!serial_priv)
-@@ -1260,18 +1261,31 @@ static int digi_startup(struct usb_serial *serial)
- 
- 	spin_lock_init(&serial_priv->ds_serial_lock);
- 	serial_priv->ds_oob_port_num = serial->type->num_ports;
-+
-+	/* Check whether the expected number of ports matches the device */
-+	if (serial->num_ports < serial_priv->ds_oob_port_num)
-+		goto error;
-+	/* all features must be present */
-+	for (i = 0; i < serial->type->num_ports + 1 ; i++) {
-+		if (!serial->port[i]->read_urb)
-+			goto error;
-+		if (!serial->port[i]->write_urb)
-+			goto error;
-+	}
-+
- 	serial_priv->ds_oob_port = serial->port[serial_priv->ds_oob_port_num];
- 
- 	ret = digi_port_init(serial_priv->ds_oob_port,
- 						serial_priv->ds_oob_port_num);
--	if (ret) {
--		kfree(serial_priv);
--		return ret;
--	}
-+	if (ret)
-+		goto error;
- 
- 	usb_set_serial_data(serial, serial_priv);
- 
- 	return 0;
-+error:
-+	kfree(serial_priv);
-+	return ret;
- }
- 
- 
--- 
-2.1.4
diff --git a/ims-pcu-sanity-check-against-missing-interfaces.patch b/ims-pcu-sanity-check-against-missing-interfaces.patch
deleted file mode 100644
index 827a2b7ee..000000000
--- a/ims-pcu-sanity-check-against-missing-interfaces.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From a4200b7eb26271108586d3a7cf34a2f16d460e48 Mon Sep 17 00:00:00 2001
-From: Oliver Neukum <oneukum@suse.com>
-Date: Thu, 17 Mar 2016 15:10:47 +0100
-Subject: [PATCH] ims-pcu: sanity check against missing interfaces
-
-A malicious device missing interface can make the driver oops.
-Add sanity checking.
-
-Signed-off-by: Oliver Neukum <ONeukum@suse.com>
-CC: stable@vger.kernel.org
----
- drivers/input/misc/ims-pcu.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/drivers/input/misc/ims-pcu.c b/drivers/input/misc/ims-pcu.c
-index ac1fa5f44580..9c0ea36913b4 100644
---- a/drivers/input/misc/ims-pcu.c
-+++ b/drivers/input/misc/ims-pcu.c
-@@ -1663,6 +1663,8 @@ static int ims_pcu_parse_cdc_data(struct usb_interface *intf, struct ims_pcu *pc
- 
- 	pcu->ctrl_intf = usb_ifnum_to_if(pcu->udev,
- 					 union_desc->bMasterInterface0);
-+	if (!pcu->ctrl_intf)
-+		return -EINVAL;
- 
- 	alt = pcu->ctrl_intf->cur_altsetting;
- 	pcu->ep_ctrl = &alt->endpoint[0].desc;
-@@ -1670,6 +1672,8 @@ static int ims_pcu_parse_cdc_data(struct usb_interface *intf, struct ims_pcu *pc
- 
- 	pcu->data_intf = usb_ifnum_to_if(pcu->udev,
- 					 union_desc->bSlaveInterface0);
-+	if (!pcu->data_intf)
-+		return -EINVAL;
- 
- 	alt = pcu->data_intf->cur_altsetting;
- 	if (alt->desc.bNumEndpoints != 2) {
--- 
-2.5.0
-
diff --git a/kernel.spec b/kernel.spec
index d166d8878..a4bb22304 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -42,7 +42,7 @@ Summary: The Linux kernel
 # For non-released -rc kernels, this will be appended after the rcX and
 # gitX tags, so a 3 here would become part of release "0.rcX.gitX.3"
 #
-%global baserelease 302
+%global baserelease 300
 %global fedora_build %{baserelease}
 
 # base_sublevel is the kernel version we're starting with and patching
@@ -54,7 +54,7 @@ Summary: The Linux kernel
 %if 0%{?released_kernel}
 
 # Do we have a -stable update to apply?
-%define stable_update 0
+%define stable_update 1
 # Set rpm version accordingly
 %if 0%{?stable_update}
 %define stablerev %{stable_update}
@@ -496,7 +496,6 @@ Source5005: kbuild-AFTER_LINK.patch
 # Git trees.
 
 # Standalone patches
-
 Patch420: arm64-avoid-needing-console-to-enable-serial-console.patch
 
 Patch421: arm64-acpi-drop-expert-patch.patch
@@ -629,12 +628,6 @@ Patch646: HID-sony-do-not-bail-out-when-the-sixaxis-refuses-th.patch
 #rhbz 1309658
 Patch648: 0001-mm-CONFIG_NR_ZONES_EXTENDED.patch
 
-#rhbz 1312102
-Patch649: perf-tools-Fix-python-extension-build.patch
-
-#rhbz 1316136
-Patch663: USB-serial-ftdi_sio-Add-support-for-ICP-DAS-I-756xU-.patch
-
 #CVE-2016-3135 rhbz 1317386 1317387
 Patch664: netfilter-x_tables-check-for-size-overflow.patch
 
@@ -644,51 +637,12 @@ Patch665: netfilter-x_tables-deal-with-bogus-nextoffset-values.patch
 #CVE-2016-3135 rhbz 1318172 1318270
 Patch666: ipv4-Dont-do-expensive-useless-work-during-inetdev-des.patch
 
-#CVE-2016-2184 rhbz 1317012 1317470
-Patch670: ALSA-usb-audio-Fix-NULL-dereference-in-create_fixed_.patch
-Patch671: ALSA-usb-audio-Add-sanity-checks-for-endpoint-access.patch
-Patch667: ALSA-usb-audio-Minor-code-cleanup-in-create_fixed_st.patch
-Patch668: ALSA-usb-audio-Fix-double-free-in-error-paths-after-.patch
-
-#CVE-2016-3137 rhbz 1317010 1316996
-Patch672: cypress_m8-add-sanity-checking.patch
-
-#CVE-2016-2186 rhbz 1317015 1317464
-Patch673: USB-input-powermate-fix-oops-with-malicious-USB-desc.patch
-
-#CVE-2016-2188 rhbz 1317018 1317467
-Patch674: USB-iowarrior-fix-oops-with-malicious-USB-descriptor.patch
-
-#CVE-2016-2185 rhbz 1317014 1317471
-Patch675: usb_driver_claim_interface-add-sanity-checking.patch
-Patch669: Input-ati_remote2-fix-crashes-on-detecting-device-wi.patch
-
-#CVE-2016-3138 rhbz 1317010 1316204
-Patch676: cdc-acm-more-sanity-checking.patch
-
-#CVE-2016-3140 rhbz 1317010 1316995
-Patch677: digi_acceleport-do-sanity-checking-for-the-number-of.patch
-
-Patch678: ims-pcu-sanity-check-against-missing-interfaces.patch
-
 #rhbz 1315013
 Patch679: 0001-uas-Limit-qdepth-at-the-scsi-host-level.patch
 
-#rhbz 1317190
-Patch680: thermal-fix.patch
-
-#rhbz 1318079
-Patch681: 0001-Input-synaptics-handle-spurious-release-of-trackstic.patch
-
 #CVE-2016-2187 rhbz 1317017 1317010
 Patch686: input-gtco-fix-crash-on-detecting-device-without-end.patch
 
-#CVE-2016-3136 rhbz 1317007 1317010
-Patch687: mct_u232-sanity-checking-in-probe.patch
-
-# CVE-2016-3157 rhbz 1315711 1321948
-Patch688: x86-iopl-64-Properly-context-switch-IOPL-on-Xen-PV.patch
-
 # CVE-2016-3672 rhbz 1324749 1324750
 Patch689: x86-mm-32-Enable-full-randomization-on-i386-and-X86_.patch
 
@@ -2216,6 +2170,9 @@ fi
 #
 # 
 %changelog
+* Tue Apr 12 2016 Justin M. Forbes <jforbes@fedoraproject.org> - 4.5.1-300
+- Linux v4.5.1
+
 * Tue Apr 12 2016 Josh Boyer <jwboyer@fedoraproject.org>
 - Fix Bamboo ONE issues (rhbz 1317116)
 
diff --git a/mct_u232-sanity-checking-in-probe.patch b/mct_u232-sanity-checking-in-probe.patch
deleted file mode 100644
index 006faf15f..000000000
--- a/mct_u232-sanity-checking-in-probe.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-Subject:    [PATCH v2] mct_u232: sanity checking in probe
-From:       Oliver Neukum <oneukum@suse.com>
-Date:       2016-03-21 13:14:37
-
-An attack using the lack of sanity checking in probe
-is known. This patch checks for the existance of a
-second port.
-CVE-2016-3136
-
-Signed-off-by: Oliver Neukum <ONeukum@suse.com>
-CC: stable@vger.kernel.org
-
-v1 - add sanity check for presence of a second port
-v2 - add sanity check for an interrupt endpoint
----
- drivers/usb/serial/mct_u232.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/drivers/usb/serial/mct_u232.c b/drivers/usb/serial/mct_u232.c
-index 4446b8d..3e64538 100644
---- a/drivers/usb/serial/mct_u232.c
-+++ b/drivers/usb/serial/mct_u232.c
-@@ -378,6 +378,10 @@ static int mct_u232_port_probe(struct usb_serial_port *port)
- {
- 	struct mct_u232_private *priv;
- 
-+	/* check first to simplify error handling */
-+	if (!port->serial->port[1] || !port->serial->port[1]->interrupt_in_urb)
-+		return -ENODEV;
-+
- 	priv = kzalloc(sizeof(*priv), GFP_KERNEL);
- 	if (!priv)
- 		return -ENOMEM;
--- 
-2.1.4
diff --git a/perf-tools-Fix-python-extension-build.patch b/perf-tools-Fix-python-extension-build.patch
deleted file mode 100644
index cdca4a69b..000000000
--- a/perf-tools-Fix-python-extension-build.patch
+++ /dev/null
@@ -1,71 +0,0 @@
-From 99b0044d511e16fb373df6d8a4e011d4804432c4 Mon Sep 17 00:00:00 2001
-From: Jiri Olsa <jolsa@redhat.com>
-Date: Sat, 27 Feb 2016 21:21:12 +0100
-Subject: [PATCH] perf tools: Fix python extension build
-
-On Fri, Feb 26, 2016 at 11:59:03PM +0100, Jiri Olsa wrote:
-> On Fri, Feb 26, 2016 at 05:49:02PM -0500, Josh Boyer wrote:
->
-> SNIP
->
-> > > ./python_ext_build/tmp/home/jolsa/kernel/linux-perf/tools/perf/util/evsel.o
-> > > ./python_ext_build/tmp/home/jolsa/kernel/linux-perf/tools/perf/util/trace-event.o
-> > > ./python_ext_build/tmp/home/jolsa/kernel/linux-perf/tools/perf/util/xyarray.o
-> > > ./python_ext_build/tmp/home/jolsa/kernel/linux-perf/tools/perf/util/python.o
-> > > ./python_ext_build/tmp/home/jolsa/kernel/linux-perf/tools/perf/util/ctype.o
-> > > ./python_ext_build/tmp/home/jolsa/kernel/linux-perf/tools/perf/util/cgroup.o
-> > > ./python_ext_build/tmp/home/jolsa/kernel/linux-perf/tools/perf/util/rblist.o
-> > > ./python_ext_build/tmp/home/jolsa/kernel/linux-perf/tools/perf/util/string.o
-> > > ./python_ext_build/tmp/home/jolsa/kernel/linux-perf/tools/lib
-> > > ./python_ext_build/tmp/home/jolsa/kernel/linux-perf/tools/lib/hweight.o
-> > > ./python_ext_build/tmp/home/jolsa/kernel/linux-perf/tools/lib/rbtree.o
-> > > ./python_ext_build/tmp/home/jolsa/kernel/linux-perf/tools/lib/bitmap.o
-> > > ./python_ext_build/tmp/home/jolsa/kernel/linux-perf/tools/lib/find_bit.o
-> > >
-> > > not sure we want to come up with some 'nicer' solution
-> >
-> > I don't think anything under python_ext_build/tmp/ actually matters in
-> > any significant way.  As long as this doesn't negatively impact
-> > something via side-effect, it's probably good enough.
->
-> right, and it's probably generic sollution too
->
-> >
-> > Will you write up a full patch?
->
-> yep, will post it tomorrow
->
-> jirka
-
-sending full patch
-
-jirka
----
- tools/perf/util/setup.py | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/tools/perf/util/setup.py b/tools/perf/util/setup.py
-index 1833103768cb..c8680984d2d6 100644
---- a/tools/perf/util/setup.py
-+++ b/tools/perf/util/setup.py
-@@ -22,6 +22,7 @@ cflags = getenv('CFLAGS', '').split()
- # switch off several checks (need to be at the end of cflags list)
- cflags += ['-fno-strict-aliasing', '-Wno-write-strings', '-Wno-unused-parameter' ]
- 
-+src_perf  = getenv('srctree') + '/tools/perf'
- build_lib = getenv('PYTHON_EXTBUILD_LIB')
- build_tmp = getenv('PYTHON_EXTBUILD_TMP')
- libtraceevent = getenv('LIBTRACEEVENT')
-@@ -30,6 +31,9 @@ libapikfs = getenv('LIBAPI')
- ext_sources = [f.strip() for f in file('util/python-ext-sources')
- 				if len(f.strip()) > 0 and f[0] != '#']
- 
-+# use full paths with source files
-+ext_sources = map(lambda x: '%s/%s' % (src_perf, x) , ext_sources)
-+
- perf = Extension('perf',
- 		  sources = ext_sources,
- 		  include_dirs = ['util/include'],
--- 
-2.5.0
-
diff --git a/sources b/sources
index 4d9a84fe2..c02933f34 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,3 @@
 a60d48eee08ec0536d5efb17ca819aef  linux-4.5.tar.xz
 6f557fe90b800b615c85c2ca04da6154  perf-man-4.5.tar.gz
+1df9ff0283c1732ebbf7c55f340a121b  patch-4.5.1.xz
diff --git a/thermal-fix.patch b/thermal-fix.patch
deleted file mode 100644
index bca27cfbe..000000000
--- a/thermal-fix.patch
+++ /dev/null
@@ -1,77 +0,0 @@
-From 81ad4276b505e987dd8ebbdf63605f92cd172b52 Mon Sep 17 00:00:00 2001
-From: Zhang Rui <rui.zhang@intel.com>
-Date: Fri, 18 Mar 2016 10:03:24 +0800
-Subject: [PATCH] Thermal: Ignore invalid trip points
-
-In some cases, platform thermal driver may report invalid trip points,
-thermal core should not take any action for these trip points.
-
-CC: <stable@vger.kernel.org> #3.18+
-Link: https://bugzilla.redhat.com/show_bug.cgi?id=1317190
-Link: https://bugzilla.kernel.org/show_bug.cgi?id=114551
-Signed-off-by: Zhang Rui <rui.zhang@intel.com>
----
- drivers/thermal/thermal_core.c | 13 ++++++++++++-
- include/linux/thermal.h        |  2 ++
- 2 files changed, 14 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
-index a0a8fd1..d4b5465 100644
---- a/drivers/thermal/thermal_core.c
-+++ b/drivers/thermal/thermal_core.c
-@@ -454,6 +454,10 @@ static void handle_thermal_trip(struct thermal_zone_device *tz, int trip)
- {
- 	enum thermal_trip_type type;
- 
-+	/* Ignore disabled trip points */
-+	if (test_bit(trip, &tz->trips_disabled))
-+		return;
-+
- 	tz->ops->get_trip_type(tz, trip, &type);
- 
- 	if (type == THERMAL_TRIP_CRITICAL || type == THERMAL_TRIP_HOT)
-@@ -1800,6 +1804,7 @@ struct thermal_zone_device *thermal_zone_device_register(const char *type,
- {
- 	struct thermal_zone_device *tz;
- 	enum thermal_trip_type trip_type;
-+	int trip_temp;
- 	int result;
- 	int count;
- 	int passive = 0;
-@@ -1871,9 +1876,15 @@ struct thermal_zone_device *thermal_zone_device_register(const char *type,
- 		goto unregister;
- 
- 	for (count = 0; count < trips; count++) {
--		tz->ops->get_trip_type(tz, count, &trip_type);
-+		if (tz->ops->get_trip_type(tz, count, &trip_type))
-+			set_bit(count, &tz->trips_disabled);
- 		if (trip_type == THERMAL_TRIP_PASSIVE)
- 			passive = 1;
-+		if (tz->ops->get_trip_temp(tz, count, &trip_temp))
-+			set_bit(count, &tz->trips_disabled);
-+		/* Check for bogus trip points */
-+		if (trip_temp == 0)
-+			set_bit(count, &tz->trips_disabled);
- 	}
- 
- 	if (!passive) {
-diff --git a/include/linux/thermal.h b/include/linux/thermal.h
-index 9c48199..a55d052 100644
---- a/include/linux/thermal.h
-+++ b/include/linux/thermal.h
-@@ -156,6 +156,7 @@ struct thermal_attr {
-  * @trip_hyst_attrs:	attributes for trip points for sysfs: trip hysteresis
-  * @devdata:	private pointer for device private data
-  * @trips:	number of trip points the thermal zone supports
-+ * @trips_disabled;	bitmap for disabled trips
-  * @passive_delay:	number of milliseconds to wait between polls when
-  *			performing passive cooling.
-  * @polling_delay:	number of milliseconds to wait between polls when
-@@ -191,6 +192,7 @@ struct thermal_zone_device {
- 	struct thermal_attr *trip_hyst_attrs;
- 	void *devdata;
- 	int trips;
-+	unsigned long trips_disabled;	/* bitmap for disabled trips */
- 	int passive_delay;
- 	int polling_delay;
- 	int temperature;
diff --git a/usb_driver_claim_interface-add-sanity-checking.patch b/usb_driver_claim_interface-add-sanity-checking.patch
deleted file mode 100644
index 079ff03fd..000000000
--- a/usb_driver_claim_interface-add-sanity-checking.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From de0784bdf6314b70c69416d8c576eb83237d5b1e Mon Sep 17 00:00:00 2001
-From: Oliver Neukum <oneukum@suse.com>
-Date: Wed, 16 Mar 2016 12:26:17 -0400
-Subject: [PATCH] usb_driver_claim_interface: add sanity checking
-
-Attacks that trick drivers into passing a NULL pointer
-to usb_driver_claim_interface() using forged descriptors are
-known. This thwarts them by sanity checking.
-
-Signed-off-by: Oliver Neukum <ONeukum@suse.com>
-CC: stable@vger.kernel.org
----
- drivers/usb/core/driver.c | 6 +++++-
- 1 file changed, 5 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
-index 6b5063e7943f..e2d242b68d4b 100644
---- a/drivers/usb/core/driver.c
-+++ b/drivers/usb/core/driver.c
-@@ -500,11 +500,15 @@ static int usb_unbind_interface(struct device *dev)
- int usb_driver_claim_interface(struct usb_driver *driver,
- 				struct usb_interface *iface, void *priv)
- {
--	struct device *dev = &iface->dev;
-+	struct device *dev;
- 	struct usb_device *udev;
- 	int retval = 0;
- 	int lpm_disable_error;
- 
-+	if (!iface)
-+		return -ENODEV;
-+
-+	dev = &iface->dev;
- 	if (dev->driver)
- 		return -EBUSY;
- 
--- 
-2.5.0
-
diff --git a/x86-Lock-down-IO-port-access-when-module-security-is.patch b/x86-Lock-down-IO-port-access-when-module-security-is.patch
index 708006c2e..31126f89d 100644
--- a/x86-Lock-down-IO-port-access-when-module-security-is.patch
+++ b/x86-Lock-down-IO-port-access-when-module-security-is.patch
@@ -44,7 +44,7 @@ index 37dae792dbbe..1ecc03ca3c15 100644
 +		if (!capable(CAP_SYS_RAWIO) || secure_modules())
  			return -EPERM;
  	}
- 	regs->flags = (regs->flags & ~X86_EFLAGS_IOPL) | (level << 12);
+ 	regs->flags = (regs->flags & ~X86_EFLAGS_IOPL) |
 diff --git a/drivers/char/mem.c b/drivers/char/mem.c
 index 6b1721f978c2..53fe675f9bd7 100644
 --- a/drivers/char/mem.c
diff --git a/x86-iopl-64-Properly-context-switch-IOPL-on-Xen-PV.patch b/x86-iopl-64-Properly-context-switch-IOPL-on-Xen-PV.patch
deleted file mode 100644
index 38f7bfbb0..000000000
--- a/x86-iopl-64-Properly-context-switch-IOPL-on-Xen-PV.patch
+++ /dev/null
@@ -1,96 +0,0 @@
-From b7a584598aea7ca73140cb87b40319944dd3393f Mon Sep 17 00:00:00 2001
-From: Andy Lutomirski <luto@kernel.org>
-Date: Wed, 16 Mar 2016 14:14:21 -0700
-Subject: [PATCH] x86/iopl/64: Properly context-switch IOPL on Xen PV
-
-On Xen PV, regs->flags doesn't reliably reflect IOPL and the
-exit-to-userspace code doesn't change IOPL.  We need to context
-switch it manually.
-
-I'm doing this without going through paravirt because this is
-specific to Xen PV.  After the dust settles, we can merge this with
-the 32-bit code, tidy up the iopl syscall implementation, and remove
-the set_iopl pvop entirely.
-
-Fixes XSA-171.
-
-Reviewewd-by: Jan Beulich <JBeulich@suse.com>
-Signed-off-by: Andy Lutomirski <luto@kernel.org>
-Cc: Andrew Cooper <andrew.cooper3@citrix.com>
-Cc: Andy Lutomirski <luto@amacapital.net>
-Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
-Cc: Borislav Petkov <bp@alien8.de>
-Cc: Brian Gerst <brgerst@gmail.com>
-Cc: David Vrabel <david.vrabel@citrix.com>
-Cc: Denys Vlasenko <dvlasenk@redhat.com>
-Cc: H. Peter Anvin <hpa@zytor.com>
-Cc: Jan Beulich <JBeulich@suse.com>
-Cc: Linus Torvalds <torvalds@linux-foundation.org>
-Cc: Peter Zijlstra <peterz@infradead.org>
-Cc: Thomas Gleixner <tglx@linutronix.de>
-Cc: stable@vger.kernel.org
-Link: http://lkml.kernel.org/r/693c3bd7aeb4d3c27c92c622b7d0f554a458173c.1458162709.git.luto@kernel.org
-Signed-off-by: Ingo Molnar <mingo@kernel.org>
----
- arch/x86/include/asm/xen/hypervisor.h |  2 ++
- arch/x86/kernel/process_64.c          | 12 ++++++++++++
- arch/x86/xen/enlighten.c              |  2 +-
- 3 files changed, 15 insertions(+), 1 deletion(-)
-
-diff --git a/arch/x86/include/asm/xen/hypervisor.h b/arch/x86/include/asm/xen/hypervisor.h
-index 8b2d4bea9962..39171b3646bb 100644
---- a/arch/x86/include/asm/xen/hypervisor.h
-+++ b/arch/x86/include/asm/xen/hypervisor.h
-@@ -62,4 +62,6 @@ void xen_arch_register_cpu(int num);
- void xen_arch_unregister_cpu(int num);
- #endif
- 
-+extern void xen_set_iopl_mask(unsigned mask);
-+
- #endif /* _ASM_X86_XEN_HYPERVISOR_H */
-diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
-index b9d99e0f82c4..9f751876066f 100644
---- a/arch/x86/kernel/process_64.c
-+++ b/arch/x86/kernel/process_64.c
-@@ -48,6 +48,7 @@
- #include <asm/syscalls.h>
- #include <asm/debugreg.h>
- #include <asm/switch_to.h>
-+#include <asm/xen/hypervisor.h>
- 
- asmlinkage extern void ret_from_fork(void);
- 
-@@ -411,6 +412,17 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
- 		     task_thread_info(prev_p)->flags & _TIF_WORK_CTXSW_PREV))
- 		__switch_to_xtra(prev_p, next_p, tss);
- 
-+#ifdef CONFIG_XEN
-+	/*
-+	 * On Xen PV, IOPL bits in pt_regs->flags have no effect, and
-+	 * current_pt_regs()->flags may not match the current task's
-+	 * intended IOPL.  We need to switch it manually.
-+	 */
-+	if (unlikely(static_cpu_has(X86_FEATURE_XENPV) &&
-+		     prev->iopl != next->iopl))
-+		xen_set_iopl_mask(next->iopl);
-+#endif
-+
- 	if (static_cpu_has_bug(X86_BUG_SYSRET_SS_ATTRS)) {
- 		/*
- 		 * AMD CPUs have a misfeature: SYSRET sets the SS selector but
-diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
-index 2c261082eadf..8381fb990c7f 100644
---- a/arch/x86/xen/enlighten.c
-+++ b/arch/x86/xen/enlighten.c
-@@ -961,7 +961,7 @@ static void xen_load_sp0(struct tss_struct *tss,
- 	tss->x86_tss.sp0 = thread->sp0;
- }
- 
--static void xen_set_iopl_mask(unsigned mask)
-+void xen_set_iopl_mask(unsigned mask)
- {
- 	struct physdev_set_iopl set_iopl;
- 
--- 
-2.5.5
-