Merge remote-tracking branch 'origin/master'

9 files changed, 25 insertions, 312 deletions

diff --git a/USB-serial-ftdi_sio-Add-support-for-ICP-DAS-I-756xU-.patch b/USB-serial-ftdi_sio-Add-support-for-ICP-DAS-I-756xU-.patch
deleted file mode 100644
index ac8e71c72..000000000
--- a/USB-serial-ftdi_sio-Add-support-for-ICP-DAS-I-756xU-.patch
+++ /dev/null
@@ -1,59 +0,0 @@
-From 94c78c81df3056e573fb84000a32512e9c16e555 Mon Sep 17 00:00:00 2001
-From: Josh Boyer <jwboyer@fedoraproject.org>
-Date: Thu, 10 Mar 2016 08:49:02 -0500
-Subject: [PATCH] USB: serial: ftdi_sio: Add support for ICP DAS I-756xU
- devices
-
-A Fedora user reports that the ftdi_sio driver works properly for the
-ICP DAS I-7561U device.  Further, the user manual for these devices
-instructs users to load the driver and add the ids using the sysfs
-interface.
-
-Add support for these in the driver directly so that the devices work
-out of the box instead of needing manual configuration.
-
-Reported-by: <thesource@mail.ru>
-CC: stable <stable@vger.kernel.org>
-Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org>
----
- drivers/usb/serial/ftdi_sio.c     | 4 ++++
- drivers/usb/serial/ftdi_sio_ids.h | 8 ++++++++
- 2 files changed, 12 insertions(+)
-
-diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
-index 8c660ae401d8..b61f12160d37 100644
---- a/drivers/usb/serial/ftdi_sio.c
-+++ b/drivers/usb/serial/ftdi_sio.c
-@@ -1004,6 +1004,10 @@ static const struct usb_device_id id_table_combined[] = {
- 	{ USB_DEVICE(FTDI_VID, CHETCO_SEASMART_DISPLAY_PID) },
- 	{ USB_DEVICE(FTDI_VID, CHETCO_SEASMART_LITE_PID) },
- 	{ USB_DEVICE(FTDI_VID, CHETCO_SEASMART_ANALOG_PID) },
-+	/* ICP DAS I-756xU devices */
-+	{ USB_DEVICE(ICPDAS_VID, ICPDAS_I7560U_PID) },
-+	{ USB_DEVICE(ICPDAS_VID, ICPDAS_I7561U_PID) },
-+	{ USB_DEVICE(ICPDAS_VID, ICPDAS_I7563U_PID) },
- 	{ }					/* Terminating entry */
- };
- 
-diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
-index a84df2513994..a4ec24ce6a11 100644
---- a/drivers/usb/serial/ftdi_sio_ids.h
-+++ b/drivers/usb/serial/ftdi_sio_ids.h
-@@ -872,6 +872,14 @@
- #define NOVITUS_BONO_E_PID		0x6010
- 
- /*
-+ * ICPDAS I-756*U devices
-+ */
-+#define ICPDAS_VID				0x1b5c
-+#define ICPDAS_I7560U_PID			0x0103
-+#define ICPDAS_I7561U_PID			0x0104
-+#define ICPDAS_I7563U_PID			0x0105
-+
-+/*
-  * RT Systems programming cables for various ham radios
-  */
- #define RTSYSTEMS_VID		0x2100	/* Vendor ID */
--- 
-2.5.0
-
diff --git a/config-armv7-generic b/config-armv7-generic
index a51a85b40..c564a5bc4 100644
--- a/config-armv7-generic
+++ b/config-armv7-generic
@@ -241,7 +241,8 @@ CONFIG_NVMEM_SUNXI_SID=m
 CONFIG_SERIAL_AMBA_PL011=y
 CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
 CONFIG_DMA_BCM2835=m
-CONFIG_MMC_SDHCI_BCM2835=m
+CONFIG_MMC_SDHCI_IPROC=m
+# CONFIG_MMC_SDHCI_BCM2835 is not set
 CONFIG_BCM2835_MBOX=m
 CONFIG_PWM_BCM2835=m
 CONFIG_HW_RANDOM_BCM2835=m
diff --git a/cypress_m8-add-sanity-checking.patch b/cypress_m8-add-sanity-checking.patch
deleted file mode 100644
index fa8513f94..000000000
--- a/cypress_m8-add-sanity-checking.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-From f7a3aa353011e38e119adebd845b38551587a26a Mon Sep 17 00:00:00 2001
-From: Oliver Neukum <oneukum@suse.com>
-Date: Thu, 17 Mar 2016 16:25:33 +0100
-Subject: [PATCH] cypress_m8: add sanity checking
-
-An attack using missing endpoints exists.
-CVE-2016-3137
-
-Signed-off-by: Oliver Neukum <ONeukum@suse.com>
-CC: stable@vger.kernel.org
-
-v1 - add sanity check
-v2 - add error logging
-v3 - correct error message
----
- drivers/usb/serial/cypress_m8.c | 11 +++++------
- 1 file changed, 5 insertions(+), 6 deletions(-)
-
-diff --git a/drivers/usb/serial/cypress_m8.c b/drivers/usb/serial/cypress_m8.c
-index 01bf53392819..5e25443fe4ef 100644
---- a/drivers/usb/serial/cypress_m8.c
-+++ b/drivers/usb/serial/cypress_m8.c
-@@ -447,6 +447,11 @@ static int cypress_generic_port_probe(struct usb_serial_port *port)
- 	struct usb_serial *serial = port->serial;
- 	struct cypress_private *priv;
- 
-+	if (!port->interrupt_out_urb || !port->interrupt_in_urb) {
-+		dev_err(&port->dev, "A required endpoint is missing\n");
-+		return -ENODEV;
-+	}
-+
- 	priv = kzalloc(sizeof(struct cypress_private), GFP_KERNEL);
- 	if (!priv)
- 		return -ENOMEM;
-@@ -606,12 +611,6 @@ static int cypress_open(struct tty_struct *tty, struct usb_serial_port *port)
- 		cypress_set_termios(tty, port, &priv->tmp_termios);
- 
- 	/* setup the port and start reading from the device */
--	if (!port->interrupt_in_urb) {
--		dev_err(&port->dev, "%s - interrupt_in_urb is empty!\n",
--			__func__);
--		return -1;
--	}
--
- 	usb_fill_int_urb(port->interrupt_in_urb, serial->dev,
- 		usb_rcvintpipe(serial->dev, port->interrupt_in_endpointAddress),
- 		port->interrupt_in_urb->transfer_buffer,
--- 
-2.5.0
-
diff --git a/digi_acceleport-do-sanity-checking-for-the-number-of.patch b/digi_acceleport-do-sanity-checking-for-the-number-of.patch
deleted file mode 100644
index eb060eb08..000000000
--- a/digi_acceleport-do-sanity-checking-for-the-number-of.patch
+++ /dev/null
@@ -1,70 +0,0 @@
-From e9c2a3972496927631a1a98fef43e9538e9fd5d5 Mon Sep 17 00:00:00 2001
-From: Oliver Neukum <oneukum@suse.com>
-Date: Mon, 14 Mar 2016 15:53:38 +0100
-Subject: [PATCH v2] digi_acceleport: do sanity checking for the number of ports
-
-The driver can be crashed with devices that expose crafted
-descriptors with too few endpoints.
-See:
-http://seclists.org/bugtraq/2016/Mar/61
-
-Signed-off-by: Oliver Neukum <ONeukum@suse.com>
-
-v1 - added sanity checks
-v2 - moved them to probe() to fix problems Johan pointed out
----
- drivers/usb/serial/digi_acceleport.c | 24 +++++++++++++++++++-----
- 1 file changed, 19 insertions(+), 5 deletions(-)
-
-diff --git a/drivers/usb/serial/digi_acceleport.c b/drivers/usb/serial/digi_acceleport.c
-index 12b0e67..dab1dcf 100644
---- a/drivers/usb/serial/digi_acceleport.c
-+++ b/drivers/usb/serial/digi_acceleport.c
-@@ -1252,7 +1252,8 @@ static int digi_port_init(struct usb_serial_port *port, unsigned port_num)
- static int digi_startup(struct usb_serial *serial)
- {
- 	struct digi_serial *serial_priv;
--	int ret;
-+	int ret = -ENODEV;
-+	int i;
- 
- 	serial_priv = kzalloc(sizeof(*serial_priv), GFP_KERNEL);
- 	if (!serial_priv)
-@@ -1260,18 +1261,31 @@ static int digi_startup(struct usb_serial *serial)
- 
- 	spin_lock_init(&serial_priv->ds_serial_lock);
- 	serial_priv->ds_oob_port_num = serial->type->num_ports;
-+
-+	/* Check whether the expected number of ports matches the device */
-+	if (serial->num_ports < serial_priv->ds_oob_port_num)
-+		goto error;
-+	/* all features must be present */
-+	for (i = 0; i < serial->type->num_ports + 1 ; i++) {
-+		if (!serial->port[i]->read_urb)
-+			goto error;
-+		if (!serial->port[i]->write_urb)
-+			goto error;
-+	}
-+
- 	serial_priv->ds_oob_port = serial->port[serial_priv->ds_oob_port_num];
- 
- 	ret = digi_port_init(serial_priv->ds_oob_port,
- 						serial_priv->ds_oob_port_num);
--	if (ret) {
--		kfree(serial_priv);
--		return ret;
--	}
-+	if (ret)
-+		goto error;
- 
- 	usb_set_serial_data(serial, serial_priv);
- 
- 	return 0;
-+error:
-+	kfree(serial_priv);
-+	return ret;
- }
- 
- 
--- 
-2.1.4
diff --git a/gitrev b/gitrev
index 948140534..df8154276 100644
--- a/gitrev
+++ b/gitrev
@@ -1 +1 @@
-9735a22799b9214d17d3c231fe377fc852f042e9
+3c9688876ace9ca4cd8630e5fbba8bb28235990a
diff --git a/kernel.spec b/kernel.spec
index 5726176c4..1b1f0d7c8 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -75,7 +75,7 @@ Summary: The Linux kernel
 # The next upstream release sublevel (base_sublevel+1)
 %define upstream_sublevel %(echo $((%{base_sublevel} + 1)))
 # The rc snapshot level
-%define rcrev 2
+%define rcrev 3 
 # The git snapshot level
 %define gitrev 0
 # Set rpm version accordingly
@@ -625,29 +625,15 @@ Patch571: ideapad-laptop-Add-Lenovo-ideapad-Y700-17ISK-to-no_h.patch
 #Required for some persistent memory options
 Patch641: disable-CONFIG_EXPERT-for-ZONE_DMA.patch
 
-#rhbz 1316136
-Patch663: USB-serial-ftdi_sio-Add-support-for-ICP-DAS-I-756xU-.patch
-
 #CVE-2016-3134 rhbz 1317383 1317384
 Patch665: netfilter-x_tables-deal-with-bogus-nextoffset-values.patch
 
-#CVE-2016-3137 rhbz 1317010 1316996
-Patch672: cypress_m8-add-sanity-checking.patch
-
-#CVE-2016-3140 rhbz 1317010 1316995
-Patch677: digi_acceleport-do-sanity-checking-for-the-number-of.patch
-
 #rhbz 1315013
 Patch683: 0001-uas-Limit-qdepth-at-the-scsi-host-level.patch
 
 #CVE-2016-2187 rhbz 1317017 1317010
 Patch686: input-gtco-fix-crash-on-detecting-device-without-end.patch
 
-#CVE-2016-3136 rhbz 1317007 1317010
-Patch687: mct_u232-sanity-checking-in-probe.patch
-
-Patch688: sound-usb-fix-NULL-dereference-in-usb_audio_probe.patch
-
 # END OF PATCH DEFINITIONS
 
 %endif
@@ -2176,6 +2162,26 @@ fi
 #
 # 
 %changelog
+* Mon Apr 11 2016 Josh Boyer <jwboyer@fedoraproject.org> - 4.6.0-0.rc3.git0.1
+- Linux v4.6-rc3
+- Disable debugging options.
+
+* Sun Apr 10 2016 Peter Robinson <pbrobinson@fedoraproject.org>
+- Use the correct MMC driver for some ARM platforms
+
+* Fri Apr 08 2016 Justin M. Forbes <jforbes@fedoraproject.org> - 4.6.0-0.rc2.git4.1
+- Linux v4.6-rc2-151-g3c96888
+
+* Thu Apr 07 2016 Justin M. Forbes <jforbes@fedoraproject.org> - 4.6.0-0.rc2.git3.1
+- Linux v4.6-rc2-88-gc4004b0
+
+* Wed Apr 06 2016 Justin M. Forbes <jforbes@fedoraproject.org> - 4.6.0-0.rc2.git2.1
+- Linux v4.6-rc2-84-g541d8f4
+
+* Tue Apr 05 2016 Justin M. Forbes <jforbes@fedoraproject.org> - 4.6.0-0.rc2.git1.1
+- Linux v4.6-rc2-42-g1e1e5ce
+- Reenable debugging options.
+
 * Mon Apr 04 2016 Justin M. Forbes <jforbes@fedoraproject.org> - 4.6.0-0.rc2.git0.1
 - Linux v4.6-rc2
 
diff --git a/mct_u232-sanity-checking-in-probe.patch b/mct_u232-sanity-checking-in-probe.patch
deleted file mode 100644
index 006faf15f..000000000
--- a/mct_u232-sanity-checking-in-probe.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-Subject:    [PATCH v2] mct_u232: sanity checking in probe
-From:       Oliver Neukum <oneukum@suse.com>
-Date:       2016-03-21 13:14:37
-
-An attack using the lack of sanity checking in probe
-is known. This patch checks for the existance of a
-second port.
-CVE-2016-3136
-
-Signed-off-by: Oliver Neukum <ONeukum@suse.com>
-CC: stable@vger.kernel.org
-
-v1 - add sanity check for presence of a second port
-v2 - add sanity check for an interrupt endpoint
----
- drivers/usb/serial/mct_u232.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/drivers/usb/serial/mct_u232.c b/drivers/usb/serial/mct_u232.c
-index 4446b8d..3e64538 100644
---- a/drivers/usb/serial/mct_u232.c
-+++ b/drivers/usb/serial/mct_u232.c
-@@ -378,6 +378,10 @@ static int mct_u232_port_probe(struct usb_serial_port *port)
- {
- 	struct mct_u232_private *priv;
- 
-+	/* check first to simplify error handling */
-+	if (!port->serial->port[1] || !port->serial->port[1]->interrupt_in_urb)
-+		return -ENODEV;
-+
- 	priv = kzalloc(sizeof(*priv), GFP_KERNEL);
- 	if (!priv)
- 		return -ENOMEM;
--- 
-2.1.4
diff --git a/sound-usb-fix-NULL-dereference-in-usb_audio_probe.patch b/sound-usb-fix-NULL-dereference-in-usb_audio_probe.patch
deleted file mode 100644
index 3ee63e4d4..000000000
--- a/sound-usb-fix-NULL-dereference-in-usb_audio_probe.patch
+++ /dev/null
@@ -1,80 +0,0 @@
-From cef7f62d5881e886cd514436bc386a7202af25f1 Mon Sep 17 00:00:00 2001
-From: Nicolai Stange <nicstange@gmail.com>
-Date: Tue, 15 Mar 2016 13:35:06 +0100
-Subject: [PATCH] sound/usb: fix NULL dereference in usb_audio_probe()
-
-With commit
-
-  aebb2b89bff0 ("[media] sound/usb: Use Media Controller API to share
-                 media resources")
-
-an access to quirk->media_device without checking for quirk != NULL has
-been introduced in usb_audio_probe().
-
-With a Plantronics USB headset (device ID 0x047f:0xc010) attached,
-this results in the following splat at boot time:
-
-  BUG: unable to handle kernel NULL pointer dereference at 0000000000000014
-  IP: [<ffffffffa089aa6c>] usb_audio_probe+0x2cc/0x9a0 [snd_usb_audio]
-  Oops: 0000 [#1] SMP
-  [...]
-  CPU: 2 PID: 696 Comm: systemd-udevd Not tainted 4.5.0-next-20160315 #13
-  Hardware name: Dell Inc. Latitude E6540/0725FP, BIOS A10 06/26/2014
-  task: ffff88021c88d7c0 ti: ffff88003d5b0000 task.ti: ffff88003d5b0000
-  RIP: 0010:[<ffffffffa089aa6c>]  [<ffffffffa089aa6c>]
-                                usb_audio_probe+0x2cc/0x9a0 [snd_usb_audio]
-  [...]
-  Call Trace:
-   [<ffffffff815a8e16>] usb_probe_interface+0x136/0x2d0
-   [<ffffffff81509edc>] driver_probe_device+0x22c/0x440
-   [<ffffffff8150a1c1>] __driver_attach+0xd1/0xf0
-   [<ffffffff8150a0f0>] ? driver_probe_device+0x440/0x440
-   [<ffffffff815077ec>] bus_for_each_dev+0x6c/0xc0
-   [<ffffffff815095ce>] driver_attach+0x1e/0x20
-   [<ffffffff81509013>] bus_add_driver+0x1c3/0x280
-   [<ffffffff8150ab10>] driver_register+0x60/0xe0
-   [<ffffffff815a7711>] usb_register_driver+0x81/0x140
-   [<ffffffffa08c7000>] ? 0xffffffffa08c7000
-   [<ffffffffa08c701e>] usb_audio_driver_init+0x1e/0x1000 [snd_usb_audio]
-   [<ffffffff81002123>] do_one_initcall+0xb3/0x1f0
-   [<ffffffff811fb091>] ? __vunmap+0x81/0xd0
-   [<ffffffff8121b8d2>] ? kmem_cache_alloc_trace+0x182/0x1d0
-   [<ffffffff811b0267>] ? do_init_module+0x27/0x1d8
-   [<ffffffff811b029f>] do_init_module+0x5f/0x1d8
-   [<ffffffff8112ce35>] load_module+0x1fe5/0x27a0
-   [<ffffffff81129870>] ? __symbol_put+0x60/0x60
-   [<ffffffff81241690>] ? vfs_read+0x110/0x130
-   [<ffffffff8112d866>] SYSC_finit_module+0xe6/0x120
-   [<ffffffff8112d8be>] SyS_finit_module+0xe/0x10
-   [<ffffffff81003d94>] do_syscall_64+0x64/0x110
-   [<ffffffff817c0b61>] entry_SYSCALL64_slow_path+0x25/0x25
-
-After encountering this, the system-udevd process seems to be blocked
-until it is killed when hitting its timeout of 3min.
-
-In analogy to the other accesses to members of quirk in usb_audio_probe(),
-check for quirk != NULL before accessing its ->media_device.
-
-Fixes: aebb2b89bff0 ("[media] sound/usb: Use Media Controller API to share
-                      media resources")
-Signed-off-by: Nicolai Stange <nicstange@gmail.com>
----
- sound/usb/card.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/sound/usb/card.c b/sound/usb/card.c
-index 63244bbba8c7..479621e775bc 100644
---- a/sound/usb/card.c
-+++ b/sound/usb/card.c
-@@ -612,7 +612,7 @@ static int usb_audio_probe(struct usb_interface *intf,
- 	if (err < 0)
- 		goto __error;
- 
--	if (quirk->media_device) {
-+	if (quirk && quirk->media_device) {
- 		/* don't want to fail when media_snd_device_create() fails */
- 		media_snd_device_create(chip, intf);
- 	}
--- 
-2.5.5
-
diff --git a/sources b/sources
index 03590ad3e..4e60c4c7c 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
 a60d48eee08ec0536d5efb17ca819aef  linux-4.5.tar.xz
 6f557fe90b800b615c85c2ca04da6154  perf-man-4.5.tar.gz
-e3752dbebf18b474b70d589ddb148706  patch-4.6-rc2.xz
+aa1c3f33ceabb564e3264cd8163df780  patch-4.6-rc3.xz