diff options
author | Thorsten Leemhuis <fedora@leemhuis.info> | 2016-11-15 18:56:26 +0100 |
---|---|---|
committer | Thorsten Leemhuis <fedora@leemhuis.info> | 2016-11-15 18:56:26 +0100 |
commit | f26355ef26e794d6e53cf0ad0e8d5aab59f81d44 (patch) | |
tree | 450a9fb1e3d4c9538e0503c3bb5dfa4d9029f7a1 | |
parent | 30d4152f55839cd026ed4f3c9214f91e107d03c6 (diff) | |
parent | 65ef66a1469550aaacf5c86e4dbb35412b812cce (diff) | |
download | kernel-4.8.8-200.vanilla.knurd.1.fc24.tar.gz kernel-4.8.8-200.vanilla.knurd.1.fc24.tar.xz kernel-4.8.8-200.vanilla.knurd.1.fc24.zip |
Merge remote-tracking branch 'origin/f24' into f24-user-thl-vanilla-fedorakernel-4.8.8-200.vanilla.knurd.1.fc24
-rw-r--r-- | 0001-drm-i915-Refresh-that-status-of-MST-capable-connecto.patch | 61 | ||||
-rw-r--r-- | 0001-platform-x86-ideapad-laptop-Add-Lenovo-Yoga-910-13IK.patch | 40 | ||||
-rw-r--r-- | 0001-tcp-take-care-of-truncations-done-by-sk_filter.patch | 105 | ||||
-rw-r--r-- | kernel.spec | 29 | ||||
-rw-r--r-- | nouveau-add-maxwell-to-backlight-init.patch | 24 | ||||
-rw-r--r-- | sources | 2 |
6 files changed, 258 insertions, 3 deletions
diff --git a/0001-drm-i915-Refresh-that-status-of-MST-capable-connecto.patch b/0001-drm-i915-Refresh-that-status-of-MST-capable-connecto.patch new file mode 100644 index 000000000..6e38648ac --- /dev/null +++ b/0001-drm-i915-Refresh-that-status-of-MST-capable-connecto.patch @@ -0,0 +1,61 @@ +From 1aab956c7b8872fb6976328316bfad62c6e67cf8 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com> +Date: Fri, 21 Oct 2016 16:44:38 +0300 +Subject: [PATCH] drm/i915: Refresh that status of MST capable connectors in + ->detect() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Once we've determined that the sink is MST capable we never end up +running through the full detect cycle again, despite getting HPDs. +Fix tht by ripping out the incorrect piece of code responsible. + +This got broken when I moved the long HPD handling to the ->detect() +hook, but failed to remove the leftover code. + +Cc: Ander Conselvan de Oliveira <conselvan2@gmail.com> +Cc: drm-intel-fixes@lists.freedesktop.org +Cc: Rui Tiago Matos <tiagomatos@gmail.com> +Tested-by: Rui Tiago Matos <tiagomatos@gmail.com> +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=98323 +Cc: Kirill A. Shutemov <kirill@shutemov.name> +Tested-by: Kirill A. Shutemov <kirill@shutemov.name> +References: https://bugs.freedesktop.org/show_bug.cgi?id=98306 +Fixes: 27d4efc5591a ("drm/i915: Move long hpd handling into the hotplug work") +Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> +Link: http://patchwork.freedesktop.org/patch/msgid/1477057478-29328-1-git-send-email-ville.syrjala@linux.intel.com +Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk> +--- + drivers/gpu/drm/i915/intel_dp.c | 10 ---------- + 1 file changed, 10 deletions(-) + +diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c +index f30db8f..80db8a3 100644 +--- a/drivers/gpu/drm/i915/intel_dp.c ++++ b/drivers/gpu/drm/i915/intel_dp.c +@@ -4492,21 +4492,11 @@ static enum drm_connector_status + intel_dp_detect(struct drm_connector *connector, bool force) + { + struct intel_dp *intel_dp = intel_attached_dp(connector); +- struct intel_digital_port *intel_dig_port = dp_to_dig_port(intel_dp); +- struct intel_encoder *intel_encoder = &intel_dig_port->base; + enum drm_connector_status status = connector->status; + + DRM_DEBUG_KMS("[CONNECTOR:%d:%s]\n", + connector->base.id, connector->name); + +- if (intel_dp->is_mst) { +- /* MST devices are disconnected from a monitor POV */ +- intel_dp_unset_edid(intel_dp); +- if (intel_encoder->type != INTEL_OUTPUT_EDP) +- intel_encoder->type = INTEL_OUTPUT_DP; +- return connector_status_disconnected; +- } +- + /* If full detect is not performed yet, do a full detect */ + if (!intel_dp->detect_done) + status = intel_dp_long_pulse(intel_dp->attached_connector); +-- +2.7.4 + diff --git a/0001-platform-x86-ideapad-laptop-Add-Lenovo-Yoga-910-13IK.patch b/0001-platform-x86-ideapad-laptop-Add-Lenovo-Yoga-910-13IK.patch new file mode 100644 index 000000000..42e935206 --- /dev/null +++ b/0001-platform-x86-ideapad-laptop-Add-Lenovo-Yoga-910-13IK.patch @@ -0,0 +1,40 @@ +From 40c30bbf3377babc4d6bb16b699184236a8bfa27 Mon Sep 17 00:00:00 2001 +From: Brian Masney <masneyb@onstation.org> +Date: Tue, 11 Oct 2016 19:28:02 -0400 +Subject: [PATCH] platform/x86: ideapad-laptop: Add Lenovo Yoga 910-13IKB to + no_hw_rfkill dmi list + +The Lenovo Yoga 910-13IKB does not have a hw rfkill switch, and trying +to read the hw rfkill switch through the ideapad module causes it to +always report as blocked. + +This commit adds the Lenovo Yoga 910-13IKB to the no_hw_rfkill dmi list, +fixing the WiFI breakage. + +Signed-off-by: Brian Masney <masneyb@onstation.org> +Signed-off-by: Darren Hart <dvhart@linux.intel.com> +--- + drivers/platform/x86/ideapad-laptop.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c +index d1a091b..a232394 100644 +--- a/drivers/platform/x86/ideapad-laptop.c ++++ b/drivers/platform/x86/ideapad-laptop.c +@@ -933,6 +933,13 @@ static const struct dmi_system_id no_hw_rfkill_list[] = { + DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo YOGA 900"), + }, + }, ++ { ++ .ident = "Lenovo YOGA 910-13IKB", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo YOGA 910-13IKB"), ++ }, ++ }, + {} + }; + +-- +2.7.4 + diff --git a/0001-tcp-take-care-of-truncations-done-by-sk_filter.patch b/0001-tcp-take-care-of-truncations-done-by-sk_filter.patch new file mode 100644 index 000000000..1c9b2f022 --- /dev/null +++ b/0001-tcp-take-care-of-truncations-done-by-sk_filter.patch @@ -0,0 +1,105 @@ +From ac6e780070e30e4c35bd395acfe9191e6268bdd3 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet <edumazet@google.com> +Date: Thu, 10 Nov 2016 13:12:35 -0800 +Subject: [PATCH] tcp: take care of truncations done by sk_filter() + +With syzkaller help, Marco Grassi found a bug in TCP stack, +crashing in tcp_collapse() + +Root cause is that sk_filter() can truncate the incoming skb, +but TCP stack was not really expecting this to happen. +It probably was expecting a simple DROP or ACCEPT behavior. + +We first need to make sure no part of TCP header could be removed. +Then we need to adjust TCP_SKB_CB(skb)->end_seq + +Many thanks to syzkaller team and Marco for giving us a reproducer. + +Signed-off-by: Eric Dumazet <edumazet@google.com> +Reported-by: Marco Grassi <marco.gra@gmail.com> +Reported-by: Vladis Dronov <vdronov@redhat.com> +Signed-off-by: David S. Miller <davem@davemloft.net> +--- + include/net/tcp.h | 1 + + net/ipv4/tcp_ipv4.c | 19 ++++++++++++++++++- + net/ipv6/tcp_ipv6.c | 6 ++++-- + 3 files changed, 23 insertions(+), 3 deletions(-) + +diff --git a/include/net/tcp.h b/include/net/tcp.h +index 304a8e1..123979f 100644 +--- a/include/net/tcp.h ++++ b/include/net/tcp.h +@@ -1220,6 +1220,7 @@ static inline void tcp_prequeue_init(struct tcp_sock *tp) + } + + bool tcp_prequeue(struct sock *sk, struct sk_buff *skb); ++int tcp_filter(struct sock *sk, struct sk_buff *skb); + + #undef STATE_TRACE + +diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c +index 61b7be3..2259114 100644 +--- a/net/ipv4/tcp_ipv4.c ++++ b/net/ipv4/tcp_ipv4.c +@@ -1564,6 +1564,21 @@ bool tcp_add_backlog(struct sock *sk, struct sk_buff *skb) + } + EXPORT_SYMBOL(tcp_prequeue); + ++int tcp_filter(struct sock *sk, struct sk_buff *skb) ++{ ++ struct tcphdr *th = (struct tcphdr *)skb->data; ++ unsigned int eaten = skb->len; ++ int err; ++ ++ err = sk_filter_trim_cap(sk, skb, th->doff * 4); ++ if (!err) { ++ eaten -= skb->len; ++ TCP_SKB_CB(skb)->end_seq -= eaten; ++ } ++ return err; ++} ++EXPORT_SYMBOL(tcp_filter); ++ + /* + * From tcp_input.c + */ +@@ -1676,8 +1691,10 @@ int tcp_v4_rcv(struct sk_buff *skb) + + nf_reset(skb); + +- if (sk_filter(sk, skb)) ++ if (tcp_filter(sk, skb)) + goto discard_and_relse; ++ th = (const struct tcphdr *)skb->data; ++ iph = ip_hdr(skb); + + skb->dev = NULL; + +diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c +index 6ca23c2..b9f1fee 100644 +--- a/net/ipv6/tcp_ipv6.c ++++ b/net/ipv6/tcp_ipv6.c +@@ -1229,7 +1229,7 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb) + if (skb->protocol == htons(ETH_P_IP)) + return tcp_v4_do_rcv(sk, skb); + +- if (sk_filter(sk, skb)) ++ if (tcp_filter(sk, skb)) + goto discard; + + /* +@@ -1457,8 +1457,10 @@ static int tcp_v6_rcv(struct sk_buff *skb) + if (tcp_v6_inbound_md5_hash(sk, skb)) + goto discard_and_relse; + +- if (sk_filter(sk, skb)) ++ if (tcp_filter(sk, skb)) + goto discard_and_relse; ++ th = (const struct tcphdr *)skb->data; ++ hdr = ipv6_hdr(skb); + + skb->dev = NULL; + +-- +2.7.4 + diff --git a/kernel.spec b/kernel.spec index 1c121940e..20d1fb396 100644 --- a/kernel.spec +++ b/kernel.spec @@ -59,7 +59,7 @@ Summary: The Linux kernel # Do we have a -stable update to apply? -%define stable_update 7 +%define stable_update 8 # Set rpm version accordingly %if 0%{?stable_update} %define stablerev %{stable_update} @@ -650,6 +650,18 @@ Patch850: v3-vfio-pci-Fix-integer-overflows-bitmask-check.patch #rhbz 1325354 Patch852: 0001-HID-input-ignore-System-Control-application-usages-i.patch +#rhbz 1392885 +Patch853: 0001-drm-i915-Refresh-that-status-of-MST-capable-connecto.patch + +#rhbz 1390308 +Patch854: nouveau-add-maxwell-to-backlight-init.patch + +#rhbz 1385823 +Patch855: 0001-platform-x86-ideapad-laptop-Add-Lenovo-Yoga-910-13IK.patch + +#CVE-2016-8645 rhbz 1393904 1393908 +Patch856: 0001-tcp-take-care-of-truncations-done-by-sk_filter.patch + # END OF PATCH DEFINITIONS %endif @@ -2180,7 +2192,20 @@ fi # # %changelog -* Thu Nov 10 2016 Justin M. Forbes <jforbes@fedoraproject.org> - 4.8.7-200 +* Tue Nov 15 2016 Justin M. Forbes <jforbes@fedoraproject.org> - 4.8.8-200 +- Linux v4.8.8 +- Fix crash in tcp_collapse CVE-2016-8645 (rhbz 1393904 1393908) + +* Mon Nov 14 2016 Laura Abbott <labbott@fedoraproject.org> +- Fix for some Yoga laptop WIFI (rhbz 1385823) + +* Fri Nov 11 2016 Justin M. Forbes <jforbes@fedoraproject.org> +- Nouveau: Add Maxwell to backlight initialization (rhbz 1390308) + +* Fri Nov 11 2016 Justin M. Forbes <jforbes@fedoraproject.org> - 4.8.7-200 +- Refresh status of MST capable connectors (rhbz 1392885) + +* Thu Nov 10 2016 Justin M. Forbes <jforbes@fedoraproject.org> - Linux v4.8.7 - Fixes CVE-2016-8630 (rhbz 1393350 1393358) diff --git a/nouveau-add-maxwell-to-backlight-init.patch b/nouveau-add-maxwell-to-backlight-init.patch new file mode 100644 index 000000000..9d89069c1 --- /dev/null +++ b/nouveau-add-maxwell-to-backlight-init.patch @@ -0,0 +1,24 @@ +From bbe1f94a8b3f2e8622dd400a6827d3242005d951 Mon Sep 17 00:00:00 2001 +From: Faris Alsalama <farisbenbrahem@gmail.com> +Date: Sat, 21 May 2016 14:41:43 -0400 +Subject: drm/nouveau/kms: add Maxwell to backlight initialization + +Signed-off-by: Faris Alsalama <farisbenbrahem@gmail.com> +Acked-by: Acked-by: Pierre Moreau <pierre.morrow@free.fr> +Signed-off-by: Ben Skeggs <bskeggs@redhat.com> + +diff --git a/drivers/gpu/drm/nouveau/nouveau_backlight.c b/drivers/gpu/drm/nouveau/nouveau_backlight.c +index f5101be..5e2c568 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_backlight.c ++++ b/drivers/gpu/drm/nouveau/nouveau_backlight.c +@@ -232,6 +232,7 @@ nouveau_backlight_init(struct drm_device *dev) + case NV_DEVICE_INFO_V0_TESLA: + case NV_DEVICE_INFO_V0_FERMI: + case NV_DEVICE_INFO_V0_KEPLER: ++ case NV_DEVICE_INFO_V0_MAXWELL: + return nv50_backlight_init(connector); + default: + break; +-- +cgit v0.10.2 + @@ -1,3 +1,3 @@ c1af0afbd3df35c1ccdc7a5118cd2d07 linux-4.8.tar.xz 0dad03f586e835d538d3e0d2cbdb9a28 perf-man-4.8.tar.gz -ad7cdae5329497d07582b31858516686 patch-4.8.7.xz +38e85040e09193251766975d6fd30d08 patch-4.8.8.xz |