diff options
author | Thorsten Leemhuis <fedora@leemhuis.info> | 2019-01-31 08:33:29 +0100 |
---|---|---|
committer | Thorsten Leemhuis <fedora@leemhuis.info> | 2019-01-31 08:33:29 +0100 |
commit | f97542704c0a941828be1498e5997b16668dc8ea (patch) | |
tree | aa9629acd25dca30edf79b3183d7d7ae66992630 | |
parent | d9412e41352baf7a10dd76c5cfcfd128ca3e4a00 (diff) | |
parent | e826a30dd1a2c910f9b5a90e5b2c2535ec25518a (diff) | |
download | kernel-f97542704c0a941828be1498e5997b16668dc8ea.tar.gz kernel-f97542704c0a941828be1498e5997b16668dc8ea.tar.xz kernel-f97542704c0a941828be1498e5997b16668dc8ea.zip |
Merge remote-tracking branch 'origin/f29' into f29-user-thl-vanilla-fedora
-rw-r--r-- | CVE-2018-16880.patch | 194 | ||||
-rw-r--r-- | configs/fedora/generic/CONFIG_IIO_ST_LSM6DSX | 2 | ||||
-rw-r--r-- | kernel-aarch64-debug.config | 2 | ||||
-rw-r--r-- | kernel-aarch64.config | 2 | ||||
-rw-r--r-- | kernel-armv7hl-debug.config | 2 | ||||
-rw-r--r-- | kernel-armv7hl-lpae-debug.config | 2 | ||||
-rw-r--r-- | kernel-armv7hl-lpae.config | 2 | ||||
-rw-r--r-- | kernel-armv7hl.config | 2 | ||||
-rw-r--r-- | kernel-i686-debug.config | 2 | ||||
-rw-r--r-- | kernel-i686.config | 2 | ||||
-rw-r--r-- | kernel-ppc64le-debug.config | 2 | ||||
-rw-r--r-- | kernel-ppc64le.config | 2 | ||||
-rw-r--r-- | kernel-s390x-debug.config | 2 | ||||
-rw-r--r-- | kernel-s390x.config | 2 | ||||
-rw-r--r-- | kernel-x86_64-debug.config | 2 | ||||
-rw-r--r-- | kernel-x86_64.config | 2 | ||||
-rw-r--r-- | kernel.spec | 7 |
17 files changed, 216 insertions, 15 deletions
diff --git a/CVE-2018-16880.patch b/CVE-2018-16880.patch new file mode 100644 index 000000000..29bdf6909 --- /dev/null +++ b/CVE-2018-16880.patch @@ -0,0 +1,194 @@ +From mboxrd@z Thu Jan 1 00:00:00 1970 +Return-Path: <SRS0=BDae=QE=vger.kernel.org=netdev-owner@kernel.org> +X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on + aws-us-west-2-korg-lkml-1.web.codeaurora.org +X-Spam-Level: +X-Spam-Status: No, score=-7.0 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, + INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_PASS + autolearn=unavailable autolearn_force=no version=3.4.0 +Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) + by smtp.lore.kernel.org (Postfix) with ESMTP id 5590FC282CB + for <netdev@archiver.kernel.org>; Mon, 28 Jan 2019 07:05:21 +0000 (UTC) +Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) + by mail.kernel.org (Postfix) with ESMTP id 29A2B20881 + for <netdev@archiver.kernel.org>; Mon, 28 Jan 2019 07:05:21 +0000 (UTC) +Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand + id S1726913AbfA1HFQ (ORCPT <rfc822;netdev@archiver.kernel.org>); + Mon, 28 Jan 2019 02:05:16 -0500 +Received: from mx1.redhat.com ([209.132.183.28]:34448 "EHLO mx1.redhat.com" + rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP + id S1726612AbfA1HFQ (ORCPT <rfc822;netdev@vger.kernel.org>); + Mon, 28 Jan 2019 02:05:16 -0500 +Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12]) + (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) + (No client certificate requested) + by mx1.redhat.com (Postfix) with ESMTPS id 999BC81DE3; + Mon, 28 Jan 2019 07:05:15 +0000 (UTC) +Received: from jason-ThinkPad-T450s.redhat.com (ovpn-12-212.pek2.redhat.com [10.72.12.212]) + by smtp.corp.redhat.com (Postfix) with ESMTP id EF31253B21; + Mon, 28 Jan 2019 07:05:07 +0000 (UTC) +From: Jason Wang <jasowang@redhat.com> +To: mst@redhat.com, jasowang@redhat.com, stefanha@redhat.com +Cc: kvm@vger.kernel.org, virtualization@lists.linux-foundation.org, + netdev@vger.kernel.org, linux-kernel@vger.kernel.org +Subject: [PATCH net] vhost: fix OOB in get_rx_bufs() +Date: Mon, 28 Jan 2019 15:05:05 +0800 +Message-Id: <20190128070505.18335-1-jasowang@redhat.com> +X-Scanned-By: MIMEDefang 2.79 on 10.5.11.12 +X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.25]); Mon, 28 Jan 2019 07:05:15 +0000 (UTC) +Sender: netdev-owner@vger.kernel.org +Precedence: bulk +List-ID: <netdev.vger.kernel.org> +X-Mailing-List: netdev@vger.kernel.org +Archived-At: <https://lore.kernel.org/netdev/20190128070505.18335-1-jasowang@redhat.com/> +List-Archive: <https://lore.kernel.org/netdev/> +List-Post: <mailto:netdev@vger.kernel.org> + +After batched used ring updating was introduced in commit e2b3b35eb989 +("vhost_net: batch used ring update in rx"). We tend to batch heads in +vq->heads for more than one packet. But the quota passed to +get_rx_bufs() was not correctly limited, which can result a OOB write +in vq->heads. + + headcount = get_rx_bufs(vq, vq->heads + nvq->done_idx, + vhost_len, &in, vq_log, &log, + likely(mergeable) ? UIO_MAXIOV : 1); + +UIO_MAXIOV was still used which is wrong since we could have batched +used in vq->heads, this will cause OOB if the next buffer needs more +than 960 (1024 (UIO_MAXIOV) - 64 (VHOST_NET_BATCH)) heads after we've +batched 64 (VHOST_NET_BATCH) heads: + +============================================================================= +BUG kmalloc-8k (Tainted: G B ): Redzone overwritten +----------------------------------------------------------------------------- + +INFO: 0x00000000fd93b7a2-0x00000000f0713384. First byte 0xa9 instead of 0xcc +INFO: Allocated in alloc_pd+0x22/0x60 age=3933677 cpu=2 pid=2674 + kmem_cache_alloc_trace+0xbb/0x140 + alloc_pd+0x22/0x60 + gen8_ppgtt_create+0x11d/0x5f0 + i915_ppgtt_create+0x16/0x80 + i915_gem_create_context+0x248/0x390 + i915_gem_context_create_ioctl+0x4b/0xe0 + drm_ioctl_kernel+0xa5/0xf0 + drm_ioctl+0x2ed/0x3a0 + do_vfs_ioctl+0x9f/0x620 + ksys_ioctl+0x6b/0x80 + __x64_sys_ioctl+0x11/0x20 + do_syscall_64+0x43/0xf0 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 +INFO: Slab 0x00000000d13e87af objects=3 used=3 fp=0x (null) flags=0x200000000010201 +INFO: Object 0x0000000003278802 @offset=17064 fp=0x00000000e2e6652b + +Fixing this by allocating UIO_MAXIOV + VHOST_NET_BATCH iovs for +vhost-net. This is done through set the limitation through +vhost_dev_init(), then set_owner can allocate the number of iov in a +per device manner. + +This fixes CVE-2018-16880. + +Fixes: e2b3b35eb989 ("vhost_net: batch used ring update in rx") +Signed-off-by: Jason Wang <jasowang@redhat.com> +--- + drivers/vhost/net.c | 3 ++- + drivers/vhost/scsi.c | 2 +- + drivers/vhost/vhost.c | 7 ++++--- + drivers/vhost/vhost.h | 4 +++- + drivers/vhost/vsock.c | 2 +- + 5 files changed, 11 insertions(+), 7 deletions(-) + +diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c +index bca86bf7189f..df51a35cf537 100644 +--- a/drivers/vhost/net.c ++++ b/drivers/vhost/net.c +@@ -1337,7 +1337,8 @@ static int vhost_net_open(struct inode *inode, struct file *f) + n->vqs[i].rx_ring = NULL; + vhost_net_buf_init(&n->vqs[i].rxq); + } +- vhost_dev_init(dev, vqs, VHOST_NET_VQ_MAX); ++ vhost_dev_init(dev, vqs, VHOST_NET_VQ_MAX, ++ UIO_MAXIOV + VHOST_NET_BATCH); + + vhost_poll_init(n->poll + VHOST_NET_VQ_TX, handle_tx_net, EPOLLOUT, dev); + vhost_poll_init(n->poll + VHOST_NET_VQ_RX, handle_rx_net, EPOLLIN, dev); +diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c +index 344684f3e2e4..23593cb23dd0 100644 +--- a/drivers/vhost/scsi.c ++++ b/drivers/vhost/scsi.c +@@ -1627,7 +1627,7 @@ static int vhost_scsi_open(struct inode *inode, struct file *f) + vqs[i] = &vs->vqs[i].vq; + vs->vqs[i].vq.handle_kick = vhost_scsi_handle_kick; + } +- vhost_dev_init(&vs->dev, vqs, VHOST_SCSI_MAX_VQ); ++ vhost_dev_init(&vs->dev, vqs, VHOST_SCSI_MAX_VQ, UIO_MAXIOV); + + vhost_scsi_init_inflight(vs, NULL); + +diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c +index 15a216cdd507..24a129fcdd61 100644 +--- a/drivers/vhost/vhost.c ++++ b/drivers/vhost/vhost.c +@@ -390,9 +390,9 @@ static long vhost_dev_alloc_iovecs(struct vhost_dev *dev) + vq->indirect = kmalloc_array(UIO_MAXIOV, + sizeof(*vq->indirect), + GFP_KERNEL); +- vq->log = kmalloc_array(UIO_MAXIOV, sizeof(*vq->log), ++ vq->log = kmalloc_array(dev->iov_limit, sizeof(*vq->log), + GFP_KERNEL); +- vq->heads = kmalloc_array(UIO_MAXIOV, sizeof(*vq->heads), ++ vq->heads = kmalloc_array(dev->iov_limit, sizeof(*vq->heads), + GFP_KERNEL); + if (!vq->indirect || !vq->log || !vq->heads) + goto err_nomem; +@@ -414,7 +414,7 @@ static void vhost_dev_free_iovecs(struct vhost_dev *dev) + } + + void vhost_dev_init(struct vhost_dev *dev, +- struct vhost_virtqueue **vqs, int nvqs) ++ struct vhost_virtqueue **vqs, int nvqs, int iov_limit) + { + struct vhost_virtqueue *vq; + int i; +@@ -427,6 +427,7 @@ void vhost_dev_init(struct vhost_dev *dev, + dev->iotlb = NULL; + dev->mm = NULL; + dev->worker = NULL; ++ dev->iov_limit = iov_limit; + init_llist_head(&dev->work_list); + init_waitqueue_head(&dev->wait); + INIT_LIST_HEAD(&dev->read_list); +diff --git a/drivers/vhost/vhost.h b/drivers/vhost/vhost.h +index 1b675dad5e05..9490e7ddb340 100644 +--- a/drivers/vhost/vhost.h ++++ b/drivers/vhost/vhost.h +@@ -170,9 +170,11 @@ struct vhost_dev { + struct list_head read_list; + struct list_head pending_list; + wait_queue_head_t wait; ++ int iov_limit; + }; + +-void vhost_dev_init(struct vhost_dev *, struct vhost_virtqueue **vqs, int nvqs); ++void vhost_dev_init(struct vhost_dev *, struct vhost_virtqueue **vqs, ++ int nvqs, int iov_limit); + long vhost_dev_set_owner(struct vhost_dev *dev); + bool vhost_dev_has_owner(struct vhost_dev *dev); + long vhost_dev_check_owner(struct vhost_dev *); +diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c +index 3fbc068eaa9b..bb5fc0e9fbc2 100644 +--- a/drivers/vhost/vsock.c ++++ b/drivers/vhost/vsock.c +@@ -531,7 +531,7 @@ static int vhost_vsock_dev_open(struct inode *inode, struct file *file) + vsock->vqs[VSOCK_VQ_TX].handle_kick = vhost_vsock_handle_tx_kick; + vsock->vqs[VSOCK_VQ_RX].handle_kick = vhost_vsock_handle_rx_kick; + +- vhost_dev_init(&vsock->dev, vqs, ARRAY_SIZE(vsock->vqs)); ++ vhost_dev_init(&vsock->dev, vqs, ARRAY_SIZE(vsock->vqs), UIO_MAXIOV); + + file->private_data = vsock; + spin_lock_init(&vsock->send_pkt_list_lock); +-- +2.17.1 + + diff --git a/configs/fedora/generic/CONFIG_IIO_ST_LSM6DSX b/configs/fedora/generic/CONFIG_IIO_ST_LSM6DSX index b6ec57836..1b22a0c72 100644 --- a/configs/fedora/generic/CONFIG_IIO_ST_LSM6DSX +++ b/configs/fedora/generic/CONFIG_IIO_ST_LSM6DSX @@ -1 +1 @@ -# CONFIG_IIO_ST_LSM6DSX is not set +CONFIG_IIO_ST_LSM6DSX=m diff --git a/kernel-aarch64-debug.config b/kernel-aarch64-debug.config index fa6dab204..7affa7000 100644 --- a/kernel-aarch64-debug.config +++ b/kernel-aarch64-debug.config @@ -2336,7 +2336,7 @@ CONFIG_IIO_ST_ACCEL_SPI_3AXIS=m CONFIG_IIO_ST_GYRO_3AXIS=m CONFIG_IIO_ST_GYRO_I2C_3AXIS=m CONFIG_IIO_ST_GYRO_SPI_3AXIS=m -# CONFIG_IIO_ST_LSM6DSX is not set +CONFIG_IIO_ST_LSM6DSX=m CONFIG_IIO_ST_MAGN_3AXIS=m CONFIG_IIO_ST_PRESS_I2C=m CONFIG_IIO_ST_PRESS=m diff --git a/kernel-aarch64.config b/kernel-aarch64.config index 08fbdda85..25f04384a 100644 --- a/kernel-aarch64.config +++ b/kernel-aarch64.config @@ -2319,7 +2319,7 @@ CONFIG_IIO_ST_ACCEL_SPI_3AXIS=m CONFIG_IIO_ST_GYRO_3AXIS=m CONFIG_IIO_ST_GYRO_I2C_3AXIS=m CONFIG_IIO_ST_GYRO_SPI_3AXIS=m -# CONFIG_IIO_ST_LSM6DSX is not set +CONFIG_IIO_ST_LSM6DSX=m CONFIG_IIO_ST_MAGN_3AXIS=m CONFIG_IIO_ST_PRESS_I2C=m CONFIG_IIO_ST_PRESS=m diff --git a/kernel-armv7hl-debug.config b/kernel-armv7hl-debug.config index d746bdca5..09f21eade 100644 --- a/kernel-armv7hl-debug.config +++ b/kernel-armv7hl-debug.config @@ -2440,7 +2440,7 @@ CONFIG_IIO_ST_ACCEL_SPI_3AXIS=m CONFIG_IIO_ST_GYRO_3AXIS=m CONFIG_IIO_ST_GYRO_I2C_3AXIS=m CONFIG_IIO_ST_GYRO_SPI_3AXIS=m -# CONFIG_IIO_ST_LSM6DSX is not set +CONFIG_IIO_ST_LSM6DSX=m CONFIG_IIO_ST_MAGN_3AXIS=m CONFIG_IIO_ST_PRESS_I2C=m CONFIG_IIO_ST_PRESS=m diff --git a/kernel-armv7hl-lpae-debug.config b/kernel-armv7hl-lpae-debug.config index d4564b82c..61c82ff92 100644 --- a/kernel-armv7hl-lpae-debug.config +++ b/kernel-armv7hl-lpae-debug.config @@ -2328,7 +2328,7 @@ CONFIG_IIO_ST_ACCEL_SPI_3AXIS=m CONFIG_IIO_ST_GYRO_3AXIS=m CONFIG_IIO_ST_GYRO_I2C_3AXIS=m CONFIG_IIO_ST_GYRO_SPI_3AXIS=m -# CONFIG_IIO_ST_LSM6DSX is not set +CONFIG_IIO_ST_LSM6DSX=m CONFIG_IIO_ST_MAGN_3AXIS=m CONFIG_IIO_ST_PRESS_I2C=m CONFIG_IIO_ST_PRESS=m diff --git a/kernel-armv7hl-lpae.config b/kernel-armv7hl-lpae.config index 068f65f01..1feb50c30 100644 --- a/kernel-armv7hl-lpae.config +++ b/kernel-armv7hl-lpae.config @@ -2312,7 +2312,7 @@ CONFIG_IIO_ST_ACCEL_SPI_3AXIS=m CONFIG_IIO_ST_GYRO_3AXIS=m CONFIG_IIO_ST_GYRO_I2C_3AXIS=m CONFIG_IIO_ST_GYRO_SPI_3AXIS=m -# CONFIG_IIO_ST_LSM6DSX is not set +CONFIG_IIO_ST_LSM6DSX=m CONFIG_IIO_ST_MAGN_3AXIS=m CONFIG_IIO_ST_PRESS_I2C=m CONFIG_IIO_ST_PRESS=m diff --git a/kernel-armv7hl.config b/kernel-armv7hl.config index ab2d22c0d..d1e6f3d23 100644 --- a/kernel-armv7hl.config +++ b/kernel-armv7hl.config @@ -2424,7 +2424,7 @@ CONFIG_IIO_ST_ACCEL_SPI_3AXIS=m CONFIG_IIO_ST_GYRO_3AXIS=m CONFIG_IIO_ST_GYRO_I2C_3AXIS=m CONFIG_IIO_ST_GYRO_SPI_3AXIS=m -# CONFIG_IIO_ST_LSM6DSX is not set +CONFIG_IIO_ST_LSM6DSX=m CONFIG_IIO_ST_MAGN_3AXIS=m CONFIG_IIO_ST_PRESS_I2C=m CONFIG_IIO_ST_PRESS=m diff --git a/kernel-i686-debug.config b/kernel-i686-debug.config index a6bbf4c53..7a95709e3 100644 --- a/kernel-i686-debug.config +++ b/kernel-i686-debug.config @@ -2167,7 +2167,7 @@ CONFIG_IIO_ST_ACCEL_SPI_3AXIS=m CONFIG_IIO_ST_GYRO_3AXIS=m CONFIG_IIO_ST_GYRO_I2C_3AXIS=m CONFIG_IIO_ST_GYRO_SPI_3AXIS=m -# CONFIG_IIO_ST_LSM6DSX is not set +CONFIG_IIO_ST_LSM6DSX=m CONFIG_IIO_ST_MAGN_3AXIS=m # CONFIG_IIO_ST_PRESS is not set CONFIG_IIO_SW_DEVICE=m diff --git a/kernel-i686.config b/kernel-i686.config index 266474f3f..29df0ff18 100644 --- a/kernel-i686.config +++ b/kernel-i686.config @@ -2149,7 +2149,7 @@ CONFIG_IIO_ST_ACCEL_SPI_3AXIS=m CONFIG_IIO_ST_GYRO_3AXIS=m CONFIG_IIO_ST_GYRO_I2C_3AXIS=m CONFIG_IIO_ST_GYRO_SPI_3AXIS=m -# CONFIG_IIO_ST_LSM6DSX is not set +CONFIG_IIO_ST_LSM6DSX=m CONFIG_IIO_ST_MAGN_3AXIS=m # CONFIG_IIO_ST_PRESS is not set CONFIG_IIO_SW_DEVICE=m diff --git a/kernel-ppc64le-debug.config b/kernel-ppc64le-debug.config index a761d7b0f..6f80148aa 100644 --- a/kernel-ppc64le-debug.config +++ b/kernel-ppc64le-debug.config @@ -2000,7 +2000,7 @@ CONFIG_IIO_ST_ACCEL_SPI_3AXIS=m CONFIG_IIO_ST_GYRO_3AXIS=m CONFIG_IIO_ST_GYRO_I2C_3AXIS=m CONFIG_IIO_ST_GYRO_SPI_3AXIS=m -# CONFIG_IIO_ST_LSM6DSX is not set +CONFIG_IIO_ST_LSM6DSX=m CONFIG_IIO_ST_MAGN_3AXIS=m # CONFIG_IIO_ST_PRESS is not set CONFIG_IIO_SW_DEVICE=m diff --git a/kernel-ppc64le.config b/kernel-ppc64le.config index 8718ac190..b1d3f661b 100644 --- a/kernel-ppc64le.config +++ b/kernel-ppc64le.config @@ -1982,7 +1982,7 @@ CONFIG_IIO_ST_ACCEL_SPI_3AXIS=m CONFIG_IIO_ST_GYRO_3AXIS=m CONFIG_IIO_ST_GYRO_I2C_3AXIS=m CONFIG_IIO_ST_GYRO_SPI_3AXIS=m -# CONFIG_IIO_ST_LSM6DSX is not set +CONFIG_IIO_ST_LSM6DSX=m CONFIG_IIO_ST_MAGN_3AXIS=m # CONFIG_IIO_ST_PRESS is not set CONFIG_IIO_SW_DEVICE=m diff --git a/kernel-s390x-debug.config b/kernel-s390x-debug.config index 2382d00b5..1610baf88 100644 --- a/kernel-s390x-debug.config +++ b/kernel-s390x-debug.config @@ -1953,7 +1953,7 @@ CONFIG_IIO_ST_ACCEL_SPI_3AXIS=m CONFIG_IIO_ST_GYRO_3AXIS=m CONFIG_IIO_ST_GYRO_I2C_3AXIS=m CONFIG_IIO_ST_GYRO_SPI_3AXIS=m -# CONFIG_IIO_ST_LSM6DSX is not set +CONFIG_IIO_ST_LSM6DSX=m CONFIG_IIO_ST_MAGN_3AXIS=m # CONFIG_IIO_ST_PRESS is not set CONFIG_IIO_SW_DEVICE=m diff --git a/kernel-s390x.config b/kernel-s390x.config index 9747bd48a..6de1d9943 100644 --- a/kernel-s390x.config +++ b/kernel-s390x.config @@ -1935,7 +1935,7 @@ CONFIG_IIO_ST_ACCEL_SPI_3AXIS=m CONFIG_IIO_ST_GYRO_3AXIS=m CONFIG_IIO_ST_GYRO_I2C_3AXIS=m CONFIG_IIO_ST_GYRO_SPI_3AXIS=m -# CONFIG_IIO_ST_LSM6DSX is not set +CONFIG_IIO_ST_LSM6DSX=m CONFIG_IIO_ST_MAGN_3AXIS=m # CONFIG_IIO_ST_PRESS is not set CONFIG_IIO_SW_DEVICE=m diff --git a/kernel-x86_64-debug.config b/kernel-x86_64-debug.config index 05518c364..3550d9366 100644 --- a/kernel-x86_64-debug.config +++ b/kernel-x86_64-debug.config @@ -2209,7 +2209,7 @@ CONFIG_IIO_ST_ACCEL_SPI_3AXIS=m CONFIG_IIO_ST_GYRO_3AXIS=m CONFIG_IIO_ST_GYRO_I2C_3AXIS=m CONFIG_IIO_ST_GYRO_SPI_3AXIS=m -# CONFIG_IIO_ST_LSM6DSX is not set +CONFIG_IIO_ST_LSM6DSX=m CONFIG_IIO_ST_MAGN_3AXIS=m # CONFIG_IIO_ST_PRESS is not set CONFIG_IIO_SW_DEVICE=m diff --git a/kernel-x86_64.config b/kernel-x86_64.config index e07bb90cb..bff06fe98 100644 --- a/kernel-x86_64.config +++ b/kernel-x86_64.config @@ -2191,7 +2191,7 @@ CONFIG_IIO_ST_ACCEL_SPI_3AXIS=m CONFIG_IIO_ST_GYRO_3AXIS=m CONFIG_IIO_ST_GYRO_I2C_3AXIS=m CONFIG_IIO_ST_GYRO_SPI_3AXIS=m -# CONFIG_IIO_ST_LSM6DSX is not set +CONFIG_IIO_ST_LSM6DSX=m CONFIG_IIO_ST_MAGN_3AXIS=m # CONFIG_IIO_ST_PRESS is not set CONFIG_IIO_SW_DEVICE=m diff --git a/kernel.spec b/kernel.spec index d1d55aae6..fba7b99a3 100644 --- a/kernel.spec +++ b/kernel.spec @@ -647,6 +647,9 @@ Patch507: CVE-2019-3459-and-CVE-2019-3460.patch # rhbz 1663613 patch merged into 5.0-rc# Patch508: 0001-drm-nouveau-register-backlight-on-pascal-and-newer.patch +# CVE-2018-16880 rhbz 1656472 1669545 +Patch509: CVE-2018-16880.patch + # END OF PATCH DEFINITIONS %endif @@ -1921,6 +1924,10 @@ fi # # %changelog +* Mon Jan 28 2019 Justin M. Forbes <jforbes@fedoraproject.org> - 4.20.5-200 +- Linux v4.20.5 +- Fix CVE-2018-16880 (rhbz 1656472 1669545) + * Wed Jan 23 2019 Hans de Goede <hdegoede@redhat.com> - Add upstream patch fixing backlight control not working on some laptops with a Nvidia GPU (rhbz#1663613, rhbz#1665505) |