20 files changed, 167 insertions, 18 deletions
diff --git a/arm64-dma-mapping-Fix-dma_mapping_error-when-bypassing-SWIOTLB.patch b/arm64-dma-mapping-Fix-dma_mapping_error-when-bypassing-SWIOTLB.patch
new file mode 100644
index 000000000..2e7f51ec6
--- /dev/null
+++ b/arm64-dma-mapping-Fix-dma_mapping_error-when-bypassing-SWIOTLB.patch
@@ -0,0 +1,66 @@
+From patchwork Wed Jan 25 18:31:31 2017
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+Subject: [v2] arm64: dma-mapping: Fix dma_mapping_error() when bypassing
+ SWIOTLB
+From: Robin Murphy <robin.murphy@arm.com>
+X-Patchwork-Id: 9537723
+Message-Id: <840027acb4750542003dff17b4a8902ba8972754.1485368348.git.robin.murphy@arm.com>
+To: will.deacon@arm.com,
+	catalin.marinas@arm.com
+Cc: Jisheng Zhang <jszhang@marvell.com>, arnd@arndb.de,
+ konrad.wilk@oracle.com, aaro.koskinen@iki.fi, stable@vger.kernel.org,
+ linux-rpi-kernel@lists.infradead.org, linux-arm-kernel@lists.infradead.org
+Date: Wed, 25 Jan 2017 18:31:31 +0000
+
+When bypassing SWIOTLB on small-memory systems, we need to avoid calling
+into swiotlb_dma_mapping_error() in exactly the same way as we avoid
+swiotlb_dma_supported(), because the former also relies on SWIOTLB state
+being initialised.
+
+Under the assumptions for which we skip SWIOTLB, dma_map_{single,page}()
+will only ever return the DMA-offset-adjusted physical address of the
+page passed in, thus we can report success unconditionally.
+
+Fixes: b67a8b29df7e ("arm64: mm: only initialize swiotlb when necessary")
+CC: stable@vger.kernel.org
+CC: Jisheng Zhang <jszhang@marvell.com>
+Reported-by: Aaro Koskinen <aaro.koskinen@iki.fi>
+Signed-off-by: Robin Murphy <robin.murphy@arm.com>
+Tested-by: Aaro Koskinen <aaro.koskinen@iki.fi>
+---
+
+v2: Get the return value the right way round this time... After some
+    careful reasoning it really is that simple.
+
+ arch/arm64/mm/dma-mapping.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/mm/dma-mapping.c b/arch/arm64/mm/dma-mapping.c
+index e04082700bb1..1ffb7d5d299a 100644
+--- a/arch/arm64/mm/dma-mapping.c
++++ b/arch/arm64/mm/dma-mapping.c
+@@ -352,6 +352,13 @@ static int __swiotlb_dma_supported(struct device *hwdev, u64 mask)
+ 	return 1;
+ }
+ 
++static int __swiotlb_dma_mapping_error(struct device *hwdev, dma_addr_t addr)
++{
++	if (swiotlb)
++		return swiotlb_dma_mapping_error(hwdev, addr);
++	return 0;
++}
++
+ static struct dma_map_ops swiotlb_dma_ops = {
+ 	.alloc = __dma_alloc,
+ 	.free = __dma_free,
+@@ -366,7 +373,7 @@ static struct dma_map_ops swiotlb_dma_ops = {
+ 	.sync_sg_for_cpu = __swiotlb_sync_sg_for_cpu,
+ 	.sync_sg_for_device = __swiotlb_sync_sg_for_device,
+ 	.dma_supported = __swiotlb_dma_supported,
+-	.mapping_error = swiotlb_dma_mapping_error,
++	.mapping_error = __swiotlb_dma_mapping_error,
+ };
+ 
+ static int __init atomic_pool_init(void)
diff --git a/baseconfig/CONFIG_SPI_ARMADA_3700 b/baseconfig/CONFIG_SPI_ARMADA_3700
deleted file mode 100644
index f245ed398..000000000
--- a/baseconfig/CONFIG_SPI_ARMADA_3700
+++ /dev/null
@@ -1 +0,0 @@
-CONFIG_SPI_ARMADA_3700=m
diff --git a/drm_vc4_Fix_an_integer_overflow_in_temporary_allocation_layout.patch b/drm_vc4_Fix_an_integer_overflow_in_temporary_allocation_layout.patch
new file mode 100644
index 000000000..37f012073
--- /dev/null
+++ b/drm_vc4_Fix_an_integer_overflow_in_temporary_allocation_layout.patch
@@ -0,0 +1,82 @@
+From: Eric Anholt <eric@anholt.net>
+To: dri-devel@lists.freedesktop.org
+Subject: [PATCH 1/2] drm/vc4: Fix an integer overflow in temporary
+ allocation layout.
+Date: Wed, 18 Jan 2017 07:20:49 +1100
+
+We copy the unvalidated ioctl arguments from the user into kernel
+temporary memory to run the validation from, to avoid a race where the
+user updates the unvalidate contents in between validating them and
+copying them into the validated BO.
+
+However, in setting up the layout of the kernel side, we failed to
+check one of the additions (the roundup() for shader_rec_offset)
+against integer overflow, allowing a nearly MAX_UINT value of
+bin_cl_size to cause us to under-allocate the temporary space that we
+then copy_from_user into.
+
+Reported-by: Murray McAllister <murray.mcallister@insomniasec.com>
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Fixes: d5b1a78a772f ("drm/vc4: Add support for drawing 3D frames.")
+---
+ drivers/gpu/drm/vc4/vc4_gem.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/vc4/vc4_gem.c b/drivers/gpu/drm/vc4/vc4_gem.c
+index db920771bfb5..c5fe3554858e 100644
+--- a/drivers/gpu/drm/vc4/vc4_gem.c
++++ b/drivers/gpu/drm/vc4/vc4_gem.c
+@@ -594,7 +594,8 @@ vc4_get_bcl(struct drm_device *dev, struct vc4_exec_info *exec)
+ 					  args->shader_rec_count);
+ 	struct vc4_bo *bo;
+ 
+-	if (uniforms_offset < shader_rec_offset ||
++	if (shader_rec_offset < args->bin_cl_size ||
++	    uniforms_offset < shader_rec_offset ||
+ 	    exec_size < uniforms_offset ||
+ 	    args->shader_rec_count >= (UINT_MAX /
+ 					  sizeof(struct vc4_shader_state)) ||
+-- 
+2.11.0
+
+_______________________________________________
+dri-devel mailing list
+dri-devel@lists.freedesktop.org
+https://lists.freedesktop.org/mailman/listinfo/dri-devel
+
+From: Eric Anholt <eric@anholt.net>
+To: dri-devel@lists.freedesktop.org
+Subject: [PATCH 2/2] drm/vc4: Return -EINVAL on the overflow checks failing.
+Date: Wed, 18 Jan 2017 07:20:50 +1100
+
+By failing to set the errno, we'd continue on to trying to set up the
+RCL, and then oops on trying to dereference the tile_bo that binning
+validation should have set up.
+
+Reported-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Fixes: d5b1a78a772f ("drm/vc4: Add support for drawing 3D frames.")
+---
+ drivers/gpu/drm/vc4/vc4_gem.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/vc4/vc4_gem.c b/drivers/gpu/drm/vc4/vc4_gem.c
+index c5fe3554858e..ab3016982466 100644
+--- a/drivers/gpu/drm/vc4/vc4_gem.c
++++ b/drivers/gpu/drm/vc4/vc4_gem.c
+@@ -601,6 +601,7 @@ vc4_get_bcl(struct drm_device *dev, struct vc4_exec_info *exec)
+ 					  sizeof(struct vc4_shader_state)) ||
+ 	    temp_size < exec_size) {
+ 		DRM_ERROR("overflow in exec arguments\n");
++		ret = -EINVAL;
+ 		goto fail;
+ 	}
+ 
+-- 
+2.11.0
+
+_______________________________________________
+dri-devel mailing list
+dri-devel@lists.freedesktop.org
+https://lists.freedesktop.org/mailman/listinfo/dri-devel
+
diff --git a/gitrev b/gitrev
index 32cfbda13..ad19f21e6 100644
--- a/gitrev
+++ b/gitrev
@@ -1 +1 @@
-a4685d2f58e2230d4e27fb2ee581d7ea35e5d046
+ff9f8a7cf935468a94d9927c68b00daae701667e
diff --git a/kernel-i686-PAE.config b/kernel-i686-PAE.config
index 4c38676a0..b0f9cc9cb 100644
--- a/kernel-i686-PAE.config
+++ b/kernel-i686-PAE.config
@@ -4888,7 +4888,6 @@ CONFIG_SPARSE_IRQ=y
 CONFIG_SPARSE_RCU_POINTER=y
 # CONFIG_SPEAKUP is not set
 # CONFIG_SPI_ALTERA is not set
-CONFIG_SPI_ARMADA_3700=m
 # CONFIG_SPI_AXI_SPI_ENGINE is not set
 # CONFIG_SPI_BITBANG is not set
 # CONFIG_SPI_BUTTERFLY is not set
diff --git a/kernel-i686-PAEdebug.config b/kernel-i686-PAEdebug.config
index 97420ae14..57dcf5991 100644
--- a/kernel-i686-PAEdebug.config
+++ b/kernel-i686-PAEdebug.config
@@ -4909,7 +4909,6 @@ CONFIG_SPARSE_IRQ=y
 CONFIG_SPARSE_RCU_POINTER=y
 # CONFIG_SPEAKUP is not set
 # CONFIG_SPI_ALTERA is not set
-CONFIG_SPI_ARMADA_3700=m
 # CONFIG_SPI_AXI_SPI_ENGINE is not set
 # CONFIG_SPI_BITBANG is not set
 # CONFIG_SPI_BUTTERFLY is not set
diff --git a/kernel-i686-debug.config b/kernel-i686-debug.config
index ea0cca961..6ff1e94de 100644
--- a/kernel-i686-debug.config
+++ b/kernel-i686-debug.config
@@ -4909,7 +4909,6 @@ CONFIG_SPARSE_IRQ=y
 CONFIG_SPARSE_RCU_POINTER=y
 # CONFIG_SPEAKUP is not set
 # CONFIG_SPI_ALTERA is not set
-CONFIG_SPI_ARMADA_3700=m
 # CONFIG_SPI_AXI_SPI_ENGINE is not set
 # CONFIG_SPI_BITBANG is not set
 # CONFIG_SPI_BUTTERFLY is not set
diff --git a/kernel-i686.config b/kernel-i686.config
index 0831ed641..a63bcb922 100644
--- a/kernel-i686.config
+++ b/kernel-i686.config
@@ -4888,7 +4888,6 @@ CONFIG_SPARSE_IRQ=y
 CONFIG_SPARSE_RCU_POINTER=y
 # CONFIG_SPEAKUP is not set
 # CONFIG_SPI_ALTERA is not set
-CONFIG_SPI_ARMADA_3700=m
 # CONFIG_SPI_AXI_SPI_ENGINE is not set
 # CONFIG_SPI_BITBANG is not set
 # CONFIG_SPI_BUTTERFLY is not set
diff --git a/kernel-ppc64-debug.config b/kernel-ppc64-debug.config
index b7735db11..342cd6de4 100644
--- a/kernel-ppc64-debug.config
+++ b/kernel-ppc64-debug.config
@@ -4760,7 +4760,6 @@ CONFIG_SPARSEMEM_VMEMMAP=y
 CONFIG_SPARSE_RCU_POINTER=y
 # CONFIG_SPEAKUP is not set
 # CONFIG_SPI_ALTERA is not set
-CONFIG_SPI_ARMADA_3700=m
 # CONFIG_SPI_AXI_SPI_ENGINE is not set
 # CONFIG_SPI_BITBANG is not set
 # CONFIG_SPI_BUTTERFLY is not set
diff --git a/kernel-ppc64.config b/kernel-ppc64.config
index a691d0838..21a6d5e04 100644
--- a/kernel-ppc64.config
+++ b/kernel-ppc64.config
@@ -4737,7 +4737,6 @@ CONFIG_SPARSEMEM_VMEMMAP=y
 CONFIG_SPARSE_RCU_POINTER=y
 # CONFIG_SPEAKUP is not set
 # CONFIG_SPI_ALTERA is not set
-CONFIG_SPI_ARMADA_3700=m
 # CONFIG_SPI_AXI_SPI_ENGINE is not set
 # CONFIG_SPI_BITBANG is not set
 # CONFIG_SPI_BUTTERFLY is not set
diff --git a/kernel-ppc64le-debug.config b/kernel-ppc64le-debug.config
index fcfa47306..99c26d4aa 100644
--- a/kernel-ppc64le-debug.config
+++ b/kernel-ppc64le-debug.config
@@ -4689,7 +4689,6 @@ CONFIG_SPARSEMEM_VMEMMAP=y
 CONFIG_SPARSE_RCU_POINTER=y
 # CONFIG_SPEAKUP is not set
 # CONFIG_SPI_ALTERA is not set
-CONFIG_SPI_ARMADA_3700=m
 # CONFIG_SPI_AXI_SPI_ENGINE is not set
 # CONFIG_SPI_BITBANG is not set
 # CONFIG_SPI_BUTTERFLY is not set
diff --git a/kernel-ppc64le.config b/kernel-ppc64le.config
index 50bb94a74..b67fac408 100644
--- a/kernel-ppc64le.config
+++ b/kernel-ppc64le.config
@@ -4666,7 +4666,6 @@ CONFIG_SPARSEMEM_VMEMMAP=y
 CONFIG_SPARSE_RCU_POINTER=y
 # CONFIG_SPEAKUP is not set
 # CONFIG_SPI_ALTERA is not set
-CONFIG_SPI_ARMADA_3700=m
 # CONFIG_SPI_AXI_SPI_ENGINE is not set
 # CONFIG_SPI_BITBANG is not set
 # CONFIG_SPI_BUTTERFLY is not set
diff --git a/kernel-ppc64p7-debug.config b/kernel-ppc64p7-debug.config
index abb0bc7e8..efa1ecd0d 100644
--- a/kernel-ppc64p7-debug.config
+++ b/kernel-ppc64p7-debug.config
@@ -4688,7 +4688,6 @@ CONFIG_SPARSEMEM_VMEMMAP=y
 CONFIG_SPARSE_RCU_POINTER=y
 # CONFIG_SPEAKUP is not set
 # CONFIG_SPI_ALTERA is not set
-CONFIG_SPI_ARMADA_3700=m
 # CONFIG_SPI_AXI_SPI_ENGINE is not set
 # CONFIG_SPI_BITBANG is not set
 # CONFIG_SPI_BUTTERFLY is not set
diff --git a/kernel-ppc64p7.config b/kernel-ppc64p7.config
index 9b24abb1b..483ef2b72 100644
--- a/kernel-ppc64p7.config
+++ b/kernel-ppc64p7.config
@@ -4665,7 +4665,6 @@ CONFIG_SPARSEMEM_VMEMMAP=y
 CONFIG_SPARSE_RCU_POINTER=y
 # CONFIG_SPEAKUP is not set
 # CONFIG_SPI_ALTERA is not set
-CONFIG_SPI_ARMADA_3700=m
 # CONFIG_SPI_AXI_SPI_ENGINE is not set
 # CONFIG_SPI_BITBANG is not set
 # CONFIG_SPI_BUTTERFLY is not set
diff --git a/kernel-s390x-debug.config b/kernel-s390x-debug.config
index 54561e4a7..36fe54367 100644
--- a/kernel-s390x-debug.config
+++ b/kernel-s390x-debug.config
@@ -4579,7 +4579,6 @@ CONFIG_SOUND_OSS_CORE_PRECLAIM=y
 CONFIG_SPARSE_RCU_POINTER=y
 # CONFIG_SPEAKUP is not set
 # CONFIG_SPI_ALTERA is not set
-CONFIG_SPI_ARMADA_3700=m
 # CONFIG_SPI_AXI_SPI_ENGINE is not set
 # CONFIG_SPI_BITBANG is not set
 # CONFIG_SPI_BUTTERFLY is not set
diff --git a/kernel-s390x.config b/kernel-s390x.config
index 08d9cc5fa..7b962cfba 100644
--- a/kernel-s390x.config
+++ b/kernel-s390x.config
@@ -4556,7 +4556,6 @@ CONFIG_SOUND_OSS_CORE_PRECLAIM=y
 CONFIG_SPARSE_RCU_POINTER=y
 # CONFIG_SPEAKUP is not set
 # CONFIG_SPI_ALTERA is not set
-CONFIG_SPI_ARMADA_3700=m
 # CONFIG_SPI_AXI_SPI_ENGINE is not set
 # CONFIG_SPI_BITBANG is not set
 # CONFIG_SPI_BUTTERFLY is not set
diff --git a/kernel-x86_64-debug.config b/kernel-x86_64-debug.config
index 9ce86af2f..b6714a8ee 100644
--- a/kernel-x86_64-debug.config
+++ b/kernel-x86_64-debug.config
@@ -4941,7 +4941,6 @@ CONFIG_SPARSEMEM=y
 CONFIG_SPARSE_RCU_POINTER=y
 # CONFIG_SPEAKUP is not set
 # CONFIG_SPI_ALTERA is not set
-CONFIG_SPI_ARMADA_3700=m
 # CONFIG_SPI_AXI_SPI_ENGINE is not set
 # CONFIG_SPI_BITBANG is not set
 # CONFIG_SPI_BUTTERFLY is not set
diff --git a/kernel-x86_64.config b/kernel-x86_64.config
index 04ee06380..d6c92e25d 100644
--- a/kernel-x86_64.config
+++ b/kernel-x86_64.config
@@ -4920,7 +4920,6 @@ CONFIG_SPARSEMEM=y
 CONFIG_SPARSE_RCU_POINTER=y
 # CONFIG_SPEAKUP is not set
 # CONFIG_SPI_ALTERA is not set
-CONFIG_SPI_ARMADA_3700=m
 # CONFIG_SPI_AXI_SPI_ENGINE is not set
 # CONFIG_SPI_BITBANG is not set
 # CONFIG_SPI_BUTTERFLY is not set
diff --git a/kernel.spec b/kernel.spec
index a69291534..525ff1207 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -77,7 +77,7 @@ Summary: The Linux kernel
 # The rc snapshot level
 %global rcrev 5
 # The git snapshot level
-%define gitrev 1
+%define gitrev 3
 # Set rpm version accordingly
 %define rpmversion 4.%{upstream_sublevel}.0
 %endif
@@ -534,6 +534,9 @@ Patch425: ARM-tegra-usb-no-reset.patch
 
 Patch426: AllWinner-net-emac.patch
 
+# http://www.spinics.net/lists/arm-kernel/msg557831.html
+Patch427: arm64-dma-mapping-Fix-dma_mapping_error-when-bypassing-SWIOTLB.patch
+
 Patch430: bcm2837-initial-support.patch
 
 # http://www.spinics.net/lists/linux-mmc/msg41151.html
@@ -607,6 +610,9 @@ Patch851: Armada-trace-build-fix.patch
 # selinux: allow context mounts on tmpfs, ramfs, devpts within user namespaces
 Patch852: selinux-allow-context-mounts-on-tmpfs-etc.patch
 
+#CVE-2017-5576 CVE-2017-5577 rhbz 1416436 1416437 1416439
+Patch853: drm_vc4_Fix_an_integer_overflow_in_temporary_allocation_layout.patch
+
 # END OF PATCH DEFINITIONS
 
 %endif
@@ -2180,6 +2186,16 @@ fi
 #
 #
 %changelog
+* Thu Jan 26 2017 Justin M. Forbes <jforbes@fedoraproject.org> - 4.10.0-0.rc5.git3.1
+- Linux v4.10-rc5-122-gff9f8a7
+
+* Thu Jan 26 2017 Peter Robinson <pbrobinson@fedoraproject.org>
+- arm64: dma-mapping: Fix dma_mapping_error() when bypassing SWIOTLB
+
+* Wed Jan 25 2017 Justin M. Forbes <jforbes@fedoraproject.org> - 4.10.0-0.rc5.git2.1
+- Linux v4.10-rc5-107-g883af14
+- CVE-2017-5576 CVE-2017-5577 vc4 overflows (rhbz 1416436 1416437 1416439)
+
 * Tue Jan 24 2017 Justin M. Forbes <jforbes@fedoraproject.org> - 4.10.0-0.rc5.git1.1
 - Linux v4.10-rc5-71-ga4685d2
 
diff --git a/sources b/sources
index bbd62b66c..9fe2523ce 100644
--- a/sources
+++ b/sources
@@ -1,4 +1,4 @@
 SHA512 (linux-4.9.tar.xz) = bf67ff812cc3cb7e5059e82cc5db0d9a7c5637f7ed9a42e4730c715bf7047c81ed3a571225f92a33ef0b6d65f35595bc32d773356646df2627da55e9bc7f1f1a
 SHA512 (perf-man-4.9.tar.gz) = d23bb3da1eadd6623fddbf4696948de7675f3dcf57c711a7427dd7ae111394f58d8f42752938bbea7cd219f1e7f6f116fc67a1c74f769711063940a065f37b99
 SHA512 (patch-4.10-rc5.xz) = 5c51bce76af4e6f4637aaa059a9211c958d3d26332ef9efab421586069b1df5610b781908359da325dd114c9a6567f45be45a3c6bae6830586af69669d05910a
-SHA512 (patch-4.10-rc5-git1.xz) = 3a9c5193d80217069e3e1c61a110d0705f607442cfcfa801d1da61ce41b5a824ea7fd65c9273272f11469ef4caf8655f63139835fa1b7a0e89f7c2a82b379bc5
+SHA512 (patch-4.10-rc5-git3.xz) = e4510851b1bc53e6e34226642386ed5fe2fbca1341a335bb80acbd8535410fb4a218616435e8a3578e4e3d3b4119d021d32643744c85c1287a4da2bab8af2123