diff options
| -rw-r--r-- | 0001-x86-cpu-cacheinfo-Fix-teardown-path.patch | 86 | ||||
| -rw-r--r-- | USB-whiteheat-fix-potential-null-deref-at-probe.patch | 81 | ||||
| -rw-r--r-- | config-generic | 1 | ||||
| -rw-r--r-- | kernel.spec | 13 | ||||
| -rw-r--r-- | sources | 3 |
5 files changed, 7 insertions, 177 deletions
diff --git a/0001-x86-cpu-cacheinfo-Fix-teardown-path.patch b/0001-x86-cpu-cacheinfo-Fix-teardown-path.patch deleted file mode 100644 index 52e82feed..000000000 --- a/0001-x86-cpu-cacheinfo-Fix-teardown-path.patch +++ /dev/null @@ -1,86 +0,0 @@ -From 680ac028240f8747f31c03986fbcf18b2b521e93 Mon Sep 17 00:00:00 2001 -From: Borislav Petkov <bp@suse.de> -Date: Mon, 27 Jul 2015 09:58:05 +0200 -Subject: [PATCH] x86/cpu/cacheinfo: Fix teardown path -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Philip Müller reported a hang when booting 32-bit 4.1 kernel on -an AMD box. A fragment of the splat was enough to pinpoint the -issue: - - task: f58e0000 ti: f58e8000 task.ti: f58e800 - EIP: 0060:[<c135a903>] EFLAGS: 00010206 CPU: 0 - EIP is at free_cache_attributes+0x83/0xd0 - EAX: 00000001 EBX: f589d46c ECX: 00000090 EDX: 360c2000 - ESI: 00000000 EDI: c1724a80 EBP: f58e9ec0 ESP: f58e9ea0 - DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068 - CR0: 8005003b CR2: 000000ac CR3: 01731000 CR4: 000006d0 - -cache_shared_cpu_map_setup() did check sibling CPUs cacheinfo -descriptor while the respective teardown path -cache_shared_cpu_map_remove() didn't. Fix that. - -From tglx's version: to be on the safe side, move the cacheinfo -descriptor check to free_cache_attributes(), thus cleaning up -the hotplug path a little and making this even more robust. - -Reported-by: Philip Müller <philm@manjaro.org> -Signed-off-by: Borislav Petkov <bp@suse.de> -Cc: <stable@vger.kernel.org> # v4.1+ -Cc: Andre Przywara <andre.przywara@arm.com> -Cc: Guenter Roeck <linux@roeck-us.net> -Cc: H. Peter Anvin <hpa@zytor.com> -Cc: Linus Torvalds <torvalds@linux-foundation.org> -Cc: Peter Zijlstra <peterz@infradead.org> -Cc: Sudeep Holla <sudeep.holla@arm.com> -Cc: Thomas Gleixner <tglx@linutronix.de> -Cc: linux-kernel@vger.kernel.org -Cc: manjaro-dev@manjaro.org -Link: http://lkml.kernel.org/r/20150727075805.GA20416@nazgul.tnic -Link: https://lkml.kernel.org/r/55B47BB8.6080202@manjaro.org -Signed-off-by: Ingo Molnar <mingo@kernel.org> ---- - drivers/base/cacheinfo.c | 10 ++++++++-- - 1 file changed, 8 insertions(+), 2 deletions(-) - -diff --git a/drivers/base/cacheinfo.c b/drivers/base/cacheinfo.c -index 764280a91776..e9fd32e91668 100644 ---- a/drivers/base/cacheinfo.c -+++ b/drivers/base/cacheinfo.c -@@ -148,7 +148,11 @@ static void cache_shared_cpu_map_remove(unsigned int cpu) - - if (sibling == cpu) /* skip itself */ - continue; -+ - sib_cpu_ci = get_cpu_cacheinfo(sibling); -+ if (!sib_cpu_ci->info_list) -+ continue; -+ - sib_leaf = sib_cpu_ci->info_list + index; - cpumask_clear_cpu(cpu, &sib_leaf->shared_cpu_map); - cpumask_clear_cpu(sibling, &this_leaf->shared_cpu_map); -@@ -159,6 +163,9 @@ static void cache_shared_cpu_map_remove(unsigned int cpu) - - static void free_cache_attributes(unsigned int cpu) - { -+ if (!per_cpu_cacheinfo(cpu)) -+ return; -+ - cache_shared_cpu_map_remove(cpu); - - kfree(per_cpu_cacheinfo(cpu)); -@@ -514,8 +521,7 @@ static int cacheinfo_cpu_callback(struct notifier_block *nfb, - break; - case CPU_DEAD: - cache_remove_dev(cpu); -- if (per_cpu_cacheinfo(cpu)) -- free_cache_attributes(cpu); -+ free_cache_attributes(cpu); - break; - } - return notifier_from_errno(rc); --- -2.4.3 - diff --git a/USB-whiteheat-fix-potential-null-deref-at-probe.patch b/USB-whiteheat-fix-potential-null-deref-at-probe.patch deleted file mode 100644 index 00fd5578c..000000000 --- a/USB-whiteheat-fix-potential-null-deref-at-probe.patch +++ /dev/null @@ -1,81 +0,0 @@ -From 10d98bced414c6fc1d09db123e7f762d91b5ebea Mon Sep 17 00:00:00 2001 -From: Johan Hovold <johan@kernel.org> -Date: Wed, 23 Sep 2015 11:41:42 -0700 -Subject: [PATCH] USB: whiteheat: fix potential null-deref at probe - -Fix potential null-pointer dereference at probe by making sure that the -required endpoints are present. - -The whiteheat driver assumes there are at least five pairs of bulk -endpoints, of which the final pair is used for the "command port". An -attempt to bind to an interface with fewer bulk endpoints would -currently lead to an oops. - -Fixes CVE-2015-5257. - -Reported-by: Moein Ghasemzadeh <moein@istuary.com> -Cc: stable <stable@vger.kernel.org> -Signed-off-by: Johan Hovold <johan@kernel.org> ---- - drivers/usb/serial/whiteheat.c | 31 +++++++++++++++++++++++++++++++ - 1 file changed, 31 insertions(+) - -diff --git a/drivers/usb/serial/whiteheat.c b/drivers/usb/serial/whiteheat.c -index 6c3734d2b45a..d3ea90bef84d 100644 ---- a/drivers/usb/serial/whiteheat.c -+++ b/drivers/usb/serial/whiteheat.c -@@ -80,6 +80,8 @@ static int whiteheat_firmware_download(struct usb_serial *serial, - static int whiteheat_firmware_attach(struct usb_serial *serial); - - /* function prototypes for the Connect Tech WhiteHEAT serial converter */ -+static int whiteheat_probe(struct usb_serial *serial, -+ const struct usb_device_id *id); - static int whiteheat_attach(struct usb_serial *serial); - static void whiteheat_release(struct usb_serial *serial); - static int whiteheat_port_probe(struct usb_serial_port *port); -@@ -116,6 +118,7 @@ static struct usb_serial_driver whiteheat_device = { - .description = "Connect Tech - WhiteHEAT", - .id_table = id_table_std, - .num_ports = 4, -+ .probe = whiteheat_probe, - .attach = whiteheat_attach, - .release = whiteheat_release, - .port_probe = whiteheat_port_probe, -@@ -217,6 +220,34 @@ static int whiteheat_firmware_attach(struct usb_serial *serial) - /***************************************************************************** - * Connect Tech's White Heat serial driver functions - *****************************************************************************/ -+ -+static int whiteheat_probe(struct usb_serial *serial, -+ const struct usb_device_id *id) -+{ -+ struct usb_host_interface *iface_desc; -+ struct usb_endpoint_descriptor *endpoint; -+ size_t num_bulk_in = 0; -+ size_t num_bulk_out = 0; -+ size_t min_num_bulk; -+ unsigned int i; -+ -+ iface_desc = serial->interface->cur_altsetting; -+ -+ for (i = 0; i < iface_desc->desc.bNumEndpoints; i++) { -+ endpoint = &iface_desc->endpoint[i].desc; -+ if (usb_endpoint_is_bulk_in(endpoint)) -+ ++num_bulk_in; -+ if (usb_endpoint_is_bulk_out(endpoint)) -+ ++num_bulk_out; -+ } -+ -+ min_num_bulk = COMMAND_PORT + 1; -+ if (num_bulk_in < min_num_bulk || num_bulk_out < min_num_bulk) -+ return -ENODEV; -+ -+ return 0; -+} -+ - static int whiteheat_attach(struct usb_serial *serial) - { - struct usb_serial_port *command_port; --- -2.4.3 - diff --git a/config-generic b/config-generic index e4b564b80..db17cdd4e 100644 --- a/config-generic +++ b/config-generic @@ -1889,6 +1889,7 @@ CONFIG_USB_NET_RNDIS_WLAN=m CONFIG_USB_NET_KALMIA=m CONFIG_USB_NET_QMI_WWAN=m CONFIG_USB_NET_SMSC75XX=m +CONFIG_USB_NET_CH9200=m # CONFIG_WL_TI is not set CONFIG_ZD1211RW=m # CONFIG_ZD1211RW_DEBUG is not set diff --git a/kernel.spec b/kernel.spec index eb5491e99..78f32265f 100644 --- a/kernel.spec +++ b/kernel.spec @@ -65,9 +65,9 @@ Summary: The Linux kernel # The next upstream release sublevel (base_sublevel+1) %define upstream_sublevel %(echo $((%{base_sublevel} + 1))) # The rc snapshot level -%define rcrev 2 +%define rcrev 3 # The git snapshot level -%define gitrev 1 +%define gitrev 0 # Set rpm version accordingly %define rpmversion 4.%{upstream_sublevel}.0 %endif @@ -587,12 +587,6 @@ Patch509: ideapad-laptop-Add-Lenovo-Yoga-3-14-to-no_hw_rfkill-.patch Patch520: ARM-dts-Fix-Makefile-target-for-sun4i-a10-itead-itea.patch -#rhbz 1263762 -Patch526: 0001-x86-cpu-cacheinfo-Fix-teardown-path.patch - -#CVE-2015-5257 rhbz 1265607 1265612 -Patch527: USB-whiteheat-fix-potential-null-deref-at-probe.patch - Patch904: kdbus.patch # END OF PATCH DEFINITIONS @@ -2038,6 +2032,9 @@ fi # # %changelog +* Mon Sep 28 2015 Laura Abbott <labbott@redhat.com> - 4.3.0-0.rc3.git0.1 +- Linux v4.3-rc3 + * Mon Sep 28 2015 Peter Robinson <pbrobinson@fedoraproject.org> - Minor ARMv7 updates @@ -1,4 +1,3 @@ 3d5ea06d767e2f35c999eeadafc76523 linux-4.2.tar.xz 4c964bfba54d65b5b54cc898baddecad perf-man-4.2.tar.gz -ccf42975f84dac28605d8abced239c1d patch-4.3-rc2.xz -ea9a48b95631e7af3d274164aaf58271 patch-4.3-rc2-git1.xz +7b080fe7715b861b89b06868ed0b27f0 patch-4.3-rc3.xz |