From 5b87b4bfd943976e122b6f4b0de6945617526fbf Mon Sep 17 00:00:00 2001 From: "Justin M. Forbes" Date: Tue, 12 Apr 2016 13:28:45 -0500 Subject: Linux v4.5.1 --- ...tics-handle-spurious-release-of-trackstic.patch | 31 ------ ...dio-Add-sanity-checks-for-endpoint-access.patch | 80 --------------- ...dio-Fix-NULL-dereference-in-create_fixed_.patch | 40 -------- ...dio-Fix-double-free-in-error-paths-after-.patch | 100 ------------------- ...dio-Minor-code-cleanup-in-create_fixed_st.patch | 62 ------------ ...emote2-fix-crashes-on-detecting-device-wi.patch | 107 --------------------- ...owermate-fix-oops-with-malicious-USB-desc.patch | 38 -------- ...or-fix-oops-with-malicious-USB-descriptor.patch | 40 -------- ...ftdi_sio-Add-support-for-ICP-DAS-I-756xU-.patch | 59 ------------ ...Pull-upstream-fixes-plus-iproc-mmc-driver.patch | 88 ----------------- cdc-acm-more-sanity-checking.patch | 33 ------- cypress_m8-add-sanity-checking.patch | 50 ---------- ...port-do-sanity-checking-for-the-number-of.patch | 70 -------------- ...u-sanity-check-against-missing-interfaces.patch | 39 -------- kernel.spec | 53 +--------- mct_u232-sanity-checking-in-probe.patch | 35 ------- perf-tools-Fix-python-extension-build.patch | 71 -------------- sources | 1 + thermal-fix.patch | 77 --------------- ...river_claim_interface-add-sanity-checking.patch | 39 -------- ...wn-IO-port-access-when-module-security-is.patch | 2 +- ...64-Properly-context-switch-IOPL-on-Xen-PV.patch | 96 ------------------ 22 files changed, 7 insertions(+), 1204 deletions(-) delete mode 100644 0001-Input-synaptics-handle-spurious-release-of-trackstic.patch delete mode 100644 ALSA-usb-audio-Add-sanity-checks-for-endpoint-access.patch delete mode 100644 ALSA-usb-audio-Fix-NULL-dereference-in-create_fixed_.patch delete mode 100644 ALSA-usb-audio-Fix-double-free-in-error-paths-after-.patch delete mode 100644 ALSA-usb-audio-Minor-code-cleanup-in-create_fixed_st.patch delete mode 100644 Input-ati_remote2-fix-crashes-on-detecting-device-wi.patch delete mode 100644 USB-input-powermate-fix-oops-with-malicious-USB-desc.patch delete mode 100644 USB-iowarrior-fix-oops-with-malicious-USB-descriptor.patch delete mode 100644 USB-serial-ftdi_sio-Add-support-for-ICP-DAS-I-756xU-.patch delete mode 100644 cdc-acm-more-sanity-checking.patch delete mode 100644 cypress_m8-add-sanity-checking.patch delete mode 100644 digi_acceleport-do-sanity-checking-for-the-number-of.patch delete mode 100644 ims-pcu-sanity-check-against-missing-interfaces.patch delete mode 100644 mct_u232-sanity-checking-in-probe.patch delete mode 100644 perf-tools-Fix-python-extension-build.patch delete mode 100644 thermal-fix.patch delete mode 100644 usb_driver_claim_interface-add-sanity-checking.patch delete mode 100644 x86-iopl-64-Properly-context-switch-IOPL-on-Xen-PV.patch diff --git a/0001-Input-synaptics-handle-spurious-release-of-trackstic.patch b/0001-Input-synaptics-handle-spurious-release-of-trackstic.patch deleted file mode 100644 index 52b082b36..000000000 --- a/0001-Input-synaptics-handle-spurious-release-of-trackstic.patch +++ /dev/null @@ -1,31 +0,0 @@ -From cb6fcfe5a7e9197ceb7e9eec56e9c526e4e76354 Mon Sep 17 00:00:00 2001 -From: Benjamin Tissoires -Date: Mon, 14 Mar 2016 19:37:12 +0100 -Subject: [PATCH] Input: synaptics - handle spurious release of trackstick - buttons, again - -Looks like the fimware 8.2 stall has the extra buttons spurious release -bug. - -Signed-off-by: Benjamin Tissoires ---- - drivers/input/mouse/synaptics.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c -index 6025eb4..4ef8d7a 100644 ---- a/drivers/input/mouse/synaptics.c -+++ b/drivers/input/mouse/synaptics.c -@@ -863,7 +863,8 @@ static void synaptics_report_ext_buttons(struct psmouse *psmouse, - return; - - /* Bug in FW 8.1, buttons are reported only when ExtBit is 1 */ -- if (SYN_ID_FULL(priv->identity) == 0x801 && -+ if ((SYN_ID_FULL(priv->identity) == 0x801 || -+ SYN_ID_FULL(priv->identity) == 0x802) && - !((psmouse->packet[0] ^ psmouse->packet[3]) & 0x02)) - return; - --- -2.5.0 - diff --git a/ALSA-usb-audio-Add-sanity-checks-for-endpoint-access.patch b/ALSA-usb-audio-Add-sanity-checks-for-endpoint-access.patch deleted file mode 100644 index 801434a26..000000000 --- a/ALSA-usb-audio-Add-sanity-checks-for-endpoint-access.patch +++ /dev/null @@ -1,80 +0,0 @@ -From 873156565ca67779bbf5a3475ccd08ea3bb92522 Mon Sep 17 00:00:00 2001 -From: Takashi Iwai -Date: Tue, 15 Mar 2016 15:20:58 +0100 -Subject: [PATCH 2/2] ALSA: usb-audio: Add sanity checks for endpoint accesses - -Add some sanity check codes before actually accessing the endpoint via -get_endpoint() in order to avoid the invalid access through a -malformed USB descriptor. Mostly just checking bNumEndpoints, but in -one place (snd_microii_spdif_default_get()), the validity of iface and -altsetting index is checked as well. - -Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=971125 -Cc: -Signed-off-by: Takashi Iwai ---- - sound/usb/clock.c | 2 ++ - sound/usb/endpoint.c | 3 +++ - sound/usb/mixer_quirks.c | 4 ++++ - sound/usb/pcm.c | 2 ++ - 4 files changed, 11 insertions(+) - -diff --git a/sound/usb/clock.c b/sound/usb/clock.c -index 2ed260b10f6d..7ccbcaf6a147 100644 ---- a/sound/usb/clock.c -+++ b/sound/usb/clock.c -@@ -285,6 +285,8 @@ static int set_sample_rate_v1(struct snd_usb_audio *chip, int iface, - unsigned char data[3]; - int err, crate; - -+ if (get_iface_desc(alts)->bNumEndpoints < 1) -+ return -EINVAL; - ep = get_endpoint(alts, 0)->bEndpointAddress; - - /* if endpoint doesn't have sampling rate control, bail out */ -diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c -index e6f71894ecdc..c2131b851602 100644 ---- a/sound/usb/endpoint.c -+++ b/sound/usb/endpoint.c -@@ -415,6 +415,9 @@ exit_clear: - * - * New endpoints will be added to chip->ep_list and must be freed by - * calling snd_usb_endpoint_free(). -+ * -+ * For SND_USB_ENDPOINT_TYPE_SYNC, the caller needs to guarantee that -+ * bNumEndpoints > 1 beforehand. - */ - struct snd_usb_endpoint *snd_usb_add_endpoint(struct snd_usb_audio *chip, - struct usb_host_interface *alts, -diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c -index d3608c0a29f3..2d724e3c4cc0 100644 ---- a/sound/usb/mixer_quirks.c -+++ b/sound/usb/mixer_quirks.c -@@ -1518,7 +1518,11 @@ static int snd_microii_spdif_default_get(struct snd_kcontrol *kcontrol, - - /* use known values for that card: interface#1 altsetting#1 */ - iface = usb_ifnum_to_if(chip->dev, 1); -+ if (!iface || iface->num_altsetting < 2) -+ return -EINVAL; - alts = &iface->altsetting[1]; -+ if (get_iface_desc(alts)->bNumEndpoints < 1) -+ return -EINVAL; - ep = get_endpoint(alts, 0)->bEndpointAddress; - - err = snd_usb_ctl_msg(chip->dev, -diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c -index cdac5179db3f..4da64896df6d 100644 ---- a/sound/usb/pcm.c -+++ b/sound/usb/pcm.c -@@ -159,6 +159,8 @@ static int init_pitch_v1(struct snd_usb_audio *chip, int iface, - unsigned char data[1]; - int err; - -+ if (get_iface_desc(alts)->bNumEndpoints < 1) -+ return -EINVAL; - ep = get_endpoint(alts, 0)->bEndpointAddress; - - data[0] = 1; --- -2.5.0 - diff --git a/ALSA-usb-audio-Fix-NULL-dereference-in-create_fixed_.patch b/ALSA-usb-audio-Fix-NULL-dereference-in-create_fixed_.patch deleted file mode 100644 index 37cdb213a..000000000 --- a/ALSA-usb-audio-Fix-NULL-dereference-in-create_fixed_.patch +++ /dev/null @@ -1,40 +0,0 @@ -From b0bb5691b38e2f439b071e226bad9f699c33b77d Mon Sep 17 00:00:00 2001 -From: Takashi Iwai -Date: Tue, 15 Mar 2016 12:09:10 +0100 -Subject: [PATCH 1/2] ALSA: usb-audio: Fix NULL dereference in - create_fixed_stream_quirk() - -create_fixed_stream_quirk() may cause a NULL-pointer dereference by -accessing the non-existing endpoint when a USB device with a malformed -USB descriptor is used. - -This patch avoids it simply by adding a sanity check of bNumEndpoints -before the accesses. - -Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=971125 -Cc: -Signed-off-by: Takashi Iwai ---- - sound/usb/quirks.c | 6 ++++++ - 1 file changed, 6 insertions(+) - -diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c -index eef9b8e4b949..e128ca62eb44 100644 ---- a/sound/usb/quirks.c -+++ b/sound/usb/quirks.c -@@ -177,6 +177,12 @@ static int create_fixed_stream_quirk(struct snd_usb_audio *chip, - } - alts = &iface->altsetting[fp->altset_idx]; - altsd = get_iface_desc(alts); -+ if (altsd->bNumEndpoints < 1) { -+ kfree(fp); -+ kfree(rate_table); -+ return -EINVAL; -+ } -+ - fp->protocol = altsd->bInterfaceProtocol; - - if (fp->datainterval == 0) --- -2.5.0 - diff --git a/ALSA-usb-audio-Fix-double-free-in-error-paths-after-.patch b/ALSA-usb-audio-Fix-double-free-in-error-paths-after-.patch deleted file mode 100644 index c1c72f9bf..000000000 --- a/ALSA-usb-audio-Fix-double-free-in-error-paths-after-.patch +++ /dev/null @@ -1,100 +0,0 @@ -From 1b9e866417f77622b03f5b9c4e2845133054e670 Mon Sep 17 00:00:00 2001 -From: Vladis Dronov -Date: Thu, 31 Mar 2016 12:05:43 -0400 -Subject: [PATCH 2/2] ALSA: usb-audio: Fix double-free in error paths after - snd_usb_add_audio_stream() call - -create_fixed_stream_quirk(), snd_usb_parse_audio_interface() and -create_uaxx_quirk() functions allocate the audioformat object by themselves -and free it upon error before returning. However, once the object is linked -to a stream, it's freed again in snd_usb_audio_pcm_free(), thus it'll be -double-freed, eventually resulting in a memory corruption. - -This patch fixes these failures in the error paths by unlinking the audioformat -object before freeing it. - -Based on a patch by Takashi Iwai" - -[Note for stable backports: - this patch requires the commit 902eb7fd1e4a ('ALSA: usb-audio: Minor - code cleanup in create_fixed_stream_quirk()')] - -Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1283358 -Reported-by: Ralf Spenneberg -Cc: # see the note above -Signed-off-by: Vladis Dronov ---- - sound/usb/quirks.c | 4 ++++ - sound/usb/stream.c | 6 +++++- - 2 files changed, 9 insertions(+), 1 deletion(-) - -diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c -index 2f0bbc43f902..6f68ba9bda8a 100644 ---- a/sound/usb/quirks.c -+++ b/sound/usb/quirks.c -@@ -150,6 +150,7 @@ static int create_fixed_stream_quirk(struct snd_usb_audio *chip, - usb_audio_err(chip, "cannot memdup\n"); - return -ENOMEM; - } -+ INIT_LIST_HEAD(&fp->list); - if (fp->nr_rates > MAX_NR_RATES) { - kfree(fp); - return -EINVAL; -@@ -193,6 +194,7 @@ static int create_fixed_stream_quirk(struct snd_usb_audio *chip, - return 0; - - error: -+ list_del(&fp->list); /* unlink for avoiding double-free */ - kfree(fp); - kfree(rate_table); - return err; -@@ -468,6 +470,7 @@ static int create_uaxx_quirk(struct snd_usb_audio *chip, - fp->ep_attr = get_endpoint(alts, 0)->bmAttributes; - fp->datainterval = 0; - fp->maxpacksize = le16_to_cpu(get_endpoint(alts, 0)->wMaxPacketSize); -+ INIT_LIST_HEAD(&fp->list); - - switch (fp->maxpacksize) { - case 0x120: -@@ -491,6 +494,7 @@ static int create_uaxx_quirk(struct snd_usb_audio *chip, - ? SNDRV_PCM_STREAM_CAPTURE : SNDRV_PCM_STREAM_PLAYBACK; - err = snd_usb_add_audio_stream(chip, stream, fp); - if (err < 0) { -+ list_del(&fp->list); /* unlink for avoiding double-free */ - kfree(fp); - return err; - } -diff --git a/sound/usb/stream.c b/sound/usb/stream.c -index 8ee14f2365e7..3b23102230c0 100644 ---- a/sound/usb/stream.c -+++ b/sound/usb/stream.c -@@ -316,7 +316,9 @@ static struct snd_pcm_chmap_elem *convert_chmap(int channels, unsigned int bits, - /* - * add this endpoint to the chip instance. - * if a stream with the same endpoint already exists, append to it. -- * if not, create a new pcm stream. -+ * if not, create a new pcm stream. note, fp is added to the substream -+ * fmt_list and will be freed on the chip instance release. do not free -+ * fp or do remove it from the substream fmt_list to avoid double-free. - */ - int snd_usb_add_audio_stream(struct snd_usb_audio *chip, - int stream, -@@ -677,6 +679,7 @@ int snd_usb_parse_audio_interface(struct snd_usb_audio *chip, int iface_no) - * (fp->maxpacksize & 0x7ff); - fp->attributes = parse_uac_endpoint_attributes(chip, alts, protocol, iface_no); - fp->clock = clock; -+ INIT_LIST_HEAD(&fp->list); - - /* some quirks for attributes here */ - -@@ -725,6 +728,7 @@ int snd_usb_parse_audio_interface(struct snd_usb_audio *chip, int iface_no) - dev_dbg(&dev->dev, "%u:%d: add audio endpoint %#x\n", iface_no, altno, fp->endpoint); - err = snd_usb_add_audio_stream(chip, stream, fp); - if (err < 0) { -+ list_del(&fp->list); /* unlink for avoiding double-free */ - kfree(fp->rate_table); - kfree(fp->chmap); - kfree(fp); --- -2.5.5 - diff --git a/ALSA-usb-audio-Minor-code-cleanup-in-create_fixed_st.patch b/ALSA-usb-audio-Minor-code-cleanup-in-create_fixed_st.patch deleted file mode 100644 index 65f88553b..000000000 --- a/ALSA-usb-audio-Minor-code-cleanup-in-create_fixed_st.patch +++ /dev/null @@ -1,62 +0,0 @@ -From aa6c68ed429ba354b904554d396326bfd9ab96bf Mon Sep 17 00:00:00 2001 -From: Takashi Iwai -Date: Tue, 15 Mar 2016 12:14:49 +0100 -Subject: [PATCH 1/2] ALSA: usb-audio: Minor code cleanup in - create_fixed_stream_quirk() - -Just a minor code cleanup: unify the error paths. - -Signed-off-by: Takashi Iwai ---- - sound/usb/quirks.c | 22 +++++++++++----------- - 1 file changed, 11 insertions(+), 11 deletions(-) - -diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c -index f2e4eebdf76d..2f0bbc43f902 100644 ---- a/sound/usb/quirks.c -+++ b/sound/usb/quirks.c -@@ -167,23 +167,18 @@ static int create_fixed_stream_quirk(struct snd_usb_audio *chip, - stream = (fp->endpoint & USB_DIR_IN) - ? SNDRV_PCM_STREAM_CAPTURE : SNDRV_PCM_STREAM_PLAYBACK; - err = snd_usb_add_audio_stream(chip, stream, fp); -- if (err < 0) { -- kfree(fp); -- kfree(rate_table); -- return err; -- } -+ if (err < 0) -+ goto error; - if (fp->iface != get_iface_desc(&iface->altsetting[0])->bInterfaceNumber || - fp->altset_idx >= iface->num_altsetting) { -- kfree(fp); -- kfree(rate_table); -- return -EINVAL; -+ err = -EINVAL; -+ goto error; - } - alts = &iface->altsetting[fp->altset_idx]; - altsd = get_iface_desc(alts); - if (altsd->bNumEndpoints < 1) { -- kfree(fp); -- kfree(rate_table); -- return -EINVAL; -+ err = -EINVAL; -+ goto error; - } - - fp->protocol = altsd->bInterfaceProtocol; -@@ -196,6 +191,11 @@ static int create_fixed_stream_quirk(struct snd_usb_audio *chip, - snd_usb_init_pitch(chip, fp->iface, alts, fp); - snd_usb_init_sample_rate(chip, fp->iface, alts, fp, fp->rate_max); - return 0; -+ -+ error: -+ kfree(fp); -+ kfree(rate_table); -+ return err; - } - - static int create_auto_pcm_quirk(struct snd_usb_audio *chip, --- -2.5.5 - diff --git a/Input-ati_remote2-fix-crashes-on-detecting-device-wi.patch b/Input-ati_remote2-fix-crashes-on-detecting-device-wi.patch deleted file mode 100644 index c7a461de8..000000000 --- a/Input-ati_remote2-fix-crashes-on-detecting-device-wi.patch +++ /dev/null @@ -1,107 +0,0 @@ -From 0f8536022831faaba3a952fa633902d9686f535f Mon Sep 17 00:00:00 2001 -From: Vladis Dronov -Date: Wed, 23 Mar 2016 15:53:07 -0400 -Subject: [PATCH] Input: ati_remote2: fix crashes on detecting device with - invalid descriptor - -The ati_remote2 driver expects at least two interfaces with one -endpoint each. If given malicious descriptor that specify one -interface or no endpoints, it will crash in the probe function. -Ensure there is at least two interfaces and one endpoint for each -interface before using it. - -The full disclosure: http://seclists.org/bugtraq/2016/Mar/90 - -Reported-by: Ralf Spenneberg -Signed-off-by: Vladis Dronov ---- - drivers/input/misc/ati_remote2.c | 36 ++++++++++++++++++++++++++++++------ - 1 file changed, 30 insertions(+), 6 deletions(-) - -diff --git a/drivers/input/misc/ati_remote2.c b/drivers/input/misc/ati_remote2.c -index cfd58e87da26..cf5d1e8d92c7 100644 ---- a/drivers/input/misc/ati_remote2.c -+++ b/drivers/input/misc/ati_remote2.c -@@ -817,26 +817,49 @@ static int ati_remote2_probe(struct usb_interface *interface, const struct usb_d - - ar2->udev = udev; - -+ /* Sanity check, first interface must have an endpoint */ -+ if ((alt->desc.bNumEndpoints < 1) || !alt->endpoint) { -+ dev_err(&interface->dev, -+ "%s(): interface 0 must have an endpoint\n", __func__); -+ r = -ENODEV; -+ goto fail1; -+ } - ar2->intf[0] = interface; - ar2->ep[0] = &alt->endpoint[0].desc; - -+ /* Sanity check, the device must have two interfaces */ - ar2->intf[1] = usb_ifnum_to_if(udev, 1); -+ if ((udev->actconfig->desc.bNumInterfaces < 2) || !ar2->intf[1]) { -+ dev_err(&interface->dev, "%s(): need 2 interfaces, found %d\n", -+ __func__, udev->actconfig->desc.bNumInterfaces); -+ r = -ENODEV; -+ goto fail1; -+ } -+ - r = usb_driver_claim_interface(&ati_remote2_driver, ar2->intf[1], ar2); - if (r) - goto fail1; -+ -+ /* Sanity check, second interface must have an endpoint */ - alt = ar2->intf[1]->cur_altsetting; -+ if ((alt->desc.bNumEndpoints < 1) || !alt->endpoint) { -+ dev_err(&interface->dev, -+ "%s(): interface 1 must have an endpoint\n", __func__); -+ r = -ENODEV; -+ goto fail2; -+ } - ar2->ep[1] = &alt->endpoint[0].desc; - - r = ati_remote2_urb_init(ar2); - if (r) -- goto fail2; -+ goto fail3; - - ar2->channel_mask = channel_mask; - ar2->mode_mask = mode_mask; - - r = ati_remote2_setup(ar2, ar2->channel_mask); - if (r) -- goto fail2; -+ goto fail3; - - usb_make_path(udev, ar2->phys, sizeof(ar2->phys)); - strlcat(ar2->phys, "/input0", sizeof(ar2->phys)); -@@ -845,11 +868,11 @@ static int ati_remote2_probe(struct usb_interface *interface, const struct usb_d - - r = sysfs_create_group(&udev->dev.kobj, &ati_remote2_attr_group); - if (r) -- goto fail2; -+ goto fail3; - - r = ati_remote2_input_init(ar2); - if (r) -- goto fail3; -+ goto fail4; - - usb_set_intfdata(interface, ar2); - -@@ -857,10 +880,11 @@ static int ati_remote2_probe(struct usb_interface *interface, const struct usb_d - - return 0; - -- fail3: -+ fail4: - sysfs_remove_group(&udev->dev.kobj, &ati_remote2_attr_group); -- fail2: -+ fail3: - ati_remote2_urb_cleanup(ar2); -+ fail2: - usb_driver_release_interface(&ati_remote2_driver, ar2->intf[1]); - fail1: - kfree(ar2); --- -2.5.0 - diff --git a/USB-input-powermate-fix-oops-with-malicious-USB-desc.patch b/USB-input-powermate-fix-oops-with-malicious-USB-desc.patch deleted file mode 100644 index 7de890e1b..000000000 --- a/USB-input-powermate-fix-oops-with-malicious-USB-desc.patch +++ /dev/null @@ -1,38 +0,0 @@ -From 0383ff3ba89d3e6c604138e3ba46685621d71f98 Mon Sep 17 00:00:00 2001 -From: Josh Boyer -Date: Mon, 14 Mar 2016 10:02:51 -0400 -Subject: [PATCH] USB: input: powermate: fix oops with malicious USB - descriptors - -The powermate driver expects at least one valid USB endpoint in its -probe function. If given malicious descriptors that specify 0 for -the number of endpoints, it will crash. Validate the number of -endpoints on the interface before using them. - -The full report for this issue can be found here: -http://seclists.org/bugtraq/2016/Mar/85 - -Reported-by: Ralf Spenneberg -Cc: stable -Signed-off-by: Josh Boyer ---- - drivers/input/misc/powermate.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/drivers/input/misc/powermate.c b/drivers/input/misc/powermate.c -index 63b539d3daba..84909a12ff36 100644 ---- a/drivers/input/misc/powermate.c -+++ b/drivers/input/misc/powermate.c -@@ -307,6 +307,9 @@ static int powermate_probe(struct usb_interface *intf, const struct usb_device_i - int error = -ENOMEM; - - interface = intf->cur_altsetting; -+ if (interface->desc.bNumEndpoints < 1) -+ return -EINVAL; -+ - endpoint = &interface->endpoint[0].desc; - if (!usb_endpoint_is_int_in(endpoint)) - return -EIO; --- -2.5.0 - diff --git a/USB-iowarrior-fix-oops-with-malicious-USB-descriptor.patch b/USB-iowarrior-fix-oops-with-malicious-USB-descriptor.patch deleted file mode 100644 index 7df3af2b1..000000000 --- a/USB-iowarrior-fix-oops-with-malicious-USB-descriptor.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 3620ebad64a327113bed34edefd45c3605086fc6 Mon Sep 17 00:00:00 2001 -From: Josh Boyer -Date: Mon, 14 Mar 2016 10:38:31 -0400 -Subject: [PATCH] USB: iowarrior: fix oops with malicious USB descriptors - -The iowarrior driver expects at least one valid endpoint. If given -malicious descriptors that specify 0 for the number of endpoints, -it will crash in the probe function. Ensure there is at least -one endpoint on the interface before using it. - -The full report of this issue can be found here: -http://seclists.org/bugtraq/2016/Mar/87 - -Reported-by: Ralf Spenneberg -Cc: stable -Signed-off-by: Josh Boyer ---- - drivers/usb/misc/iowarrior.c | 6 ++++++ - 1 file changed, 6 insertions(+) - -diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c -index c6bfd13f6c92..1950e87b4219 100644 ---- a/drivers/usb/misc/iowarrior.c -+++ b/drivers/usb/misc/iowarrior.c -@@ -787,6 +787,12 @@ static int iowarrior_probe(struct usb_interface *interface, - iface_desc = interface->cur_altsetting; - dev->product_id = le16_to_cpu(udev->descriptor.idProduct); - -+ if (iface_desc->desc.bNumEndpoints < 1) { -+ dev_err(&interface->dev, "Invalid number of endpoints\n"); -+ retval = -EINVAL; -+ goto error; -+ } -+ - /* set up the endpoint information */ - for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) { - endpoint = &iface_desc->endpoint[i].desc; --- -2.5.0 - diff --git a/USB-serial-ftdi_sio-Add-support-for-ICP-DAS-I-756xU-.patch b/USB-serial-ftdi_sio-Add-support-for-ICP-DAS-I-756xU-.patch deleted file mode 100644 index ac8e71c72..000000000 --- a/USB-serial-ftdi_sio-Add-support-for-ICP-DAS-I-756xU-.patch +++ /dev/null @@ -1,59 +0,0 @@ -From 94c78c81df3056e573fb84000a32512e9c16e555 Mon Sep 17 00:00:00 2001 -From: Josh Boyer -Date: Thu, 10 Mar 2016 08:49:02 -0500 -Subject: [PATCH] USB: serial: ftdi_sio: Add support for ICP DAS I-756xU - devices - -A Fedora user reports that the ftdi_sio driver works properly for the -ICP DAS I-7561U device. Further, the user manual for these devices -instructs users to load the driver and add the ids using the sysfs -interface. - -Add support for these in the driver directly so that the devices work -out of the box instead of needing manual configuration. - -Reported-by: -CC: stable -Signed-off-by: Josh Boyer ---- - drivers/usb/serial/ftdi_sio.c | 4 ++++ - drivers/usb/serial/ftdi_sio_ids.h | 8 ++++++++ - 2 files changed, 12 insertions(+) - -diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c -index 8c660ae401d8..b61f12160d37 100644 ---- a/drivers/usb/serial/ftdi_sio.c -+++ b/drivers/usb/serial/ftdi_sio.c -@@ -1004,6 +1004,10 @@ static const struct usb_device_id id_table_combined[] = { - { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_DISPLAY_PID) }, - { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_LITE_PID) }, - { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_ANALOG_PID) }, -+ /* ICP DAS I-756xU devices */ -+ { USB_DEVICE(ICPDAS_VID, ICPDAS_I7560U_PID) }, -+ { USB_DEVICE(ICPDAS_VID, ICPDAS_I7561U_PID) }, -+ { USB_DEVICE(ICPDAS_VID, ICPDAS_I7563U_PID) }, - { } /* Terminating entry */ - }; - -diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h -index a84df2513994..a4ec24ce6a11 100644 ---- a/drivers/usb/serial/ftdi_sio_ids.h -+++ b/drivers/usb/serial/ftdi_sio_ids.h -@@ -872,6 +872,14 @@ - #define NOVITUS_BONO_E_PID 0x6010 - - /* -+ * ICPDAS I-756*U devices -+ */ -+#define ICPDAS_VID 0x1b5c -+#define ICPDAS_I7560U_PID 0x0103 -+#define ICPDAS_I7561U_PID 0x0104 -+#define ICPDAS_I7563U_PID 0x0105 -+ -+/* - * RT Systems programming cables for various ham radios - */ - #define RTSYSTEMS_VID 0x2100 /* Vendor ID */ --- -2.5.0 - diff --git a/bcm283x-Pull-upstream-fixes-plus-iproc-mmc-driver.patch b/bcm283x-Pull-upstream-fixes-plus-iproc-mmc-driver.patch index 56f2a3981..092e7206a 100644 --- a/bcm283x-Pull-upstream-fixes-plus-iproc-mmc-driver.patch +++ b/bcm283x-Pull-upstream-fixes-plus-iproc-mmc-driver.patch @@ -2288,46 +2288,6 @@ index 6bcf51d..d8b8649 100644 -- 2.7.3 -From d258332b618af0136386d4fb8f738caedae8c71d Mon Sep 17 00:00:00 2001 -From: Dan Carpenter -Date: Tue, 8 Mar 2016 15:09:41 +0300 -Subject: [PATCH 18/36] drm/vc4: Return -EFAULT on copy_from_user() failure - -The copy_from_user() function returns the number of bytes not copied but -we want to return a negative error code. - -Fixes: 463873d57014 ('drm/vc4: Add an API for creating GPU shaders in GEM BOs.') -Cc: stable@vger.kernel.org -Signed-off-by: Dan Carpenter -Reviewed-by: Eric Anholt -Signed-off-by: Eric Anholt ---- - drivers/gpu/drm/vc4/vc4_bo.c | 7 ++++--- - 1 file changed, 4 insertions(+), 3 deletions(-) - -diff --git a/drivers/gpu/drm/vc4/vc4_bo.c b/drivers/gpu/drm/vc4/vc4_bo.c -index 22278bc..ac8eafe 100644 ---- a/drivers/gpu/drm/vc4/vc4_bo.c -+++ b/drivers/gpu/drm/vc4/vc4_bo.c -@@ -499,11 +499,12 @@ vc4_create_shader_bo_ioctl(struct drm_device *dev, void *data, - if (IS_ERR(bo)) - return PTR_ERR(bo); - -- ret = copy_from_user(bo->base.vaddr, -+ if (copy_from_user(bo->base.vaddr, - (void __user *)(uintptr_t)args->data, -- args->size); -- if (ret != 0) -+ args->size)) { -+ ret = -EFAULT; - goto fail; -+ } - /* Clear the rest of the memory from allocating from the BO - * cache. - */ --- -2.7.3 - From ed6836e411dd559a811dd063509a01772f4fe00f Mon Sep 17 00:00:00 2001 From: Eric Anholt Date: Fri, 4 Mar 2016 12:32:07 -0800 @@ -2361,54 +2321,6 @@ index 31de5d1..e6d3c60 100644 -- 2.7.3 -From 142ad4bd29558b85f269a02b74c5149b514acf88 Mon Sep 17 00:00:00 2001 -From: Eric Anholt -Date: Mon, 15 Feb 2016 19:03:57 -0800 -Subject: [PATCH 20/36] clk: bcm2835: Fix setting of PLL divider clock rates - -Our dividers weren't being set successfully because CM_PASSWORD wasn't -included in the register write. It looks easier to just compute the -divider to write ourselves than to update clk-divider for the ability -to OR in some arbitrary bits on write. - -Fixes about half of the video modes on my HDMI monitor (everything -except 720x400). - -Cc: stable@vger.kernel.org -Signed-off-by: Eric Anholt -Signed-off-by: Michael Turquette ---- - drivers/clk/bcm/clk-bcm2835.c | 12 +++++++----- - 1 file changed, 7 insertions(+), 5 deletions(-) - -diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c -index 015e687..9f4df8f 100644 ---- a/drivers/clk/bcm/clk-bcm2835.c -+++ b/drivers/clk/bcm/clk-bcm2835.c -@@ -1107,13 +1107,15 @@ static int bcm2835_pll_divider_set_rate(struct clk_hw *hw, - struct bcm2835_pll_divider *divider = bcm2835_pll_divider_from_hw(hw); - struct bcm2835_cprman *cprman = divider->cprman; - const struct bcm2835_pll_divider_data *data = divider->data; -- u32 cm; -- int ret; -+ u32 cm, div, max_div = 1 << A2W_PLL_DIV_BITS; - -- ret = clk_divider_ops.set_rate(hw, rate, parent_rate); -- if (ret) -- return ret; -+ div = DIV_ROUND_UP_ULL(parent_rate, rate); -+ -+ div = min(div, max_div); -+ if (div == max_div) -+ div = 0; - -+ cprman_write(cprman, data->a2w_reg, div); - cm = cprman_read(cprman, data->cm_reg); - cprman_write(cprman, data->cm_reg, cm | data->load_mask); - cprman_write(cprman, data->cm_reg, cm & ~data->load_mask); --- -2.7.3 - From 55acd7db60c8247d926969b705373765c26c1f44 Mon Sep 17 00:00:00 2001 From: Martin Sperl Date: Fri, 11 Sep 2015 11:22:05 +0000 diff --git a/cdc-acm-more-sanity-checking.patch b/cdc-acm-more-sanity-checking.patch deleted file mode 100644 index 99ad43416..000000000 --- a/cdc-acm-more-sanity-checking.patch +++ /dev/null @@ -1,33 +0,0 @@ -From e6a87f147002fa16adcbafebbc458ff90a463474 Mon Sep 17 00:00:00 2001 -From: Oliver Neukum -Date: Tue, 15 Mar 2016 10:14:04 +0100 -Subject: [PATCH] cdc-acm: more sanity checking - -An attack has become available which pretends to be a quirky -device circumventing normal sanity checks and crashes the kernel -by an insufficient number of interfaces. This patch adds a check -to the code path for quirky devices. - -Signed-off-by: Oliver Neukum -CC: stable@vger.kernel.org ---- - drivers/usb/class/cdc-acm.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c -index 26ca4f910cb0..a7732f80a912 100644 ---- a/drivers/usb/class/cdc-acm.c -+++ b/drivers/usb/class/cdc-acm.c -@@ -1113,6 +1113,9 @@ static int acm_probe(struct usb_interface *intf, - if (quirks == NO_UNION_NORMAL) { - data_interface = usb_ifnum_to_if(usb_dev, 1); - control_interface = usb_ifnum_to_if(usb_dev, 0); -+ /* we would crash */ -+ if (!data_interface || !control_interface) -+ return -ENODEV; - goto skip_normal_probe; - } - --- -2.5.0 - diff --git a/cypress_m8-add-sanity-checking.patch b/cypress_m8-add-sanity-checking.patch deleted file mode 100644 index fa8513f94..000000000 --- a/cypress_m8-add-sanity-checking.patch +++ /dev/null @@ -1,50 +0,0 @@ -From f7a3aa353011e38e119adebd845b38551587a26a Mon Sep 17 00:00:00 2001 -From: Oliver Neukum -Date: Thu, 17 Mar 2016 16:25:33 +0100 -Subject: [PATCH] cypress_m8: add sanity checking - -An attack using missing endpoints exists. -CVE-2016-3137 - -Signed-off-by: Oliver Neukum -CC: stable@vger.kernel.org - -v1 - add sanity check -v2 - add error logging -v3 - correct error message ---- - drivers/usb/serial/cypress_m8.c | 11 +++++------ - 1 file changed, 5 insertions(+), 6 deletions(-) - -diff --git a/drivers/usb/serial/cypress_m8.c b/drivers/usb/serial/cypress_m8.c -index 01bf53392819..5e25443fe4ef 100644 ---- a/drivers/usb/serial/cypress_m8.c -+++ b/drivers/usb/serial/cypress_m8.c -@@ -447,6 +447,11 @@ static int cypress_generic_port_probe(struct usb_serial_port *port) - struct usb_serial *serial = port->serial; - struct cypress_private *priv; - -+ if (!port->interrupt_out_urb || !port->interrupt_in_urb) { -+ dev_err(&port->dev, "A required endpoint is missing\n"); -+ return -ENODEV; -+ } -+ - priv = kzalloc(sizeof(struct cypress_private), GFP_KERNEL); - if (!priv) - return -ENOMEM; -@@ -606,12 +611,6 @@ static int cypress_open(struct tty_struct *tty, struct usb_serial_port *port) - cypress_set_termios(tty, port, &priv->tmp_termios); - - /* setup the port and start reading from the device */ -- if (!port->interrupt_in_urb) { -- dev_err(&port->dev, "%s - interrupt_in_urb is empty!\n", -- __func__); -- return -1; -- } -- - usb_fill_int_urb(port->interrupt_in_urb, serial->dev, - usb_rcvintpipe(serial->dev, port->interrupt_in_endpointAddress), - port->interrupt_in_urb->transfer_buffer, --- -2.5.0 - diff --git a/digi_acceleport-do-sanity-checking-for-the-number-of.patch b/digi_acceleport-do-sanity-checking-for-the-number-of.patch deleted file mode 100644 index eb060eb08..000000000 --- a/digi_acceleport-do-sanity-checking-for-the-number-of.patch +++ /dev/null @@ -1,70 +0,0 @@ -From e9c2a3972496927631a1a98fef43e9538e9fd5d5 Mon Sep 17 00:00:00 2001 -From: Oliver Neukum -Date: Mon, 14 Mar 2016 15:53:38 +0100 -Subject: [PATCH v2] digi_acceleport: do sanity checking for the number of ports - -The driver can be crashed with devices that expose crafted -descriptors with too few endpoints. -See: -http://seclists.org/bugtraq/2016/Mar/61 - -Signed-off-by: Oliver Neukum - -v1 - added sanity checks -v2 - moved them to probe() to fix problems Johan pointed out ---- - drivers/usb/serial/digi_acceleport.c | 24 +++++++++++++++++++----- - 1 file changed, 19 insertions(+), 5 deletions(-) - -diff --git a/drivers/usb/serial/digi_acceleport.c b/drivers/usb/serial/digi_acceleport.c -index 12b0e67..dab1dcf 100644 ---- a/drivers/usb/serial/digi_acceleport.c -+++ b/drivers/usb/serial/digi_acceleport.c -@@ -1252,7 +1252,8 @@ static int digi_port_init(struct usb_serial_port *port, unsigned port_num) - static int digi_startup(struct usb_serial *serial) - { - struct digi_serial *serial_priv; -- int ret; -+ int ret = -ENODEV; -+ int i; - - serial_priv = kzalloc(sizeof(*serial_priv), GFP_KERNEL); - if (!serial_priv) -@@ -1260,18 +1261,31 @@ static int digi_startup(struct usb_serial *serial) - - spin_lock_init(&serial_priv->ds_serial_lock); - serial_priv->ds_oob_port_num = serial->type->num_ports; -+ -+ /* Check whether the expected number of ports matches the device */ -+ if (serial->num_ports < serial_priv->ds_oob_port_num) -+ goto error; -+ /* all features must be present */ -+ for (i = 0; i < serial->type->num_ports + 1 ; i++) { -+ if (!serial->port[i]->read_urb) -+ goto error; -+ if (!serial->port[i]->write_urb) -+ goto error; -+ } -+ - serial_priv->ds_oob_port = serial->port[serial_priv->ds_oob_port_num]; - - ret = digi_port_init(serial_priv->ds_oob_port, - serial_priv->ds_oob_port_num); -- if (ret) { -- kfree(serial_priv); -- return ret; -- } -+ if (ret) -+ goto error; - - usb_set_serial_data(serial, serial_priv); - - return 0; -+error: -+ kfree(serial_priv); -+ return ret; - } - - --- -2.1.4 diff --git a/ims-pcu-sanity-check-against-missing-interfaces.patch b/ims-pcu-sanity-check-against-missing-interfaces.patch deleted file mode 100644 index 827a2b7ee..000000000 --- a/ims-pcu-sanity-check-against-missing-interfaces.patch +++ /dev/null @@ -1,39 +0,0 @@ -From a4200b7eb26271108586d3a7cf34a2f16d460e48 Mon Sep 17 00:00:00 2001 -From: Oliver Neukum -Date: Thu, 17 Mar 2016 15:10:47 +0100 -Subject: [PATCH] ims-pcu: sanity check against missing interfaces - -A malicious device missing interface can make the driver oops. -Add sanity checking. - -Signed-off-by: Oliver Neukum -CC: stable@vger.kernel.org ---- - drivers/input/misc/ims-pcu.c | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/drivers/input/misc/ims-pcu.c b/drivers/input/misc/ims-pcu.c -index ac1fa5f44580..9c0ea36913b4 100644 ---- a/drivers/input/misc/ims-pcu.c -+++ b/drivers/input/misc/ims-pcu.c -@@ -1663,6 +1663,8 @@ static int ims_pcu_parse_cdc_data(struct usb_interface *intf, struct ims_pcu *pc - - pcu->ctrl_intf = usb_ifnum_to_if(pcu->udev, - union_desc->bMasterInterface0); -+ if (!pcu->ctrl_intf) -+ return -EINVAL; - - alt = pcu->ctrl_intf->cur_altsetting; - pcu->ep_ctrl = &alt->endpoint[0].desc; -@@ -1670,6 +1672,8 @@ static int ims_pcu_parse_cdc_data(struct usb_interface *intf, struct ims_pcu *pc - - pcu->data_intf = usb_ifnum_to_if(pcu->udev, - union_desc->bSlaveInterface0); -+ if (!pcu->data_intf) -+ return -EINVAL; - - alt = pcu->data_intf->cur_altsetting; - if (alt->desc.bNumEndpoints != 2) { --- -2.5.0 - diff --git a/kernel.spec b/kernel.spec index d166d8878..a4bb22304 100644 --- a/kernel.spec +++ b/kernel.spec @@ -42,7 +42,7 @@ Summary: The Linux kernel # For non-released -rc kernels, this will be appended after the rcX and # gitX tags, so a 3 here would become part of release "0.rcX.gitX.3" # -%global baserelease 302 +%global baserelease 300 %global fedora_build %{baserelease} # base_sublevel is the kernel version we're starting with and patching @@ -54,7 +54,7 @@ Summary: The Linux kernel %if 0%{?released_kernel} # Do we have a -stable update to apply? -%define stable_update 0 +%define stable_update 1 # Set rpm version accordingly %if 0%{?stable_update} %define stablerev %{stable_update} @@ -496,7 +496,6 @@ Source5005: kbuild-AFTER_LINK.patch # Git trees. # Standalone patches - Patch420: arm64-avoid-needing-console-to-enable-serial-console.patch Patch421: arm64-acpi-drop-expert-patch.patch @@ -629,12 +628,6 @@ Patch646: HID-sony-do-not-bail-out-when-the-sixaxis-refuses-th.patch #rhbz 1309658 Patch648: 0001-mm-CONFIG_NR_ZONES_EXTENDED.patch -#rhbz 1312102 -Patch649: perf-tools-Fix-python-extension-build.patch - -#rhbz 1316136 -Patch663: USB-serial-ftdi_sio-Add-support-for-ICP-DAS-I-756xU-.patch - #CVE-2016-3135 rhbz 1317386 1317387 Patch664: netfilter-x_tables-check-for-size-overflow.patch @@ -644,51 +637,12 @@ Patch665: netfilter-x_tables-deal-with-bogus-nextoffset-values.patch #CVE-2016-3135 rhbz 1318172 1318270 Patch666: ipv4-Dont-do-expensive-useless-work-during-inetdev-des.patch -#CVE-2016-2184 rhbz 1317012 1317470 -Patch670: ALSA-usb-audio-Fix-NULL-dereference-in-create_fixed_.patch -Patch671: ALSA-usb-audio-Add-sanity-checks-for-endpoint-access.patch -Patch667: ALSA-usb-audio-Minor-code-cleanup-in-create_fixed_st.patch -Patch668: ALSA-usb-audio-Fix-double-free-in-error-paths-after-.patch - -#CVE-2016-3137 rhbz 1317010 1316996 -Patch672: cypress_m8-add-sanity-checking.patch - -#CVE-2016-2186 rhbz 1317015 1317464 -Patch673: USB-input-powermate-fix-oops-with-malicious-USB-desc.patch - -#CVE-2016-2188 rhbz 1317018 1317467 -Patch674: USB-iowarrior-fix-oops-with-malicious-USB-descriptor.patch - -#CVE-2016-2185 rhbz 1317014 1317471 -Patch675: usb_driver_claim_interface-add-sanity-checking.patch -Patch669: Input-ati_remote2-fix-crashes-on-detecting-device-wi.patch - -#CVE-2016-3138 rhbz 1317010 1316204 -Patch676: cdc-acm-more-sanity-checking.patch - -#CVE-2016-3140 rhbz 1317010 1316995 -Patch677: digi_acceleport-do-sanity-checking-for-the-number-of.patch - -Patch678: ims-pcu-sanity-check-against-missing-interfaces.patch - #rhbz 1315013 Patch679: 0001-uas-Limit-qdepth-at-the-scsi-host-level.patch -#rhbz 1317190 -Patch680: thermal-fix.patch - -#rhbz 1318079 -Patch681: 0001-Input-synaptics-handle-spurious-release-of-trackstic.patch - #CVE-2016-2187 rhbz 1317017 1317010 Patch686: input-gtco-fix-crash-on-detecting-device-without-end.patch -#CVE-2016-3136 rhbz 1317007 1317010 -Patch687: mct_u232-sanity-checking-in-probe.patch - -# CVE-2016-3157 rhbz 1315711 1321948 -Patch688: x86-iopl-64-Properly-context-switch-IOPL-on-Xen-PV.patch - # CVE-2016-3672 rhbz 1324749 1324750 Patch689: x86-mm-32-Enable-full-randomization-on-i386-and-X86_.patch @@ -2216,6 +2170,9 @@ fi # # %changelog +* Tue Apr 12 2016 Justin M. Forbes - 4.5.1-300 +- Linux v4.5.1 + * Tue Apr 12 2016 Josh Boyer - Fix Bamboo ONE issues (rhbz 1317116) diff --git a/mct_u232-sanity-checking-in-probe.patch b/mct_u232-sanity-checking-in-probe.patch deleted file mode 100644 index 006faf15f..000000000 --- a/mct_u232-sanity-checking-in-probe.patch +++ /dev/null @@ -1,35 +0,0 @@ -Subject: [PATCH v2] mct_u232: sanity checking in probe -From: Oliver Neukum -Date: 2016-03-21 13:14:37 - -An attack using the lack of sanity checking in probe -is known. This patch checks for the existance of a -second port. -CVE-2016-3136 - -Signed-off-by: Oliver Neukum -CC: stable@vger.kernel.org - -v1 - add sanity check for presence of a second port -v2 - add sanity check for an interrupt endpoint ---- - drivers/usb/serial/mct_u232.c | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/drivers/usb/serial/mct_u232.c b/drivers/usb/serial/mct_u232.c -index 4446b8d..3e64538 100644 ---- a/drivers/usb/serial/mct_u232.c -+++ b/drivers/usb/serial/mct_u232.c -@@ -378,6 +378,10 @@ static int mct_u232_port_probe(struct usb_serial_port *port) - { - struct mct_u232_private *priv; - -+ /* check first to simplify error handling */ -+ if (!port->serial->port[1] || !port->serial->port[1]->interrupt_in_urb) -+ return -ENODEV; -+ - priv = kzalloc(sizeof(*priv), GFP_KERNEL); - if (!priv) - return -ENOMEM; --- -2.1.4 diff --git a/perf-tools-Fix-python-extension-build.patch b/perf-tools-Fix-python-extension-build.patch deleted file mode 100644 index cdca4a69b..000000000 --- a/perf-tools-Fix-python-extension-build.patch +++ /dev/null @@ -1,71 +0,0 @@ -From 99b0044d511e16fb373df6d8a4e011d4804432c4 Mon Sep 17 00:00:00 2001 -From: Jiri Olsa -Date: Sat, 27 Feb 2016 21:21:12 +0100 -Subject: [PATCH] perf tools: Fix python extension build - -On Fri, Feb 26, 2016 at 11:59:03PM +0100, Jiri Olsa wrote: -> On Fri, Feb 26, 2016 at 05:49:02PM -0500, Josh Boyer wrote: -> -> SNIP -> -> > > ./python_ext_build/tmp/home/jolsa/kernel/linux-perf/tools/perf/util/evsel.o -> > > ./python_ext_build/tmp/home/jolsa/kernel/linux-perf/tools/perf/util/trace-event.o -> > > ./python_ext_build/tmp/home/jolsa/kernel/linux-perf/tools/perf/util/xyarray.o -> > > ./python_ext_build/tmp/home/jolsa/kernel/linux-perf/tools/perf/util/python.o -> > > ./python_ext_build/tmp/home/jolsa/kernel/linux-perf/tools/perf/util/ctype.o -> > > ./python_ext_build/tmp/home/jolsa/kernel/linux-perf/tools/perf/util/cgroup.o -> > > ./python_ext_build/tmp/home/jolsa/kernel/linux-perf/tools/perf/util/rblist.o -> > > ./python_ext_build/tmp/home/jolsa/kernel/linux-perf/tools/perf/util/string.o -> > > ./python_ext_build/tmp/home/jolsa/kernel/linux-perf/tools/lib -> > > ./python_ext_build/tmp/home/jolsa/kernel/linux-perf/tools/lib/hweight.o -> > > ./python_ext_build/tmp/home/jolsa/kernel/linux-perf/tools/lib/rbtree.o -> > > ./python_ext_build/tmp/home/jolsa/kernel/linux-perf/tools/lib/bitmap.o -> > > ./python_ext_build/tmp/home/jolsa/kernel/linux-perf/tools/lib/find_bit.o -> > > -> > > not sure we want to come up with some 'nicer' solution -> > -> > I don't think anything under python_ext_build/tmp/ actually matters in -> > any significant way. As long as this doesn't negatively impact -> > something via side-effect, it's probably good enough. -> -> right, and it's probably generic sollution too -> -> > -> > Will you write up a full patch? -> -> yep, will post it tomorrow -> -> jirka - -sending full patch - -jirka ---- - tools/perf/util/setup.py | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/tools/perf/util/setup.py b/tools/perf/util/setup.py -index 1833103768cb..c8680984d2d6 100644 ---- a/tools/perf/util/setup.py -+++ b/tools/perf/util/setup.py -@@ -22,6 +22,7 @@ cflags = getenv('CFLAGS', '').split() - # switch off several checks (need to be at the end of cflags list) - cflags += ['-fno-strict-aliasing', '-Wno-write-strings', '-Wno-unused-parameter' ] - -+src_perf = getenv('srctree') + '/tools/perf' - build_lib = getenv('PYTHON_EXTBUILD_LIB') - build_tmp = getenv('PYTHON_EXTBUILD_TMP') - libtraceevent = getenv('LIBTRACEEVENT') -@@ -30,6 +31,9 @@ libapikfs = getenv('LIBAPI') - ext_sources = [f.strip() for f in file('util/python-ext-sources') - if len(f.strip()) > 0 and f[0] != '#'] - -+# use full paths with source files -+ext_sources = map(lambda x: '%s/%s' % (src_perf, x) , ext_sources) -+ - perf = Extension('perf', - sources = ext_sources, - include_dirs = ['util/include'], --- -2.5.0 - diff --git a/sources b/sources index 4d9a84fe2..c02933f34 100644 --- a/sources +++ b/sources @@ -1,2 +1,3 @@ a60d48eee08ec0536d5efb17ca819aef linux-4.5.tar.xz 6f557fe90b800b615c85c2ca04da6154 perf-man-4.5.tar.gz +1df9ff0283c1732ebbf7c55f340a121b patch-4.5.1.xz diff --git a/thermal-fix.patch b/thermal-fix.patch deleted file mode 100644 index bca27cfbe..000000000 --- a/thermal-fix.patch +++ /dev/null @@ -1,77 +0,0 @@ -From 81ad4276b505e987dd8ebbdf63605f92cd172b52 Mon Sep 17 00:00:00 2001 -From: Zhang Rui -Date: Fri, 18 Mar 2016 10:03:24 +0800 -Subject: [PATCH] Thermal: Ignore invalid trip points - -In some cases, platform thermal driver may report invalid trip points, -thermal core should not take any action for these trip points. - -CC: #3.18+ -Link: https://bugzilla.redhat.com/show_bug.cgi?id=1317190 -Link: https://bugzilla.kernel.org/show_bug.cgi?id=114551 -Signed-off-by: Zhang Rui ---- - drivers/thermal/thermal_core.c | 13 ++++++++++++- - include/linux/thermal.h | 2 ++ - 2 files changed, 14 insertions(+), 1 deletion(-) - -diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c -index a0a8fd1..d4b5465 100644 ---- a/drivers/thermal/thermal_core.c -+++ b/drivers/thermal/thermal_core.c -@@ -454,6 +454,10 @@ static void handle_thermal_trip(struct thermal_zone_device *tz, int trip) - { - enum thermal_trip_type type; - -+ /* Ignore disabled trip points */ -+ if (test_bit(trip, &tz->trips_disabled)) -+ return; -+ - tz->ops->get_trip_type(tz, trip, &type); - - if (type == THERMAL_TRIP_CRITICAL || type == THERMAL_TRIP_HOT) -@@ -1800,6 +1804,7 @@ struct thermal_zone_device *thermal_zone_device_register(const char *type, - { - struct thermal_zone_device *tz; - enum thermal_trip_type trip_type; -+ int trip_temp; - int result; - int count; - int passive = 0; -@@ -1871,9 +1876,15 @@ struct thermal_zone_device *thermal_zone_device_register(const char *type, - goto unregister; - - for (count = 0; count < trips; count++) { -- tz->ops->get_trip_type(tz, count, &trip_type); -+ if (tz->ops->get_trip_type(tz, count, &trip_type)) -+ set_bit(count, &tz->trips_disabled); - if (trip_type == THERMAL_TRIP_PASSIVE) - passive = 1; -+ if (tz->ops->get_trip_temp(tz, count, &trip_temp)) -+ set_bit(count, &tz->trips_disabled); -+ /* Check for bogus trip points */ -+ if (trip_temp == 0) -+ set_bit(count, &tz->trips_disabled); - } - - if (!passive) { -diff --git a/include/linux/thermal.h b/include/linux/thermal.h -index 9c48199..a55d052 100644 ---- a/include/linux/thermal.h -+++ b/include/linux/thermal.h -@@ -156,6 +156,7 @@ struct thermal_attr { - * @trip_hyst_attrs: attributes for trip points for sysfs: trip hysteresis - * @devdata: private pointer for device private data - * @trips: number of trip points the thermal zone supports -+ * @trips_disabled; bitmap for disabled trips - * @passive_delay: number of milliseconds to wait between polls when - * performing passive cooling. - * @polling_delay: number of milliseconds to wait between polls when -@@ -191,6 +192,7 @@ struct thermal_zone_device { - struct thermal_attr *trip_hyst_attrs; - void *devdata; - int trips; -+ unsigned long trips_disabled; /* bitmap for disabled trips */ - int passive_delay; - int polling_delay; - int temperature; diff --git a/usb_driver_claim_interface-add-sanity-checking.patch b/usb_driver_claim_interface-add-sanity-checking.patch deleted file mode 100644 index 079ff03fd..000000000 --- a/usb_driver_claim_interface-add-sanity-checking.patch +++ /dev/null @@ -1,39 +0,0 @@ -From de0784bdf6314b70c69416d8c576eb83237d5b1e Mon Sep 17 00:00:00 2001 -From: Oliver Neukum -Date: Wed, 16 Mar 2016 12:26:17 -0400 -Subject: [PATCH] usb_driver_claim_interface: add sanity checking - -Attacks that trick drivers into passing a NULL pointer -to usb_driver_claim_interface() using forged descriptors are -known. This thwarts them by sanity checking. - -Signed-off-by: Oliver Neukum -CC: stable@vger.kernel.org ---- - drivers/usb/core/driver.c | 6 +++++- - 1 file changed, 5 insertions(+), 1 deletion(-) - -diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c -index 6b5063e7943f..e2d242b68d4b 100644 ---- a/drivers/usb/core/driver.c -+++ b/drivers/usb/core/driver.c -@@ -500,11 +500,15 @@ static int usb_unbind_interface(struct device *dev) - int usb_driver_claim_interface(struct usb_driver *driver, - struct usb_interface *iface, void *priv) - { -- struct device *dev = &iface->dev; -+ struct device *dev; - struct usb_device *udev; - int retval = 0; - int lpm_disable_error; - -+ if (!iface) -+ return -ENODEV; -+ -+ dev = &iface->dev; - if (dev->driver) - return -EBUSY; - --- -2.5.0 - diff --git a/x86-Lock-down-IO-port-access-when-module-security-is.patch b/x86-Lock-down-IO-port-access-when-module-security-is.patch index 708006c2e..31126f89d 100644 --- a/x86-Lock-down-IO-port-access-when-module-security-is.patch +++ b/x86-Lock-down-IO-port-access-when-module-security-is.patch @@ -44,7 +44,7 @@ index 37dae792dbbe..1ecc03ca3c15 100644 + if (!capable(CAP_SYS_RAWIO) || secure_modules()) return -EPERM; } - regs->flags = (regs->flags & ~X86_EFLAGS_IOPL) | (level << 12); + regs->flags = (regs->flags & ~X86_EFLAGS_IOPL) | diff --git a/drivers/char/mem.c b/drivers/char/mem.c index 6b1721f978c2..53fe675f9bd7 100644 --- a/drivers/char/mem.c diff --git a/x86-iopl-64-Properly-context-switch-IOPL-on-Xen-PV.patch b/x86-iopl-64-Properly-context-switch-IOPL-on-Xen-PV.patch deleted file mode 100644 index 38f7bfbb0..000000000 --- a/x86-iopl-64-Properly-context-switch-IOPL-on-Xen-PV.patch +++ /dev/null @@ -1,96 +0,0 @@ -From b7a584598aea7ca73140cb87b40319944dd3393f Mon Sep 17 00:00:00 2001 -From: Andy Lutomirski -Date: Wed, 16 Mar 2016 14:14:21 -0700 -Subject: [PATCH] x86/iopl/64: Properly context-switch IOPL on Xen PV - -On Xen PV, regs->flags doesn't reliably reflect IOPL and the -exit-to-userspace code doesn't change IOPL. We need to context -switch it manually. - -I'm doing this without going through paravirt because this is -specific to Xen PV. After the dust settles, we can merge this with -the 32-bit code, tidy up the iopl syscall implementation, and remove -the set_iopl pvop entirely. - -Fixes XSA-171. - -Reviewewd-by: Jan Beulich -Signed-off-by: Andy Lutomirski -Cc: Andrew Cooper -Cc: Andy Lutomirski -Cc: Boris Ostrovsky -Cc: Borislav Petkov -Cc: Brian Gerst -Cc: David Vrabel -Cc: Denys Vlasenko -Cc: H. Peter Anvin -Cc: Jan Beulich -Cc: Linus Torvalds -Cc: Peter Zijlstra -Cc: Thomas Gleixner -Cc: stable@vger.kernel.org -Link: http://lkml.kernel.org/r/693c3bd7aeb4d3c27c92c622b7d0f554a458173c.1458162709.git.luto@kernel.org -Signed-off-by: Ingo Molnar ---- - arch/x86/include/asm/xen/hypervisor.h | 2 ++ - arch/x86/kernel/process_64.c | 12 ++++++++++++ - arch/x86/xen/enlighten.c | 2 +- - 3 files changed, 15 insertions(+), 1 deletion(-) - -diff --git a/arch/x86/include/asm/xen/hypervisor.h b/arch/x86/include/asm/xen/hypervisor.h -index 8b2d4bea9962..39171b3646bb 100644 ---- a/arch/x86/include/asm/xen/hypervisor.h -+++ b/arch/x86/include/asm/xen/hypervisor.h -@@ -62,4 +62,6 @@ void xen_arch_register_cpu(int num); - void xen_arch_unregister_cpu(int num); - #endif - -+extern void xen_set_iopl_mask(unsigned mask); -+ - #endif /* _ASM_X86_XEN_HYPERVISOR_H */ -diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c -index b9d99e0f82c4..9f751876066f 100644 ---- a/arch/x86/kernel/process_64.c -+++ b/arch/x86/kernel/process_64.c -@@ -48,6 +48,7 @@ - #include - #include - #include -+#include - - asmlinkage extern void ret_from_fork(void); - -@@ -411,6 +412,17 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p) - task_thread_info(prev_p)->flags & _TIF_WORK_CTXSW_PREV)) - __switch_to_xtra(prev_p, next_p, tss); - -+#ifdef CONFIG_XEN -+ /* -+ * On Xen PV, IOPL bits in pt_regs->flags have no effect, and -+ * current_pt_regs()->flags may not match the current task's -+ * intended IOPL. We need to switch it manually. -+ */ -+ if (unlikely(static_cpu_has(X86_FEATURE_XENPV) && -+ prev->iopl != next->iopl)) -+ xen_set_iopl_mask(next->iopl); -+#endif -+ - if (static_cpu_has_bug(X86_BUG_SYSRET_SS_ATTRS)) { - /* - * AMD CPUs have a misfeature: SYSRET sets the SS selector but -diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c -index 2c261082eadf..8381fb990c7f 100644 ---- a/arch/x86/xen/enlighten.c -+++ b/arch/x86/xen/enlighten.c -@@ -961,7 +961,7 @@ static void xen_load_sp0(struct tss_struct *tss, - tss->x86_tss.sp0 = thread->sp0; - } - --static void xen_set_iopl_mask(unsigned mask) -+void xen_set_iopl_mask(unsigned mask) - { - struct physdev_set_iopl set_iopl; - --- -2.5.5 - -- cgit