From 5d76b33ba44470cfcb2fc7c6627c070135b2c914 Mon Sep 17 00:00:00 2001 From: Josh Boyer Date: Fri, 14 Nov 2014 08:35:51 -0500 Subject: Linux v3.18-rc4-184-gb23dc5a7cc6e --- ...d-support-for-MS-Surface-Pro-3-Type-Cover.patch | 12 ++-- Input-add-driver-for-the-Goodix-touchpanel.patch | 2 +- kernel-arm64.patch | 56 ++++------------ kernel.spec | 15 ++--- ...x-NULL-pointer-dereference-in-af-from_add.patch | 77 ---------------------- sources | 2 +- virtio_console-move-early-VQ-enablement.patch | 46 ------------- 7 files changed, 24 insertions(+), 186 deletions(-) delete mode 100644 net-sctp-fix-NULL-pointer-dereference-in-af-from_add.patch delete mode 100644 virtio_console-move-early-VQ-enablement.patch diff --git a/HID-add-support-for-MS-Surface-Pro-3-Type-Cover.patch b/HID-add-support-for-MS-Surface-Pro-3-Type-Cover.patch index b4276610d..18a0c7ec6 100644 --- a/HID-add-support-for-MS-Surface-Pro-3-Type-Cover.patch +++ b/HID-add-support-for-MS-Surface-Pro-3-Type-Cover.patch @@ -19,7 +19,7 @@ Signed-off-by: Jiri Kosina 4 files changed, 10 insertions(+) diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c -index 73bd9e2e42bc..e94afcc19eda 100644 +index 3402033fa52a..3d3820ecaa49 100644 --- a/drivers/hid/hid-core.c +++ b/drivers/hid/hid-core.c @@ -702,6 +702,11 @@ static void hid_scan_collection(struct hid_parser *parser, unsigned type) @@ -34,7 +34,7 @@ index 73bd9e2e42bc..e94afcc19eda 100644 } static int hid_scan_main(struct hid_parser *parser, struct hid_item *item) -@@ -1861,6 +1866,7 @@ static const struct hid_device_id hid_have_special_driver[] = { +@@ -1862,6 +1867,7 @@ static const struct hid_device_id hid_have_special_driver[] = { { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_DIGITAL_MEDIA_3K) }, { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_WIRELESS_OPTICAL_DESKTOP_3_0) }, { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_OFFICE_KB) }, @@ -43,10 +43,10 @@ index 73bd9e2e42bc..e94afcc19eda 100644 { HID_USB_DEVICE(USB_VENDOR_ID_MSI, USB_DEVICE_ID_MSI_GT683R_LED_PANEL) }, { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN) }, diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h -index e23ab8b30626..15f32c22178c 100644 +index 7c863738e419..ab562f41c00c 100644 --- a/drivers/hid/hid-ids.h +++ b/drivers/hid/hid-ids.h -@@ -648,6 +648,7 @@ +@@ -649,6 +649,7 @@ #define USB_DEVICE_ID_MS_SURFACE_PRO_2 0x0799 #define USB_DEVICE_ID_MS_TOUCH_COVER_2 0x07a7 #define USB_DEVICE_ID_MS_TYPE_COVER_2 0x07a9 @@ -68,10 +68,10 @@ index 8ba17a946f2a..cacda43f6a6f 100644 { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_PRESENTER_8K_BT), .driver_data = MS_PRESENTER }, diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c -index 5014bb567b29..cebfaf288bd3 100644 +index 552671ee7c5d..41814fced1cc 100644 --- a/drivers/hid/usbhid/hid-quirks.c +++ b/drivers/hid/usbhid/hid-quirks.c -@@ -77,6 +77,7 @@ static const struct hid_blacklist { +@@ -78,6 +78,7 @@ static const struct hid_blacklist { { USB_VENDOR_ID_FORMOSA, USB_DEVICE_ID_FORMOSA_IR_RECEIVER, HID_QUIRK_NO_INIT_REPORTS }, { USB_VENDOR_ID_FREESCALE, USB_DEVICE_ID_FREESCALE_MX28, HID_QUIRK_NOGET }, { USB_VENDOR_ID_MGE, USB_DEVICE_ID_MGE_UPS, HID_QUIRK_NOGET }, diff --git a/Input-add-driver-for-the-Goodix-touchpanel.patch b/Input-add-driver-for-the-Goodix-touchpanel.patch index 27d94ea4f..3be7cee56 100644 --- a/Input-add-driver-for-the-Goodix-touchpanel.patch +++ b/Input-add-driver-for-the-Goodix-touchpanel.patch @@ -21,7 +21,7 @@ Signed-off-by: Dmitry Torokhov create mode 100644 drivers/input/touchscreen/goodix.c diff --git a/MAINTAINERS b/MAINTAINERS -index ea4d0058fd1b..b9fb1cdad014 100644 +index 60b1163dba28..ec5ae9692f7c 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -4140,6 +4140,12 @@ L: linux-media@vger.kernel.org diff --git a/kernel-arm64.patch b/kernel-arm64.patch index f5b14ec4f..b3f7e3e59 100644 --- a/kernel-arm64.patch +++ b/kernel-arm64.patch @@ -91,28 +91,6 @@ Date: Mon Nov 10 16:31:05 2014 -0500 Signed-off-by: Mark Salter -commit ae7850d2b972ee1258878ccc16824aba9d35b653 -Author: Guenter Roeck -Date: Sun Nov 2 18:19:15 2014 -0800 - - netfilter: nft_reject_bridge: Fix powerpc build error - - Fix: - net/bridge/netfilter/nft_reject_bridge.c: - In function 'nft_reject_br_send_v6_unreach': - net/bridge/netfilter/nft_reject_bridge.c:240:3: - error: implicit declaration of function 'csum_ipv6_magic' - csum_ipv6_magic(&nip6h->saddr, &nip6h->daddr, - ^ - make[3]: *** [net/bridge/netfilter/nft_reject_bridge.o] Error 1 - - Seen with powerpc:allmodconfig. - - Fixes: 523b929d5446 ("netfilter: nft_reject_bridge: don't use IP stack to reject traffic") - Cc: Pablo Neira Ayuso - Signed-off-by: Guenter Roeck - Signed-off-by: David S. Miller - commit e2992498e4b2aad3ceac52bfb6faccfd18332236 Author: Mark Salter Date: Mon Nov 10 21:35:11 2014 -0500 @@ -1867,7 +1845,6 @@ Date: Wed Oct 8 16:11:27 2014 +0200 include/linux/of.h | 34 + include/linux/pci.h | 37 +- include/linux/property.h | 143 +++++ - net/bridge/netfilter/nft_reject_bridge.c | 1 + net/rfkill/rfkill-gpio.c | 18 +- virt/kvm/arm/arch_timer.c | 108 ++-- virt/kvm/arm/vgic-v2.c | 75 ++- @@ -9793,12 +9770,12 @@ index 789957d..59498eb 100644 /* Timestamp support */ spinlock_t tstamp_lock; diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c b/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c -index 63ea194..bb059b4 100644 +index 7ba83ffb08ac..3abbbd492a2c 100644 --- a/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c +++ b/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c -@@ -579,9 +579,11 @@ static void xgene_enet_reset(struct xgene_enet_pdata *pdata) - { - u32 val; +@@ -593,9 +593,11 @@ static int xgene_enet_reset(struct xgene_enet_pdata *pdata) + if (!xgene_ring_mgr_init(pdata)) + return -ENODEV; - clk_prepare_enable(pdata->clk); - clk_disable_unprepare(pdata->clk); @@ -9811,7 +9788,7 @@ index 63ea194..bb059b4 100644 xgene_enet_ecc_init(pdata); xgene_enet_config_ring_if_assoc(pdata); -@@ -647,15 +649,20 @@ static int xgene_enet_phy_connect(struct net_device *ndev) +@@ -663,15 +665,21 @@ static int xgene_enet_phy_connect(struct net_device *ndev) struct phy_device *phy_dev; struct device *dev = &pdata->pdev->dev; @@ -9822,7 +9799,7 @@ index 63ea194..bb059b4 100644 + if (dev->of_node) { + phy_np = of_parse_phandle(dev->of_node, "phy-handle", 0); + if (!phy_np) { -+ netdev_dbg(ndev, "No phy-handle found in DT\n"); ++ netdev_dbg(ndev, "No phy-handle found\n"); + return -ENODEV; + } + pdata->phy_dev = of_phy_find_device(phy_np); @@ -9834,12 +9811,13 @@ index 63ea194..bb059b4 100644 + phy_dev = pdata->phy_dev; + + if (phy_dev == NULL || -+ phy_connect_direct(ndev, phy_dev, &xgene_enet_adjust_link, -+ pdata->phy_mode)) { ++ phy_connect_direct(ndev, phy_dev, &xgene_enet_adjust_link, ++ pdata->phy_mode)) { ++ 0, pdata->phy_mode); netdev_err(ndev, "Could not connect to PHY\n"); return -ENODEV; } -@@ -665,11 +672,52 @@ static int xgene_enet_phy_connect(struct net_device *ndev) +@@ -681,11 +689,52 @@ static int xgene_enet_phy_connect(struct net_device *ndev) ~SUPPORTED_100baseT_Half & ~SUPPORTED_1000baseT_Half; phy_dev->advertising = phy_dev->supported; @@ -9893,7 +9871,7 @@ index 63ea194..bb059b4 100644 int xgene_enet_mdio_config(struct xgene_enet_pdata *pdata) { struct net_device *ndev = pdata->ndev; -@@ -686,7 +734,7 @@ int xgene_enet_mdio_config(struct xgene_enet_pdata *pdata) +@@ -702,7 +751,7 @@ int xgene_enet_mdio_config(struct xgene_enet_pdata *pdata) } } @@ -9902,7 +9880,7 @@ index 63ea194..bb059b4 100644 netdev_dbg(ndev, "No mdio node in the dts\n"); return -ENXIO; } -@@ -704,7 +752,10 @@ int xgene_enet_mdio_config(struct xgene_enet_pdata *pdata) +@@ -720,7 +769,10 @@ int xgene_enet_mdio_config(struct xgene_enet_pdata *pdata) mdio_bus->priv = pdata; mdio_bus->parent = &ndev->dev; @@ -12810,16 +12788,6 @@ index 0000000..a6a3d98 +#endif /* _LINUX_PROPERTY_H_ */ diff --git a/net/bridge/netfilter/nft_reject_bridge.c b/net/bridge/netfilter/nft_reject_bridge.c index 654c901..48da2c5 100644 ---- a/net/bridge/netfilter/nft_reject_bridge.c -+++ b/net/bridge/netfilter/nft_reject_bridge.c -@@ -18,6 +18,7 @@ - #include - #include - #include -+#include - #include - #include "../br_private.h" - diff --git a/net/rfkill/rfkill-gpio.c b/net/rfkill/rfkill-gpio.c index 0f62326..2a47179 100644 --- a/net/rfkill/rfkill-gpio.c diff --git a/kernel.spec b/kernel.spec index 880fc4079..1d43ad31a 100644 --- a/kernel.spec +++ b/kernel.spec @@ -69,7 +69,7 @@ Summary: The Linux kernel # The rc snapshot level %define rcrev 4 # The git snapshot level -%define gitrev 1 +%define gitrev 2 # Set rpm version accordingly %define rpmversion 3.%{upstream_sublevel}.0 %endif @@ -602,8 +602,6 @@ Patch22000: weird-root-dentry-name-debug.patch # Patch series from Hans for various backlight and platform driver fixes Patch26002: samsung-laptop-Add-broken-acpi-video-quirk-for-NC210.patch -Patch26057: virtio_console-move-early-VQ-enablement.patch - Patch26058: asus-nb-wmi-Add-wapf4-quirk-for-the-X550VB.patch #rhbz 1111138 @@ -619,9 +617,6 @@ Patch26065: sched-Remove-lockdep-check-in-sched_move_task.patch #rhbz 1161805 Patch26066: ahci-disable-MSI-instead-of-NCQ-on-Samsung-pci-e-SSD.patch -#CVE-2014-7841 rhbz 1163087 1163095 -Patch26067: net-sctp-fix-NULL-pointer-dereference-in-af-from_add.patch - #CVE-2014-7843 rhbz 1163744 1163745 Patch26069: arm64-__clear_user-handle-exceptions-on-strb.patch @@ -1339,8 +1334,6 @@ ApplyPatch ath9k-rx-dma-stop-check.patch # Patch series from Hans for various backlight and platform driver fixes ApplyPatch samsung-laptop-Add-broken-acpi-video-quirk-for-NC210.patch -ApplyPatch virtio_console-move-early-VQ-enablement.patch - ApplyPatch asus-nb-wmi-Add-wapf4-quirk-for-the-X550VB.patch #rhbz 1111138 @@ -1356,9 +1349,6 @@ ApplyPatch sched-Remove-lockdep-check-in-sched_move_task.patch #rhbz 1161805 ApplyPatch ahci-disable-MSI-instead-of-NCQ-on-Samsung-pci-e-SSD.patch -#CVE-2014-7841 rhbz 1163087 1163095 -ApplyPatch net-sctp-fix-NULL-pointer-dereference-in-af-from_add.patch - #CVE-2014-7843 rhbz 1163744 1163745 ApplyPatch arm64-__clear_user-handle-exceptions-on-strb.patch @@ -2233,6 +2223,9 @@ fi # ||----w | # || || %changelog +* Fri Nov 14 2014 Josh Boyer - 3.18.0-0.rc4.git2.1 +- Linux v3.18-rc4-184-gb23dc5a7cc6e + * Thu Nov 13 2014 Josh Boyer - Add patch for MS Surface Pro 3 Type Cover (rhbz 1135338) - CVE-2014-7843 aarch64: copying from /dev/zero causes local DoS (rhbz 1163744 1163745) diff --git a/net-sctp-fix-NULL-pointer-dereference-in-af-from_add.patch b/net-sctp-fix-NULL-pointer-dereference-in-af-from_add.patch deleted file mode 100644 index 34dae532b..000000000 --- a/net-sctp-fix-NULL-pointer-dereference-in-af-from_add.patch +++ /dev/null @@ -1,77 +0,0 @@ -From: Daniel Borkmann -Date: Mon, 10 Nov 2014 17:54:26 +0100 -Subject: [PATCH] net: sctp: fix NULL pointer dereference in - af->from_addr_param on malformed packet - -An SCTP server doing ASCONF will panic on malformed INIT ping-of-death -in the form of: - - ------------ INIT[PARAM: SET_PRIMARY_IP] ------------> - -While the INIT chunk parameter verification dissects through many things -in order to detect malformed input, it misses to actually check parameters -inside of parameters. E.g. RFC5061, section 4.2.4 proposes a 'set primary -IP address' parameter in ASCONF, which has as a subparameter an address -parameter. - -So an attacker may send a parameter type other than SCTP_PARAM_IPV4_ADDRESS -or SCTP_PARAM_IPV6_ADDRESS, param_type2af() will subsequently return 0 -and thus sctp_get_af_specific() returns NULL, too, which we then happily -dereference unconditionally through af->from_addr_param(). - -The trace for the log: - -BUG: unable to handle kernel NULL pointer dereference at 0000000000000078 -IP: [] sctp_process_init+0x492/0x990 [sctp] -PGD 0 -Oops: 0000 [#1] SMP -[...] -Pid: 0, comm: swapper Not tainted 2.6.32-504.el6.x86_64 #1 Bochs Bochs -RIP: 0010:[] [] sctp_process_init+0x492/0x990 [sctp] -[...] -Call Trace: - - [] ? sctp_bind_addr_copy+0x5d/0xe0 [sctp] - [] sctp_sf_do_5_1B_init+0x21b/0x340 [sctp] - [] sctp_do_sm+0x71/0x1210 [sctp] - [] ? sctp_endpoint_lookup_assoc+0xc9/0xf0 [sctp] - [] sctp_endpoint_bh_rcv+0x116/0x230 [sctp] - [] sctp_inq_push+0x56/0x80 [sctp] - [] sctp_rcv+0x982/0xa10 [sctp] - [] ? ipt_local_in_hook+0x23/0x28 [iptable_filter] - [] ? nf_iterate+0x69/0xb0 - [] ? ip_local_deliver_finish+0x0/0x2d0 - [] ? nf_hook_slow+0x76/0x120 - [] ? ip_local_deliver_finish+0x0/0x2d0 -[...] - -A minimal way to address this is to check for NULL as we do on all -other such occasions where we know sctp_get_af_specific() could -possibly return with NULL. - -Fixes: d6de3097592b ("[SCTP]: Add the handling of "Set Primary IP Address" parameter to INIT") -Signed-off-by: Daniel Borkmann -Cc: Vlad Yasevich -Acked-by: Neil Horman -Signed-off-by: David S. Miller ---- - net/sctp/sm_make_chunk.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c -index ab734be8cb20..9f32741abb1c 100644 ---- a/net/sctp/sm_make_chunk.c -+++ b/net/sctp/sm_make_chunk.c -@@ -2609,6 +2609,9 @@ do_addr_param: - addr_param = param.v + sizeof(sctp_addip_param_t); - - af = sctp_get_af_specific(param_type2af(param.p->type)); -+ if (af == NULL) -+ break; -+ - af->from_addr_param(&addr, addr_param, - htons(asoc->peer.port), 0); - --- -1.9.3 - diff --git a/sources b/sources index 20d6bc1dc..f4395aecf 100644 --- a/sources +++ b/sources @@ -1,4 +1,4 @@ fb30d0f29214d75cddd2faa94f73d5cf linux-3.17.tar.xz 159e969cbc27201d8e2fa0f609dc722f perf-man-3.17.tar.gz 587ecff959eff7392c4977c513580f44 patch-3.18-rc4.xz -07fdfa90e4a01192e10f802dcb810d4d patch-3.18-rc4-git1.xz +eaaef1d4eaf53e64e5b54c12f5dcdf0b patch-3.18-rc4-git2.xz diff --git a/virtio_console-move-early-VQ-enablement.patch b/virtio_console-move-early-VQ-enablement.patch deleted file mode 100644 index 8825504b6..000000000 --- a/virtio_console-move-early-VQ-enablement.patch +++ /dev/null @@ -1,46 +0,0 @@ -From: Cornelia Huck -Date: Mon, 20 Oct 2014 15:58:49 +0200 -Subject: [PATCH] virtio_console: move early VQ enablement - -Commit f5866db6 (virtio_console: enable VQs early) tried to make -sure that DRIVER_OK was set when virtio_console started using its -virtqueues. Doing this in add_port(), however, means that we try -to set DRIVER_OK again when when a port is dynamically added after -the probe function is done. - -Let's move virtio_device_ready() to the probe function just before -trying to use the virtqueues instead. This is fine as nothing can -fail inbetween. - -Reported-by: Thomas Graf -Reviewed-by: Michael S. Tsirkin -Signed-off-by: Cornelia Huck ---- - drivers/char/virtio_console.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c -index bfa640023e64..cf7a561fad7c 100644 ---- a/drivers/char/virtio_console.c -+++ b/drivers/char/virtio_console.c -@@ -1449,8 +1449,6 @@ static int add_port(struct ports_device *portdev, u32 id) - spin_lock_init(&port->outvq_lock); - init_waitqueue_head(&port->waitqueue); - -- virtio_device_ready(portdev->vdev); -- - /* Fill the in_vq with buffers so the host can send us data. */ - nr_added_bufs = fill_queue(port->in_vq, &port->inbuf_lock); - if (!nr_added_bufs) { -@@ -2026,6 +2024,8 @@ static int virtcons_probe(struct virtio_device *vdev) - spin_lock_init(&portdev->ports_lock); - INIT_LIST_HEAD(&portdev->ports); - -+ virtio_device_ready(portdev->vdev); -+ - if (multiport) { - unsigned int nr_added_bufs; - --- -1.9.3 - -- cgit