Linux v3.8.5
This commit is contained in:
Josh Boyer
parent
030685dae1
commit
245cd7a89c
|
|
@ -1,61 +0,0 @@
|
|||
commit cf0a6584aa6d382f802f2c3cacac23ccbccde0cd
|
||||
Author: Daniel Vetter <daniel.vetter@ffwll.ch>
|
||||
Date: Wed Feb 6 11:24:41 2013 +0100
|
||||
|
||||
drm/i915: write backlight harder
|
||||
|
||||
770c12312ad617172b1a65b911d3e6564fc5aca8 is the first bad commit
|
||||
commit 770c12312ad617172b1a65b911d3e6564fc5aca8
|
||||
Author: Takashi Iwai <tiwai@suse.de>
|
||||
Date: Sat Aug 11 08:56:42 2012 +0200
|
||||
|
||||
drm/i915: Fix blank panel at reopening lid
|
||||
|
||||
changed the register write sequence for restoring the backlight, which
|
||||
helped prevent non-working backlights on some machines. Turns out that
|
||||
the original sequence was the right thing to do for a different set of
|
||||
machines. Worse, setting the backlight level _after_ enabling it seems
|
||||
to reset it somehow. So we need to make that one conditional upon the
|
||||
backlight having been reset to zero, and add the old one back.
|
||||
|
||||
Cargo-culting at it's best, but it seems to work.
|
||||
|
||||
Cc: stable@vger.kernel.org
|
||||
Cc: Takashi Iwai <tiwai@suse.de>
|
||||
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=47941
|
||||
Reviewed-by: Jani Nikula <jani.nikula@intel.com>
|
||||
Acked-by: Takashi Iwai <tiwai@suse.de>
|
||||
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
|
||||
|
||||
diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
|
||||
index bee8cb6..a3730e0 100644
|
||||
--- a/drivers/gpu/drm/i915/intel_panel.c
|
||||
+++ b/drivers/gpu/drm/i915/intel_panel.c
|
||||
@@ -321,6 +321,9 @@ void intel_panel_enable_backlight(struct drm_device *dev,
|
||||
if (dev_priv->backlight_level == 0)
|
||||
dev_priv->backlight_level = intel_panel_get_max_backlight(dev);
|
||||
|
||||
+ dev_priv->backlight_enabled = true;
|
||||
+ intel_panel_actually_set_backlight(dev, dev_priv->backlight_level);
|
||||
+
|
||||
if (INTEL_INFO(dev)->gen >= 4) {
|
||||
uint32_t reg, tmp;
|
||||
|
||||
@@ -356,12 +359,12 @@ void intel_panel_enable_backlight(struct drm_device *dev,
|
||||
}
|
||||
|
||||
set_level:
|
||||
- /* Call below after setting BLC_PWM_CPU_CTL2 and BLC_PWM_PCH_CTL1.
|
||||
- * BLC_PWM_CPU_CTL may be cleared to zero automatically when these
|
||||
- * registers are set.
|
||||
+ /* Check the current backlight level and try to set again if it's zero.
|
||||
+ * On some machines, BLC_PWM_CPU_CTL is cleared to zero automatically
|
||||
+ * when BLC_PWM_CPU_CTL2 and BLC_PWM_PCH_CTL1 are written.
|
||||
*/
|
||||
- dev_priv->backlight_enabled = true;
|
||||
- intel_panel_actually_set_backlight(dev, dev_priv->backlight_level);
|
||||
+ if (!intel_panel_get_backlight(dev))
|
||||
+ intel_panel_actually_set_backlight(dev, dev_priv->backlight_level);
|
||||
}
|
||||
|
||||
static void intel_panel_init_backlight(struct drm_device *dev)
|
||||
|
|
@ -36,6 +36,8 @@ CONFIG_X86_PM_TIMER=y
|
|||
CONFIG_EFI=y
|
||||
CONFIG_EFI_STUB=y
|
||||
CONFIG_EFI_VARS=y
|
||||
CONFIG_EFI_VARS_PSTORE=y
|
||||
# CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE is not set
|
||||
CONFIG_EFI_PCDP=y
|
||||
CONFIG_FB_EFI=y
|
||||
|
||||
|
|
|
|||
|
|
@ -1,51 +0,0 @@
|
|||
From e896e9dde50fd9a44cbbed205cc0beb869e2193b Mon Sep 17 00:00:00 2001
|
||||
From: Kees Cook <keescook@chromium.org>
|
||||
Date: Mon, 11 Mar 2013 17:31:45 -0700
|
||||
Subject: [PATCH] drm/i915: bounds check execbuffer relocation count
|
||||
|
||||
It is possible to wrap the counter used to allocate the buffer for
|
||||
relocation copies. This could lead to heap writing overflows.
|
||||
|
||||
CVE-2013-0913
|
||||
|
||||
v3: collapse test, improve comment
|
||||
v2: move check into validate_exec_list
|
||||
|
||||
Signed-off-by: Kees Cook <keescook@chromium.org>
|
||||
Reported-by: Pinkie Pie
|
||||
Cc: stable@vger.kernel.org
|
||||
---
|
||||
drivers/gpu/drm/i915/i915_gem_execbuffer.c | 11 ++++++++---
|
||||
1 file changed, 8 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
|
||||
index 26d08bb..7adf5a7 100644
|
||||
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
|
||||
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
|
||||
@@ -706,15 +706,20 @@ validate_exec_list(struct drm_i915_gem_exec_object2 *exec,
|
||||
int count)
|
||||
{
|
||||
int i;
|
||||
+ int relocs_total = 0;
|
||||
+ int relocs_max = INT_MAX / sizeof(struct drm_i915_gem_relocation_entry);
|
||||
|
||||
for (i = 0; i < count; i++) {
|
||||
char __user *ptr = (char __user *)(uintptr_t)exec[i].relocs_ptr;
|
||||
int length; /* limited by fault_in_pages_readable() */
|
||||
|
||||
- /* First check for malicious input causing overflow */
|
||||
- if (exec[i].relocation_count >
|
||||
- INT_MAX / sizeof(struct drm_i915_gem_relocation_entry))
|
||||
+ /* First check for malicious input causing overflow in
|
||||
+ * the worst case where we need to allocate the entire
|
||||
+ * relocation tree as a single array.
|
||||
+ */
|
||||
+ if (exec[i].relocation_count > relocs_max - relocs_total)
|
||||
return -EINVAL;
|
||||
+ relocs_total += exec[i].relocation_count;
|
||||
|
||||
length = exec[i].relocation_count *
|
||||
sizeof(struct drm_i915_gem_relocation_entry);
|
||||
--
|
||||
1.8.1.2
|
||||
|
||||
19
kernel.spec
19
kernel.spec
|
|
@ -62,7 +62,7 @@ Summary: The Linux kernel
|
|||
# For non-released -rc kernels, this will be appended after the rcX and
|
||||
# gitX tags, so a 3 here would become part of release "0.rcX.gitX.3"
|
||||
#
|
||||
%global baserelease 203
|
||||
%global baserelease 201
|
||||
%global fedora_build %{baserelease}
|
||||
|
||||
# base_sublevel is the kernel version we're starting with and patching
|
||||
|
|
@ -74,7 +74,7 @@ Summary: The Linux kernel
|
|||
%if 0%{?released_kernel}
|
||||
|
||||
# Do we have a -stable update to apply?
|
||||
%define stable_update 4
|
||||
%define stable_update 5
|
||||
# Is it a -stable RC?
|
||||
%define stable_rc 0
|
||||
# Set rpm version accordingly
|
||||
|
|
@ -758,15 +758,9 @@ Patch24000: alps.patch
|
|||
|
||||
Patch24100: userns-avoid-recursion-in-put_user_ns.patch
|
||||
|
||||
#rhbz 917353
|
||||
Patch24102: backlight_revert.patch
|
||||
|
||||
#rhbz 879462
|
||||
Patch24107: uvcvideo-suspend-fix.patch
|
||||
|
||||
#CVE-2013-0913 rhbz 920471 920529
|
||||
Patch24109: drm-i915-bounds-check-execbuffer-relocation-count.patch
|
||||
|
||||
#rhbz 856863 892599
|
||||
Patch24111: cfg80211-mac80211-disconnect-on-suspend.patch
|
||||
Patch24112: mac80211_fixes_for_ieee80211_do_stop_while_suspend_v3.8.patch
|
||||
|
|
@ -1506,9 +1500,6 @@ ApplyPatch 0001-drivers-crypto-nx-fix-init-race-alignmasks-and-GCM-b.patch
|
|||
|
||||
ApplyPatch userns-avoid-recursion-in-put_user_ns.patch
|
||||
|
||||
#rhbz 917353
|
||||
ApplyPatch backlight_revert.patch -R
|
||||
|
||||
#rhbz 920586
|
||||
ApplyPatch amd64_edac_fix_rank_count.patch
|
||||
|
||||
|
|
@ -1521,9 +1512,6 @@ ApplyPatch team-net-next-update-20130307.patch
|
|||
#rhbz 879462
|
||||
ApplyPatch uvcvideo-suspend-fix.patch
|
||||
|
||||
#CVE-2013-0913 rhbz 920471 920529
|
||||
ApplyPatch drm-i915-bounds-check-execbuffer-relocation-count.patch
|
||||
|
||||
#rhbz 856863 892599
|
||||
ApplyPatch cfg80211-mac80211-disconnect-on-suspend.patch
|
||||
ApplyPatch mac80211_fixes_for_ieee80211_do_stop_while_suspend_v3.8.patch
|
||||
|
|
@ -2409,6 +2397,9 @@ fi
|
|||
# ||----w |
|
||||
# || ||
|
||||
%changelog
|
||||
* Thu Mar 28 2013 Josh Boyer <jwboyer@redhat.com> - 3.8.5-201
|
||||
- Linux v3.8.5
|
||||
|
||||
* Tue Mar 26 2013 Justin M. Forbes <jforbes@redhat.com>
|
||||
- Fix child thread introspection of of /proc/self/exe (rhbz 927469)
|
||||
|
||||
|
|
|
|||
Loading…
Reference in New Issue