Linux v4.2.6
This commit is contained in:
Justin M. Forbes
parent
fc05221707
commit
27552ab413
|
|
@ -1,61 +0,0 @@
|
|||
From fd7cd061adcf5f7503515ba52b6a724642a839c8 Mon Sep 17 00:00:00 2001
|
||||
From: Laura Abbott <labbott@fedoraproject.org>
|
||||
Date: Mon, 12 Oct 2015 11:30:13 +0300
|
||||
Subject: [PATCH] xhci: Add spurious wakeup quirk for LynxPoint-LP controllers
|
||||
|
||||
We received several reports of systems rebooting and powering on
|
||||
after an attempted shutdown. Testing showed that setting
|
||||
XHCI_SPURIOUS_WAKEUP quirk in addition to the XHCI_SPURIOUS_REBOOT
|
||||
quirk allowed the system to shutdown as expected for LynxPoint-LP
|
||||
xHCI controllers. Set the quirk back.
|
||||
|
||||
Note that the quirk was originally introduced for LynxPoint and
|
||||
LynxPoint-LP just for this same reason. See:
|
||||
|
||||
commit 638298dc66ea ("xhci: Fix spurious wakeups after S5 on Haswell")
|
||||
|
||||
It was later limited to only concern HP machines as it caused
|
||||
regression on some machines, see both bug and commit:
|
||||
|
||||
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=66171
|
||||
commit 6962d914f317 ("xhci: Limit the spurious wakeup fix only to HP machines")
|
||||
|
||||
Later it was discovered that the powering on after shutdown
|
||||
was limited to LynxPoint-LP (Haswell-ULT) and that some non-LP HP
|
||||
machine suffered from spontaneous resume from S3 (which should
|
||||
not be related to the SPURIOUS_WAKEUP quirk at all). An attempt
|
||||
to fix this then removed the SPURIOUS_WAKEUP flag usage completely.
|
||||
|
||||
commit b45abacde3d5 ("xhci: no switching back on non-ULT Haswell")
|
||||
|
||||
Current understanding is that LynxPoint-LP (Haswell ULT) machines
|
||||
need the SPURIOUS_WAKEUP quirk, otherwise they will restart, and
|
||||
plain Lynxpoint (Haswell) machines may _not_ have the quirk
|
||||
set otherwise they again will restart.
|
||||
|
||||
Signed-off-by: Laura Abbott <labbott@fedoraproject.org>
|
||||
Cc: Takashi Iwai <tiwai@suse.de>
|
||||
Cc: Oliver Neukum <oneukum@suse.com>
|
||||
[Added more history to commit message -Mathias]
|
||||
Cc: stable <stable@vger.kernel.org>
|
||||
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
---
|
||||
drivers/usb/host/xhci-pci.c | 1 +
|
||||
1 file changed, 1 insertion(+)
|
||||
|
||||
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
|
||||
index c79d336..c47d3e4 100644
|
||||
--- a/drivers/usb/host/xhci-pci.c
|
||||
+++ b/drivers/usb/host/xhci-pci.c
|
||||
@@ -147,6 +147,7 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
|
||||
if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
|
||||
pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI) {
|
||||
xhci->quirks |= XHCI_SPURIOUS_REBOOT;
|
||||
+ xhci->quirks |= XHCI_SPURIOUS_WAKEUP;
|
||||
}
|
||||
if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
|
||||
(pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI ||
|
||||
--
|
||||
2.4.3
|
||||
|
||||
|
|
@ -1,62 +0,0 @@
|
|||
From ae93580ee59c02395c1711d3e6b90546b8137b86 Mon Sep 17 00:00:00 2001
|
||||
From: Alex Deucher <alexander.deucher@amd.com>
|
||||
Date: Tue, 27 Oct 2015 10:56:44 -0400
|
||||
Subject: [PATCH 2/2] drm/radeon: fix dpms when driver backlight control is
|
||||
disabled
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
If driver backlight control is disabled, either by driver
|
||||
parameter or default per-asic setting, revert to the old behavior.
|
||||
|
||||
Fixes a regression in commit:
|
||||
4281f46ef839050d2ef60348f661eb463c21cc2e
|
||||
|
||||
Reviewed-by: Michel Dänzer <michel.daenzer@amd.com>
|
||||
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
|
||||
Cc: stable@vger.kernel.org
|
||||
---
|
||||
drivers/gpu/drm/radeon/atombios_encoders.c | 18 ++++++++++++++----
|
||||
1 file changed, 14 insertions(+), 4 deletions(-)
|
||||
|
||||
diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c
|
||||
index 933fd1bc849b..bb292143997e 100644
|
||||
--- a/drivers/gpu/drm/radeon/atombios_encoders.c
|
||||
+++ b/drivers/gpu/drm/radeon/atombios_encoders.c
|
||||
@@ -1625,9 +1625,14 @@ radeon_atom_encoder_dpms_avivo(struct drm_encoder *encoder, int mode)
|
||||
} else
|
||||
atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
|
||||
if (radeon_encoder->devices & (ATOM_DEVICE_LCD_SUPPORT)) {
|
||||
- struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
|
||||
+ if (rdev->mode_info.bl_encoder) {
|
||||
+ struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
|
||||
|
||||
- atombios_set_backlight_level(radeon_encoder, dig->backlight_level);
|
||||
+ atombios_set_backlight_level(radeon_encoder, dig->backlight_level);
|
||||
+ } else {
|
||||
+ args.ucAction = ATOM_LCD_BLON;
|
||||
+ atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
|
||||
+ }
|
||||
}
|
||||
break;
|
||||
case DRM_MODE_DPMS_STANDBY:
|
||||
@@ -1707,8 +1712,13 @@ radeon_atom_encoder_dpms_dig(struct drm_encoder *encoder, int mode)
|
||||
if (ASIC_IS_DCE4(rdev))
|
||||
atombios_dig_encoder_setup(encoder, ATOM_ENCODER_CMD_DP_VIDEO_ON, 0);
|
||||
}
|
||||
- if (radeon_encoder->devices & (ATOM_DEVICE_LCD_SUPPORT))
|
||||
- atombios_set_backlight_level(radeon_encoder, dig->backlight_level);
|
||||
+ if (radeon_encoder->devices & (ATOM_DEVICE_LCD_SUPPORT)) {
|
||||
+ if (rdev->mode_info.bl_encoder)
|
||||
+ atombios_set_backlight_level(radeon_encoder, dig->backlight_level);
|
||||
+ else
|
||||
+ atombios_dig_transmitter_setup(encoder,
|
||||
+ ATOM_TRANSMITTER_ACTION_LCD_BLON, 0, 0);
|
||||
+ }
|
||||
if (ext_encoder)
|
||||
atombios_external_encoder_setup(encoder, ext_encoder, ATOM_ENABLE);
|
||||
break;
|
||||
--
|
||||
2.4.3
|
||||
|
||||
|
|
@ -1,59 +0,0 @@
|
|||
From 4cee6a9057d5e13911f0cb6e143d11dc1a3245dd Mon Sep 17 00:00:00 2001
|
||||
From: Alex Deucher <alexander.deucher@amd.com>
|
||||
Date: Wed, 28 Oct 2015 14:26:32 -0400
|
||||
Subject: [PATCH 1/2] drm/radeon: move bl encoder assignment into bl init
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
So that the bl encoder will be null if the GPU does not
|
||||
control the backlight.
|
||||
|
||||
Reviewed-by: Michel Dänzer <michel.daenzer@amd.com>
|
||||
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
|
||||
Cc: stable@vger.kernel.org
|
||||
---
|
||||
drivers/gpu/drm/radeon/atombios_encoders.c | 1 +
|
||||
drivers/gpu/drm/radeon/radeon_encoders.c | 1 -
|
||||
drivers/gpu/drm/radeon/radeon_legacy_encoders.c | 1 +
|
||||
3 files changed, 2 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c
|
||||
index 65adb9c72377..933fd1bc849b 100644
|
||||
--- a/drivers/gpu/drm/radeon/atombios_encoders.c
|
||||
+++ b/drivers/gpu/drm/radeon/atombios_encoders.c
|
||||
@@ -237,6 +237,7 @@ void radeon_atom_backlight_init(struct radeon_encoder *radeon_encoder,
|
||||
backlight_update_status(bd);
|
||||
|
||||
DRM_INFO("radeon atom DIG backlight initialized\n");
|
||||
+ rdev->mode_info.bl_encoder = radeon_encoder;
|
||||
|
||||
return;
|
||||
|
||||
diff --git a/drivers/gpu/drm/radeon/radeon_encoders.c b/drivers/gpu/drm/radeon/radeon_encoders.c
|
||||
index ef99917f000d..c6ee80216cf4 100644
|
||||
--- a/drivers/gpu/drm/radeon/radeon_encoders.c
|
||||
+++ b/drivers/gpu/drm/radeon/radeon_encoders.c
|
||||
@@ -194,7 +194,6 @@ static void radeon_encoder_add_backlight(struct radeon_encoder *radeon_encoder,
|
||||
radeon_atom_backlight_init(radeon_encoder, connector);
|
||||
else
|
||||
radeon_legacy_backlight_init(radeon_encoder, connector);
|
||||
- rdev->mode_info.bl_encoder = radeon_encoder;
|
||||
}
|
||||
}
|
||||
|
||||
diff --git a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
|
||||
index 45715307db71..30de43366eae 100644
|
||||
--- a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
|
||||
+++ b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
|
||||
@@ -441,6 +441,7 @@ void radeon_legacy_backlight_init(struct radeon_encoder *radeon_encoder,
|
||||
backlight_update_status(bd);
|
||||
|
||||
DRM_INFO("radeon legacy LVDS backlight initialized\n");
|
||||
+ rdev->mode_info.bl_encoder = radeon_encoder;
|
||||
|
||||
return;
|
||||
|
||||
--
|
||||
2.4.3
|
||||
|
||||
29
kernel.spec
29
kernel.spec
|
|
@ -40,7 +40,7 @@ Summary: The Linux kernel
|
|||
# For non-released -rc kernels, this will be appended after the rcX and
|
||||
# gitX tags, so a 3 here would become part of release "0.rcX.gitX.3"
|
||||
#
|
||||
%global baserelease 201
|
||||
%global baserelease 200
|
||||
%global fedora_build %{baserelease}
|
||||
|
||||
# base_sublevel is the kernel version we're starting with and patching
|
||||
|
|
@ -52,7 +52,7 @@ Summary: The Linux kernel
|
|||
%if 0%{?released_kernel}
|
||||
|
||||
# Do we have a -stable update to apply?
|
||||
%define stable_update 5
|
||||
%define stable_update 6
|
||||
# Set rpm version accordingly
|
||||
%if 0%{?stable_update}
|
||||
%define stablerev %{stable_update}
|
||||
|
|
@ -622,25 +622,14 @@ Patch523: RDS-verify-the-underlying-transport-exists-before-cr.patch
|
|||
#CVE-2015-7990 rhbz 1276437 1276438
|
||||
Patch524: RDS-fix-race-condition-when-sending-a-message-on-unb.patch
|
||||
|
||||
#rhbz 1265978
|
||||
Patch536: si2168-Bounds-check-firmware.patch
|
||||
Patch537: si2157-Bounds-check-firmware.patch
|
||||
|
||||
#rhbz 1272172
|
||||
Patch540: 0001-KEYS-Fix-crash-when-attempt-to-garbage-collect-an-un.patch
|
||||
Patch541: 0002-KEYS-Don-t-permit-request_key-to-construct-a-new-key.patch
|
||||
|
||||
#rhbz 1257131
|
||||
Patch542: 0001-xhci-Add-spurious-wakeup-quirk-for-LynxPoint-LP-cont.patch
|
||||
|
||||
#CVE-2015-7799 rhbz 1271134 1271135
|
||||
Patch543: isdn_ppp-Add-checks-for-allocation-failure-in-isdn_p.patch
|
||||
Patch544: ppp-slip-Validate-VJ-compression-slot-parameters-com.patch
|
||||
|
||||
#rhbz 1278407
|
||||
Patch545: drm-radeon-move-bl-encoder-assignment-into-bl-init.patch
|
||||
Patch546: drm-radeon-fix-dpms-when-driver-backlight-control-is.patch
|
||||
|
||||
#CVE-2015-5307 rhbz 1277172 1279688
|
||||
Patch550: KVM-x86-work-around-infinite-loop-in-microcode-when-.patch
|
||||
|
||||
|
|
@ -1392,25 +1381,14 @@ ApplyPatch RDS-fix-race-condition-when-sending-a-message-on-unb.patch
|
|||
|
||||
ApplyPatch regulator-axp20x-module-alias.patch
|
||||
|
||||
#rhbz 1265978
|
||||
ApplyPatch si2168-Bounds-check-firmware.patch
|
||||
ApplyPatch si2157-Bounds-check-firmware.patch
|
||||
|
||||
#rhbz 1272172
|
||||
ApplyPatch 0001-KEYS-Fix-crash-when-attempt-to-garbage-collect-an-un.patch
|
||||
ApplyPatch 0002-KEYS-Don-t-permit-request_key-to-construct-a-new-key.patch
|
||||
|
||||
#rhbz 1257131
|
||||
ApplyPatch 0001-xhci-Add-spurious-wakeup-quirk-for-LynxPoint-LP-cont.patch
|
||||
|
||||
#CVE-2015-7799 rhbz 1271134 1271135
|
||||
ApplyPatch isdn_ppp-Add-checks-for-allocation-failure-in-isdn_p.patch
|
||||
ApplyPatch ppp-slip-Validate-VJ-compression-slot-parameters-com.patch
|
||||
|
||||
#rhbz 1278407
|
||||
ApplyPatch drm-radeon-move-bl-encoder-assignment-into-bl-init.patch
|
||||
ApplyPatch drm-radeon-fix-dpms-when-driver-backlight-control-is.patch
|
||||
|
||||
#CVE-2015-5307 rhbz 1277172 1279688
|
||||
ApplyPatch KVM-x86-work-around-infinite-loop-in-microcode-when-.patch
|
||||
|
||||
|
|
@ -2270,6 +2248,9 @@ fi
|
|||
#
|
||||
#
|
||||
%changelog
|
||||
* Tue Nov 10 2015 Justin M. Forbes <jforbes@fedoraproject.org> - 4.2.6-200
|
||||
- Linux v4.2.6
|
||||
|
||||
* Tue Nov 10 2015 Josh Boyer <jwboyer@fedoraproject.org>
|
||||
- Fix incorrect size calculations in megaraid with 64K pages (rhbz 1269300)
|
||||
- CVE-2015-8104 kvm: DoS infinite loop in microcode DB exception (rhbz 1278496 1279691)
|
||||
|
|
|
|||
|
|
@ -1,39 +0,0 @@
|
|||
From 526fbce5b0e44c67a97c57656b3be9911f0a9b9b Mon Sep 17 00:00:00 2001
|
||||
From: Laura Abbott <labbott@fedoraproject.org>
|
||||
Date: Tue, 29 Sep 2015 16:59:20 -0700
|
||||
Subject: [PATCH 2/2] si2157: Bounds check firmware
|
||||
To: Antti Palosaari <crope@iki.fi>
|
||||
To: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
|
||||
Cc: Olli Salonen <olli.salonen@iki.fi>
|
||||
Cc: linux-media@vger.kernel.org
|
||||
Cc: linux-kernel@vger.kernel.org
|
||||
|
||||
When reading the firmware and sending commands, the length
|
||||
must be bounds checked to avoid overrunning the size of the command
|
||||
buffer and smashing the stack if the firmware is not in the
|
||||
expected format. Add the proper check.
|
||||
|
||||
Cc: stable@kernel.org
|
||||
Signed-off-by: Laura Abbott <labbott@fedoraproject.org>
|
||||
---
|
||||
drivers/media/tuners/si2157.c | 4 ++++
|
||||
1 file changed, 4 insertions(+)
|
||||
|
||||
diff --git a/drivers/media/tuners/si2157.c b/drivers/media/tuners/si2157.c
|
||||
index 5073821..ce157ed 100644
|
||||
--- a/drivers/media/tuners/si2157.c
|
||||
+++ b/drivers/media/tuners/si2157.c
|
||||
@@ -166,6 +166,10 @@ static int si2157_init(struct dvb_frontend *fe)
|
||||
|
||||
for (remaining = fw->size; remaining > 0; remaining -= 17) {
|
||||
len = fw->data[fw->size - remaining];
|
||||
+ if (len > SI2157_ARGLEN) {
|
||||
+ dev_err(&client->dev, "Bad firmware length\n");
|
||||
+ goto err_release_firmware;
|
||||
+ }
|
||||
memcpy(cmd.args, &fw->data[(fw->size - remaining) + 1], len);
|
||||
cmd.wlen = len;
|
||||
cmd.rlen = 1;
|
||||
--
|
||||
2.4.3
|
||||
|
||||
|
|
@ -1,50 +0,0 @@
|
|||
From 43018528944fa4965a4048fee91d76b47dcaf60e Mon Sep 17 00:00:00 2001
|
||||
From: Laura Abbott <labbott@fedoraproject.org>
|
||||
Date: Mon, 28 Sep 2015 14:10:34 -0700
|
||||
Subject: [PATCH 1/2] si2168: Bounds check firmware
|
||||
To: Antti Palosaari <crope@iki.fi>
|
||||
To: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
|
||||
Cc: Olli Salonen <olli.salonen@iki.fi>
|
||||
Cc: linux-media@vger.kernel.org
|
||||
Cc: linux-kernel@vger.kernel.org
|
||||
Cc: Stuart Auchterlonie <sauchter@redhat.com>
|
||||
|
||||
|
||||
When reading the firmware and sending commands, the length must
|
||||
be bounds checked to avoid overrunning the size of the command
|
||||
buffer and smashing the stack if the firmware is not in the expected
|
||||
format:
|
||||
|
||||
si2168 11-0064: found a 'Silicon Labs Si2168-B40'
|
||||
si2168 11-0064: downloading firmware from file 'dvb-demod-si2168-b40-01.fw'
|
||||
si2168 11-0064: firmware download failed -95
|
||||
Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ffffffffa085708f
|
||||
|
||||
Add the proper check.
|
||||
|
||||
Cc: stable@kernel.org
|
||||
Reported-by: Stuart Auchterlonie <sauchter@redhat.com>
|
||||
Reviewed-by: Antti Palosaari <crope@iki.fi>
|
||||
Signed-off-by: Laura Abbott <labbott@fedoraproject.org>
|
||||
---
|
||||
drivers/media/dvb-frontends/si2168.c | 4 ++++
|
||||
1 file changed, 4 insertions(+)
|
||||
|
||||
diff --git a/drivers/media/dvb-frontends/si2168.c b/drivers/media/dvb-frontends/si2168.c
|
||||
index 81788c5..821a8f4 100644
|
||||
--- a/drivers/media/dvb-frontends/si2168.c
|
||||
+++ b/drivers/media/dvb-frontends/si2168.c
|
||||
@@ -502,6 +502,10 @@ static int si2168_init(struct dvb_frontend *fe)
|
||||
/* firmware is in the new format */
|
||||
for (remaining = fw->size; remaining > 0; remaining -= 17) {
|
||||
len = fw->data[fw->size - remaining];
|
||||
+ if (len > SI2168_ARGLEN) {
|
||||
+ ret = -EINVAL;
|
||||
+ break;
|
||||
+ }
|
||||
memcpy(cmd.args, &fw->data[(fw->size - remaining) + 1], len);
|
||||
cmd.wlen = len;
|
||||
cmd.rlen = 1;
|
||||
--
|
||||
2.4.3
|
||||
|
||||
Loading…
Reference in New Issue