rpms
/
kernel
2
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

3.8.1

This commit is contained in:
Dave Jones 2013-02-28 13:04:11 -05:00
parent dca57f8f98
commit 42cc12eb2a
7 changed files with 12 additions and 409 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

72
drm-i915-lvds-reclock-fix.patch
View File

@ -1,72 +0,0 @@
Origin:
http://cgit.freedesktop.org/~danvet/drm-intel/commit/?h=drm-intel-next&id=725a5b54028916cd2511a251c5b5b13d1715addc
Rediffed for 3.7.x, and any bugs introduced, by ajax
diff -up linux-3.7.7-202.fc18.x86_64/drivers/gpu/drm/i915/i915_gem.c.jx linux-3.7.7-202.fc18.x86_64/drivers/gpu/drm/i915/i915_gem.c
--- linux-3.7.7-202.fc18.x86_64/drivers/gpu/drm/i915/i915_gem.c.jx 2013-02-14 12:40:21.068832043 -0500
+++ linux-3.7.7-202.fc18.x86_64/drivers/gpu/drm/i915/i915_gem.c 2013-02-14 12:41:16.645147300 -0500
@@ -1919,9 +1919,6 @@ i915_gem_object_move_to_inactive(struct
BUG_ON(obj->base.write_domain & ~I915_GEM_GPU_DOMAINS);
BUG_ON(!obj->active);
- if (obj->pin_count) /* are we a framebuffer? */
- intel_mark_fb_idle(obj);
-
list_move_tail(&obj->mm_list, &dev_priv->mm.inactive_list);
list_del_init(&obj->ring_list);
diff -up linux-3.7.7-202.fc18.x86_64/drivers/gpu/drm/i915/intel_display.c.jx linux-3.7.7-202.fc18.x86_64/drivers/gpu/drm/i915/intel_display.c
--- linux-3.7.7-202.fc18.x86_64/drivers/gpu/drm/i915/intel_display.c.jx 2013-02-14 12:40:22.022854621 -0500
+++ linux-3.7.7-202.fc18.x86_64/drivers/gpu/drm/i915/intel_display.c 2013-02-14 12:41:16.648147371 -0500
@@ -6094,11 +6094,6 @@ void intel_mark_busy(struct drm_device *
void intel_mark_idle(struct drm_device *dev)
{
-}
-
-void intel_mark_fb_busy(struct drm_i915_gem_object *obj)
-{
- struct drm_device *dev = obj->base.dev;
struct drm_crtc *crtc;
if (!i915_powersave)
@@ -6108,12 +6103,11 @@ void intel_mark_fb_busy(struct drm_i915_
if (!crtc->fb)
continue;
- if (to_intel_framebuffer(crtc->fb)->obj == obj)
- intel_increase_pllclock(crtc);
+ intel_decrease_pllclock(crtc);
}
}
-void intel_mark_fb_idle(struct drm_i915_gem_object *obj)
+void intel_mark_fb_busy(struct drm_i915_gem_object *obj)
{
struct drm_device *dev = obj->base.dev;
struct drm_crtc *crtc;
@@ -6126,7 +6120,7 @@ void intel_mark_fb_idle(struct drm_i915_
continue;
if (to_intel_framebuffer(crtc->fb)->obj == obj)
- intel_decrease_pllclock(crtc);
+ intel_increase_pllclock(crtc);
}
}
diff -up linux-3.7.7-202.fc18.x86_64/drivers/gpu/drm/i915/intel_drv.h.jx linux-3.7.7-202.fc18.x86_64/drivers/gpu/drm/i915/intel_drv.h
--- linux-3.7.7-202.fc18.x86_64/drivers/gpu/drm/i915/intel_drv.h.jx 2013-02-14 12:40:21.071832114 -0500
+++ linux-3.7.7-202.fc18.x86_64/drivers/gpu/drm/i915/intel_drv.h 2013-02-14 12:41:16.648147371 -0500
@@ -417,9 +417,8 @@ extern bool intel_sdvo_init(struct drm_d
extern void intel_dvo_init(struct drm_device *dev);
extern void intel_tv_init(struct drm_device *dev);
extern void intel_mark_busy(struct drm_device *dev);
-extern void intel_mark_idle(struct drm_device *dev);
extern void intel_mark_fb_busy(struct drm_i915_gem_object *obj);
-extern void intel_mark_fb_idle(struct drm_i915_gem_object *obj);
+extern void intel_mark_idle(struct drm_device *dev);
extern bool intel_lvds_init(struct drm_device *dev);
extern void intel_dp_init(struct drm_device *dev, int output_reg,
enum port port);

134
ipv6-dst-from-ptr-race.patch
View File

@ -1,134 +0,0 @@
diff -up ./include/net/dst.h.orig ./include/net/dst.h
--- ./include/net/dst.h.orig 2012-12-10 22:30:57.000000000 -0500
+++ ./include/net/dst.h 2013-02-20 09:42:49.541777989 -0500
@@ -36,13 +36,9 @@ struct dst_entry {
struct net_device *dev;
struct dst_ops *ops;
unsigned long _metrics;
- union {
- unsigned long expires;
- /* point to where the dst_entry copied from */
- struct dst_entry *from;
- };
+ unsigned long expires;
struct dst_entry *path;
- void *__pad0;
+ struct dst_entry *from;
#ifdef CONFIG_XFRM
struct xfrm_state *xfrm;
#else
diff -up ./include/net/ip6_fib.h.orig ./include/net/ip6_fib.h
--- ./include/net/ip6_fib.h.orig 2012-12-10 22:30:57.000000000 -0500
+++ ./include/net/ip6_fib.h 2013-02-20 09:42:49.597779552 -0500
@@ -157,50 +157,35 @@ static inline struct inet6_dev *ip6_dst_
static inline void rt6_clean_expires(struct rt6_info *rt)
{
- if (!(rt->rt6i_flags & RTF_EXPIRES) && rt->dst.from)
- dst_release(rt->dst.from);
-
rt->rt6i_flags &= ~RTF_EXPIRES;
- rt->dst.from = NULL;
}
static inline void rt6_set_expires(struct rt6_info *rt, unsigned long expires)
{
- if (!(rt->rt6i_flags & RTF_EXPIRES) && rt->dst.from)
- dst_release(rt->dst.from);
-
- rt->rt6i_flags |= RTF_EXPIRES;
rt->dst.expires = expires;
+ rt->rt6i_flags |= RTF_EXPIRES;
}
-static inline void rt6_update_expires(struct rt6_info *rt, int timeout)
+static inline void rt6_update_expires(struct rt6_info *rt0, int timeout)
{
- if (!(rt->rt6i_flags & RTF_EXPIRES)) {
- if (rt->dst.from)
- dst_release(rt->dst.from);
- /* dst_set_expires relies on expires == 0
- * if it has not been set previously.
- */
- rt->dst.expires = 0;
- }
+ struct rt6_info *rt;
- dst_set_expires(&rt->dst, timeout);
- rt->rt6i_flags |= RTF_EXPIRES;
+ for (rt = rt0; rt && !(rt->rt6i_flags & RTF_EXPIRES);
+ rt = (struct rt6_info *)rt->dst.from);
+ if (rt && rt != rt0)
+ rt0->dst.expires = rt->dst.expires;
+
+ dst_set_expires(&rt0->dst, timeout);
+ rt0->rt6i_flags |= RTF_EXPIRES;
}
static inline void rt6_set_from(struct rt6_info *rt, struct rt6_info *from)
{
struct dst_entry *new = (struct dst_entry *) from;
- if (!(rt->rt6i_flags & RTF_EXPIRES) && rt->dst.from) {
- if (new == rt->dst.from)
- return;
- dst_release(rt->dst.from);
- }
-
rt->rt6i_flags &= ~RTF_EXPIRES;
- rt->dst.from = new;
dst_hold(new);
+ rt->dst.from = new;
}
struct fib6_walker_t {
diff -up ./net/core/dst.c.orig ./net/core/dst.c
--- ./net/core/dst.c.orig 2012-12-10 22:30:57.000000000 -0500
+++ ./net/core/dst.c 2013-02-20 09:42:49.984790357 -0500
@@ -179,6 +179,7 @@ void *dst_alloc(struct dst_ops *ops, str
dst_init_metrics(dst, dst_default_metrics, true);
dst->expires = 0UL;
dst->path = dst;
+ dst->from = NULL;
#ifdef CONFIG_XFRM
dst->xfrm = NULL;
#endif
diff -up ./net/ipv6/route.c.orig ./net/ipv6/route.c
--- ./net/ipv6/route.c.orig 2012-12-10 22:30:57.000000000 -0500
+++ ./net/ipv6/route.c 2013-02-20 09:42:50.238797449 -0500
@@ -297,6 +297,7 @@ static void ip6_dst_destroy(struct dst_e
{
struct rt6_info *rt = (struct rt6_info *)dst;
struct inet6_dev *idev = rt->rt6i_idev;
+ struct dst_entry *from = dst->from;
if (rt->n)
neigh_release(rt->n);
@@ -309,8 +310,8 @@ static void ip6_dst_destroy(struct dst_e
in6_dev_put(idev);
}
- if (!(rt->rt6i_flags & RTF_EXPIRES) && dst->from)
- dst_release(dst->from);
+ dst->from = NULL;
+ dst_release(from);
if (rt6_has_peer(rt)) {
struct inet_peer *peer = rt6_peer_ptr(rt);
@@ -998,7 +999,6 @@ struct dst_entry *ip6_blackhole_route(st
rt->rt6i_gateway = ort->rt6i_gateway;
rt->rt6i_flags = ort->rt6i_flags;
- rt6_clean_expires(rt);
rt->rt6i_metric = 0;
memcpy(&rt->rt6i_dst, &ort->rt6i_dst, sizeof(struct rt6key));
@@ -1814,8 +1814,6 @@ static struct rt6_info *ip6_rt_copy(stru
if ((ort->rt6i_flags & (RTF_DEFAULT | RTF_ADDRCONF)) ==
(RTF_DEFAULT | RTF_ADDRCONF))
rt6_set_from(rt, ort);
- else
- rt6_clean_expires(rt);
rt->rt6i_metric = 0;
#ifdef CONFIG_IPV6_SUBTREES

45
kernel.spec
View File

@ -74,7 +74,7 @@ Summary: The Linux kernel
%if 0%{?released_kernel}
# Do we have a -stable update to apply?
%define stable_update 0
%define stable_update 1
# Is it a -stable RC?
%define stable_rc 0
# Set rpm version accordingly
@ -700,8 +700,6 @@ Patch1825: drm-i915-dp-stfu.patch
# mustard patch to shut abrt up. please drop (and notify ajax) whenever it
# fails to apply
Patch1826: drm-i915-tv-detect-hush.patch
# d-i-n backport for https://bugzilla.redhat.com/show_bug.cgi?id=901951
Patch1827: drm-i915-lvds-reclock-fix.patch
# Quiet boot fixes
# silence the ACPI blacklist code
@ -764,30 +762,15 @@ Patch22241: Input-add-support-for-Cypress-PS2-Trackpads.patch
#rhbz 892811
Patch22247: ath9k_rx_dma_stop_check.patch
#rhbz 909591
Patch22255: usb-cypress-supertop.patch
#rhbz 906055
Patch22258: perf-hists-Fix-period-symbol_conf.field_sep-display.patch
#CVE-2013-1763 rhbz 915052,915057
Patch22260: sock_diag-Fix-out-of-bounds-access-to-sock_diag_handlers.patch
#rhbz 903192
Patch22261: 0001-kmsg-Honor-dmesg_restrict-sysctl-on-dev-kmsg.patch
#rhbz 914737
Patch22262: x86-mm-Fix-vmalloc_fault-oops-during-lazy-MMU-updates.patch
#CVE-2013-1767 rhbz 915592,915716
Patch22263: tmpfs-fix-use-after-free-of-mempolicy-object.patch
#rhbz 812111
Patch24000: alps.patch
#rhbz 892060
Patch24001: ipv6-dst-from-ptr-race.patch
Patch24100: userns-avoid-recursion-in-put_user_ns.patch
@ -1441,7 +1424,6 @@ ApplyPatch secure-boot-20130218.patch
ApplyOptionalPatch drm-intel-next.patch
ApplyPatch drm-i915-dp-stfu.patch
ApplyPatch drm-i915-tv-detect-hush.patch
ApplyPatch drm-i915-lvds-reclock-fix.patch
# silence the ACPI blacklist code
ApplyPatch linux-2.6-silence-acpi-blacklist.patch
@ -1489,30 +1471,15 @@ ApplyPatch Input-add-support-for-Cypress-PS2-Trackpads.patch
#rhbz 892811
ApplyPatch ath9k_rx_dma_stop_check.patch
#rhbz 909591
ApplyPatch usb-cypress-supertop.patch
#rhbz 906055
ApplyPatch perf-hists-Fix-period-symbol_conf.field_sep-display.patch
#rhbz 812111
ApplyPatch alps.patch
#rhbz 892060
ApplyPatch ipv6-dst-from-ptr-race.patch
#CVE-2013-1763 rhbz 915052,915057
ApplyPatch sock_diag-Fix-out-of-bounds-access-to-sock_diag_handlers.patch
#rhbz 903192
ApplyPatch 0001-kmsg-Honor-dmesg_restrict-sysctl-on-dev-kmsg.patch
#rhbz 914737
ApplyPatch x86-mm-Fix-vmalloc_fault-oops-during-lazy-MMU-updates.patch
#CVE-2013-1767 rhbz 915592,915716
ApplyPatch tmpfs-fix-use-after-free-of-mempolicy-object.patch
ApplyPatch userns-avoid-recursion-in-put_user_ns.patch
@ -2380,6 +2347,16 @@ fi
# ||----w |
# || ||
%changelog
* Thu Feb 28 2013 Dave Jones <davej@redhat.com>
- Linux 3.8.1
Dropped (merged in 3.8.1)
- drm-i915-lvds-reclock-fix.patch
- usb-cypress-supertop.patch
- perf-hists-Fix-period-symbol_conf.field_sep-display.patch
- ipv6-dst-from-ptr-race.patch
- sock_diag-Fix-out-of-bounds-access-to-sock_diag_handlers.patch
- tmpfs-fix-use-after-free-of-mempolicy-object.patch
* Thu Feb 28 2013 Dave Jones <davej@redhat.com>
- Update usb-cypress-supertop.patch

48
perf-hists-Fix-period-symbol_conf.field_sep-display.patch
View File

@ -1,48 +0,0 @@
From 755b5f5715c117f4723ec04a81a46da85c9179a3 Mon Sep 17 00:00:00 2001
From: Jiri Olsa <jolsa@redhat.com>
Date: Sat, 20 Oct 2012 22:14:10 +0200
Subject: [PATCH] perf hists: Fix period symbol_conf.field_sep display
Upstream commit c0d246b85fc7d42688d7a5d999ea671777caf65b
Currently we don't properly display hist data with symbol_conf.field_sep
separator. We need to display either space or separator.
Signed-off-by: Jiri Olsa <jolsa@redhat.com>
Cc: Arnaldo Carvalho de Melo <acme@ghostprotocols.net>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: Paul Mackerras <paulus@samba.org>
Cc: Corey Ashford <cjashfor@linux.vnet.ibm.com>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Link: http://lkml.kernel.org/n/tip-cyggwys0bz5kqdowwvfd8h72@git.kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
---
tools/perf/ui/hist.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/tools/perf/ui/hist.c b/tools/perf/ui/hist.c
index f5a1e4f..947e20a 100644
--- a/tools/perf/ui/hist.c
+++ b/tools/perf/ui/hist.c
@@ -363,11 +363,15 @@ int hist_entry__period_snprintf(struct perf_hpp *hpp, struct hist_entry *he,
if (!perf_hpp__format[i].cond)
continue;
+ /*
+ * If there's no field_sep, we still need
+ * to display initial ' '.
+ */
if (!sep || !first) {
ret = scnprintf(hpp->buf, hpp->size, "%s", sep ?: " ");
advance_hpp(hpp, ret);
+ } else
first = false;
- }
if (color && perf_hpp__format[i].color)
ret = perf_hpp__format[i].color(hpp, he);
--
1.8.1.2

86
sock_diag-Fix-out-of-bounds-access-to-sock_diag_handlers.patch
View File

@ -1,86 +0,0 @@
Path: news.gmane.org!not-for-mail
From: Mathias Krause <minipli@googlemail.com>
Newsgroups: gmane.linux.network
Subject: [PATCH 1/2] sock_diag: Fix out-of-bounds access to sock_diag_handlers[]
Date: Sat, 23 Feb 2013 12:13:47 +0100
Lines: 28
Approved: news@gmane.org
Message-ID: <1361618028-9024-2-git-send-email-minipli@googlemail.com>
References: <1361618028-9024-1-git-send-email-minipli@googlemail.com>
NNTP-Posting-Host: plane.gmane.org
X-Trace: ger.gmane.org 1361618069 2156 80.91.229.3 (23 Feb 2013 11:14:29 GMT)
X-Complaints-To: usenet@ger.gmane.org
NNTP-Posting-Date: Sat, 23 Feb 2013 11:14:29 +0000 (UTC)
Cc: netdev@vger.kernel.org, Mathias Krause <minipli@googlemail.com>
To: "David S. Miller" <davem@davemloft.net>
Original-X-From: netdev-owner@vger.kernel.org Sat Feb 23 12:14:49 2013
Return-path: <netdev-owner@vger.kernel.org>
Envelope-to: linux-netdev-2@plane.gmane.org
Original-Received: from vger.kernel.org ([209.132.180.67])
by plane.gmane.org with esmtp (Exim 4.69)
(envelope-from <netdev-owner@vger.kernel.org>)
id 1U9D3z-0003H8-6Z
for linux-netdev-2@plane.gmane.org; Sat, 23 Feb 2013 12:14:43 +0100
Original-Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
id S1757811Ab3BWLOQ (ORCPT <rfc822;linux-netdev-2@m.gmane.org>);
Sat, 23 Feb 2013 06:14:16 -0500
Original-Received: from mail-bk0-f53.google.com ([209.85.214.53]:46309 "EHLO
mail-bk0-f53.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
with ESMTP id S1757044Ab3BWLOM (ORCPT
<rfc822;netdev@vger.kernel.org>); Sat, 23 Feb 2013 06:14:12 -0500
Original-Received: by mail-bk0-f53.google.com with SMTP id j10so635828bkw.40
for <netdev@vger.kernel.org>; Sat, 23 Feb 2013 03:14:11 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=googlemail.com; s=20120113;
h=x-received:from:to:cc:subject:date:message-id:x-mailer:in-reply-to
:references;
bh=NM4oEi0qkLdUhxSK1IKpg60DjwOeNtHa0EKsIVngex0=;
b=xdMKHhwMk8BGqDXVGVKf/KcWjSwJajtfpzPDCVugS7vLJh2HtrJnhKiBOUta3XNtTK
ibjB4FQuAenC9ZjXfuEPdo4ct1CIQC2xN2sW/VmeqhYip/xDJ/csVRnX/BxNYWDTFkHo
Uva0peiyrsvR1W0oTeqNLQ1fYIm4f1UwYHzhouschB9mlYHfrCDQFuI7TDfOTUNN1lmY
D5T4vV1aWKsxHx1OYFSRS3aUo3l0Tyzx0zeSPJH+aL3mrhoBDc84RtjsmRafY7RiEXi8
ropiUO1Q9ATcLZd1/2+L/ausYzkP7NiU16SdbkQWuZkP1J8nBK7n5pahlYnDcktklyGM
od5Q==
X-Received: by 10.204.149.196 with SMTP id u4mr2435753bkv.23.1361618051168;
Sat, 23 Feb 2013 03:14:11 -0800 (PST)
Original-Received: from jig.fritz.box (pD9EB2658.dip.t-dialin.net. [217.235.38.88])
by mx.google.com with ESMTPS id gy3sm1474145bkc.16.2013.02.23.03.14.09
(version=TLSv1.2 cipher=ECDHE-RSA-RC4-SHA bits=128/128);
Sat, 23 Feb 2013 03:14:10 -0800 (PST)
X-Mailer: git-send-email 1.7.10.4
In-Reply-To: <1361618028-9024-1-git-send-email-minipli@googlemail.com>
Original-Sender: netdev-owner@vger.kernel.org
Precedence: bulk
List-ID: <netdev.vger.kernel.org>
X-Mailing-List: netdev@vger.kernel.org
Xref: news.gmane.org gmane.linux.network:260061
Archived-At: <http://permalink.gmane.org/gmane.linux.network/260061>
Userland can send a netlink message requesting SOCK_DIAG_BY_FAMILY
with a family greater or equal then AF_MAX -- the array size of
sock_diag_handlers[]. The current code does not test for this
condition therefore is vulnerable to an out-of-bound access opening
doors for a privilege escalation.
Signed-off-by: Mathias Krause <minipli@googlemail.com>
---
net/core/sock_diag.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/core/sock_diag.c b/net/core/sock_diag.c
index 602cd63..750f44f 100644
--- a/net/core/sock_diag.c
+++ b/net/core/sock_diag.c
@@ -121,6 +121,9 @@ static int __sock_diag_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
if (nlmsg_len(nlh) < sizeof(*req))
return -EINVAL;
+ if (req->sdiag_family >= AF_MAX)
+ return -EINVAL;
+
hndl = sock_diag_lock_handler(req->sdiag_family);
if (hndl == NULL)
err = -ENOENT;
--
1.7.10.4

1
sources
View File

@ -1 +1,2 @@
1c738edfc54e7c65faeb90c436104e2f linux-3.8.tar.xz
50a68679086c346dddb34dedccfae7ee patch-3.8.1.xz

35
usb-cypress-supertop.patch
View File

@ -1,35 +0,0 @@
From 1cd59b0d0b82c66135bf10ed3a87213a87e318ab Mon Sep 17 00:00:00 2001
From: Josh Boyer <jwboyer@redhat.com>
Date: Thu, 14 Feb 2013 09:29:55 -0500
Subject: [PATCH] USB: usb-storage: unusual_devs update for Super TOP SATA
bridge
The current entry in unusual_cypress.h for the Super TOP SATA bridge devices
seems to be causing corruption on newer revisions of this device. This has
been reported in Arch Linux and Fedora. The original patch was tested on
devices with bcdDevice of 1.60, whereas the newer devices report bcdDevice
as 2.20. Limit the UNUSUAL_DEV entry to devices less than 2.20.
This fixes https://bugzilla.redhat.com/show_bug.cgi?id=909591
Reported-by: Carsten S. <carsteniq@yahoo.com>
Tested-by: Carsten S. <carsteniq@yahoo.com>
CC: <stable@vger.kernel.org>
Signed-off-by: Josh Boyer <jwboyer@redhat.com>
---
drivers/usb/storage/unusual_cypress.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/storage/unusual_cypress.h b/drivers/usb/storage/unusual_cypress.h
index 2c85530..65a6a75 100644
--- a/drivers/usb/storage/unusual_cypress.h
+++ b/drivers/usb/storage/unusual_cypress.h
@@ -31,7 +31,7 @@ UNUSUAL_DEV( 0x04b4, 0x6831, 0x0000, 0x
"Cypress ISD-300LP",
USB_SC_CYP_ATACB, USB_PR_DEVICE, NULL, 0),
-UNUSUAL_DEV( 0x14cd, 0x6116, 0x0000, 0x9999,
+UNUSUAL_DEV( 0x14cd, 0x6116, 0x0000, 0x0219,
"Super Top",
"USB 2.0 SATA BRIDGE",
USB_SC_CYP_ATACB, USB_PR_DEVICE, NULL, 0),