Linux v4.0-rc7-30-g20624d17963c
This commit is contained in:
Josh Boyer
parent
b6b5f47a14
commit
5fbe6a96e1
|
|
@ -163,10 +163,10 @@ index b033dab5c8bf..f526b6e02f59 100644
|
|||
|
||||
extern int modules_disabled; /* for sysctl */
|
||||
diff --git a/kernel/module.c b/kernel/module.c
|
||||
index 33e695877504..f1742ffe92bd 100644
|
||||
index 0372c3961016..55dacebb687b 100644
|
||||
--- a/kernel/module.c
|
||||
+++ b/kernel/module.c
|
||||
@@ -3892,6 +3892,13 @@ void module_layout(struct module *mod,
|
||||
@@ -3909,6 +3909,13 @@ void module_layout(struct module *mod,
|
||||
EXPORT_SYMBOL(module_layout);
|
||||
#endif
|
||||
|
||||
|
|
|
|||
|
|
@ -41,10 +41,10 @@ index b03485bcb82a..b033dab5c8bf 100644
|
|||
|
||||
#ifdef CONFIG_SYSFS
|
||||
diff --git a/kernel/module.c b/kernel/module.c
|
||||
index 99fdf94efce8..33e695877504 100644
|
||||
index ec53f594e9c9..0372c3961016 100644
|
||||
--- a/kernel/module.c
|
||||
+++ b/kernel/module.c
|
||||
@@ -3891,3 +3891,13 @@ void module_layout(struct module *mod,
|
||||
@@ -3908,3 +3908,13 @@ void module_layout(struct module *mod,
|
||||
}
|
||||
EXPORT_SYMBOL(module_layout);
|
||||
#endif
|
||||
|
|
|
|||
|
|
@ -228,7 +228,7 @@ index 4121345498e0..0ff3cef5df96 100644
|
|||
|
||||
return 0;
|
||||
diff --git a/kernel/module.c b/kernel/module.c
|
||||
index f1742ffe92bd..f4738b4cc373 100644
|
||||
index 55dacebb687b..9d4deeb9268e 100644
|
||||
--- a/kernel/module.c
|
||||
+++ b/kernel/module.c
|
||||
@@ -107,9 +107,9 @@ struct list_head *kdb_modules = &modules; /* kdb needs the list of modules */
|
||||
|
|
|
|||
|
|
@ -1,47 +0,0 @@
|
|||
From: Shachar Raindel <raindel@mellanox.com>
|
||||
Date: Sun, 4 Jan 2015 18:30:32 +0200
|
||||
Subject: [PATCH] IB/core: Prevent integer overflow in ib_umem_get address
|
||||
arithmetic
|
||||
|
||||
Properly verify that the resulting page aligned end address is larger
|
||||
than both the start address and the length of the memory area
|
||||
requested.
|
||||
|
||||
Both the start and length arguments for ib_umem_get are controlled by
|
||||
the user. A misbehaving user can provide values which will cause an
|
||||
integer overflow when calculating the page aligned end address.
|
||||
|
||||
This overflow can cause also miscalculation of the number of pages
|
||||
mapped, and additional logic issues.
|
||||
|
||||
Issue: 470602
|
||||
Change-Id: Iee88441db454af291fc5a376009d840603398d23
|
||||
Signed-off-by: Shachar Raindel <raindel@mellanox.com>
|
||||
Signed-off-by: Jack Morgenstein <jackm@mellanox.com>
|
||||
Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
|
||||
---
|
||||
drivers/infiniband/core/umem.c | 8 ++++++++
|
||||
1 file changed, 8 insertions(+)
|
||||
|
||||
diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
|
||||
index aec7a6aa2951..8c014b5dab4c 100644
|
||||
--- a/drivers/infiniband/core/umem.c
|
||||
+++ b/drivers/infiniband/core/umem.c
|
||||
@@ -99,6 +99,14 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr,
|
||||
if (dmasync)
|
||||
dma_set_attr(DMA_ATTR_WRITE_BARRIER, &attrs);
|
||||
|
||||
+ /*
|
||||
+ * If the combination of the addr and size requested for this memory
|
||||
+ * region causes an integer overflow, return error.
|
||||
+ */
|
||||
+ if ((PAGE_ALIGN(addr + size) <= size) ||
|
||||
+ (PAGE_ALIGN(addr + size) <= addr))
|
||||
+ return ERR_PTR(-EINVAL);
|
||||
+
|
||||
if (!can_do_mlock())
|
||||
return ERR_PTR(-EPERM);
|
||||
|
||||
--
|
||||
2.1.0
|
||||
|
||||
|
|
@ -1,54 +0,0 @@
|
|||
From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
||||
Date: Sat, 21 Mar 2015 20:36:56 -0700
|
||||
Subject: [PATCH] Input: ALPS - fix max coordinates for v5 and v7 protocols
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
Commit 3296f71cd2fde7a2ad52e66a27eae419f6328066 ("Input: ALPS - consolidate
|
||||
setting protocol parameters") inadvertently moved call to
|
||||
alps_dolphin_get_device_area() from v5 to v7 protocol, causing both
|
||||
protocols report incorrect maximum values for X and Y axes which resulted
|
||||
in crash in Synaptics X driver.
|
||||
|
||||
Reported-by: Santiago Gala <sgala@apache.org>
|
||||
Reported-by: Pali Rohár <pali.rohar@gmail.com>
|
||||
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
||||
---
|
||||
drivers/input/mouse/alps.c | 11 ++++++-----
|
||||
1 file changed, 6 insertions(+), 5 deletions(-)
|
||||
|
||||
diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
|
||||
index 1bd15ebc01f2..33198b91bebf 100644
|
||||
--- a/drivers/input/mouse/alps.c
|
||||
+++ b/drivers/input/mouse/alps.c
|
||||
@@ -2281,10 +2281,12 @@ static int alps_set_protocol(struct psmouse *psmouse,
|
||||
priv->set_abs_params = alps_set_abs_params_mt;
|
||||
priv->nibble_commands = alps_v3_nibble_commands;
|
||||
priv->addr_command = PSMOUSE_CMD_RESET_WRAP;
|
||||
- priv->x_max = 1360;
|
||||
- priv->y_max = 660;
|
||||
priv->x_bits = 23;
|
||||
priv->y_bits = 12;
|
||||
+
|
||||
+ if (alps_dolphin_get_device_area(psmouse, priv))
|
||||
+ return -EIO;
|
||||
+
|
||||
break;
|
||||
|
||||
case ALPS_PROTO_V6:
|
||||
@@ -2303,9 +2305,8 @@ static int alps_set_protocol(struct psmouse *psmouse,
|
||||
priv->set_abs_params = alps_set_abs_params_mt;
|
||||
priv->nibble_commands = alps_v3_nibble_commands;
|
||||
priv->addr_command = PSMOUSE_CMD_RESET_WRAP;
|
||||
-
|
||||
- if (alps_dolphin_get_device_area(psmouse, priv))
|
||||
- return -EIO;
|
||||
+ priv->x_max = 0xfff;
|
||||
+ priv->y_max = 0x7ff;
|
||||
|
||||
if (priv->fw_ver[1] != 0xba)
|
||||
priv->flags |= ALPS_BUTTONPAD;
|
||||
--
|
||||
2.1.0
|
||||
|
||||
|
|
@ -43,7 +43,7 @@ Signed-off-by: Josh Stone <jistone@redhat.com>
|
|||
2 files changed, 21 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/Makefile b/Makefile
|
||||
index da36a3be7969..92089c03e64e 100644
|
||||
index 54430f933b62..09e578408544 100644
|
||||
--- a/Makefile
|
||||
+++ b/Makefile
|
||||
@@ -706,7 +706,11 @@ KBUILD_CFLAGS += -fomit-frame-pointer
|
||||
|
|
|
|||
|
|
@ -766,6 +766,9 @@ CONFIG_KEYBOARD_CROS_EC=m
|
|||
CONFIG_I2C_CROS_EC_TUNNEL=m
|
||||
CONFIG_SND_SOC_TS3A227E=m
|
||||
|
||||
CONFIG_R8188EU=m
|
||||
# CONFIG_88EU_AP_MODE is not set
|
||||
|
||||
# Needs work/investigation
|
||||
# CONFIG_ARM_KPROBES_TEST is not set
|
||||
|
||||
|
|
|
|||
21
kernel.spec
21
kernel.spec
|
|
@ -66,9 +66,9 @@ Summary: The Linux kernel
|
|||
# define upstream_sublevel %(echo $((%{base_sublevel} + 1)))
|
||||
%define upstream_sublevel 0
|
||||
# The rc snapshot level
|
||||
%define rcrev 6
|
||||
%define rcrev 7
|
||||
# The git snapshot level
|
||||
%define gitrev 2
|
||||
%define gitrev 1
|
||||
# Set rpm version accordingly
|
||||
%define rpmversion 4.%{upstream_sublevel}.0
|
||||
%endif
|
||||
|
|
@ -406,7 +406,7 @@ BuildRequires: binutils-%{_build_arch}-linux-gnu, gcc-%{_build_arch}-linux-gnu
|
|||
%endif
|
||||
|
||||
#Source0: ftp://ftp.kernel.org/pub/linux/kernel/v4.x/linux-%{kversion}.tar.xz
|
||||
Source0: ftp://ftp.kernel.org/pub/linux/kernel/v4.x/linux-4.0-rc6.tar.xz
|
||||
Source0: ftp://ftp.kernel.org/pub/linux/kernel/v4.x/linux-4.0-rc7.tar.xz
|
||||
|
||||
Source10: perf-man-%{kversion}.tar.gz
|
||||
Source11: x509.genkey
|
||||
|
|
@ -618,9 +618,6 @@ Patch26139: Bluetooth-ath3k-Add-support-Atheros-AR5B195-combo-Mi.patch
|
|||
#rhbz 1196825
|
||||
Patch26140: security-yama-Remove-unnecessary-selects-from-Kconfi.patch
|
||||
|
||||
#CVE-2014-8159 rhbz 1181166 1200950
|
||||
Patch26167: IB-core-Prevent-integer-overflow-in-ib_umem_get-addr.patch
|
||||
|
||||
#rhbz 1201532
|
||||
Patch26168: HID-multitouch-add-support-of-clickpads.patch
|
||||
|
||||
|
|
@ -628,9 +625,6 @@ Patch26168: HID-multitouch-add-support-of-clickpads.patch
|
|||
Patch26170: acpi-video-Allow-forcing-native-backlight-on-non-win.patch
|
||||
Patch26171: acpi-video-Add-force-native-backlight-quirk-for-Leno.patch
|
||||
|
||||
#rhbz 1203584
|
||||
Patch26174: Input-ALPS-fix-max-coordinates-for-v5-and-v7-protoco.patch
|
||||
|
||||
#CVE-2015-2150 rhbz 1196266 1200397
|
||||
Patch26175: xen-pciback-Don-t-disable-PCI_COMMAND-on-PCI-device-.patch
|
||||
|
||||
|
|
@ -1363,9 +1357,6 @@ ApplyPatch Bluetooth-ath3k-Add-support-Atheros-AR5B195-combo-Mi.patch
|
|||
#rhbz 1196825
|
||||
ApplyPatch security-yama-Remove-unnecessary-selects-from-Kconfi.patch
|
||||
|
||||
#CVE-2014-8159 rhbz 1181166 1200950
|
||||
ApplyPatch IB-core-Prevent-integer-overflow-in-ib_umem_get-addr.patch
|
||||
|
||||
#rhbz 1201532
|
||||
ApplyPatch HID-multitouch-add-support-of-clickpads.patch
|
||||
|
||||
|
|
@ -1373,9 +1364,6 @@ ApplyPatch HID-multitouch-add-support-of-clickpads.patch
|
|||
ApplyPatch acpi-video-Allow-forcing-native-backlight-on-non-win.patch
|
||||
ApplyPatch acpi-video-Add-force-native-backlight-quirk-for-Leno.patch
|
||||
|
||||
#rhbz 1203584
|
||||
ApplyPatch Input-ALPS-fix-max-coordinates-for-v5-and-v7-protoco.patch
|
||||
|
||||
#CVE-2015-2150 rhbz 1196266 1200397
|
||||
ApplyPatch xen-pciback-Don-t-disable-PCI_COMMAND-on-PCI-device-.patch
|
||||
|
||||
|
|
@ -2229,6 +2217,9 @@ fi
|
|||
#
|
||||
#
|
||||
%changelog
|
||||
* Thu Apr 09 2015 Josh Boyer <jwboyer@fedoraproject.org> - 4.0.0-0.rc7.git1.1
|
||||
- Linux v4.0-rc7-30-g20624d17963c
|
||||
|
||||
* Thu Apr 02 2015 Josh Boyer <jwboyer@fedoraproject.org> - 4.0.0-0.rc6.git2.1
|
||||
- Linux v4.0-rc6-101-g0a4812798fae
|
||||
|
||||
|
|
|
|||
6
sources
6
sources
|
|
@ -1,3 +1,3 @@
|
|||
bec0aeeacab2852d9a17ccbfa7e280f8 linux-4.0-rc6.tar.xz
|
||||
260f7a6cccde97c91b2e79eb93049820 perf-man-4.0-rc6.tar.gz
|
||||
9c5164f5f19edaf4c78df0b2e7e4a047 patch-4.0-rc6-git2.xz
|
||||
26db663899b1a54397b4f184ca05f213 linux-4.0-rc7.tar.xz
|
||||
3fa282f45f65ef53dda78e0f9628f3ae perf-man-4.0-rc7.tar.gz
|
||||
d2fb082931b93e69291c82a5efef4f7b patch-4.0-rc7-git1.xz
|
||||
|
|
|
|||
Loading…
Reference in New Issue