Josh Boyer
parent
e9555570fe
commit
7b6b31a413
|
|
@ -1,59 +0,0 @@
|
|||
From 94c78c81df3056e573fb84000a32512e9c16e555 Mon Sep 17 00:00:00 2001
|
||||
From: Josh Boyer <jwboyer@fedoraproject.org>
|
||||
Date: Thu, 10 Mar 2016 08:49:02 -0500
|
||||
Subject: [PATCH] USB: serial: ftdi_sio: Add support for ICP DAS I-756xU
|
||||
devices
|
||||
|
||||
A Fedora user reports that the ftdi_sio driver works properly for the
|
||||
ICP DAS I-7561U device. Further, the user manual for these devices
|
||||
instructs users to load the driver and add the ids using the sysfs
|
||||
interface.
|
||||
|
||||
Add support for these in the driver directly so that the devices work
|
||||
out of the box instead of needing manual configuration.
|
||||
|
||||
Reported-by: <thesource@mail.ru>
|
||||
CC: stable <stable@vger.kernel.org>
|
||||
Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org>
|
||||
---
|
||||
drivers/usb/serial/ftdi_sio.c | 4 ++++
|
||||
drivers/usb/serial/ftdi_sio_ids.h | 8 ++++++++
|
||||
2 files changed, 12 insertions(+)
|
||||
|
||||
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
|
||||
index 8c660ae401d8..b61f12160d37 100644
|
||||
--- a/drivers/usb/serial/ftdi_sio.c
|
||||
+++ b/drivers/usb/serial/ftdi_sio.c
|
||||
@@ -1004,6 +1004,10 @@ static const struct usb_device_id id_table_combined[] = {
|
||||
{ USB_DEVICE(FTDI_VID, CHETCO_SEASMART_DISPLAY_PID) },
|
||||
{ USB_DEVICE(FTDI_VID, CHETCO_SEASMART_LITE_PID) },
|
||||
{ USB_DEVICE(FTDI_VID, CHETCO_SEASMART_ANALOG_PID) },
|
||||
+ /* ICP DAS I-756xU devices */
|
||||
+ { USB_DEVICE(ICPDAS_VID, ICPDAS_I7560U_PID) },
|
||||
+ { USB_DEVICE(ICPDAS_VID, ICPDAS_I7561U_PID) },
|
||||
+ { USB_DEVICE(ICPDAS_VID, ICPDAS_I7563U_PID) },
|
||||
{ } /* Terminating entry */
|
||||
};
|
||||
|
||||
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
|
||||
index a84df2513994..a4ec24ce6a11 100644
|
||||
--- a/drivers/usb/serial/ftdi_sio_ids.h
|
||||
+++ b/drivers/usb/serial/ftdi_sio_ids.h
|
||||
@@ -872,6 +872,14 @@
|
||||
#define NOVITUS_BONO_E_PID 0x6010
|
||||
|
||||
/*
|
||||
+ * ICPDAS I-756*U devices
|
||||
+ */
|
||||
+#define ICPDAS_VID 0x1b5c
|
||||
+#define ICPDAS_I7560U_PID 0x0103
|
||||
+#define ICPDAS_I7561U_PID 0x0104
|
||||
+#define ICPDAS_I7563U_PID 0x0105
|
||||
+
|
||||
+/*
|
||||
* RT Systems programming cables for various ham radios
|
||||
*/
|
||||
#define RTSYSTEMS_VID 0x2100 /* Vendor ID */
|
||||
--
|
||||
2.5.0
|
||||
|
||||
|
|
@ -1845,13 +1845,13 @@ CONFIG_B43_PCMCIA=y
|
|||
CONFIG_B43_SDIO=y
|
||||
CONFIG_B43_BCMA=y
|
||||
CONFIG_B43_BCMA_PIO=y
|
||||
CONFIG_B43_DEBUG=y
|
||||
# CONFIG_B43_DEBUG is not set
|
||||
CONFIG_B43_PHY_LP=y
|
||||
CONFIG_B43_PHY_N=y
|
||||
CONFIG_B43_PHY_HT=y
|
||||
CONFIG_B43_PHY_G=y
|
||||
CONFIG_B43LEGACY=m
|
||||
CONFIG_B43LEGACY_DEBUG=y
|
||||
# CONFIG_B43LEGACY_DEBUG is not set
|
||||
CONFIG_B43LEGACY_DMA=y
|
||||
CONFIG_B43LEGACY_PIO=y
|
||||
CONFIG_B43LEGACY_DMA_AND_PIO_MODE=y
|
||||
|
|
@ -5207,7 +5207,7 @@ CONFIG_PM_DEBUG=y
|
|||
# CONFIG_DPM_WATCHDOG is not set # revisit this in debug
|
||||
CONFIG_PM_TRACE=y
|
||||
CONFIG_PM_TRACE_RTC=y
|
||||
CONFIG_PM_TEST_SUSPEND=y
|
||||
# CONFIG_PM_TEST_SUSPEND is not set
|
||||
# CONFIG_PM_OPP is not set
|
||||
# CONFIG_PM_AUTOSLEEP is not set
|
||||
# CONFIG_PM_WAKELOCKS is not set
|
||||
|
|
|
|||
110
config-nodebug
110
config-nodebug
|
|
@ -2,101 +2,101 @@ CONFIG_SND_VERBOSE_PRINTK=y
|
|||
CONFIG_SND_DEBUG=y
|
||||
CONFIG_SND_PCM_XRUN_DEBUG=y
|
||||
|
||||
CONFIG_DEBUG_ATOMIC_SLEEP=y
|
||||
# CONFIG_DEBUG_ATOMIC_SLEEP is not set
|
||||
|
||||
CONFIG_DEBUG_MUTEXES=y
|
||||
CONFIG_DEBUG_RT_MUTEXES=y
|
||||
CONFIG_DEBUG_LOCK_ALLOC=y
|
||||
CONFIG_LOCK_TORTURE_TEST=m
|
||||
CONFIG_PROVE_LOCKING=y
|
||||
CONFIG_DEBUG_SPINLOCK=y
|
||||
CONFIG_PROVE_RCU=y
|
||||
# CONFIG_DEBUG_MUTEXES is not set
|
||||
# CONFIG_DEBUG_RT_MUTEXES is not set
|
||||
# CONFIG_DEBUG_LOCK_ALLOC is not set
|
||||
# CONFIG_LOCK_TORTURE_TEST is not set
|
||||
# CONFIG_PROVE_LOCKING is not set
|
||||
# CONFIG_DEBUG_SPINLOCK is not set
|
||||
# CONFIG_PROVE_RCU is not set
|
||||
# CONFIG_PROVE_RCU_REPEATEDLY is not set
|
||||
CONFIG_DEBUG_PER_CPU_MAPS=y
|
||||
# CONFIG_DEBUG_PER_CPU_MAPS is not set
|
||||
CONFIG_CPUMASK_OFFSTACK=y
|
||||
|
||||
CONFIG_CPU_NOTIFIER_ERROR_INJECT=m
|
||||
# CONFIG_CPU_NOTIFIER_ERROR_INJECT is not set
|
||||
|
||||
CONFIG_FAULT_INJECTION=y
|
||||
CONFIG_FAILSLAB=y
|
||||
CONFIG_FAIL_PAGE_ALLOC=y
|
||||
CONFIG_FAIL_MAKE_REQUEST=y
|
||||
CONFIG_FAULT_INJECTION_DEBUG_FS=y
|
||||
CONFIG_FAULT_INJECTION_STACKTRACE_FILTER=y
|
||||
CONFIG_FAIL_IO_TIMEOUT=y
|
||||
CONFIG_FAIL_MMC_REQUEST=y
|
||||
# CONFIG_FAULT_INJECTION is not set
|
||||
# CONFIG_FAILSLAB is not set
|
||||
# CONFIG_FAIL_PAGE_ALLOC is not set
|
||||
# CONFIG_FAIL_MAKE_REQUEST is not set
|
||||
# CONFIG_FAULT_INJECTION_DEBUG_FS is not set
|
||||
# CONFIG_FAULT_INJECTION_STACKTRACE_FILTER is not set
|
||||
# CONFIG_FAIL_IO_TIMEOUT is not set
|
||||
# CONFIG_FAIL_MMC_REQUEST is not set
|
||||
|
||||
CONFIG_LOCK_STAT=y
|
||||
# CONFIG_LOCK_STAT is not set
|
||||
|
||||
CONFIG_DEBUG_STACK_USAGE=y
|
||||
# CONFIG_DEBUG_STACK_USAGE is not set
|
||||
|
||||
CONFIG_ACPI_DEBUG=y
|
||||
# CONFIG_ACPI_DEBUG is not set
|
||||
# CONFIG_ACPI_DEBUGGER is not set
|
||||
|
||||
CONFIG_DEBUG_SG=y
|
||||
CONFIG_DEBUG_PI_LIST=y
|
||||
# CONFIG_DEBUG_SG is not set
|
||||
# CONFIG_DEBUG_PI_LIST is not set
|
||||
|
||||
# CONFIG_PAGE_EXTENSION is not set
|
||||
# CONFIG_PAGE_OWNER is not set
|
||||
# CONFIG_DEBUG_PAGEALLOC is not set
|
||||
|
||||
CONFIG_DEBUG_OBJECTS=y
|
||||
# CONFIG_DEBUG_OBJECTS is not set
|
||||
# CONFIG_DEBUG_OBJECTS_SELFTEST is not set
|
||||
CONFIG_DEBUG_OBJECTS_FREE=y
|
||||
CONFIG_DEBUG_OBJECTS_TIMERS=y
|
||||
CONFIG_DEBUG_OBJECTS_RCU_HEAD=y
|
||||
# CONFIG_DEBUG_OBJECTS_FREE is not set
|
||||
# CONFIG_DEBUG_OBJECTS_TIMERS is not set
|
||||
# CONFIG_DEBUG_OBJECTS_RCU_HEAD is not set
|
||||
CONFIG_DEBUG_OBJECTS_ENABLE_DEFAULT=1
|
||||
|
||||
CONFIG_X86_PTDUMP=y
|
||||
CONFIG_ARM64_PTDUMP=y
|
||||
CONFIG_EFI_PGT_DUMP=y
|
||||
# CONFIG_ARM64_PTDUMP is not set
|
||||
# CONFIG_EFI_PGT_DUMP is not set
|
||||
|
||||
CONFIG_CAN_DEBUG_DEVICES=y
|
||||
# CONFIG_CAN_DEBUG_DEVICES is not set
|
||||
|
||||
CONFIG_MODULE_FORCE_UNLOAD=y
|
||||
# CONFIG_MODULE_FORCE_UNLOAD is not set
|
||||
|
||||
|
||||
CONFIG_DEBUG_NOTIFIERS=y
|
||||
# CONFIG_DEBUG_NOTIFIERS is not set
|
||||
|
||||
CONFIG_DMA_API_DEBUG=y
|
||||
# CONFIG_DMA_API_DEBUG is not set
|
||||
|
||||
CONFIG_MMIOTRACE=y
|
||||
# CONFIG_MMIOTRACE is not set
|
||||
|
||||
CONFIG_DEBUG_CREDENTIALS=y
|
||||
# CONFIG_DEBUG_CREDENTIALS is not set
|
||||
|
||||
# off in both production debug and nodebug builds,
|
||||
# on in rawhide nodebug builds
|
||||
CONFIG_DEBUG_FORCE_WEAK_PER_CPU=y
|
||||
# CONFIG_DEBUG_FORCE_WEAK_PER_CPU is not set
|
||||
|
||||
CONFIG_EXT4_DEBUG=y
|
||||
# CONFIG_EXT4_DEBUG is not set
|
||||
|
||||
# CONFIG_XFS_WARN is not set
|
||||
|
||||
CONFIG_DEBUG_PERF_USE_VMALLOC=y
|
||||
# CONFIG_DEBUG_PERF_USE_VMALLOC is not set
|
||||
|
||||
CONFIG_JBD2_DEBUG=y
|
||||
# CONFIG_JBD2_DEBUG is not set
|
||||
|
||||
CONFIG_NFSD_FAULT_INJECTION=y
|
||||
# CONFIG_NFSD_FAULT_INJECTION is not set
|
||||
|
||||
CONFIG_DEBUG_BLK_CGROUP=y
|
||||
# CONFIG_DEBUG_BLK_CGROUP is not set
|
||||
|
||||
CONFIG_DRBD_FAULT_INJECTION=y
|
||||
# CONFIG_DRBD_FAULT_INJECTION is not set
|
||||
|
||||
CONFIG_ATH_DEBUG=y
|
||||
CONFIG_CARL9170_DEBUGFS=y
|
||||
CONFIG_IWLWIFI_DEVICE_TRACING=y
|
||||
# CONFIG_ATH_DEBUG is not set
|
||||
# CONFIG_CARL9170_DEBUGFS is not set
|
||||
# CONFIG_IWLWIFI_DEVICE_TRACING is not set
|
||||
|
||||
# CONFIG_RTLWIFI_DEBUG is not set
|
||||
|
||||
CONFIG_DEBUG_OBJECTS_WORK=y
|
||||
# CONFIG_DEBUG_OBJECTS_WORK is not set
|
||||
|
||||
CONFIG_DMADEVICES_DEBUG=y
|
||||
# CONFIG_DMADEVICES_DEBUG is not set
|
||||
# CONFIG_DMADEVICES_VDEBUG is not set
|
||||
|
||||
CONFIG_PM_ADVANCED_DEBUG=y
|
||||
|
||||
CONFIG_CEPH_LIB_PRETTYDEBUG=y
|
||||
CONFIG_QUOTA_DEBUG=y
|
||||
# CONFIG_CEPH_LIB_PRETTYDEBUG is not set
|
||||
# CONFIG_QUOTA_DEBUG is not set
|
||||
|
||||
|
||||
CONFIG_KGDB_KDB=y
|
||||
|
|
@ -104,19 +104,19 @@ CONFIG_KDB_DEFAULT_ENABLE=0x0
|
|||
CONFIG_KDB_KEYBOARD=y
|
||||
CONFIG_KDB_CONTINUE_CATASTROPHIC=0
|
||||
|
||||
CONFIG_DEBUG_OBJECTS_PERCPU_COUNTER=y
|
||||
# CONFIG_DEBUG_OBJECTS_PERCPU_COUNTER is not set
|
||||
# CONFIG_PERCPU_TEST is not set
|
||||
CONFIG_TEST_LIST_SORT=y
|
||||
# CONFIG_TEST_LIST_SORT is not set
|
||||
# CONFIG_TEST_STRING_HELPERS is not set
|
||||
|
||||
CONFIG_DETECT_HUNG_TASK=y
|
||||
# CONFIG_DETECT_HUNG_TASK is not set
|
||||
CONFIG_DEFAULT_HUNG_TASK_TIMEOUT=120
|
||||
# CONFIG_BOOTPARAM_HUNG_TASK_PANIC is not set
|
||||
CONFIG_WQ_WATCHDOG=y
|
||||
# CONFIG_WQ_WATCHDOG is not set
|
||||
|
||||
CONFIG_X86_BOOTPARAM_MEMORY_CORRUPTION_CHECK=y
|
||||
# CONFIG_X86_BOOTPARAM_MEMORY_CORRUPTION_CHECK is not set
|
||||
|
||||
CONFIG_DEBUG_KMEMLEAK=y
|
||||
# CONFIG_DEBUG_KMEMLEAK is not set
|
||||
CONFIG_DEBUG_KMEMLEAK_EARLY_LOG_SIZE=1024
|
||||
# CONFIG_DEBUG_KMEMLEAK_TEST is not set
|
||||
CONFIG_DEBUG_KMEMLEAK_DEFAULT_OFF=y
|
||||
|
|
|
|||
|
|
@ -378,7 +378,7 @@ CONFIG_SP5100_TCO=m
|
|||
|
||||
# CONFIG_MEMTEST is not set
|
||||
# CONFIG_DEBUG_TLBFLUSH is not set
|
||||
CONFIG_MAXSMP=y
|
||||
# CONFIG_MAXSMP is not set
|
||||
|
||||
|
||||
CONFIG_HP_ILO=m
|
||||
|
|
|
|||
|
|
@ -1,50 +0,0 @@
|
|||
From f7a3aa353011e38e119adebd845b38551587a26a Mon Sep 17 00:00:00 2001
|
||||
From: Oliver Neukum <oneukum@suse.com>
|
||||
Date: Thu, 17 Mar 2016 16:25:33 +0100
|
||||
Subject: [PATCH] cypress_m8: add sanity checking
|
||||
|
||||
An attack using missing endpoints exists.
|
||||
CVE-2016-3137
|
||||
|
||||
Signed-off-by: Oliver Neukum <ONeukum@suse.com>
|
||||
CC: stable@vger.kernel.org
|
||||
|
||||
v1 - add sanity check
|
||||
v2 - add error logging
|
||||
v3 - correct error message
|
||||
---
|
||||
drivers/usb/serial/cypress_m8.c | 11 +++++------
|
||||
1 file changed, 5 insertions(+), 6 deletions(-)
|
||||
|
||||
diff --git a/drivers/usb/serial/cypress_m8.c b/drivers/usb/serial/cypress_m8.c
|
||||
index 01bf53392819..5e25443fe4ef 100644
|
||||
--- a/drivers/usb/serial/cypress_m8.c
|
||||
+++ b/drivers/usb/serial/cypress_m8.c
|
||||
@@ -447,6 +447,11 @@ static int cypress_generic_port_probe(struct usb_serial_port *port)
|
||||
struct usb_serial *serial = port->serial;
|
||||
struct cypress_private *priv;
|
||||
|
||||
+ if (!port->interrupt_out_urb || !port->interrupt_in_urb) {
|
||||
+ dev_err(&port->dev, "A required endpoint is missing\n");
|
||||
+ return -ENODEV;
|
||||
+ }
|
||||
+
|
||||
priv = kzalloc(sizeof(struct cypress_private), GFP_KERNEL);
|
||||
if (!priv)
|
||||
return -ENOMEM;
|
||||
@@ -606,12 +611,6 @@ static int cypress_open(struct tty_struct *tty, struct usb_serial_port *port)
|
||||
cypress_set_termios(tty, port, &priv->tmp_termios);
|
||||
|
||||
/* setup the port and start reading from the device */
|
||||
- if (!port->interrupt_in_urb) {
|
||||
- dev_err(&port->dev, "%s - interrupt_in_urb is empty!\n",
|
||||
- __func__);
|
||||
- return -1;
|
||||
- }
|
||||
-
|
||||
usb_fill_int_urb(port->interrupt_in_urb, serial->dev,
|
||||
usb_rcvintpipe(serial->dev, port->interrupt_in_endpointAddress),
|
||||
port->interrupt_in_urb->transfer_buffer,
|
||||
--
|
||||
2.5.0
|
||||
|
||||
|
|
@ -1,70 +0,0 @@
|
|||
From e9c2a3972496927631a1a98fef43e9538e9fd5d5 Mon Sep 17 00:00:00 2001
|
||||
From: Oliver Neukum <oneukum@suse.com>
|
||||
Date: Mon, 14 Mar 2016 15:53:38 +0100
|
||||
Subject: [PATCH v2] digi_acceleport: do sanity checking for the number of ports
|
||||
|
||||
The driver can be crashed with devices that expose crafted
|
||||
descriptors with too few endpoints.
|
||||
See:
|
||||
http://seclists.org/bugtraq/2016/Mar/61
|
||||
|
||||
Signed-off-by: Oliver Neukum <ONeukum@suse.com>
|
||||
|
||||
v1 - added sanity checks
|
||||
v2 - moved them to probe() to fix problems Johan pointed out
|
||||
---
|
||||
drivers/usb/serial/digi_acceleport.c | 24 +++++++++++++++++++-----
|
||||
1 file changed, 19 insertions(+), 5 deletions(-)
|
||||
|
||||
diff --git a/drivers/usb/serial/digi_acceleport.c b/drivers/usb/serial/digi_acceleport.c
|
||||
index 12b0e67..dab1dcf 100644
|
||||
--- a/drivers/usb/serial/digi_acceleport.c
|
||||
+++ b/drivers/usb/serial/digi_acceleport.c
|
||||
@@ -1252,7 +1252,8 @@ static int digi_port_init(struct usb_serial_port *port, unsigned port_num)
|
||||
static int digi_startup(struct usb_serial *serial)
|
||||
{
|
||||
struct digi_serial *serial_priv;
|
||||
- int ret;
|
||||
+ int ret = -ENODEV;
|
||||
+ int i;
|
||||
|
||||
serial_priv = kzalloc(sizeof(*serial_priv), GFP_KERNEL);
|
||||
if (!serial_priv)
|
||||
@@ -1260,18 +1261,31 @@ static int digi_startup(struct usb_serial *serial)
|
||||
|
||||
spin_lock_init(&serial_priv->ds_serial_lock);
|
||||
serial_priv->ds_oob_port_num = serial->type->num_ports;
|
||||
+
|
||||
+ /* Check whether the expected number of ports matches the device */
|
||||
+ if (serial->num_ports < serial_priv->ds_oob_port_num)
|
||||
+ goto error;
|
||||
+ /* all features must be present */
|
||||
+ for (i = 0; i < serial->type->num_ports + 1 ; i++) {
|
||||
+ if (!serial->port[i]->read_urb)
|
||||
+ goto error;
|
||||
+ if (!serial->port[i]->write_urb)
|
||||
+ goto error;
|
||||
+ }
|
||||
+
|
||||
serial_priv->ds_oob_port = serial->port[serial_priv->ds_oob_port_num];
|
||||
|
||||
ret = digi_port_init(serial_priv->ds_oob_port,
|
||||
serial_priv->ds_oob_port_num);
|
||||
- if (ret) {
|
||||
- kfree(serial_priv);
|
||||
- return ret;
|
||||
- }
|
||||
+ if (ret)
|
||||
+ goto error;
|
||||
|
||||
usb_set_serial_data(serial, serial_priv);
|
||||
|
||||
return 0;
|
||||
+error:
|
||||
+ kfree(serial_priv);
|
||||
+ return ret;
|
||||
}
|
||||
|
||||
|
||||
--
|
||||
2.1.4
|
||||
22
kernel.spec
22
kernel.spec
|
|
@ -67,9 +67,9 @@ Summary: The Linux kernel
|
|||
# The next upstream release sublevel (base_sublevel+1)
|
||||
%define upstream_sublevel %(echo $((%{base_sublevel} + 1)))
|
||||
# The rc snapshot level
|
||||
%define rcrev 2
|
||||
%define rcrev 3
|
||||
# The git snapshot level
|
||||
%define gitrev 4
|
||||
%define gitrev 0
|
||||
# Set rpm version accordingly
|
||||
%define rpmversion 4.%{upstream_sublevel}.0
|
||||
%endif
|
||||
|
|
@ -125,7 +125,7 @@ Summary: The Linux kernel
|
|||
# Set debugbuildsenabled to 1 for production (build separate debug kernels)
|
||||
# and 0 for rawhide (all kernels are debug kernels).
|
||||
# See also 'make debug' and 'make release'.
|
||||
%define debugbuildsenabled 0
|
||||
%define debugbuildsenabled 1
|
||||
|
||||
# Want to build a vanilla kernel build without any non-upstream patches?
|
||||
%define with_vanilla %{?_with_vanilla: 1} %{?!_with_vanilla: 0}
|
||||
|
|
@ -608,27 +608,15 @@ Patch571: ideapad-laptop-Add-Lenovo-ideapad-Y700-17ISK-to-no_h.patch
|
|||
#Required for some persistent memory options
|
||||
Patch641: disable-CONFIG_EXPERT-for-ZONE_DMA.patch
|
||||
|
||||
#rhbz 1316136
|
||||
Patch663: USB-serial-ftdi_sio-Add-support-for-ICP-DAS-I-756xU-.patch
|
||||
|
||||
#CVE-2016-3134 rhbz 1317383 1317384
|
||||
Patch665: netfilter-x_tables-deal-with-bogus-nextoffset-values.patch
|
||||
|
||||
#CVE-2016-3137 rhbz 1317010 1316996
|
||||
Patch672: cypress_m8-add-sanity-checking.patch
|
||||
|
||||
#CVE-2016-3140 rhbz 1317010 1316995
|
||||
Patch677: digi_acceleport-do-sanity-checking-for-the-number-of.patch
|
||||
|
||||
#rhbz 1315013
|
||||
Patch683: 0001-uas-Limit-qdepth-at-the-scsi-host-level.patch
|
||||
|
||||
#CVE-2016-2187 rhbz 1317017 1317010
|
||||
Patch686: input-gtco-fix-crash-on-detecting-device-without-end.patch
|
||||
|
||||
#CVE-2016-3136 rhbz 1317007 1317010
|
||||
Patch687: mct_u232-sanity-checking-in-probe.patch
|
||||
|
||||
# END OF PATCH DEFINITIONS
|
||||
|
||||
%endif
|
||||
|
|
@ -2154,6 +2142,10 @@ fi
|
|||
#
|
||||
#
|
||||
%changelog
|
||||
* Mon Apr 11 2016 Josh Boyer <jwboyer@fedoraproject.org> - 4.6.0-0.rc3.git0.1
|
||||
- Linux v4.6-rc3
|
||||
- Disable debugging options.
|
||||
|
||||
* Sun Apr 10 2016 Peter Robinson <pbrobinson@fedoraproject.org>
|
||||
- Use the correct MMC driver for some ARM platforms
|
||||
|
||||
|
|
|
|||
|
|
@ -1,35 +0,0 @@
|
|||
Subject: [PATCH v2] mct_u232: sanity checking in probe
|
||||
From: Oliver Neukum <oneukum@suse.com>
|
||||
Date: 2016-03-21 13:14:37
|
||||
|
||||
An attack using the lack of sanity checking in probe
|
||||
is known. This patch checks for the existance of a
|
||||
second port.
|
||||
CVE-2016-3136
|
||||
|
||||
Signed-off-by: Oliver Neukum <ONeukum@suse.com>
|
||||
CC: stable@vger.kernel.org
|
||||
|
||||
v1 - add sanity check for presence of a second port
|
||||
v2 - add sanity check for an interrupt endpoint
|
||||
---
|
||||
drivers/usb/serial/mct_u232.c | 4 ++++
|
||||
1 file changed, 4 insertions(+)
|
||||
|
||||
diff --git a/drivers/usb/serial/mct_u232.c b/drivers/usb/serial/mct_u232.c
|
||||
index 4446b8d..3e64538 100644
|
||||
--- a/drivers/usb/serial/mct_u232.c
|
||||
+++ b/drivers/usb/serial/mct_u232.c
|
||||
@@ -378,6 +378,10 @@ static int mct_u232_port_probe(struct usb_serial_port *port)
|
||||
{
|
||||
struct mct_u232_private *priv;
|
||||
|
||||
+ /* check first to simplify error handling */
|
||||
+ if (!port->serial->port[1] || !port->serial->port[1]->interrupt_in_urb)
|
||||
+ return -ENODEV;
|
||||
+
|
||||
priv = kzalloc(sizeof(*priv), GFP_KERNEL);
|
||||
if (!priv)
|
||||
return -ENOMEM;
|
||||
--
|
||||
2.1.4
|
||||
Loading…
Reference in New Issue