rpms
/
kernel
2
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Linux v4.5-6486-g6b5f04b6cf8e 

- cgroup, libata, workqueue, block, akpm, usb merges
This commit is contained in:
Josh Boyer 2016-03-19 16:14:02 -04:00
parent 3f7b06675b
commit 8e2d7107d3
12 changed files with 176 additions and 308 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

173
0001-mm-CONFIG_NR_ZONES_EXTENDED.patch
View File

@ -1,173 +0,0 @@
From 8b368e8e961944105945fbe36f3f264252bfd19a Mon Sep 17 00:00:00 2001
From: Dan Williams <dan.j.williams@intel.com>
Date: Thu, 25 Feb 2016 01:02:30 +0000
Subject: [PATCH] mm: CONFIG_NR_ZONES_EXTENDED
ZONE_DEVICE (merged in 4.3) and ZONE_CMA (proposed) are examples of new mm
zones that are bumping up against the current maximum limit of 4 zones,
i.e. 2 bits in page->flags. When adding a zone this equation still needs
to be satisified:
SECTIONS_WIDTH + ZONES_WIDTH + NODES_SHIFT + LAST_CPUPID_SHIFT
<= BITS_PER_LONG - NR_PAGEFLAGS
ZONE_DEVICE currently tries to satisfy this equation by requiring that
ZONE_DMA be disabled, but this is untenable given generic kernels want to
support ZONE_DEVICE and ZONE_DMA simultaneously. ZONE_CMA would like to
increase the amount of memory covered per section, but that limits the
minimum granularity at which consecutive memory ranges can be added via
devm_memremap_pages().
The trade-off of what is acceptable to sacrifice depends heavily on the
platform. For example, ZONE_CMA is targeted for 32-bit platforms where
page->flags is constrained, but those platforms likely do not care about
the minimum granularity of memory hotplug. A big iron machine with 1024
numa nodes can likely sacrifice ZONE_DMA where a general purpose
distribution kernel can not.
CONFIG_NR_ZONES_EXTENDED is a configuration symbol that gets selected when
the number of configured zones exceeds 4. It documents the configuration
symbols and definitions that get modified when ZONES_WIDTH is greater than
2.
For now, it steals a bit from NODES_SHIFT. Later on it can be used to
document the definitions that get modified when a 32-bit configuration
wants more zone bits.
Note that GFP_ZONE_TABLE poses an interesting constraint since
include/linux/gfp.h gets included by the 32-bit portion of a 64-bit build.
We need to be careful to only build the table for zones that have a
corresponding gfp_t flag. GFP_ZONES_SHIFT is introduced for this purpose.
This patch does not attempt to solve the problem of adding a new zone
that also has a corresponding GFP_ flag.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=110931
Fixes: 033fbae988fc ("mm: ZONE_DEVICE for "device memory"")
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Reported-by: Mark <markk@clara.co.uk>
Cc: Mel Gorman <mgorman@suse.de>
Cc: Rik van Riel <riel@redhat.com>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---
arch/x86/Kconfig | 6 ++++--
include/linux/gfp.h | 33 ++++++++++++++++++++-------------
include/linux/page-flags-layout.h | 2 ++
mm/Kconfig | 7 +++++--
4 files changed, 31 insertions(+), 17 deletions(-)
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 3fef519..b94704a 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -1409,8 +1409,10 @@ config NUMA_EMU
config NODES_SHIFT
int "Maximum NUMA Nodes (as a power of 2)" if !MAXSMP
- range 1 10
- default "10" if MAXSMP
+ range 1 10 if !NR_ZONES_EXTENDED
+ range 1 9 if NR_ZONES_EXTENDED
+ default "10" if MAXSMP && !NR_ZONES_EXTENDED
+ default "9" if MAXSMP && NR_ZONES_EXTENDED
default "6" if X86_64
default "3"
depends on NEED_MULTIPLE_NODES
diff --git a/include/linux/gfp.h b/include/linux/gfp.h
index af1f2b2..d201d8a 100644
--- a/include/linux/gfp.h
+++ b/include/linux/gfp.h
@@ -329,22 +329,29 @@ static inline bool gfpflags_allow_blocking(const gfp_t gfp_flags)
* 0xe => BAD (MOVABLE+DMA32+HIGHMEM)
* 0xf => BAD (MOVABLE+DMA32+HIGHMEM+DMA)
*
- * ZONES_SHIFT must be <= 2 on 32 bit platforms.
+ * GFP_ZONES_SHIFT must be <= 2 on 32 bit platforms.
*/
-#if 16 * ZONES_SHIFT > BITS_PER_LONG
-#error ZONES_SHIFT too large to create GFP_ZONE_TABLE integer
+#if defined(CONFIG_ZONE_DEVICE) && (MAX_NR_ZONES-1) <= 4
+/* ZONE_DEVICE is not a valid GFP zone specifier */
+#define GFP_ZONES_SHIFT 2
+#else
+#define GFP_ZONES_SHIFT ZONES_SHIFT
+#endif
+
+#if 16 * GFP_ZONES_SHIFT > BITS_PER_LONG
+#error GFP_ZONES_SHIFT too large to create GFP_ZONE_TABLE integer
#endif
#define GFP_ZONE_TABLE ( \
- (ZONE_NORMAL << 0 * ZONES_SHIFT) \
- | (OPT_ZONE_DMA << ___GFP_DMA * ZONES_SHIFT) \
- | (OPT_ZONE_HIGHMEM << ___GFP_HIGHMEM * ZONES_SHIFT) \
- | (OPT_ZONE_DMA32 << ___GFP_DMA32 * ZONES_SHIFT) \
- | (ZONE_NORMAL << ___GFP_MOVABLE * ZONES_SHIFT) \
- | (OPT_ZONE_DMA << (___GFP_MOVABLE | ___GFP_DMA) * ZONES_SHIFT) \
- | (ZONE_MOVABLE << (___GFP_MOVABLE | ___GFP_HIGHMEM) * ZONES_SHIFT) \
- | (OPT_ZONE_DMA32 << (___GFP_MOVABLE | ___GFP_DMA32) * ZONES_SHIFT) \
+ (ZONE_NORMAL << 0 * GFP_ZONES_SHIFT) \
+ | (OPT_ZONE_DMA << ___GFP_DMA * GFP_ZONES_SHIFT) \
+ | (OPT_ZONE_HIGHMEM << ___GFP_HIGHMEM * GFP_ZONES_SHIFT) \
+ | (OPT_ZONE_DMA32 << ___GFP_DMA32 * GFP_ZONES_SHIFT) \
+ | (ZONE_NORMAL << ___GFP_MOVABLE * GFP_ZONES_SHIFT) \
+ | (OPT_ZONE_DMA << (___GFP_MOVABLE | ___GFP_DMA) * GFP_ZONES_SHIFT) \
+ | (ZONE_MOVABLE << (___GFP_MOVABLE | ___GFP_HIGHMEM) * GFP_ZONES_SHIFT) \
+ | (OPT_ZONE_DMA32 << (___GFP_MOVABLE | ___GFP_DMA32) * GFP_ZONES_SHIFT) \
)
/*
@@ -369,8 +376,8 @@ static inline enum zone_type gfp_zone(gfp_t flags)
enum zone_type z;
int bit = (__force int) (flags & GFP_ZONEMASK);
- z = (GFP_ZONE_TABLE >> (bit * ZONES_SHIFT)) &
- ((1 << ZONES_SHIFT) - 1);
+ z = (GFP_ZONE_TABLE >> (bit * GFP_ZONES_SHIFT)) &
+ ((1 << GFP_ZONES_SHIFT) - 1);
VM_BUG_ON((GFP_ZONE_BAD >> bit) & 1);
return z;
}
diff --git a/include/linux/page-flags-layout.h b/include/linux/page-flags-layout.h
index da52366..77b078c 100644
--- a/include/linux/page-flags-layout.h
+++ b/include/linux/page-flags-layout.h
@@ -17,6 +17,8 @@
#define ZONES_SHIFT 1
#elif MAX_NR_ZONES <= 4
#define ZONES_SHIFT 2
+#elif MAX_NR_ZONES <= 8
+#define ZONES_SHIFT 3
#else
#error ZONES_SHIFT -- too many zones configured adjust calculation
#endif
diff --git a/mm/Kconfig b/mm/Kconfig
index 031a329..7826216 100644
--- a/mm/Kconfig
+++ b/mm/Kconfig
@@ -652,8 +652,6 @@ config IDLE_PAGE_TRACKING
config ZONE_DEVICE
bool "Device memory (pmem, etc...) hotplug support"
- default !ZONE_DMA
- depends on !ZONE_DMA
depends on MEMORY_HOTPLUG
depends on MEMORY_HOTREMOVE
depends on X86_64 #arch_add_memory() comprehends device memory
@@ -667,5 +665,10 @@ config ZONE_DEVICE
If FS_DAX is enabled, then say Y.
+config NR_ZONES_EXTENDED
+ bool
+ default n if !64BIT
+ default y if ZONE_DEVICE && ZONE_DMA && ZONE_DMA32
+
config FRAME_VECTOR
bool
--
2.5.0

31
ALSA-hda-Fix-forgotten-HDMI-monitor_present-update.patch Normal file
View File

@ -0,0 +1,31 @@
From e36b3efcd07ab5c323e82319577d972ebddcbed1 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Fri, 18 Mar 2016 18:01:53 +0100
Subject: [PATCH 2/3] ALSA: hda - Fix forgotten HDMI monitor_present update
We forgot to copy monitor_present value when updating the ELD
information. This won't change the ELD retrieval and the jack
notification behavior, but appears only in the proc output. In that
sense, it's no fatal error, but a bug is a bug is a bug.
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
---
sound/pci/hda/patch_hdmi.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
index 8cdb804aa9cf..e7d9453ecd10 100644
--- a/sound/pci/hda/patch_hdmi.c
+++ b/sound/pci/hda/patch_hdmi.c
@@ -1358,6 +1358,7 @@ static void update_eld(struct hda_codec *codec,
eld->eld_size) != 0)
eld_changed = true;
+ pin_eld->monitor_present = eld->monitor_present;
pin_eld->eld_valid = eld->eld_valid;
pin_eld->eld_size = eld->eld_size;
if (eld->eld_valid)
--
2.5.0

44
ALSA-hda-Fix-spurious-kernel-WARNING-on-Baytrail-HDM.patch Normal file
View File

@ -0,0 +1,44 @@
From 1f2109de8368f08a353d7862f462b943a5ac4b4a Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Fri, 18 Mar 2016 19:45:13 +0100
Subject: [PATCH 3/3] ALSA: hda - Fix spurious kernel WARNING on Baytrail HDMI
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
snd_hdac_sync_audio_rate() call is mandatory only for HSW and later
models, but we call the function unconditionally blindly assuming that
the function doesn't do anything harmful. But since recently, the
function checks the validity of the passed pin NID, and eventually
spews the warning if an unexpected pin is passed. This is seen on old
chips like Baytrail.
The fix is to limit the call of this function again only for the chips
with the proper binding. This can be identified by the same flag as
the eld notifier.
Reported-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Tested-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Cc: <stable@vger.kernel.org> # v4.5
Signed-off-by: Takashi Iwai <tiwai@suse.de>
---
sound/pci/hda/patch_hdmi.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
index e7d9453ecd10..56d3575ee6cc 100644
--- a/sound/pci/hda/patch_hdmi.c
+++ b/sound/pci/hda/patch_hdmi.c
@@ -1741,7 +1741,8 @@ static int generic_hdmi_playback_pcm_prepare(struct hda_pcm_stream *hinfo,
/* Call sync_audio_rate to set the N/CTS/M manually if necessary */
/* Todo: add DP1.2 MST audio support later */
- snd_hdac_sync_audio_rate(&codec->bus->core, pin_nid, runtime->rate);
+ if (codec_has_acomp(codec))
+ snd_hdac_sync_audio_rate(&codec->bus->core, pin_nid, runtime->rate);
non_pcm = check_non_pcm_per_cvt(codec, cvt_nid);
mutex_lock(&per_pin->lock);
--
2.5.0

80
ALSA-hda-Really-restrict-i915-notifier-to-HSW.patch Normal file
View File

@ -0,0 +1,80 @@
From 3fb329b2c3b6c2f009aa1255d2436ec49e49877f Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Fri, 18 Mar 2016 15:10:08 +0100
Subject: [PATCH 1/3] ALSA: hda - Really restrict i915 notifier to HSW+
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
The commit [b62232d429fa: ALSA: hda - Limit i915 HDMI binding only for
HSW and later] tried to limit the usage of i915 audio notifier to the
recent Intel models and switch to the old method on pre-Haswell
models. However, it assumed that the i915 component binding hasn't
been done on such models, and the assumption was wrong: namely,
Baytrail had already the i915 component binding due to powerwell
control. Thus, the workaround wasn't applied to Baytrail.
For fixing this properly, this patch introduces a new flag indicating
the usage of audio notifier and codec_has_acomp() refers to this flag
instead of checking the existence of audio component.
Reported-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Cc: <stable@vger.kernel.org> # v4.5
Signed-off-by: Takashi Iwai <tiwai@suse.de>
---
sound/pci/hda/patch_hdmi.c | 24 +++++++++++++++++-------
1 file changed, 17 insertions(+), 7 deletions(-)
diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
index 49ee4e55dd16..8cdb804aa9cf 100644
--- a/sound/pci/hda/patch_hdmi.c
+++ b/sound/pci/hda/patch_hdmi.c
@@ -152,6 +152,7 @@ struct hdmi_spec {
struct hda_pcm_stream pcm_playback;
/* i915/powerwell (Haswell+/Valleyview+) specific */
+ bool use_acomp_notifier; /* use i915 eld_notify callback for hotplug */
struct i915_audio_component_audio_ops i915_audio_ops;
bool i915_bound; /* was i915 bound in this driver? */
@@ -159,8 +160,11 @@ struct hdmi_spec {
};
#ifdef CONFIG_SND_HDA_I915
-#define codec_has_acomp(codec) \
- ((codec)->bus->core.audio_component != NULL)
+static inline bool codec_has_acomp(struct hda_codec *codec)
+{
+ struct hdmi_spec *spec = codec->spec;
+ return spec->use_acomp_notifier;
+}
#else
#define codec_has_acomp(codec) false
#endif
@@ -2248,12 +2252,18 @@ static int patch_generic_hdmi(struct hda_codec *codec)
codec->spec = spec;
hdmi_array_init(spec, 4);
+#ifdef CONFIG_SND_HDA_I915
/* Try to bind with i915 for Intel HSW+ codecs (if not done yet) */
- if (!codec_has_acomp(codec) &&
- (codec->core.vendor_id >> 16) == 0x8086 &&
- is_haswell_plus(codec))
- if (!snd_hdac_i915_init(&codec->bus->core))
- spec->i915_bound = true;
+ if ((codec->core.vendor_id >> 16) == 0x8086 &&
+ is_haswell_plus(codec)) {
+ if (!codec->bus->core.audio_component)
+ if (!snd_hdac_i915_init(&codec->bus->core))
+ spec->i915_bound = true;
+ /* use i915 audio component notifier for hotplug */
+ if (codec->bus->core.audio_component)
+ spec->use_acomp_notifier = true;
+ }
+#endif
if (is_haswell_plus(codec)) {
intel_haswell_enable_all_pins(codec, true);
--
2.5.0

40
USB-iowarrior-fix-oops-with-malicious-USB-descriptor.patch
View File

@ -1,40 +0,0 @@
From 3620ebad64a327113bed34edefd45c3605086fc6 Mon Sep 17 00:00:00 2001
From: Josh Boyer <jwboyer@fedoraproject.org>
Date: Mon, 14 Mar 2016 10:38:31 -0400
Subject: [PATCH] USB: iowarrior: fix oops with malicious USB descriptors
The iowarrior driver expects at least one valid endpoint. If given
malicious descriptors that specify 0 for the number of endpoints,
it will crash in the probe function. Ensure there is at least
one endpoint on the interface before using it.
The full report of this issue can be found here:
http://seclists.org/bugtraq/2016/Mar/87
Reported-by: Ralf Spenneberg <ralf@spenneberg.net>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org>
---
drivers/usb/misc/iowarrior.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c
index c6bfd13f6c92..1950e87b4219 100644
--- a/drivers/usb/misc/iowarrior.c
+++ b/drivers/usb/misc/iowarrior.c
@@ -787,6 +787,12 @@ static int iowarrior_probe(struct usb_interface *interface,
iface_desc = interface->cur_altsetting;
dev->product_id = le16_to_cpu(udev->descriptor.idProduct);
+ if (iface_desc->desc.bNumEndpoints < 1) {
+ dev_err(&interface->dev, "Invalid number of endpoints\n");
+ retval = -EINVAL;
+ goto error;
+ }
+
/* set up the endpoint information */
for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
endpoint = &iface_desc->endpoint[i].desc;
--
2.5.0

33
cdc-acm-more-sanity-checking.patch
View File

@ -1,33 +0,0 @@
From e6a87f147002fa16adcbafebbc458ff90a463474 Mon Sep 17 00:00:00 2001
From: Oliver Neukum <oneukum@suse.com>
Date: Tue, 15 Mar 2016 10:14:04 +0100
Subject: [PATCH] cdc-acm: more sanity checking
An attack has become available which pretends to be a quirky
device circumventing normal sanity checks and crashes the kernel
by an insufficient number of interfaces. This patch adds a check
to the code path for quirky devices.
Signed-off-by: Oliver Neukum <ONeukum@suse.com>
CC: stable@vger.kernel.org
---
drivers/usb/class/cdc-acm.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 26ca4f910cb0..a7732f80a912 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1113,6 +1113,9 @@ static int acm_probe(struct usb_interface *intf,
if (quirks == NO_UNION_NORMAL) {
data_interface = usb_ifnum_to_if(usb_dev, 1);
control_interface = usb_ifnum_to_if(usb_dev, 0);
+ /* we would crash */
+ if (!data_interface || !control_interface)
+ return -ENODEV;
goto skip_normal_probe;
}
--
2.5.0

3
config-generic
View File

@ -4886,6 +4886,7 @@ CONFIG_LATENCYTOP=y
# CONFIG_DEBUG_BLOCK_EXT_DEVT is not set
CONFIG_EARLY_PRINTK_DBGP=y
# CONFIG_PAGE_POISONING is not set
# CONFIG_DEBUG_PAGE_REF is not set
CONFIG_CRASH=m
CONFIG_CRASH_DUMP=y
# CONFIG_GCOV_KERNEL is not set
@ -5748,7 +5749,7 @@ CONFIG_ZBUD=y
CONFIG_ZSMALLOC=y
# CONFIG_ZSMALLOC_STAT is not set
# CONFIG_PGTABLE_MAPPING is not set
# CONFIG_DEFERRED_STRUCT_PAGE_INIT is not set
# CONFIG_IDLE_PAGE_TRACKING is not set
# CONFIG_MDIO_GPIO is not set

16
disable-CONFIG_EXPERT-for-ZONE_DMA.patch
View File

@ -1,4 +1,4 @@
From 888ba9b2a02e8d144c3a9ae5e01a1a94280cd2bf Mon Sep 17 00:00:00 2001
From 78bd7226c92c8309d1c6c1378f1224dcd591b49f Mon Sep 17 00:00:00 2001
From: Fedora Kernel Team <kernel-team@fedoraproject.org>
Date: Fri, 22 Jan 2016 13:03:36 -0600
Subject: [PATCH] Make ZONE_DMA not depend on CONFIG_EXPERT
@ -13,12 +13,12 @@ Signed-off-by: Justin Forbes <jforbes@fedoraproject.org>
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index a02c842..ea2eaeb 100644
index 3c74b549ea9a..8a5b7b8cc425 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -315,7 +315,7 @@ source "kernel/Kconfig.freezer"
@@ -318,7 +318,7 @@ source "kernel/Kconfig.freezer"
menu "Processor type and features"
config ZONE_DMA
- bool "DMA memory allocation support" if EXPERT
+ bool "DMA memory allocation support"
@ -26,18 +26,18 @@ index a02c842..ea2eaeb 100644
help
DMA memory allocation support allows devices with less than 32-bit
diff --git a/mm/Kconfig b/mm/Kconfig
index 97a4e06..26bbbe0 100644
index 05efa6a5199e..c1a01e50c293 100644
--- a/mm/Kconfig
+++ b/mm/Kconfig
@@ -650,7 +650,7 @@ config IDLE_PAGE_TRACKING
See Documentation/vm/idle_page_tracking.txt for more details.
config ZONE_DEVICE
- bool "Device memory (pmem, etc...) hotplug support" if EXPERT
+ bool "Device memory (pmem, etc...) hotplug support"
default !ZONE_DMA
depends on !ZONE_DMA
depends on MEMORY_HOTPLUG
depends on MEMORY_HOTREMOVE
depends on SPARSEMEM_VMEMMAP
--
2.5.0

2
gitrev
View File

@ -1 +1 @@
f7813ad5cbfd1fab2899914281b72a1ba0805c80
6b5f04b6cf8ebab9a65d9c0026c650bb2538fd0f

22
kernel.spec
View File

@ -69,7 +69,7 @@ Summary: The Linux kernel
# The rc snapshot level
%define rcrev 0
# The git snapshot level
%define gitrev 11
%define gitrev 12
# Set rpm version accordingly
%define rpmversion 4.%{upstream_sublevel}.0
%endif
@ -608,9 +608,6 @@ Patch621: drm-udl-Use-unlocked-gem-unreferencing.patch
#Required for some persistent memory options
Patch641: disable-CONFIG_EXPERT-for-ZONE_DMA.patch
#rhbz 1309658
Patch648: 0001-mm-CONFIG_NR_ZONES_EXTENDED.patch
#rhbz 1316136
Patch663: USB-serial-ftdi_sio-Add-support-for-ICP-DAS-I-756xU-.patch
@ -631,20 +628,15 @@ Patch668: x86-tsc-Prevent-NULL-pointer-deref-in-calibrate_dela.patch
#CVE-2016-3137 rhbz 1317010 1316996
Patch672: cypress_m8-add-sanity-checking.patch
#CVE-2016-2188 rhbz 1317018 1317467
Patch674: USB-iowarrior-fix-oops-with-malicious-USB-descriptor.patch
#CVE-2016-2185 rhbz 1317014 1317471
Patch675: usb_driver_claim_interface-add-sanity-checking.patch
#CVE-2016-3138 rhbz 1317010 1316204
Patch676: cdc-acm-more-sanity-checking.patch
#CVE-2016-3140 rhbz 1317010 1316995
Patch677: digi_acceleport-do-sanity-checking-for-the-number-of.patch
Patch678: ims-pcu-sanity-check-against-missing-interfaces.patch
Patch680: ALSA-hda-Really-restrict-i915-notifier-to-HSW.patch
Patch681: ALSA-hda-Fix-forgotten-HDMI-monitor_present-update.patch
Patch682: ALSA-hda-Fix-spurious-kernel-WARNING-on-Baytrail-HDM.patch
# END OF PATCH DEFINITIONS
%endif
@ -2167,6 +2159,10 @@ fi
#
#
%changelog
* Sat Mar 19 2016 Josh Boyer <jwboyer@fedoraproject.org> - 4.6.0-0.rc0.git12.1
- Linux v4.5-6486-g6b5f04b6cf8e
- cgroup, libata, workqueue, block, akpm, usb merges
* Sat Mar 19 2016 Peter Robinson <pbrobinson@fedoraproject.org>
- Minor ARM cleanups
- Drop ARM_PATCH_IDIV work around

1
sources
View File

@ -1,3 +1,4 @@
a60d48eee08ec0536d5efb17ca819aef linux-4.5.tar.xz
6f557fe90b800b615c85c2ca04da6154 perf-man-4.5.tar.gz
085abf64e5402f2b588b9c64f09a6f44 patch-4.5-git11.xz
54b8c38a01b8b328cb65758b15e1b972 patch-4.5-git12.xz

39
usb_driver_claim_interface-add-sanity-checking.patch
View File

@ -1,39 +0,0 @@
From de0784bdf6314b70c69416d8c576eb83237d5b1e Mon Sep 17 00:00:00 2001
From: Oliver Neukum <oneukum@suse.com>
Date: Wed, 16 Mar 2016 12:26:17 -0400
Subject: [PATCH] usb_driver_claim_interface: add sanity checking
Attacks that trick drivers into passing a NULL pointer
to usb_driver_claim_interface() using forged descriptors are
known. This thwarts them by sanity checking.
Signed-off-by: Oliver Neukum <ONeukum@suse.com>
CC: stable@vger.kernel.org
---
drivers/usb/core/driver.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
index 6b5063e7943f..e2d242b68d4b 100644
--- a/drivers/usb/core/driver.c
+++ b/drivers/usb/core/driver.c
@@ -500,11 +500,15 @@ static int usb_unbind_interface(struct device *dev)
int usb_driver_claim_interface(struct usb_driver *driver,
struct usb_interface *iface, void *priv)
{
- struct device *dev = &iface->dev;
+ struct device *dev;
struct usb_device *udev;
int retval = 0;
int lpm_disable_error;
+ if (!iface)
+ return -ENODEV;
+
+ dev = &iface->dev;
if (dev->driver)
return -EBUSY;
--
2.5.0