Linux v4.12.9
This commit is contained in:
Justin M. Forbes
parent
9ee85faed7
commit
b842984e58
|
|
@ -1,73 +0,0 @@
|
|||
From caa7919d0402b9ebe40ac3f5228c31e28a933327 Mon Sep 17 00:00:00 2001
|
||||
From: Laura Abbott <labbott@redhat.com>
|
||||
Date: Wed, 16 Aug 2017 14:56:31 -0700
|
||||
Subject: [PATCH] mm/vmalloc: Don't unconditonally use __GFP_HIGHMEM
|
||||
To: Andrew Morton <akpm@linux-foundation.org>
|
||||
To: Michal Hocko <mhocko@suse.com>
|
||||
To: Vlastimil Babka <vbabka@suse.cz>
|
||||
To: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
|
||||
Cc: linux-mm@kvack.org
|
||||
Cc: linux-kernel@vger.kernel.org
|
||||
|
||||
Commit 19809c2da28a ("mm, vmalloc: use __GFP_HIGHMEM implicitly")
|
||||
added use of __GFP_HIGHMEM for allocations. vmalloc_32 may use
|
||||
GFP_DMA/GFP_DMA32 which does not play nice with __GFP_HIGHMEM
|
||||
and will drigger a BUG in gfp_zone. Only add __GFP_HIGHMEM if
|
||||
we aren't using GFP_DMA/GFP_DMA32.
|
||||
|
||||
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1482249
|
||||
Fixes: 19809c2da28a ("mm, vmalloc: use __GFP_HIGHMEM implicitly")
|
||||
Signed-off-by: Laura Abbott <labbott@redhat.com>
|
||||
---
|
||||
mm/vmalloc.c | 13 ++++++++-----
|
||||
1 file changed, 8 insertions(+), 5 deletions(-)
|
||||
|
||||
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
|
||||
index 8698c1c86c4d..a47e3894c775 100644
|
||||
--- a/mm/vmalloc.c
|
||||
+++ b/mm/vmalloc.c
|
||||
@@ -1671,7 +1671,10 @@ static void *__vmalloc_area_node(struct vm_struct *area, gfp_t gfp_mask,
|
||||
struct page **pages;
|
||||
unsigned int nr_pages, array_size, i;
|
||||
const gfp_t nested_gfp = (gfp_mask & GFP_RECLAIM_MASK) | __GFP_ZERO;
|
||||
- const gfp_t alloc_mask = gfp_mask | __GFP_HIGHMEM | __GFP_NOWARN;
|
||||
+ const gfp_t alloc_mask = gfp_mask | __GFP_NOWARN;
|
||||
+ const gfp_t highmem_mask = (gfp_mask & (GFP_DMA | GFP_DMA32)) ?
|
||||
+ 0 :
|
||||
+ __GFP_HIGHMEM;
|
||||
|
||||
nr_pages = get_vm_area_size(area) >> PAGE_SHIFT;
|
||||
array_size = (nr_pages * sizeof(struct page *));
|
||||
@@ -1679,7 +1682,7 @@ static void *__vmalloc_area_node(struct vm_struct *area, gfp_t gfp_mask,
|
||||
area->nr_pages = nr_pages;
|
||||
/* Please note that the recursion is strictly bounded. */
|
||||
if (array_size > PAGE_SIZE) {
|
||||
- pages = __vmalloc_node(array_size, 1, nested_gfp|__GFP_HIGHMEM,
|
||||
+ pages = __vmalloc_node(array_size, 1, nested_gfp|highmem_mask,
|
||||
PAGE_KERNEL, node, area->caller);
|
||||
} else {
|
||||
pages = kmalloc_node(array_size, nested_gfp, node);
|
||||
@@ -1700,9 +1703,9 @@ static void *__vmalloc_area_node(struct vm_struct *area, gfp_t gfp_mask,
|
||||
}
|
||||
|
||||
if (node == NUMA_NO_NODE)
|
||||
- page = alloc_page(alloc_mask);
|
||||
+ page = alloc_page(alloc_mask|highmem_mask);
|
||||
else
|
||||
- page = alloc_pages_node(node, alloc_mask, 0);
|
||||
+ page = alloc_pages_node(node, alloc_mask|highmem_mask, 0);
|
||||
|
||||
if (unlikely(!page)) {
|
||||
/* Successfully allocated i pages, free them in __vunmap() */
|
||||
@@ -1710,7 +1713,7 @@ static void *__vmalloc_area_node(struct vm_struct *area, gfp_t gfp_mask,
|
||||
goto fail;
|
||||
}
|
||||
area->pages[i] = page;
|
||||
- if (gfpflags_allow_blocking(gfp_mask))
|
||||
+ if (gfpflags_allow_blocking(gfp_mask|highmem_mask))
|
||||
cond_resched();
|
||||
}
|
||||
|
||||
--
|
||||
2.13.0
|
||||
|
||||
|
|
@ -1,41 +0,0 @@
|
|||
From 4bcc0c3835cbcc9f9c175f158e2ee502506b6e02 Mon Sep 17 00:00:00 2001
|
||||
From: Fedora Kernel Team <kernel-team@fedoraproject.org>
|
||||
Date: Thu, 3 Aug 2017 13:53:11 -0500
|
||||
Subject: [PATCH] Back out qxl atomic delay
|
||||
|
||||
---
|
||||
drivers/gpu/drm/qxl/qxl_display.c | 4 ++--
|
||||
1 file changed, 2 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c
|
||||
index 4a340ef..058340a 100644
|
||||
--- a/drivers/gpu/drm/qxl/qxl_display.c
|
||||
+++ b/drivers/gpu/drm/qxl/qxl_display.c
|
||||
@@ -575,6 +575,8 @@ static void qxl_cursor_atomic_update(struct drm_plane *plane,
|
||||
if (ret)
|
||||
return;
|
||||
|
||||
+ cmd = (struct qxl_cursor_cmd *) qxl_release_map(qdev, release);
|
||||
+
|
||||
if (fb != old_state->fb) {
|
||||
obj = to_qxl_framebuffer(fb)->obj;
|
||||
user_bo = gem_to_qxl_bo(obj);
|
||||
@@ -612,7 +614,6 @@ static void qxl_cursor_atomic_update(struct drm_plane *plane,
|
||||
qxl_bo_kunmap(cursor_bo);
|
||||
qxl_bo_kunmap(user_bo);
|
||||
|
||||
- cmd = (struct qxl_cursor_cmd *) qxl_release_map(qdev, release);
|
||||
cmd->u.set.visible = 1;
|
||||
cmd->u.set.shape = qxl_bo_physical_address(qdev,
|
||||
cursor_bo, 0);
|
||||
@@ -623,7 +624,6 @@ static void qxl_cursor_atomic_update(struct drm_plane *plane,
|
||||
if (ret)
|
||||
goto out_free_release;
|
||||
|
||||
- cmd = (struct qxl_cursor_cmd *) qxl_release_map(qdev, release);
|
||||
cmd->type = QXL_CURSOR_MOVE;
|
||||
}
|
||||
|
||||
--
|
||||
2.13.3
|
||||
|
||||
|
|
@ -1,22 +0,0 @@
|
|||
From fc6a72140ef515447743c840674b1aa86b1a4812 Mon Sep 17 00:00:00 2001
|
||||
From: Fedora Kernel Team <kernel-team@fedoraproject.org>
|
||||
Date: Tue, 25 Jul 2017 12:38:46 -0500
|
||||
Subject: [PATCH] Force python3 in kvm_stat
|
||||
|
||||
---
|
||||
tools/kvm/kvm_stat/kvm_stat | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/tools/kvm/kvm_stat/kvm_stat b/tools/kvm/kvm_stat/kvm_stat
|
||||
index 8f74ed8..12a8cbb 100755
|
||||
--- a/tools/kvm/kvm_stat/kvm_stat
|
||||
+++ b/tools/kvm/kvm_stat/kvm_stat
|
||||
@@ -1,4 +1,4 @@
|
||||
-#!/usr/bin/python
|
||||
+#!/usr/bin/python3
|
||||
#
|
||||
# top-like utility for displaying kvm statistics
|
||||
#
|
||||
--
|
||||
2.9.4
|
||||
|
||||
29
kernel.spec
29
kernel.spec
|
|
@ -54,7 +54,7 @@ Summary: The Linux kernel
|
|||
%if 0%{?released_kernel}
|
||||
|
||||
# Do we have a -stable update to apply?
|
||||
%define stable_update 8
|
||||
%define stable_update 9
|
||||
# Set rpm version accordingly
|
||||
%if 0%{?stable_update}
|
||||
%define stablerev %{stable_update}
|
||||
|
|
@ -548,9 +548,6 @@ Patch122: Input-synaptics-pin-3-touches-when-the-firmware-repo.patch
|
|||
|
||||
Patch123: firmware-Drop-WARN-from-usermodehelper_read_trylock-.patch
|
||||
|
||||
# Because the python 3 transition is fail
|
||||
Patch124: force-python3-in-kvm_stat.patch
|
||||
|
||||
# 200 - x86 / secureboot
|
||||
|
||||
Patch201: efi-lockdown.patch
|
||||
|
|
@ -672,17 +669,17 @@ Patch704: input-rmi4-remove-the-need-for-artifical-IRQ.patch
|
|||
# rhbz 1476467
|
||||
Patch706: Fix-for-module-sig-verification.patch
|
||||
|
||||
# rhbz 1462381
|
||||
Patch707: Back-out-qxl-atomic-delay.patch
|
||||
|
||||
# CVE-2017-12134 rhbz 1477656 1481786
|
||||
Patch708: xsa229.patch
|
||||
|
||||
# request for bug fix
|
||||
Patch709: iio-race-fix.patch
|
||||
|
||||
# rhbz 1482249 1482570
|
||||
Patch710: 0001-mm-vmalloc-Don-t-unconditonally-use-__GFP_HIGHMEM.patch
|
||||
# rhbz 1485086
|
||||
Patch710: pci-mark-amd-stoney-gpu-ats-as-broken.patch
|
||||
|
||||
# rhbz 1480829
|
||||
Patch711: rt2800-fix-TX_PIN_CFG-setting-for-non-MT7620-chips.patch
|
||||
|
||||
# CVE-2017-7558 rhbz 1480266 1484810
|
||||
Patch712: net-sctp-Avoid-out-of-bounds-reads-from-address-storage.patch
|
||||
|
||||
# END OF PATCH DEFINITIONS
|
||||
|
||||
|
|
@ -823,6 +820,7 @@ Obsoletes: cpufreq-utils < 1:009-0.6.p1
|
|||
Obsoletes: cpufrequtils < 1:009-0.6.p1
|
||||
Obsoletes: cpuspeed < 1:1.5-16
|
||||
Requires: kernel-tools-libs = %{version}-%{release}
|
||||
%define __requires_exclude ^%{_bindir}/python
|
||||
%description -n kernel-tools
|
||||
This package contains the tools/ directory from the kernel source
|
||||
and the supporting documentation.
|
||||
|
|
@ -2257,6 +2255,13 @@ fi
|
|||
#
|
||||
#
|
||||
%changelog
|
||||
* Fri Aug 25 2017 Justin M. Forbes <jforbes@fedoraproject.org> - 4.12.9-300
|
||||
- Linux v4.12.9
|
||||
- For for AMD Stoney GPU (rhbz 1485086)
|
||||
- Fix for RT3573 regression (rhbz 1480829)
|
||||
- Fix for CVE-2017-7558 (rhbz 1480266 1484810)
|
||||
- Fix for kvm_stat (rhbz 1483527)
|
||||
|
||||
* Thu Aug 17 2017 Justin M. Forbes <jforbes@fedoraproject.org>
|
||||
- Fix for vmalloc_32 crash (rhbz 1482249 1482570)
|
||||
|
||||
|
|
|
|||
|
|
@ -0,0 +1,196 @@
|
|||
From patchwork Wed Aug 23 11:27:13 2017
|
||||
Content-Type: text/plain; charset="utf-8"
|
||||
MIME-Version: 1.0
|
||||
Content-Transfer-Encoding: 7bit
|
||||
Subject: [net] sctp: Avoid out-of-bounds reads from address storage
|
||||
From: Stefano Brivio <sbrivio@redhat.com>
|
||||
X-Patchwork-Id: 9917151
|
||||
Message-Id: <7763d91bcf14744e49f09fc4bec0fb22c097774f.1502384055.git.sbrivio@redhat.com>
|
||||
To: "David S . Miller" <davem@davemloft.net>, netdev@vger.kernel.org,
|
||||
linux-kernel@vger.kernel.org, stable@vger.kernel.org
|
||||
Cc: Xin Long <lucien.xin@gmail.com>, Vlad Yasevich <vyasevich@gmail.com>,
|
||||
Neil Horman <nhorman@tuxdriver.com>, linux-sctp@vger.kernel.org
|
||||
Date: Wed, 23 Aug 2017 13:27:13 +0200
|
||||
|
||||
inet_diag_msg_sctp{,l}addr_fill() and sctp_get_sctp_info() copy
|
||||
sizeof(sockaddr_storage) bytes to fill in sockaddr structs used
|
||||
to export diagnostic information to userspace.
|
||||
|
||||
However, the memory allocated to store sockaddr information is
|
||||
smaller than that and depends on the address family, so we leak
|
||||
up to 100 uninitialized bytes to userspace. Just use the size of
|
||||
the source structs instead, in all the three cases this is what
|
||||
userspace expects. Zero out the remaining memory.
|
||||
|
||||
Unused bytes (i.e. when IPv4 addresses are used) in source
|
||||
structs sctp_sockaddr_entry and sctp_transport are already
|
||||
cleared by sctp_add_bind_addr() and sctp_transport_new(),
|
||||
respectively.
|
||||
|
||||
Noticed while testing KASAN-enabled kernel with 'ss':
|
||||
|
||||
[ 2326.885243] BUG: KASAN: slab-out-of-bounds in inet_sctp_diag_fill+0x42c/0x6c0 [sctp_diag] at addr ffff881be8779800
|
||||
[ 2326.896800] Read of size 128 by task ss/9527
|
||||
[ 2326.901564] CPU: 0 PID: 9527 Comm: ss Not tainted 4.11.0-22.el7a.x86_64 #1
|
||||
[ 2326.909236] Hardware name: Dell Inc. PowerEdge R730/072T6D, BIOS 2.4.3 01/17/2017
|
||||
[ 2326.917585] Call Trace:
|
||||
[ 2326.920312] dump_stack+0x63/0x8d
|
||||
[ 2326.924014] kasan_object_err+0x21/0x70
|
||||
[ 2326.928295] kasan_report+0x288/0x540
|
||||
[ 2326.932380] ? inet_sctp_diag_fill+0x42c/0x6c0 [sctp_diag]
|
||||
[ 2326.938500] ? skb_put+0x8b/0xd0
|
||||
[ 2326.942098] ? memset+0x31/0x40
|
||||
[ 2326.945599] check_memory_region+0x13c/0x1a0
|
||||
[ 2326.950362] memcpy+0x23/0x50
|
||||
[ 2326.953669] inet_sctp_diag_fill+0x42c/0x6c0 [sctp_diag]
|
||||
[ 2326.959596] ? inet_diag_msg_sctpasoc_fill+0x460/0x460 [sctp_diag]
|
||||
[ 2326.966495] ? __lock_sock+0x102/0x150
|
||||
[ 2326.970671] ? sock_def_wakeup+0x60/0x60
|
||||
[ 2326.975048] ? remove_wait_queue+0xc0/0xc0
|
||||
[ 2326.979619] sctp_diag_dump+0x44a/0x760 [sctp_diag]
|
||||
[ 2326.985063] ? sctp_ep_dump+0x280/0x280 [sctp_diag]
|
||||
[ 2326.990504] ? memset+0x31/0x40
|
||||
[ 2326.994007] ? mutex_lock+0x12/0x40
|
||||
[ 2326.997900] __inet_diag_dump+0x57/0xb0 [inet_diag]
|
||||
[ 2327.003340] ? __sys_sendmsg+0x150/0x150
|
||||
[ 2327.007715] inet_diag_dump+0x4d/0x80 [inet_diag]
|
||||
[ 2327.012979] netlink_dump+0x1e6/0x490
|
||||
[ 2327.017064] __netlink_dump_start+0x28e/0x2c0
|
||||
[ 2327.021924] inet_diag_handler_cmd+0x189/0x1a0 [inet_diag]
|
||||
[ 2327.028045] ? inet_diag_rcv_msg_compat+0x1b0/0x1b0 [inet_diag]
|
||||
[ 2327.034651] ? inet_diag_dump_compat+0x190/0x190 [inet_diag]
|
||||
[ 2327.040965] ? __netlink_lookup+0x1b9/0x260
|
||||
[ 2327.045631] sock_diag_rcv_msg+0x18b/0x1e0
|
||||
[ 2327.050199] netlink_rcv_skb+0x14b/0x180
|
||||
[ 2327.054574] ? sock_diag_bind+0x60/0x60
|
||||
[ 2327.058850] sock_diag_rcv+0x28/0x40
|
||||
[ 2327.062837] netlink_unicast+0x2e7/0x3b0
|
||||
[ 2327.067212] ? netlink_attachskb+0x330/0x330
|
||||
[ 2327.071975] ? kasan_check_write+0x14/0x20
|
||||
[ 2327.076544] netlink_sendmsg+0x5be/0x730
|
||||
[ 2327.080918] ? netlink_unicast+0x3b0/0x3b0
|
||||
[ 2327.085486] ? kasan_check_write+0x14/0x20
|
||||
[ 2327.090057] ? selinux_socket_sendmsg+0x24/0x30
|
||||
[ 2327.095109] ? netlink_unicast+0x3b0/0x3b0
|
||||
[ 2327.099678] sock_sendmsg+0x74/0x80
|
||||
[ 2327.103567] ___sys_sendmsg+0x520/0x530
|
||||
[ 2327.107844] ? __get_locked_pte+0x178/0x200
|
||||
[ 2327.112510] ? copy_msghdr_from_user+0x270/0x270
|
||||
[ 2327.117660] ? vm_insert_page+0x360/0x360
|
||||
[ 2327.122133] ? vm_insert_pfn_prot+0xb4/0x150
|
||||
[ 2327.126895] ? vm_insert_pfn+0x32/0x40
|
||||
[ 2327.131077] ? vvar_fault+0x71/0xd0
|
||||
[ 2327.134968] ? special_mapping_fault+0x69/0x110
|
||||
[ 2327.140022] ? __do_fault+0x42/0x120
|
||||
[ 2327.144008] ? __handle_mm_fault+0x1062/0x17a0
|
||||
[ 2327.148965] ? __fget_light+0xa7/0xc0
|
||||
[ 2327.153049] __sys_sendmsg+0xcb/0x150
|
||||
[ 2327.157133] ? __sys_sendmsg+0xcb/0x150
|
||||
[ 2327.161409] ? SyS_shutdown+0x140/0x140
|
||||
[ 2327.165688] ? exit_to_usermode_loop+0xd0/0xd0
|
||||
[ 2327.170646] ? __do_page_fault+0x55d/0x620
|
||||
[ 2327.175216] ? __sys_sendmsg+0x150/0x150
|
||||
[ 2327.179591] SyS_sendmsg+0x12/0x20
|
||||
[ 2327.183384] do_syscall_64+0xe3/0x230
|
||||
[ 2327.187471] entry_SYSCALL64_slow_path+0x25/0x25
|
||||
[ 2327.192622] RIP: 0033:0x7f41d18fa3b0
|
||||
[ 2327.196608] RSP: 002b:00007ffc3b731218 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
|
||||
[ 2327.205055] RAX: ffffffffffffffda RBX: 00007ffc3b731380 RCX: 00007f41d18fa3b0
|
||||
[ 2327.213017] RDX: 0000000000000000 RSI: 00007ffc3b731340 RDI: 0000000000000003
|
||||
[ 2327.220978] RBP: 0000000000000002 R08: 0000000000000004 R09: 0000000000000040
|
||||
[ 2327.228939] R10: 00007ffc3b730f30 R11: 0000000000000246 R12: 0000000000000003
|
||||
[ 2327.236901] R13: 00007ffc3b731340 R14: 00007ffc3b7313d0 R15: 0000000000000084
|
||||
[ 2327.244865] Object at ffff881be87797e0, in cache kmalloc-64 size: 64
|
||||
[ 2327.251953] Allocated:
|
||||
[ 2327.254581] PID = 9484
|
||||
[ 2327.257215] save_stack_trace+0x1b/0x20
|
||||
[ 2327.261485] save_stack+0x46/0xd0
|
||||
[ 2327.265179] kasan_kmalloc+0xad/0xe0
|
||||
[ 2327.269165] kmem_cache_alloc_trace+0xe6/0x1d0
|
||||
[ 2327.274138] sctp_add_bind_addr+0x58/0x180 [sctp]
|
||||
[ 2327.279400] sctp_do_bind+0x208/0x310 [sctp]
|
||||
[ 2327.284176] sctp_bind+0x61/0xa0 [sctp]
|
||||
[ 2327.288455] inet_bind+0x5f/0x3a0
|
||||
[ 2327.292151] SYSC_bind+0x1a4/0x1e0
|
||||
[ 2327.295944] SyS_bind+0xe/0x10
|
||||
[ 2327.299349] do_syscall_64+0xe3/0x230
|
||||
[ 2327.303433] return_from_SYSCALL_64+0x0/0x6a
|
||||
[ 2327.308194] Freed:
|
||||
[ 2327.310434] PID = 4131
|
||||
[ 2327.313065] save_stack_trace+0x1b/0x20
|
||||
[ 2327.317344] save_stack+0x46/0xd0
|
||||
[ 2327.321040] kasan_slab_free+0x73/0xc0
|
||||
[ 2327.325220] kfree+0x96/0x1a0
|
||||
[ 2327.328530] dynamic_kobj_release+0x15/0x40
|
||||
[ 2327.333195] kobject_release+0x99/0x1e0
|
||||
[ 2327.337472] kobject_put+0x38/0x70
|
||||
[ 2327.341266] free_notes_attrs+0x66/0x80
|
||||
[ 2327.345545] mod_sysfs_teardown+0x1a5/0x270
|
||||
[ 2327.350211] free_module+0x20/0x2a0
|
||||
[ 2327.354099] SyS_delete_module+0x2cb/0x2f0
|
||||
[ 2327.358667] do_syscall_64+0xe3/0x230
|
||||
[ 2327.362750] return_from_SYSCALL_64+0x0/0x6a
|
||||
[ 2327.367510] Memory state around the buggy address:
|
||||
[ 2327.372855] ffff881be8779700: fc fc fc fc 00 00 00 00 00 00 00 00 fc fc fc fc
|
||||
[ 2327.380914] ffff881be8779780: fb fb fb fb fb fb fb fb fc fc fc fc 00 00 00 00
|
||||
[ 2327.388972] >ffff881be8779800: 00 00 00 00 fc fc fc fc fb fb fb fb fb fb fb fb
|
||||
[ 2327.397031] ^
|
||||
[ 2327.401792] ffff881be8779880: fc fc fc fc fb fb fb fb fb fb fb fb fc fc fc fc
|
||||
[ 2327.409850] ffff881be8779900: 00 00 00 00 00 04 fc fc fc fc fc fc 00 00 00 00
|
||||
[ 2327.417907] ==================================================================
|
||||
|
||||
This fixes CVE-2017-7558.
|
||||
|
||||
References: https://bugzilla.redhat.com/show_bug.cgi?id=1480266
|
||||
Fixes: 8f840e47f190 ("sctp: add the sctp_diag.c file")
|
||||
Cc: <stable@vger.kernel.org> # 4.7+
|
||||
Cc: Xin Long <lucien.xin@gmail.com>
|
||||
Cc: Vlad Yasevich <vyasevich@gmail.com>
|
||||
Cc: Neil Horman <nhorman@tuxdriver.com>
|
||||
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
|
||||
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
|
||||
Reviewed-by: Xin Long <lucien.xin@gmail.com>
|
||||
---
|
||||
net/sctp/sctp_diag.c | 7 +++++--
|
||||
net/sctp/socket.c | 3 +--
|
||||
2 files changed, 6 insertions(+), 4 deletions(-)
|
||||
|
||||
diff --git a/net/sctp/sctp_diag.c b/net/sctp/sctp_diag.c
|
||||
index 9a647214a91e..e99518e79b52 100644
|
||||
--- a/net/sctp/sctp_diag.c
|
||||
+++ b/net/sctp/sctp_diag.c
|
||||
@@ -70,7 +70,8 @@ static int inet_diag_msg_sctpladdrs_fill(struct sk_buff *skb,
|
||||
|
||||
info = nla_data(attr);
|
||||
list_for_each_entry_rcu(laddr, address_list, list) {
|
||||
- memcpy(info, &laddr->a, addrlen);
|
||||
+ memcpy(info, &laddr->a, sizeof(laddr->a));
|
||||
+ memset(info + sizeof(laddr->a), 0, addrlen - sizeof(laddr->a));
|
||||
info += addrlen;
|
||||
}
|
||||
|
||||
@@ -93,7 +94,9 @@ static int inet_diag_msg_sctpaddrs_fill(struct sk_buff *skb,
|
||||
info = nla_data(attr);
|
||||
list_for_each_entry(from, &asoc->peer.transport_addr_list,
|
||||
transports) {
|
||||
- memcpy(info, &from->ipaddr, addrlen);
|
||||
+ memcpy(info, &from->ipaddr, sizeof(from->ipaddr));
|
||||
+ memset(info + sizeof(from->ipaddr), 0,
|
||||
+ addrlen - sizeof(from->ipaddr));
|
||||
info += addrlen;
|
||||
}
|
||||
|
||||
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
|
||||
index 1db478e34520..8d760863bc41 100644
|
||||
--- a/net/sctp/socket.c
|
||||
+++ b/net/sctp/socket.c
|
||||
@@ -4538,8 +4538,7 @@ int sctp_get_sctp_info(struct sock *sk, struct sctp_association *asoc,
|
||||
info->sctpi_ictrlchunks = asoc->stats.ictrlchunks;
|
||||
|
||||
prim = asoc->peer.primary_path;
|
||||
- memcpy(&info->sctpi_p_address, &prim->ipaddr,
|
||||
- sizeof(struct sockaddr_storage));
|
||||
+ memcpy(&info->sctpi_p_address, &prim->ipaddr, sizeof(prim->ipaddr));
|
||||
info->sctpi_p_state = prim->state;
|
||||
info->sctpi_p_cwnd = prim->cwnd;
|
||||
info->sctpi_p_srtt = prim->srtt;
|
||||
|
|
@ -0,0 +1,47 @@
|
|||
From 9b44b0b09decfbe388131a345ba780c57240a7a9 Mon Sep 17 00:00:00 2001
|
||||
From: Joerg Roedel <jroedel@suse.de>
|
||||
Date: Tue, 11 Jul 2017 15:48:00 -0500
|
||||
Subject: PCI: Mark AMD Stoney GPU ATS as broken
|
||||
|
||||
ATS is broken on this hardware and causes IOMMU stalls and system failure.
|
||||
Disable ATS on these devices to make them usable again with IOMMU enabled.
|
||||
|
||||
Note that the commit in the Fixes tag is not buggy; it just uncovers the
|
||||
problem in the hardware by increasing the ATS flush rate.
|
||||
|
||||
Link: https://lists.linuxfoundation.org/pipermail/iommu/2017-March/020836.html
|
||||
Link: https://bugzilla.redhat.com/show_bug.cgi?id=1409201
|
||||
Fixes: b1516a14657a ("iommu/amd: Implement flush queue")
|
||||
Signed-off-by: Joerg Roedel <jroedel@suse.de>
|
||||
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
|
||||
Acked-by: Alex Deucher <alexander.deucher@amd.com>
|
||||
---
|
||||
drivers/pci/quirks.c | 15 +++++++++++++++
|
||||
1 file changed, 15 insertions(+)
|
||||
|
||||
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
|
||||
index 6967c6b..15ee4e9 100644
|
||||
--- a/drivers/pci/quirks.c
|
||||
+++ b/drivers/pci/quirks.c
|
||||
@@ -4681,3 +4681,18 @@ static void quirk_intel_no_flr(struct pci_dev *dev)
|
||||
}
|
||||
DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x1502, quirk_intel_no_flr);
|
||||
DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x1503, quirk_intel_no_flr);
|
||||
+
|
||||
+#ifdef CONFIG_PCI_ATS
|
||||
+/*
|
||||
+ * Some devices have a broken ATS implementation causing IOMMU stalls.
|
||||
+ * Don't use ATS for those devices.
|
||||
+ */
|
||||
+static void quirk_no_ats(struct pci_dev *pdev)
|
||||
+{
|
||||
+ dev_info(&pdev->dev, "disabling ATS (broken on this device)\n");
|
||||
+ pdev->ats_cap = 0;
|
||||
+}
|
||||
+
|
||||
+/* AMD Stoney platform GPU */
|
||||
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x98e4, quirk_no_ats);
|
||||
+#endif /* CONFIG_PCI_ATS */
|
||||
--
|
||||
cgit v1.1
|
||||
|
||||
|
|
@ -0,0 +1,41 @@
|
|||
From patchwork Fri Aug 25 11:38:29 2017
|
||||
Content-Type: text/plain; charset="utf-8"
|
||||
MIME-Version: 1.0
|
||||
Content-Transfer-Encoding: 7bit
|
||||
Subject: rt2800: fix TX_PIN_CFG setting for non MT7620 chips
|
||||
From: Stanislaw Gruszka <sgruszka@redhat.com>
|
||||
X-Patchwork-Id: 9921831
|
||||
Message-Id: <20170825113828.GA3959@redhat.com>
|
||||
To: linux-wireless@vger.kernel.org
|
||||
Cc: Daniel Golle <daniel@makrotopia.org>
|
||||
Date: Fri, 25 Aug 2017 13:38:29 +0200
|
||||
|
||||
Since commit 41977e86c984 ("rt2x00: add support for MT7620") we do not
|
||||
initialize TX_PIN_CFG setting. This cause breakage at least on some
|
||||
RT3573 devices. To fix the problem patch restores previous behaviour
|
||||
for non MT7620 chips.
|
||||
|
||||
Fixes: 41977e86c984 ("rt2x00: add support for MT7620")
|
||||
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1480829
|
||||
Reported-and-tested-by: Jussi Eloranta <jussi.eloranta@csun.edu>
|
||||
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
|
||||
---
|
||||
drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 5 ++++-
|
||||
1 file changed, 4 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
|
||||
index d11c7b2..5672aec 100644
|
||||
--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
|
||||
+++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
|
||||
@@ -3699,7 +3699,10 @@ static void rt2800_config_channel(struct rt2x00_dev *rt2x00dev,
|
||||
if (rt2x00_rt(rt2x00dev, RT3572))
|
||||
rt2800_rfcsr_write(rt2x00dev, 8, 0);
|
||||
|
||||
- rt2800_register_read(rt2x00dev, TX_PIN_CFG, &tx_pin);
|
||||
+ if (rt2x00_rt(rt2x00dev, RT6352))
|
||||
+ rt2800_register_read(rt2x00dev, TX_PIN_CFG, &tx_pin);
|
||||
+ else
|
||||
+ tx_pin = 0;
|
||||
|
||||
switch (rt2x00dev->default_ant.tx_chain_num) {
|
||||
case 3:
|
||||
2
sources
2
sources
|
|
@ -1,3 +1,3 @@
|
|||
SHA512 (perf-man-4.12.tar.gz) = 4d3bbda1f520dba0007c351af46f45085fe4842074eb2e01aee736fd369df595f8f72ed6c1192715f1120bf3353279777f9dca1178fe93bffe5be2de700d409c
|
||||
SHA512 (linux-4.12.tar.xz) = 8e81b41b253e63233e92948941f44c6482acb52aa3a3fd172f03a38a86f2c35b2ad4fd407acd1bc3964673eba344fe104d3a03e3ff4bf9cd1f22bd44263bd728
|
||||
SHA512 (patch-4.12.8.xz) = 44e2417fe1379977b4891f74b227c2c6d6588f3726b598ad8c8a52ecaea32f56cf222b877230fc87c043583a6f230f3044fe3c9b293c67699e1743c0161004cf
|
||||
SHA512 (patch-4.12.9.xz) = 8f4f9e270e8d00008b505be53aa0132aefbde21ae797e9daede19d6c81b26f255773b8e91396b75bbc78153d641a2479afbc22a7dc0d95b9c24534327fb95e38
|
||||
|
|
|
|||
59
xsa229.patch
59
xsa229.patch
|
|
@ -1,59 +0,0 @@
|
|||
From 84882133e793299f685991e20a9631acfd0a5608 Mon Sep 17 00:00:00 2001
|
||||
From: Roger Pau Monne <roger.pau@citrix.com>
|
||||
Date: Tue, 18 Jul 2017 15:01:00 +0100
|
||||
Subject: xen: fix bio vec merging
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
The current test for bio vec merging is not fully accurate and can be
|
||||
tricked into merging bios when certain grant combinations are used.
|
||||
The result of these malicious bio merges is a bio that extends past
|
||||
the memory page used by any of the originating bios.
|
||||
|
||||
Take into account the following scenario, where a guest creates two
|
||||
grant references that point to the same mfn, ie: grant 1 -> mfn A,
|
||||
grant 2 -> mfn A.
|
||||
|
||||
These references are then used in a PV block request, and mapped by
|
||||
the backend domain, thus obtaining two different pfns that point to
|
||||
the same mfn, pfn B -> mfn A, pfn C -> mfn A.
|
||||
|
||||
If those grants happen to be used in two consecutive sectors of a disk
|
||||
IO operation becoming two different bios in the backend domain, the
|
||||
checks in xen_biovec_phys_mergeable will succeed, because bfn1 == bfn2
|
||||
(they both point to the same mfn). However due to the bio merging,
|
||||
the backend domain will end up with a bio that expands past mfn A into
|
||||
mfn A + 1.
|
||||
|
||||
Fix this by making sure the check in xen_biovec_phys_mergeable takes
|
||||
into account the offset and the length of the bio, this basically
|
||||
replicates whats done in __BIOVEC_PHYS_MERGEABLE using mfns (bus
|
||||
addresses). While there also remove the usage of
|
||||
__BIOVEC_PHYS_MERGEABLE, since that's already checked by the callers
|
||||
of xen_biovec_phys_mergeable.
|
||||
|
||||
Reported-by: "Jan H. Schönherr" <jschoenh@amazon.de>
|
||||
Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
|
||||
Reviewed-by: Juergen Gross <jgross@suse.com>
|
||||
---
|
||||
drivers/xen/biomerge.c | 3 +--
|
||||
1 file changed, 1 insertion(+), 2 deletions(-)
|
||||
|
||||
diff --git a/drivers/xen/biomerge.c b/drivers/xen/biomerge.c
|
||||
index 4da69dbf7dca..1bdd02a6d6ac 100644
|
||||
--- a/drivers/xen/biomerge.c
|
||||
+++ b/drivers/xen/biomerge.c
|
||||
@@ -10,8 +10,7 @@ bool xen_biovec_phys_mergeable(const struct bio_vec *vec1,
|
||||
unsigned long bfn1 = pfn_to_bfn(page_to_pfn(vec1->bv_page));
|
||||
unsigned long bfn2 = pfn_to_bfn(page_to_pfn(vec2->bv_page));
|
||||
|
||||
- return __BIOVEC_PHYS_MERGEABLE(vec1, vec2) &&
|
||||
- ((bfn1 == bfn2) || ((bfn1+1) == bfn2));
|
||||
+ return bfn1 + PFN_DOWN(vec1->bv_offset + vec1->bv_len) == bfn2;
|
||||
#else
|
||||
/*
|
||||
* XXX: Add support for merging bio_vec when using different page
|
||||
--
|
||||
2.11.0 (Apple Git-81)
|
||||
|
||||
Loading…
Reference in New Issue