diff --git a/0001-net-dsa-mv88e6xxx-Introduce-_mv88e6xxx_phy_page_-rea.patch b/0001-net-dsa-mv88e6xxx-Introduce-_mv88e6xxx_phy_page_-rea.patch deleted file mode 100644 index b2c203f2c..000000000 --- a/0001-net-dsa-mv88e6xxx-Introduce-_mv88e6xxx_phy_page_-rea.patch +++ /dev/null @@ -1,95 +0,0 @@ -From cc4ee91d46158a4b43a03883ec36b77c03793e85 Mon Sep 17 00:00:00 2001 -From: Patrick Uiterwijk -Date: Fri, 25 Mar 2016 23:05:10 +0000 -Subject: [PATCH 1/2] net: dsa: mv88e6xxx: Introduce - _mv88e6xxx_phy_page_{read,write} - -Add versions of the phy_page_read and _write functions to -be used in a context where the SMI mutex is held. - -Tested-by: Vivien Didelot -Reviewed-by: Vivien Didelot -Signed-off-by: Patrick Uiterwijk ---- - drivers/net/dsa/mv88e6xxx.c | 49 +++++++++++++++++++++++++++++++++------------ - 1 file changed, 36 insertions(+), 13 deletions(-) - -diff --git a/drivers/net/dsa/mv88e6xxx.c b/drivers/net/dsa/mv88e6xxx.c -index fa086e0..86a2029 100644 ---- a/drivers/net/dsa/mv88e6xxx.c -+++ b/drivers/net/dsa/mv88e6xxx.c -@@ -2264,6 +2264,38 @@ static void mv88e6xxx_bridge_work(struct work_struct *work) - mutex_unlock(&ps->smi_mutex); - } - -+static int _mv88e6xxx_phy_page_write(struct dsa_switch *ds, int port, int page, -+ int reg, int val) -+{ -+ int ret; -+ -+ ret = _mv88e6xxx_phy_write_indirect(ds, port, 0x16, page); -+ if (ret < 0) -+ goto restore_page_0; -+ -+ ret = _mv88e6xxx_phy_write_indirect(ds, port, reg, val); -+restore_page_0: -+ _mv88e6xxx_phy_write_indirect(ds, port, 0x16, 0x0); -+ -+ return ret; -+} -+ -+static int _mv88e6xxx_phy_page_read(struct dsa_switch *ds, int port, int page, -+ int reg) -+{ -+ int ret; -+ -+ ret = _mv88e6xxx_phy_write_indirect(ds, port, 0x16, page); -+ if (ret < 0) -+ goto restore_page_0; -+ -+ ret = _mv88e6xxx_phy_read_indirect(ds, port, reg); -+restore_page_0: -+ _mv88e6xxx_phy_write_indirect(ds, port, 0x16, 0x0); -+ -+ return ret; -+} -+ - static int mv88e6xxx_setup_port(struct dsa_switch *ds, int port) - { - struct mv88e6xxx_priv_state *ps = ds_to_priv(ds); -@@ -2714,13 +2746,9 @@ int mv88e6xxx_phy_page_read(struct dsa_switch *ds, int port, int page, int reg) - int ret; - - mutex_lock(&ps->smi_mutex); -- ret = _mv88e6xxx_phy_write_indirect(ds, port, 0x16, page); -- if (ret < 0) -- goto error; -- ret = _mv88e6xxx_phy_read_indirect(ds, port, reg); --error: -- _mv88e6xxx_phy_write_indirect(ds, port, 0x16, 0x0); -+ ret = _mv88e6xxx_phy_page_read(ds, port, page, reg); - mutex_unlock(&ps->smi_mutex); -+ - return ret; - } - -@@ -2731,14 +2759,9 @@ int mv88e6xxx_phy_page_write(struct dsa_switch *ds, int port, int page, - int ret; - - mutex_lock(&ps->smi_mutex); -- ret = _mv88e6xxx_phy_write_indirect(ds, port, 0x16, page); -- if (ret < 0) -- goto error; -- -- ret = _mv88e6xxx_phy_write_indirect(ds, port, reg, val); --error: -- _mv88e6xxx_phy_write_indirect(ds, port, 0x16, 0x0); -+ ret = _mv88e6xxx_phy_page_write(ds, port, page, reg, val); - mutex_unlock(&ps->smi_mutex); -+ - return ret; - } - --- -2.5.0 - diff --git a/0002-net-dsa-mv88e6xxx-Clear-the-PDOWN-bit-on-setup.patch b/0002-net-dsa-mv88e6xxx-Clear-the-PDOWN-bit-on-setup.patch deleted file mode 100644 index b35298a56..000000000 --- a/0002-net-dsa-mv88e6xxx-Clear-the-PDOWN-bit-on-setup.patch +++ /dev/null @@ -1,104 +0,0 @@ -From e95d5ac146d9da8a703a726fe70a9f4ac02ab8b2 Mon Sep 17 00:00:00 2001 -From: Patrick Uiterwijk -Date: Fri, 25 Mar 2016 00:38:45 +0000 -Subject: [PATCH 2/2] net: dsa: mv88e6xxx: Clear the PDOWN bit on setup - -Some of the vendor-specific bootloaders set up this part -of the initialization for us, so this was never added. -However, since upstream bootloaders don't initialize the -chip specifically, they leave the fiber MII's PDOWN flag -set, which means that the CPU port doesn't connect. - -This patch checks whether this flag has been clear prior -by something else, and if not make us clear it. - -Reviewed-by: Andrew Lunn -Signed-off-by: Patrick Uiterwijk ---- - drivers/net/dsa/mv88e6xxx.c | 36 ++++++++++++++++++++++++++++++++++++ - drivers/net/dsa/mv88e6xxx.h | 8 ++++++++ - 2 files changed, 44 insertions(+) - -diff --git a/drivers/net/dsa/mv88e6xxx.c b/drivers/net/dsa/mv88e6xxx.c -index 86a2029..50454be 100644 ---- a/drivers/net/dsa/mv88e6xxx.c -+++ b/drivers/net/dsa/mv88e6xxx.c -@@ -2296,6 +2296,25 @@ restore_page_0: - return ret; - } - -+static int mv88e6xxx_power_on_serdes(struct dsa_switch *ds) -+{ -+ int ret; -+ -+ ret = _mv88e6xxx_phy_page_read(ds, REG_FIBER_SERDES, PAGE_FIBER_SERDES, -+ MII_BMCR); -+ if (ret < 0) -+ return ret; -+ -+ if (ret & BMCR_PDOWN) { -+ ret &= ~BMCR_PDOWN; -+ ret = _mv88e6xxx_phy_page_write(ds, REG_FIBER_SERDES, -+ PAGE_FIBER_SERDES, MII_BMCR, -+ ret); -+ } -+ -+ return ret; -+} -+ - static int mv88e6xxx_setup_port(struct dsa_switch *ds, int port) - { - struct mv88e6xxx_priv_state *ps = ds_to_priv(ds); -@@ -2399,6 +2418,23 @@ static int mv88e6xxx_setup_port(struct dsa_switch *ds, int port) - goto abort; - } - -+ /* If this port is connected to a SerDes, make sure the SerDes is not -+ * powered down. -+ */ -+ if (mv88e6xxx_6352_family(ds)) { -+ ret = _mv88e6xxx_reg_read(ds, REG_PORT(port), PORT_STATUS); -+ if (ret < 0) -+ goto abort; -+ ret &= PORT_STATUS_CMODE_MASK; -+ if ((ret == PORT_STATUS_CMODE_100BASE_X) || -+ (ret == PORT_STATUS_CMODE_1000BASE_X) || -+ (ret == PORT_STATUS_CMODE_SGMII)) { -+ ret = mv88e6xxx_power_on_serdes(ds); -+ if (ret < 0) -+ goto abort; -+ } -+ } -+ - /* Port Control 2: don't force a good FCS, set the maximum frame size to - * 10240 bytes, disable 802.1q tags checking, don't discard tagged or - * untagged frames on this port, do a destination address lookup on all -diff --git a/drivers/net/dsa/mv88e6xxx.h b/drivers/net/dsa/mv88e6xxx.h -index 9a038ab..26a424a 100644 ---- a/drivers/net/dsa/mv88e6xxx.h -+++ b/drivers/net/dsa/mv88e6xxx.h -@@ -28,6 +28,10 @@ - #define SMI_CMD_OP_45_READ_DATA_INC ((3 << 10) | SMI_CMD_BUSY) - #define SMI_DATA 0x01 - -+/* Fiber/SERDES Registers are located at SMI address F, page 1 */ -+#define REG_FIBER_SERDES 0x0f -+#define PAGE_FIBER_SERDES 0x01 -+ - #define REG_PORT(p) (0x10 + (p)) - #define PORT_STATUS 0x00 - #define PORT_STATUS_PAUSE_EN BIT(15) -@@ -45,6 +49,10 @@ - #define PORT_STATUS_MGMII BIT(6) /* 6185 */ - #define PORT_STATUS_TX_PAUSED BIT(5) - #define PORT_STATUS_FLOW_CTRL BIT(4) -+#define PORT_STATUS_CMODE_MASK 0x0f -+#define PORT_STATUS_CMODE_100BASE_X 0x8 -+#define PORT_STATUS_CMODE_1000BASE_X 0x9 -+#define PORT_STATUS_CMODE_SGMII 0xa - #define PORT_PCS_CTRL 0x01 - #define PORT_PCS_CTRL_RGMII_DELAY_RXCLK BIT(15) - #define PORT_PCS_CTRL_RGMII_DELAY_TXCLK BIT(14) --- -2.5.0 - diff --git a/ALSA-usb-audio-Fix-double-free-in-error-paths-after-.patch b/ALSA-usb-audio-Fix-double-free-in-error-paths-after-.patch deleted file mode 100644 index c1c72f9bf..000000000 --- a/ALSA-usb-audio-Fix-double-free-in-error-paths-after-.patch +++ /dev/null @@ -1,100 +0,0 @@ -From 1b9e866417f77622b03f5b9c4e2845133054e670 Mon Sep 17 00:00:00 2001 -From: Vladis Dronov -Date: Thu, 31 Mar 2016 12:05:43 -0400 -Subject: [PATCH 2/2] ALSA: usb-audio: Fix double-free in error paths after - snd_usb_add_audio_stream() call - -create_fixed_stream_quirk(), snd_usb_parse_audio_interface() and -create_uaxx_quirk() functions allocate the audioformat object by themselves -and free it upon error before returning. However, once the object is linked -to a stream, it's freed again in snd_usb_audio_pcm_free(), thus it'll be -double-freed, eventually resulting in a memory corruption. - -This patch fixes these failures in the error paths by unlinking the audioformat -object before freeing it. - -Based on a patch by Takashi Iwai" - -[Note for stable backports: - this patch requires the commit 902eb7fd1e4a ('ALSA: usb-audio: Minor - code cleanup in create_fixed_stream_quirk()')] - -Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1283358 -Reported-by: Ralf Spenneberg -Cc: # see the note above -Signed-off-by: Vladis Dronov ---- - sound/usb/quirks.c | 4 ++++ - sound/usb/stream.c | 6 +++++- - 2 files changed, 9 insertions(+), 1 deletion(-) - -diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c -index 2f0bbc43f902..6f68ba9bda8a 100644 ---- a/sound/usb/quirks.c -+++ b/sound/usb/quirks.c -@@ -150,6 +150,7 @@ static int create_fixed_stream_quirk(struct snd_usb_audio *chip, - usb_audio_err(chip, "cannot memdup\n"); - return -ENOMEM; - } -+ INIT_LIST_HEAD(&fp->list); - if (fp->nr_rates > MAX_NR_RATES) { - kfree(fp); - return -EINVAL; -@@ -193,6 +194,7 @@ static int create_fixed_stream_quirk(struct snd_usb_audio *chip, - return 0; - - error: -+ list_del(&fp->list); /* unlink for avoiding double-free */ - kfree(fp); - kfree(rate_table); - return err; -@@ -468,6 +470,7 @@ static int create_uaxx_quirk(struct snd_usb_audio *chip, - fp->ep_attr = get_endpoint(alts, 0)->bmAttributes; - fp->datainterval = 0; - fp->maxpacksize = le16_to_cpu(get_endpoint(alts, 0)->wMaxPacketSize); -+ INIT_LIST_HEAD(&fp->list); - - switch (fp->maxpacksize) { - case 0x120: -@@ -491,6 +494,7 @@ static int create_uaxx_quirk(struct snd_usb_audio *chip, - ? SNDRV_PCM_STREAM_CAPTURE : SNDRV_PCM_STREAM_PLAYBACK; - err = snd_usb_add_audio_stream(chip, stream, fp); - if (err < 0) { -+ list_del(&fp->list); /* unlink for avoiding double-free */ - kfree(fp); - return err; - } -diff --git a/sound/usb/stream.c b/sound/usb/stream.c -index 8ee14f2365e7..3b23102230c0 100644 ---- a/sound/usb/stream.c -+++ b/sound/usb/stream.c -@@ -316,7 +316,9 @@ static struct snd_pcm_chmap_elem *convert_chmap(int channels, unsigned int bits, - /* - * add this endpoint to the chip instance. - * if a stream with the same endpoint already exists, append to it. -- * if not, create a new pcm stream. -+ * if not, create a new pcm stream. note, fp is added to the substream -+ * fmt_list and will be freed on the chip instance release. do not free -+ * fp or do remove it from the substream fmt_list to avoid double-free. - */ - int snd_usb_add_audio_stream(struct snd_usb_audio *chip, - int stream, -@@ -677,6 +679,7 @@ int snd_usb_parse_audio_interface(struct snd_usb_audio *chip, int iface_no) - * (fp->maxpacksize & 0x7ff); - fp->attributes = parse_uac_endpoint_attributes(chip, alts, protocol, iface_no); - fp->clock = clock; -+ INIT_LIST_HEAD(&fp->list); - - /* some quirks for attributes here */ - -@@ -725,6 +728,7 @@ int snd_usb_parse_audio_interface(struct snd_usb_audio *chip, int iface_no) - dev_dbg(&dev->dev, "%u:%d: add audio endpoint %#x\n", iface_no, altno, fp->endpoint); - err = snd_usb_add_audio_stream(chip, stream, fp); - if (err < 0) { -+ list_del(&fp->list); /* unlink for avoiding double-free */ - kfree(fp->rate_table); - kfree(fp->chmap); - kfree(fp); --- -2.5.5 - diff --git a/drm-udl-Use-unlocked-gem-unreferencing.patch b/drm-udl-Use-unlocked-gem-unreferencing.patch deleted file mode 100644 index e2dbabe83..000000000 --- a/drm-udl-Use-unlocked-gem-unreferencing.patch +++ /dev/null @@ -1,58 +0,0 @@ -From patchwork Mon Nov 23 09:32:42 2015 -Content-Type: text/plain; charset="utf-8" -MIME-Version: 1.0 -Content-Transfer-Encoding: 7bit -Subject: [09/29] drm/udl: Use unlocked gem unreferencing -From: Daniel Vetter -X-Patchwork-Id: 65722 -Message-Id: <1448271183-20523-10-git-send-email-daniel.vetter@ffwll.ch> -To: DRI Development -Cc: Daniel Vetter , - Daniel Vetter , - Intel Graphics Development , - Dave Airlie -Date: Mon, 23 Nov 2015 10:32:42 +0100 - -For drm_gem_object_unreference callers are required to hold -dev->struct_mutex, which these paths don't. Enforcing this requirement -has become a bit more strict with - -commit ef4c6270bf2867e2f8032e9614d1a8cfc6c71663 -Author: Daniel Vetter -Date: Thu Oct 15 09:36:25 2015 +0200 - - drm/gem: Check locking in drm_gem_object_unreference - -Cc: Dave Airlie -Signed-off-by: Daniel Vetter ---- - drivers/gpu/drm/udl/udl_fb.c | 2 +- - drivers/gpu/drm/udl/udl_gem.c | 2 +- - 2 files changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/gpu/drm/udl/udl_fb.c b/drivers/gpu/drm/udl/udl_fb.c -index 200419d4d43c..18a2acbccb7d 100644 ---- a/drivers/gpu/drm/udl/udl_fb.c -+++ b/drivers/gpu/drm/udl/udl_fb.c -@@ -538,7 +538,7 @@ static int udlfb_create(struct drm_fb_helper *helper, - out_destroy_fbi: - drm_fb_helper_release_fbi(helper); - out_gfree: -- drm_gem_object_unreference(&ufbdev->ufb.obj->base); -+ drm_gem_object_unreference_unlocked(&ufbdev->ufb.obj->base); - out: - return ret; - } -diff --git a/drivers/gpu/drm/udl/udl_gem.c b/drivers/gpu/drm/udl/udl_gem.c -index 2a0a784ab6ee..d7528e0d8442 100644 ---- a/drivers/gpu/drm/udl/udl_gem.c -+++ b/drivers/gpu/drm/udl/udl_gem.c -@@ -52,7 +52,7 @@ udl_gem_create(struct drm_file *file, - return ret; - } - -- drm_gem_object_unreference(&obj->base); -+ drm_gem_object_unreference_unlocked(&obj->base); - *handle_p = handle; - return 0; - } diff --git a/gitrev b/gitrev index c1432e901..948140534 100644 --- a/gitrev +++ b/gitrev @@ -1 +1 @@ -11caf57f6a4b8e380001548b8af0a3ae3f7b4354 +9735a22799b9214d17d3c231fe377fc852f042e9 diff --git a/kernel.spec b/kernel.spec index 15d6b3987..2790a74a2 100644 --- a/kernel.spec +++ b/kernel.spec @@ -42,7 +42,7 @@ Summary: The Linux kernel # For non-released -rc kernels, this will be appended after the rcX and # gitX tags, so a 3 here would become part of release "0.rcX.gitX.3" # -%global baserelease 3 +%global baserelease 1 %global fedora_build %{baserelease} # base_sublevel is the kernel version we're starting with and patching @@ -67,7 +67,7 @@ Summary: The Linux kernel # The next upstream release sublevel (base_sublevel+1) %define upstream_sublevel %(echo $((%{base_sublevel} + 1))) # The rc snapshot level -%define rcrev 1 +%define rcrev 2 # The git snapshot level %define gitrev 0 # Set rpm version accordingly @@ -523,8 +523,6 @@ Patch433: 0001-ARM-mvebu-Correct-unit-address-for-linksys.patch # mvebu DSA switch fixes # http://www.spinics.net/lists/netdev/msg370841.html http://www.spinics.net/lists/netdev/msg370842.html -Patch434: 0001-net-dsa-mv88e6xxx-Introduce-_mv88e6xxx_phy_page_-rea.patch -Patch435: 0002-net-dsa-mv88e6xxx-Clear-the-PDOWN-bit-on-setup.patch Patch460: lib-cpumask-Make-CPUMASK_OFFSTACK-usable-without-deb.patch @@ -607,9 +605,6 @@ Patch508: kexec-uefi-copy-secure_boot-flag-in-boot-params.patch #rhbz 1286293 Patch571: ideapad-laptop-Add-Lenovo-ideapad-Y700-17ISK-to-no_h.patch -#rhbz 1295646 -Patch621: drm-udl-Use-unlocked-gem-unreferencing.patch - #Required for some persistent memory options Patch641: disable-CONFIG_EXPERT-for-ZONE_DMA.patch @@ -619,9 +614,6 @@ Patch663: USB-serial-ftdi_sio-Add-support-for-ICP-DAS-I-756xU-.patch #CVE-2016-3134 rhbz 1317383 1317384 Patch665: netfilter-x_tables-deal-with-bogus-nextoffset-values.patch -#CVE-2016-2184 rhbz 1317012 1317470 -Patch668: ALSA-usb-audio-Fix-double-free-in-error-paths-after-.patch - #CVE-2016-3137 rhbz 1317010 1316996 Patch672: cypress_m8-add-sanity-checking.patch @@ -639,9 +631,6 @@ Patch687: mct_u232-sanity-checking-in-probe.patch Patch688: sound-usb-fix-NULL-dereference-in-usb_audio_probe.patch -#rhbz 1321749 -Patch689: uapi-linux-stddef.h-Provide-__always_inline-to-users.patch - # END OF PATCH DEFINITIONS %endif @@ -2167,6 +2156,9 @@ fi # # %changelog +* Mon Apr 04 2016 Justin M. Forbes - 4.6.0-0.rc2.git0.1 +- Linux v4.6-rc2 + * Sun Apr 3 2016 Peter Robinson - Some minor ARMv7/aarch64 cleanups diff --git a/sources b/sources index c794314fd..03590ad3e 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ a60d48eee08ec0536d5efb17ca819aef linux-4.5.tar.xz 6f557fe90b800b615c85c2ca04da6154 perf-man-4.5.tar.gz -b4787fc5e8e27bf21e294448ff566c04 patch-4.6-rc1.xz +e3752dbebf18b474b70d589ddb148706 patch-4.6-rc2.xz diff --git a/uapi-linux-stddef.h-Provide-__always_inline-to-users.patch b/uapi-linux-stddef.h-Provide-__always_inline-to-users.patch deleted file mode 100644 index ba6628efb..000000000 --- a/uapi-linux-stddef.h-Provide-__always_inline-to-users.patch +++ /dev/null @@ -1,42 +0,0 @@ -From dd39fab52b6b8e86381d0da847a0252384926832 Mon Sep 17 00:00:00 2001 -From: Denys Vlasenko -Date: Wed, 30 Mar 2016 00:14:57 +0200 -Subject: [PATCH] uapi/linux/stddef.h: Provide __always_inline to userspace - headers - -Recent change to uapi/linux/swab.h needs this. - -Unfortunately, UAPI headers don't include compiler.h and fixing it there is not enough. - -Tested. Testcase: "make headers_install" and try to compile this: - - #include - void main() {} - -Signed-off-by: Denys Vlasenko -CC: Josh Boyer -CC: Thomas Graf -CC: Peter Zijlstra -CC: David Rientjes -CC: Arnd Bergmann -CC: Ingo Molnar -CC: Andrew Morton -CC: Linus Torvalds -CC: linux-kernel@vger.kernel.org ---- - include/uapi/linux/stddef.h | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/include/uapi/linux/stddef.h b/include/uapi/linux/stddef.h -index aa9f10428743..621fa8ac4425 100644 ---- a/include/uapi/linux/stddef.h -+++ b/include/uapi/linux/stddef.h -@@ -1 +1,5 @@ - #include -+ -+#ifndef __always_inline -+#define __always_inline inline -+#endif --- -2.5.5 -