Linux v4.0-rc7-30-g20624d17963c

This commit is contained in:
Josh Boyer 2015-04-09 10:00:06 -04:00
parent b6b5f47a14
commit 5fbe6a96e1
9 changed files with 18 additions and 125 deletions

View File

@ -163,10 +163,10 @@ index b033dab5c8bf..f526b6e02f59 100644
extern int modules_disabled; /* for sysctl */
diff --git a/kernel/module.c b/kernel/module.c
index 33e695877504..f1742ffe92bd 100644
index 0372c3961016..55dacebb687b 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -3892,6 +3892,13 @@ void module_layout(struct module *mod,
@@ -3909,6 +3909,13 @@ void module_layout(struct module *mod,
EXPORT_SYMBOL(module_layout);
#endif

View File

@ -41,10 +41,10 @@ index b03485bcb82a..b033dab5c8bf 100644
#ifdef CONFIG_SYSFS
diff --git a/kernel/module.c b/kernel/module.c
index 99fdf94efce8..33e695877504 100644
index ec53f594e9c9..0372c3961016 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -3891,3 +3891,13 @@ void module_layout(struct module *mod,
@@ -3908,3 +3908,13 @@ void module_layout(struct module *mod,
}
EXPORT_SYMBOL(module_layout);
#endif

View File

@ -228,7 +228,7 @@ index 4121345498e0..0ff3cef5df96 100644
return 0;
diff --git a/kernel/module.c b/kernel/module.c
index f1742ffe92bd..f4738b4cc373 100644
index 55dacebb687b..9d4deeb9268e 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -107,9 +107,9 @@ struct list_head *kdb_modules = &modules; /* kdb needs the list of modules */

View File

@ -1,47 +0,0 @@
From: Shachar Raindel <raindel@mellanox.com>
Date: Sun, 4 Jan 2015 18:30:32 +0200
Subject: [PATCH] IB/core: Prevent integer overflow in ib_umem_get address
arithmetic
Properly verify that the resulting page aligned end address is larger
than both the start address and the length of the memory area
requested.
Both the start and length arguments for ib_umem_get are controlled by
the user. A misbehaving user can provide values which will cause an
integer overflow when calculating the page aligned end address.
This overflow can cause also miscalculation of the number of pages
mapped, and additional logic issues.
Issue: 470602
Change-Id: Iee88441db454af291fc5a376009d840603398d23
Signed-off-by: Shachar Raindel <raindel@mellanox.com>
Signed-off-by: Jack Morgenstein <jackm@mellanox.com>
Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
---
drivers/infiniband/core/umem.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
index aec7a6aa2951..8c014b5dab4c 100644
--- a/drivers/infiniband/core/umem.c
+++ b/drivers/infiniband/core/umem.c
@@ -99,6 +99,14 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr,
if (dmasync)
dma_set_attr(DMA_ATTR_WRITE_BARRIER, &attrs);
+ /*
+ * If the combination of the addr and size requested for this memory
+ * region causes an integer overflow, return error.
+ */
+ if ((PAGE_ALIGN(addr + size) <= size) ||
+ (PAGE_ALIGN(addr + size) <= addr))
+ return ERR_PTR(-EINVAL);
+
if (!can_do_mlock())
return ERR_PTR(-EPERM);
--
2.1.0

View File

@ -1,54 +0,0 @@
From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Date: Sat, 21 Mar 2015 20:36:56 -0700
Subject: [PATCH] Input: ALPS - fix max coordinates for v5 and v7 protocols
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Commit 3296f71cd2fde7a2ad52e66a27eae419f6328066 ("Input: ALPS - consolidate
setting protocol parameters") inadvertently moved call to
alps_dolphin_get_device_area() from v5 to v7 protocol, causing both
protocols report incorrect maximum values for X and Y axes which resulted
in crash in Synaptics X driver.
Reported-by: Santiago Gala <sgala@apache.org>
Reported-by: Pali Rohár <pali.rohar@gmail.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
drivers/input/mouse/alps.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
index 1bd15ebc01f2..33198b91bebf 100644
--- a/drivers/input/mouse/alps.c
+++ b/drivers/input/mouse/alps.c
@@ -2281,10 +2281,12 @@ static int alps_set_protocol(struct psmouse *psmouse,
priv->set_abs_params = alps_set_abs_params_mt;
priv->nibble_commands = alps_v3_nibble_commands;
priv->addr_command = PSMOUSE_CMD_RESET_WRAP;
- priv->x_max = 1360;
- priv->y_max = 660;
priv->x_bits = 23;
priv->y_bits = 12;
+
+ if (alps_dolphin_get_device_area(psmouse, priv))
+ return -EIO;
+
break;
case ALPS_PROTO_V6:
@@ -2303,9 +2305,8 @@ static int alps_set_protocol(struct psmouse *psmouse,
priv->set_abs_params = alps_set_abs_params_mt;
priv->nibble_commands = alps_v3_nibble_commands;
priv->addr_command = PSMOUSE_CMD_RESET_WRAP;
-
- if (alps_dolphin_get_device_area(psmouse, priv))
- return -EIO;
+ priv->x_max = 0xfff;
+ priv->y_max = 0x7ff;
if (priv->fw_ver[1] != 0xba)
priv->flags |= ALPS_BUTTONPAD;
--
2.1.0

View File

@ -43,7 +43,7 @@ Signed-off-by: Josh Stone <jistone@redhat.com>
2 files changed, 21 insertions(+), 1 deletion(-)
diff --git a/Makefile b/Makefile
index da36a3be7969..92089c03e64e 100644
index 54430f933b62..09e578408544 100644
--- a/Makefile
+++ b/Makefile
@@ -706,7 +706,11 @@ KBUILD_CFLAGS += -fomit-frame-pointer

View File

@ -766,6 +766,9 @@ CONFIG_KEYBOARD_CROS_EC=m
CONFIG_I2C_CROS_EC_TUNNEL=m
CONFIG_SND_SOC_TS3A227E=m
CONFIG_R8188EU=m
# CONFIG_88EU_AP_MODE is not set
# Needs work/investigation
# CONFIG_ARM_KPROBES_TEST is not set

View File

@ -66,9 +66,9 @@ Summary: The Linux kernel
# define upstream_sublevel %(echo $((%{base_sublevel} + 1)))
%define upstream_sublevel 0
# The rc snapshot level
%define rcrev 6
%define rcrev 7
# The git snapshot level
%define gitrev 2
%define gitrev 1
# Set rpm version accordingly
%define rpmversion 4.%{upstream_sublevel}.0
%endif
@ -406,7 +406,7 @@ BuildRequires: binutils-%{_build_arch}-linux-gnu, gcc-%{_build_arch}-linux-gnu
%endif
#Source0: ftp://ftp.kernel.org/pub/linux/kernel/v4.x/linux-%{kversion}.tar.xz
Source0: ftp://ftp.kernel.org/pub/linux/kernel/v4.x/linux-4.0-rc6.tar.xz
Source0: ftp://ftp.kernel.org/pub/linux/kernel/v4.x/linux-4.0-rc7.tar.xz
Source10: perf-man-%{kversion}.tar.gz
Source11: x509.genkey
@ -618,9 +618,6 @@ Patch26139: Bluetooth-ath3k-Add-support-Atheros-AR5B195-combo-Mi.patch
#rhbz 1196825
Patch26140: security-yama-Remove-unnecessary-selects-from-Kconfi.patch
#CVE-2014-8159 rhbz 1181166 1200950
Patch26167: IB-core-Prevent-integer-overflow-in-ib_umem_get-addr.patch
#rhbz 1201532
Patch26168: HID-multitouch-add-support-of-clickpads.patch
@ -628,9 +625,6 @@ Patch26168: HID-multitouch-add-support-of-clickpads.patch
Patch26170: acpi-video-Allow-forcing-native-backlight-on-non-win.patch
Patch26171: acpi-video-Add-force-native-backlight-quirk-for-Leno.patch
#rhbz 1203584
Patch26174: Input-ALPS-fix-max-coordinates-for-v5-and-v7-protoco.patch
#CVE-2015-2150 rhbz 1196266 1200397
Patch26175: xen-pciback-Don-t-disable-PCI_COMMAND-on-PCI-device-.patch
@ -1363,9 +1357,6 @@ ApplyPatch Bluetooth-ath3k-Add-support-Atheros-AR5B195-combo-Mi.patch
#rhbz 1196825
ApplyPatch security-yama-Remove-unnecessary-selects-from-Kconfi.patch
#CVE-2014-8159 rhbz 1181166 1200950
ApplyPatch IB-core-Prevent-integer-overflow-in-ib_umem_get-addr.patch
#rhbz 1201532
ApplyPatch HID-multitouch-add-support-of-clickpads.patch
@ -1373,9 +1364,6 @@ ApplyPatch HID-multitouch-add-support-of-clickpads.patch
ApplyPatch acpi-video-Allow-forcing-native-backlight-on-non-win.patch
ApplyPatch acpi-video-Add-force-native-backlight-quirk-for-Leno.patch
#rhbz 1203584
ApplyPatch Input-ALPS-fix-max-coordinates-for-v5-and-v7-protoco.patch
#CVE-2015-2150 rhbz 1196266 1200397
ApplyPatch xen-pciback-Don-t-disable-PCI_COMMAND-on-PCI-device-.patch
@ -2229,6 +2217,9 @@ fi
#
#
%changelog
* Thu Apr 09 2015 Josh Boyer <jwboyer@fedoraproject.org> - 4.0.0-0.rc7.git1.1
- Linux v4.0-rc7-30-g20624d17963c
* Thu Apr 02 2015 Josh Boyer <jwboyer@fedoraproject.org> - 4.0.0-0.rc6.git2.1
- Linux v4.0-rc6-101-g0a4812798fae

View File

@ -1,3 +1,3 @@
bec0aeeacab2852d9a17ccbfa7e280f8 linux-4.0-rc6.tar.xz
260f7a6cccde97c91b2e79eb93049820 perf-man-4.0-rc6.tar.gz
9c5164f5f19edaf4c78df0b2e7e4a047 patch-4.0-rc6-git2.xz
26db663899b1a54397b4f184ca05f213 linux-4.0-rc7.tar.xz
3fa282f45f65ef53dda78e0f9628f3ae perf-man-4.0-rc7.tar.gz
d2fb082931b93e69291c82a5efef4f7b patch-4.0-rc7-git1.xz