Linux v4.3-rc3
This commit is contained in:
Laura Abbott
parent
eb17d7ebff
commit
ffe6c8179f
@ -1,86 +0,0 @@
|
|||||||
From 680ac028240f8747f31c03986fbcf18b2b521e93 Mon Sep 17 00:00:00 2001
|
|
||||||
From: Borislav Petkov <bp@suse.de>
|
|
||||||
Date: Mon, 27 Jul 2015 09:58:05 +0200
|
|
||||||
Subject: [PATCH] x86/cpu/cacheinfo: Fix teardown path
|
|
||||||
MIME-Version: 1.0
|
|
||||||
Content-Type: text/plain; charset=UTF-8
|
|
||||||
Content-Transfer-Encoding: 8bit
|
|
||||||
|
|
||||||
Philip Müller reported a hang when booting 32-bit 4.1 kernel on
|
|
||||||
an AMD box. A fragment of the splat was enough to pinpoint the
|
|
||||||
issue:
|
|
||||||
|
|
||||||
task: f58e0000 ti: f58e8000 task.ti: f58e800
|
|
||||||
EIP: 0060:[<c135a903>] EFLAGS: 00010206 CPU: 0
|
|
||||||
EIP is at free_cache_attributes+0x83/0xd0
|
|
||||||
EAX: 00000001 EBX: f589d46c ECX: 00000090 EDX: 360c2000
|
|
||||||
ESI: 00000000 EDI: c1724a80 EBP: f58e9ec0 ESP: f58e9ea0
|
|
||||||
DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
|
|
||||||
CR0: 8005003b CR2: 000000ac CR3: 01731000 CR4: 000006d0
|
|
||||||
|
|
||||||
cache_shared_cpu_map_setup() did check sibling CPUs cacheinfo
|
|
||||||
descriptor while the respective teardown path
|
|
||||||
cache_shared_cpu_map_remove() didn't. Fix that.
|
|
||||||
|
|
||||||
From tglx's version: to be on the safe side, move the cacheinfo
|
|
||||||
descriptor check to free_cache_attributes(), thus cleaning up
|
|
||||||
the hotplug path a little and making this even more robust.
|
|
||||||
|
|
||||||
Reported-by: Philip Müller <philm@manjaro.org>
|
|
||||||
Signed-off-by: Borislav Petkov <bp@suse.de>
|
|
||||||
Cc: <stable@vger.kernel.org> # v4.1+
|
|
||||||
Cc: Andre Przywara <andre.przywara@arm.com>
|
|
||||||
Cc: Guenter Roeck <linux@roeck-us.net>
|
|
||||||
Cc: H. Peter Anvin <hpa@zytor.com>
|
|
||||||
Cc: Linus Torvalds <torvalds@linux-foundation.org>
|
|
||||||
Cc: Peter Zijlstra <peterz@infradead.org>
|
|
||||||
Cc: Sudeep Holla <sudeep.holla@arm.com>
|
|
||||||
Cc: Thomas Gleixner <tglx@linutronix.de>
|
|
||||||
Cc: linux-kernel@vger.kernel.org
|
|
||||||
Cc: manjaro-dev@manjaro.org
|
|
||||||
Link: http://lkml.kernel.org/r/20150727075805.GA20416@nazgul.tnic
|
|
||||||
Link: https://lkml.kernel.org/r/55B47BB8.6080202@manjaro.org
|
|
||||||
Signed-off-by: Ingo Molnar <mingo@kernel.org>
|
|
||||||
---
|
|
||||||
drivers/base/cacheinfo.c | 10 ++++++++--
|
|
||||||
1 file changed, 8 insertions(+), 2 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/drivers/base/cacheinfo.c b/drivers/base/cacheinfo.c
|
|
||||||
index 764280a91776..e9fd32e91668 100644
|
|
||||||
--- a/drivers/base/cacheinfo.c
|
|
||||||
+++ b/drivers/base/cacheinfo.c
|
|
||||||
@@ -148,7 +148,11 @@ static void cache_shared_cpu_map_remove(unsigned int cpu)
|
|
||||||
|
|
||||||
if (sibling == cpu) /* skip itself */
|
|
||||||
continue;
|
|
||||||
+
|
|
||||||
sib_cpu_ci = get_cpu_cacheinfo(sibling);
|
|
||||||
+ if (!sib_cpu_ci->info_list)
|
|
||||||
+ continue;
|
|
||||||
+
|
|
||||||
sib_leaf = sib_cpu_ci->info_list + index;
|
|
||||||
cpumask_clear_cpu(cpu, &sib_leaf->shared_cpu_map);
|
|
||||||
cpumask_clear_cpu(sibling, &this_leaf->shared_cpu_map);
|
|
||||||
@@ -159,6 +163,9 @@ static void cache_shared_cpu_map_remove(unsigned int cpu)
|
|
||||||
|
|
||||||
static void free_cache_attributes(unsigned int cpu)
|
|
||||||
{
|
|
||||||
+ if (!per_cpu_cacheinfo(cpu))
|
|
||||||
+ return;
|
|
||||||
+
|
|
||||||
cache_shared_cpu_map_remove(cpu);
|
|
||||||
|
|
||||||
kfree(per_cpu_cacheinfo(cpu));
|
|
||||||
@@ -514,8 +521,7 @@ static int cacheinfo_cpu_callback(struct notifier_block *nfb,
|
|
||||||
break;
|
|
||||||
case CPU_DEAD:
|
|
||||||
cache_remove_dev(cpu);
|
|
||||||
- if (per_cpu_cacheinfo(cpu))
|
|
||||||
- free_cache_attributes(cpu);
|
|
||||||
+ free_cache_attributes(cpu);
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
return notifier_from_errno(rc);
|
|
||||||
--
|
|
||||||
2.4.3
|
|
||||||
|
|
||||||
@ -1,81 +0,0 @@
|
|||||||
From 10d98bced414c6fc1d09db123e7f762d91b5ebea Mon Sep 17 00:00:00 2001
|
|
||||||
From: Johan Hovold <johan@kernel.org>
|
|
||||||
Date: Wed, 23 Sep 2015 11:41:42 -0700
|
|
||||||
Subject: [PATCH] USB: whiteheat: fix potential null-deref at probe
|
|
||||||
|
|
||||||
Fix potential null-pointer dereference at probe by making sure that the
|
|
||||||
required endpoints are present.
|
|
||||||
|
|
||||||
The whiteheat driver assumes there are at least five pairs of bulk
|
|
||||||
endpoints, of which the final pair is used for the "command port". An
|
|
||||||
attempt to bind to an interface with fewer bulk endpoints would
|
|
||||||
currently lead to an oops.
|
|
||||||
|
|
||||||
Fixes CVE-2015-5257.
|
|
||||||
|
|
||||||
Reported-by: Moein Ghasemzadeh <moein@istuary.com>
|
|
||||||
Cc: stable <stable@vger.kernel.org>
|
|
||||||
Signed-off-by: Johan Hovold <johan@kernel.org>
|
|
||||||
---
|
|
||||||
drivers/usb/serial/whiteheat.c | 31 +++++++++++++++++++++++++++++++
|
|
||||||
1 file changed, 31 insertions(+)
|
|
||||||
|
|
||||||
diff --git a/drivers/usb/serial/whiteheat.c b/drivers/usb/serial/whiteheat.c
|
|
||||||
index 6c3734d2b45a..d3ea90bef84d 100644
|
|
||||||
--- a/drivers/usb/serial/whiteheat.c
|
|
||||||
+++ b/drivers/usb/serial/whiteheat.c
|
|
||||||
@@ -80,6 +80,8 @@ static int whiteheat_firmware_download(struct usb_serial *serial,
|
|
||||||
static int whiteheat_firmware_attach(struct usb_serial *serial);
|
|
||||||
|
|
||||||
/* function prototypes for the Connect Tech WhiteHEAT serial converter */
|
|
||||||
+static int whiteheat_probe(struct usb_serial *serial,
|
|
||||||
+ const struct usb_device_id *id);
|
|
||||||
static int whiteheat_attach(struct usb_serial *serial);
|
|
||||||
static void whiteheat_release(struct usb_serial *serial);
|
|
||||||
static int whiteheat_port_probe(struct usb_serial_port *port);
|
|
||||||
@@ -116,6 +118,7 @@ static struct usb_serial_driver whiteheat_device = {
|
|
||||||
.description = "Connect Tech - WhiteHEAT",
|
|
||||||
.id_table = id_table_std,
|
|
||||||
.num_ports = 4,
|
|
||||||
+ .probe = whiteheat_probe,
|
|
||||||
.attach = whiteheat_attach,
|
|
||||||
.release = whiteheat_release,
|
|
||||||
.port_probe = whiteheat_port_probe,
|
|
||||||
@@ -217,6 +220,34 @@ static int whiteheat_firmware_attach(struct usb_serial *serial)
|
|
||||||
/*****************************************************************************
|
|
||||||
* Connect Tech's White Heat serial driver functions
|
|
||||||
*****************************************************************************/
|
|
||||||
+
|
|
||||||
+static int whiteheat_probe(struct usb_serial *serial,
|
|
||||||
+ const struct usb_device_id *id)
|
|
||||||
+{
|
|
||||||
+ struct usb_host_interface *iface_desc;
|
|
||||||
+ struct usb_endpoint_descriptor *endpoint;
|
|
||||||
+ size_t num_bulk_in = 0;
|
|
||||||
+ size_t num_bulk_out = 0;
|
|
||||||
+ size_t min_num_bulk;
|
|
||||||
+ unsigned int i;
|
|
||||||
+
|
|
||||||
+ iface_desc = serial->interface->cur_altsetting;
|
|
||||||
+
|
|
||||||
+ for (i = 0; i < iface_desc->desc.bNumEndpoints; i++) {
|
|
||||||
+ endpoint = &iface_desc->endpoint[i].desc;
|
|
||||||
+ if (usb_endpoint_is_bulk_in(endpoint))
|
|
||||||
+ ++num_bulk_in;
|
|
||||||
+ if (usb_endpoint_is_bulk_out(endpoint))
|
|
||||||
+ ++num_bulk_out;
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ min_num_bulk = COMMAND_PORT + 1;
|
|
||||||
+ if (num_bulk_in < min_num_bulk || num_bulk_out < min_num_bulk)
|
|
||||||
+ return -ENODEV;
|
|
||||||
+
|
|
||||||
+ return 0;
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
static int whiteheat_attach(struct usb_serial *serial)
|
|
||||||
{
|
|
||||||
struct usb_serial_port *command_port;
|
|
||||||
--
|
|
||||||
2.4.3
|
|
||||||
|
|
||||||
@ -1889,6 +1889,7 @@ CONFIG_USB_NET_RNDIS_WLAN=m
|
|||||||
CONFIG_USB_NET_KALMIA=m
|
CONFIG_USB_NET_KALMIA=m
|
||||||
CONFIG_USB_NET_QMI_WWAN=m
|
CONFIG_USB_NET_QMI_WWAN=m
|
||||||
CONFIG_USB_NET_SMSC75XX=m
|
CONFIG_USB_NET_SMSC75XX=m
|
||||||
|
CONFIG_USB_NET_CH9200=m
|
||||||
# CONFIG_WL_TI is not set
|
# CONFIG_WL_TI is not set
|
||||||
CONFIG_ZD1211RW=m
|
CONFIG_ZD1211RW=m
|
||||||
# CONFIG_ZD1211RW_DEBUG is not set
|
# CONFIG_ZD1211RW_DEBUG is not set
|
||||||
|
|||||||
13
kernel.spec
13
kernel.spec
@ -65,9 +65,9 @@ Summary: The Linux kernel
|
|||||||
# The next upstream release sublevel (base_sublevel+1)
|
# The next upstream release sublevel (base_sublevel+1)
|
||||||
%define upstream_sublevel %(echo $((%{base_sublevel} + 1)))
|
%define upstream_sublevel %(echo $((%{base_sublevel} + 1)))
|
||||||
# The rc snapshot level
|
# The rc snapshot level
|
||||||
%define rcrev 2
|
%define rcrev 3
|
||||||
# The git snapshot level
|
# The git snapshot level
|
||||||
%define gitrev 1
|
%define gitrev 0
|
||||||
# Set rpm version accordingly
|
# Set rpm version accordingly
|
||||||
%define rpmversion 4.%{upstream_sublevel}.0
|
%define rpmversion 4.%{upstream_sublevel}.0
|
||||||
%endif
|
%endif
|
||||||
@ -587,12 +587,6 @@ Patch509: ideapad-laptop-Add-Lenovo-Yoga-3-14-to-no_hw_rfkill-.patch
|
|||||||
|
|
||||||
Patch520: ARM-dts-Fix-Makefile-target-for-sun4i-a10-itead-itea.patch
|
Patch520: ARM-dts-Fix-Makefile-target-for-sun4i-a10-itead-itea.patch
|
||||||
|
|
||||||
#rhbz 1263762
|
|
||||||
Patch526: 0001-x86-cpu-cacheinfo-Fix-teardown-path.patch
|
|
||||||
|
|
||||||
#CVE-2015-5257 rhbz 1265607 1265612
|
|
||||||
Patch527: USB-whiteheat-fix-potential-null-deref-at-probe.patch
|
|
||||||
|
|
||||||
Patch904: kdbus.patch
|
Patch904: kdbus.patch
|
||||||
|
|
||||||
# END OF PATCH DEFINITIONS
|
# END OF PATCH DEFINITIONS
|
||||||
@ -2038,6 +2032,9 @@ fi
|
|||||||
#
|
#
|
||||||
#
|
#
|
||||||
%changelog
|
%changelog
|
||||||
|
* Mon Sep 28 2015 Laura Abbott <labbott@redhat.com> - 4.3.0-0.rc3.git0.1
|
||||||
|
- Linux v4.3-rc3
|
||||||
|
|
||||||
* Mon Sep 28 2015 Peter Robinson <pbrobinson@fedoraproject.org>
|
* Mon Sep 28 2015 Peter Robinson <pbrobinson@fedoraproject.org>
|
||||||
- Minor ARMv7 updates
|
- Minor ARMv7 updates
|
||||||
|
|
||||||
|
|||||||
3
sources
3
sources
@ -1,4 +1,3 @@
|
|||||||
3d5ea06d767e2f35c999eeadafc76523 linux-4.2.tar.xz
|
3d5ea06d767e2f35c999eeadafc76523 linux-4.2.tar.xz
|
||||||
4c964bfba54d65b5b54cc898baddecad perf-man-4.2.tar.gz
|
4c964bfba54d65b5b54cc898baddecad perf-man-4.2.tar.gz
|
||||||
ccf42975f84dac28605d8abced239c1d patch-4.3-rc2.xz
|
7b080fe7715b861b89b06868ed0b27f0 patch-4.3-rc3.xz
|
||||||
ea9a48b95631e7af3d274164aaf58271 patch-4.3-rc2-git1.xz
|
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user