4.12.9-200.fc25.gnu

31 files changed, 335 insertions, 160 deletions

diff --git a/freed-ora/current/f25/Back-out-qxl-atomic-delay.patch b/freed-ora/current/f25/Back-out-qxl-atomic-delay.patch
deleted file mode 100644
index 5bd8acff2..000000000
--- a/freed-ora/current/f25/Back-out-qxl-atomic-delay.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From 4bcc0c3835cbcc9f9c175f158e2ee502506b6e02 Mon Sep 17 00:00:00 2001
-From: Fedora Kernel Team <kernel-team@fedoraproject.org>
-Date: Thu, 3 Aug 2017 13:53:11 -0500
-Subject: [PATCH] Back out qxl atomic delay
-
----
- drivers/gpu/drm/qxl/qxl_display.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c
-index 4a340ef..058340a 100644
---- a/drivers/gpu/drm/qxl/qxl_display.c
-+++ b/drivers/gpu/drm/qxl/qxl_display.c
-@@ -575,6 +575,8 @@ static void qxl_cursor_atomic_update(struct drm_plane *plane,
- 	if (ret)
- 		return;
-
-+	cmd = (struct qxl_cursor_cmd *) qxl_release_map(qdev, release);
-+
- 	if (fb != old_state->fb) {
- 		obj = to_qxl_framebuffer(fb)->obj;
- 		user_bo = gem_to_qxl_bo(obj);
-@@ -612,7 +614,6 @@ static void qxl_cursor_atomic_update(struct drm_plane *plane,
- 		qxl_bo_kunmap(cursor_bo);
- 		qxl_bo_kunmap(user_bo);
-
--		cmd = (struct qxl_cursor_cmd *) qxl_release_map(qdev, release);
- 		cmd->u.set.visible = 1;
- 		cmd->u.set.shape = qxl_bo_physical_address(qdev,
- 							   cursor_bo, 0);
-@@ -623,7 +624,6 @@ static void qxl_cursor_atomic_update(struct drm_plane *plane,
- 		if (ret)
- 			goto out_free_release;
-
--		cmd = (struct qxl_cursor_cmd *) qxl_release_map(qdev, release);
- 		cmd->type = QXL_CURSOR_MOVE;
- 	}
-
--- 
-2.13.3
-
diff --git a/freed-ora/current/f25/baseconfig/CONFIG_GPIO_IT87 b/freed-ora/current/f25/baseconfig/CONFIG_GPIO_IT87
index aaeb504ac..00746d711 100644
--- a/freed-ora/current/f25/baseconfig/CONFIG_GPIO_IT87
+++ b/freed-ora/current/f25/baseconfig/CONFIG_GPIO_IT87
@@ -1 +1 @@
-# CONFIG_GPIO_IT87 is not set
+CONFIG_GPIO_IT87=m
diff --git a/freed-ora/current/f25/force-python3-in-kvm_stat.patch b/freed-ora/current/f25/force-python3-in-kvm_stat.patch
deleted file mode 100644
index 38fca1b3c..000000000
--- a/freed-ora/current/f25/force-python3-in-kvm_stat.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-From fc6a72140ef515447743c840674b1aa86b1a4812 Mon Sep 17 00:00:00 2001
-From: Fedora Kernel Team <kernel-team@fedoraproject.org>
-Date: Tue, 25 Jul 2017 12:38:46 -0500
-Subject: [PATCH] Force python3 in kvm_stat
-
----
- tools/kvm/kvm_stat/kvm_stat | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/tools/kvm/kvm_stat/kvm_stat b/tools/kvm/kvm_stat/kvm_stat
-index 8f74ed8..12a8cbb 100755
---- a/tools/kvm/kvm_stat/kvm_stat
-+++ b/tools/kvm/kvm_stat/kvm_stat
-@@ -1,4 +1,4 @@
--#!/usr/bin/python
-+#!/usr/bin/python3
- #
- # top-like utility for displaying kvm statistics
- #
--- 
-2.9.4
-
diff --git a/freed-ora/current/f25/kernel-aarch64-debug.config b/freed-ora/current/f25/kernel-aarch64-debug.config
index f654c4e08..d2cee010a 100644
--- a/freed-ora/current/f25/kernel-aarch64-debug.config
+++ b/freed-ora/current/f25/kernel-aarch64-debug.config
@@ -1707,7 +1707,7 @@ CONFIG_GPIO_EXAR=m
 CONFIG_GPIO_GENERIC_PLATFORM=y
 CONFIG_GPIO_GENERIC=y
 # CONFIG_GPIO_GRGPIO is not set
-# CONFIG_GPIO_IT87 is not set
+CONFIG_GPIO_IT87=m
 CONFIG_GPIOLIB=y
 # CONFIG_GPIO_MAX7300 is not set
 # CONFIG_GPIO_MAX7301 is not set
diff --git a/freed-ora/current/f25/kernel-aarch64.config b/freed-ora/current/f25/kernel-aarch64.config
index 78dd619a0..506381193 100644
--- a/freed-ora/current/f25/kernel-aarch64.config
+++ b/freed-ora/current/f25/kernel-aarch64.config
@@ -1690,7 +1690,7 @@ CONFIG_GPIO_EXAR=m
 CONFIG_GPIO_GENERIC_PLATFORM=y
 CONFIG_GPIO_GENERIC=y
 # CONFIG_GPIO_GRGPIO is not set
-# CONFIG_GPIO_IT87 is not set
+CONFIG_GPIO_IT87=m
 CONFIG_GPIOLIB=y
 # CONFIG_GPIO_MAX7300 is not set
 # CONFIG_GPIO_MAX7301 is not set
diff --git a/freed-ora/current/f25/kernel-armv7hl-debug.config b/freed-ora/current/f25/kernel-armv7hl-debug.config
index 491c5050a..f44e6f206 100644
--- a/freed-ora/current/f25/kernel-armv7hl-debug.config
+++ b/freed-ora/current/f25/kernel-armv7hl-debug.config
@@ -1833,7 +1833,7 @@ CONFIG_GPIO_EXAR=m
 CONFIG_GPIO_GENERIC_PLATFORM=y
 CONFIG_GPIO_GENERIC=y
 # CONFIG_GPIO_GRGPIO is not set
-# CONFIG_GPIO_IT87 is not set
+CONFIG_GPIO_IT87=m
 CONFIG_GPIOLIB=y
 # CONFIG_GPIO_MAX7300 is not set
 CONFIG_GPIO_MAX7301=m
diff --git a/freed-ora/current/f25/kernel-armv7hl-lpae-debug.config b/freed-ora/current/f25/kernel-armv7hl-lpae-debug.config
index 5f58e50e6..96a678b19 100644
--- a/freed-ora/current/f25/kernel-armv7hl-lpae-debug.config
+++ b/freed-ora/current/f25/kernel-armv7hl-lpae-debug.config
@@ -1740,7 +1740,7 @@ CONFIG_GPIO_EXAR=m
 CONFIG_GPIO_GENERIC_PLATFORM=y
 CONFIG_GPIO_GENERIC=y
 # CONFIG_GPIO_GRGPIO is not set
-# CONFIG_GPIO_IT87 is not set
+CONFIG_GPIO_IT87=m
 CONFIG_GPIOLIB=y
 # CONFIG_GPIO_MAX7300 is not set
 CONFIG_GPIO_MAX7301=m
diff --git a/freed-ora/current/f25/kernel-armv7hl-lpae.config b/freed-ora/current/f25/kernel-armv7hl-lpae.config
index a89d4097f..918c6f25d 100644
--- a/freed-ora/current/f25/kernel-armv7hl-lpae.config
+++ b/freed-ora/current/f25/kernel-armv7hl-lpae.config
@@ -1723,7 +1723,7 @@ CONFIG_GPIO_EXAR=m
 CONFIG_GPIO_GENERIC_PLATFORM=y
 CONFIG_GPIO_GENERIC=y
 # CONFIG_GPIO_GRGPIO is not set
-# CONFIG_GPIO_IT87 is not set
+CONFIG_GPIO_IT87=m
 CONFIG_GPIOLIB=y
 # CONFIG_GPIO_MAX7300 is not set
 CONFIG_GPIO_MAX7301=m
diff --git a/freed-ora/current/f25/kernel-armv7hl.config b/freed-ora/current/f25/kernel-armv7hl.config
index 4f5db4a31..8fd8e5fc8 100644
--- a/freed-ora/current/f25/kernel-armv7hl.config
+++ b/freed-ora/current/f25/kernel-armv7hl.config
@@ -1816,7 +1816,7 @@ CONFIG_GPIO_EXAR=m
 CONFIG_GPIO_GENERIC_PLATFORM=y
 CONFIG_GPIO_GENERIC=y
 # CONFIG_GPIO_GRGPIO is not set
-# CONFIG_GPIO_IT87 is not set
+CONFIG_GPIO_IT87=m
 CONFIG_GPIOLIB=y
 # CONFIG_GPIO_MAX7300 is not set
 CONFIG_GPIO_MAX7301=m
diff --git a/freed-ora/current/f25/kernel-i686-PAE.config b/freed-ora/current/f25/kernel-i686-PAE.config
index 799982ba4..8f51814d5 100644
--- a/freed-ora/current/f25/kernel-i686-PAE.config
+++ b/freed-ora/current/f25/kernel-i686-PAE.config
@@ -1583,7 +1583,7 @@ CONFIG_GPIO_EXAR=m
 # CONFIG_GPIO_GRGPIO is not set
 CONFIG_GPIO_ICH=m
 # CONFIG_GPIO_INTEL_MID is not set
-# CONFIG_GPIO_IT87 is not set
+CONFIG_GPIO_IT87=m
 CONFIG_GPIOLIB=y
 # CONFIG_GPIO_LYNXPOINT is not set
 # CONFIG_GPIO_MAX7300 is not set
diff --git a/freed-ora/current/f25/kernel-i686-PAEdebug.config b/freed-ora/current/f25/kernel-i686-PAEdebug.config
index 15740cc5f..1e7bd5234 100644
--- a/freed-ora/current/f25/kernel-i686-PAEdebug.config
+++ b/freed-ora/current/f25/kernel-i686-PAEdebug.config
@@ -1601,7 +1601,7 @@ CONFIG_GPIO_EXAR=m
 # CONFIG_GPIO_GRGPIO is not set
 CONFIG_GPIO_ICH=m
 # CONFIG_GPIO_INTEL_MID is not set
-# CONFIG_GPIO_IT87 is not set
+CONFIG_GPIO_IT87=m
 CONFIG_GPIOLIB=y
 # CONFIG_GPIO_LYNXPOINT is not set
 # CONFIG_GPIO_MAX7300 is not set
diff --git a/freed-ora/current/f25/kernel-i686-debug.config b/freed-ora/current/f25/kernel-i686-debug.config
index b9bd24818..dfb59bf62 100644
--- a/freed-ora/current/f25/kernel-i686-debug.config
+++ b/freed-ora/current/f25/kernel-i686-debug.config
@@ -1601,7 +1601,7 @@ CONFIG_GPIO_EXAR=m
 # CONFIG_GPIO_GRGPIO is not set
 CONFIG_GPIO_ICH=m
 # CONFIG_GPIO_INTEL_MID is not set
-# CONFIG_GPIO_IT87 is not set
+CONFIG_GPIO_IT87=m
 CONFIG_GPIOLIB=y
 # CONFIG_GPIO_LYNXPOINT is not set
 # CONFIG_GPIO_MAX7300 is not set
diff --git a/freed-ora/current/f25/kernel-i686.config b/freed-ora/current/f25/kernel-i686.config
index c568ac5ff..42393fec0 100644
--- a/freed-ora/current/f25/kernel-i686.config
+++ b/freed-ora/current/f25/kernel-i686.config
@@ -1583,7 +1583,7 @@ CONFIG_GPIO_EXAR=m
 # CONFIG_GPIO_GRGPIO is not set
 CONFIG_GPIO_ICH=m
 # CONFIG_GPIO_INTEL_MID is not set
-# CONFIG_GPIO_IT87 is not set
+CONFIG_GPIO_IT87=m
 CONFIG_GPIOLIB=y
 # CONFIG_GPIO_LYNXPOINT is not set
 # CONFIG_GPIO_MAX7300 is not set
diff --git a/freed-ora/current/f25/kernel-ppc64-debug.config b/freed-ora/current/f25/kernel-ppc64-debug.config
index 6cc943f6c..51167bc5d 100644
--- a/freed-ora/current/f25/kernel-ppc64-debug.config
+++ b/freed-ora/current/f25/kernel-ppc64-debug.config
@@ -1513,7 +1513,7 @@ CONFIG_GPIO_EXAR=m
 # CONFIG_GPIO_FTGPIO010 is not set
 # CONFIG_GPIO_GENERIC_PLATFORM is not set
 # CONFIG_GPIO_GRGPIO is not set
-# CONFIG_GPIO_IT87 is not set
+CONFIG_GPIO_IT87=m
 CONFIG_GPIOLIB=y
 # CONFIG_GPIO_MAX7300 is not set
 # CONFIG_GPIO_MAX7301 is not set
diff --git a/freed-ora/current/f25/kernel-ppc64.config b/freed-ora/current/f25/kernel-ppc64.config
index 112cbde30..9f0bd9ebf 100644
--- a/freed-ora/current/f25/kernel-ppc64.config
+++ b/freed-ora/current/f25/kernel-ppc64.config
@@ -1495,7 +1495,7 @@ CONFIG_GPIO_EXAR=m
 # CONFIG_GPIO_FTGPIO010 is not set
 # CONFIG_GPIO_GENERIC_PLATFORM is not set
 # CONFIG_GPIO_GRGPIO is not set
-# CONFIG_GPIO_IT87 is not set
+CONFIG_GPIO_IT87=m
 CONFIG_GPIOLIB=y
 # CONFIG_GPIO_MAX7300 is not set
 # CONFIG_GPIO_MAX7301 is not set
diff --git a/freed-ora/current/f25/kernel-ppc64le-debug.config b/freed-ora/current/f25/kernel-ppc64le-debug.config
index 1b565f770..7b9fcb405 100644
--- a/freed-ora/current/f25/kernel-ppc64le-debug.config
+++ b/freed-ora/current/f25/kernel-ppc64le-debug.config
@@ -1467,7 +1467,7 @@ CONFIG_GPIO_EXAR=m
 # CONFIG_GPIO_FTGPIO010 is not set
 # CONFIG_GPIO_GENERIC_PLATFORM is not set
 # CONFIG_GPIO_GRGPIO is not set
-# CONFIG_GPIO_IT87 is not set
+CONFIG_GPIO_IT87=m
 CONFIG_GPIOLIB=y
 # CONFIG_GPIO_MAX7300 is not set
 # CONFIG_GPIO_MAX7301 is not set
diff --git a/freed-ora/current/f25/kernel-ppc64le.config b/freed-ora/current/f25/kernel-ppc64le.config
index 7ab010684..9f049cecd 100644
--- a/freed-ora/current/f25/kernel-ppc64le.config
+++ b/freed-ora/current/f25/kernel-ppc64le.config
@@ -1449,7 +1449,7 @@ CONFIG_GPIO_EXAR=m
 # CONFIG_GPIO_FTGPIO010 is not set
 # CONFIG_GPIO_GENERIC_PLATFORM is not set
 # CONFIG_GPIO_GRGPIO is not set
-# CONFIG_GPIO_IT87 is not set
+CONFIG_GPIO_IT87=m
 CONFIG_GPIOLIB=y
 # CONFIG_GPIO_MAX7300 is not set
 # CONFIG_GPIO_MAX7301 is not set
diff --git a/freed-ora/current/f25/kernel-ppc64p7-debug.config b/freed-ora/current/f25/kernel-ppc64p7-debug.config
index 4bf5e90ac..9f555f036 100644
--- a/freed-ora/current/f25/kernel-ppc64p7-debug.config
+++ b/freed-ora/current/f25/kernel-ppc64p7-debug.config
@@ -1466,7 +1466,7 @@ CONFIG_GPIO_EXAR=m
 # CONFIG_GPIO_FTGPIO010 is not set
 # CONFIG_GPIO_GENERIC_PLATFORM is not set
 # CONFIG_GPIO_GRGPIO is not set
-# CONFIG_GPIO_IT87 is not set
+CONFIG_GPIO_IT87=m
 CONFIG_GPIOLIB=y
 # CONFIG_GPIO_MAX7300 is not set
 # CONFIG_GPIO_MAX7301 is not set
diff --git a/freed-ora/current/f25/kernel-ppc64p7.config b/freed-ora/current/f25/kernel-ppc64p7.config
index 5b2255438..555bfc602 100644
--- a/freed-ora/current/f25/kernel-ppc64p7.config
+++ b/freed-ora/current/f25/kernel-ppc64p7.config
@@ -1448,7 +1448,7 @@ CONFIG_GPIO_EXAR=m
 # CONFIG_GPIO_FTGPIO010 is not set
 # CONFIG_GPIO_GENERIC_PLATFORM is not set
 # CONFIG_GPIO_GRGPIO is not set
-# CONFIG_GPIO_IT87 is not set
+CONFIG_GPIO_IT87=m
 CONFIG_GPIOLIB=y
 # CONFIG_GPIO_MAX7300 is not set
 # CONFIG_GPIO_MAX7301 is not set
diff --git a/freed-ora/current/f25/kernel-s390x-debug.config b/freed-ora/current/f25/kernel-s390x-debug.config
index c0b744224..bb89af2f0 100644
--- a/freed-ora/current/f25/kernel-s390x-debug.config
+++ b/freed-ora/current/f25/kernel-s390x-debug.config
@@ -1436,7 +1436,7 @@ CONFIG_GPIO_EXAR=m
 # CONFIG_GPIO_FTGPIO010 is not set
 # CONFIG_GPIO_GENERIC_PLATFORM is not set
 # CONFIG_GPIO_GRGPIO is not set
-# CONFIG_GPIO_IT87 is not set
+CONFIG_GPIO_IT87=m
 # CONFIG_GPIOLIB is not set
 # CONFIG_GPIO_MAX7300 is not set
 # CONFIG_GPIO_MAX7301 is not set
diff --git a/freed-ora/current/f25/kernel-s390x.config b/freed-ora/current/f25/kernel-s390x.config
index 23e095e6d..bfe09237d 100644
--- a/freed-ora/current/f25/kernel-s390x.config
+++ b/freed-ora/current/f25/kernel-s390x.config
@@ -1418,7 +1418,7 @@ CONFIG_GPIO_EXAR=m
 # CONFIG_GPIO_FTGPIO010 is not set
 # CONFIG_GPIO_GENERIC_PLATFORM is not set
 # CONFIG_GPIO_GRGPIO is not set
-# CONFIG_GPIO_IT87 is not set
+CONFIG_GPIO_IT87=m
 # CONFIG_GPIOLIB is not set
 # CONFIG_GPIO_MAX7300 is not set
 # CONFIG_GPIO_MAX7301 is not set
diff --git a/freed-ora/current/f25/kernel-x86_64-debug.config b/freed-ora/current/f25/kernel-x86_64-debug.config
index 79d34a652..b4344c2a0 100644
--- a/freed-ora/current/f25/kernel-x86_64-debug.config
+++ b/freed-ora/current/f25/kernel-x86_64-debug.config
@@ -1642,7 +1642,7 @@ CONFIG_GPIO_EXAR=m
 # CONFIG_GPIO_GRGPIO is not set
 CONFIG_GPIO_ICH=m
 # CONFIG_GPIO_INTEL_MID is not set
-# CONFIG_GPIO_IT87 is not set
+CONFIG_GPIO_IT87=m
 CONFIG_GPIOLIB=y
 # CONFIG_GPIO_LYNXPOINT is not set
 # CONFIG_GPIO_MAX7300 is not set
diff --git a/freed-ora/current/f25/kernel-x86_64.config b/freed-ora/current/f25/kernel-x86_64.config
index c417f8bac..24925e1ab 100644
--- a/freed-ora/current/f25/kernel-x86_64.config
+++ b/freed-ora/current/f25/kernel-x86_64.config
@@ -1624,7 +1624,7 @@ CONFIG_GPIO_EXAR=m
 # CONFIG_GPIO_GRGPIO is not set
 CONFIG_GPIO_ICH=m
 # CONFIG_GPIO_INTEL_MID is not set
-# CONFIG_GPIO_IT87 is not set
+CONFIG_GPIO_IT87=m
 CONFIG_GPIOLIB=y
 # CONFIG_GPIO_LYNXPOINT is not set
 # CONFIG_GPIO_MAX7300 is not set
diff --git a/freed-ora/current/f25/kernel.spec b/freed-ora/current/f25/kernel.spec
index ac3dde35b..3d14ce551 100644
--- a/freed-ora/current/f25/kernel.spec
+++ b/freed-ora/current/f25/kernel.spec
@@ -92,7 +92,7 @@ Summary: The Linux kernel
 %if 0%{?released_kernel}
 
 # Do we have a -stable update to apply?
-%define stable_update 8
+%define stable_update 9
 # Set rpm version accordingly
 %if 0%{?stable_update}
 %define stablerev %{stable_update}
@@ -596,9 +596,6 @@ Patch122: Input-synaptics-pin-3-touches-when-the-firmware-repo.patch
 
 Patch123: firmware-Drop-WARN-from-usermodehelper_read_trylock-.patch
 
-# Because the python 3 transition is fail
-Patch124: force-python3-in-kvm_stat.patch
-
 # 200 - x86 / secureboot
 
 Patch201: efi-lockdown.patch
@@ -720,15 +717,17 @@ Patch704: input-rmi4-remove-the-need-for-artifical-IRQ.patch
 # rhbz 1476467
 Patch706: Fix-for-module-sig-verification.patch
 
-# rhbz 1462381
-Patch707: Back-out-qxl-atomic-delay.patch
-
-# CVE-2017-12134 rhbz 1477656 1481786
-Patch708: xsa229.patch
-
 # request for bug fix
 Patch709: iio-race-fix.patch
 
+# rhbz 1485086
+Patch710: pci-mark-amd-stoney-gpu-ats-as-broken.patch
+
+# rhbz 1480829
+Patch711: rt2800-fix-TX_PIN_CFG-setting-for-non-MT7620-chips.patch
+
+# CVE-2017-7558 rhbz 1480266 1484810
+Patch712: net-sctp-Avoid-out-of-bounds-reads-from-address-storage.patch
 
 # END OF PATCH DEFINITIONS
 
@@ -895,6 +894,7 @@ Obsoletes: cpufreq-utils < 1:009-0.6.p1
 Obsoletes: cpufrequtils < 1:009-0.6.p1
 Obsoletes: cpuspeed < 1:1.5-16
 Requires: kernel-libre-tools-libs = %{version}-%{release}
+%define __requires_exclude ^%{_bindir}/python
 %description -n kernel-libre-tools
 This package contains the tools/ directory from the kernel source
 and the supporting documentation.
@@ -2399,6 +2399,19 @@ fi
 #
 #
 %changelog
+* Fri Aug 25 2017 Alexandre Oliva <lxoliva@fsfla.org> -libre
+- GNU Linux-libre 4.12.9-gnu.
+
+* Fri Aug 25 2017 Justin M. Forbes <jforbes@fedoraproject.org> - 4.12.9-200
+- Linux v4.12.9
+- For for AMD Stoney GPU (rhbz 1485086)
+- Fix for RT3573 regression (rhbz 1480829)
+- Fix for CVE-2017-7558 (rhbz 1480266 1484810)
+- Fix for kvm_stat (rhbz 1483527)
+
+* Thu Aug 17 2017 Justin M. Forbes <jforbes@fedoraproject.org>
+- Fix for vmalloc_32 crash (rhbz 1482249 1482570)
+
 * Thu Aug 17 2017 Alexandre Oliva <lxoliva@fsfla.org> -libre
 - GNU Linux-libre 4.12.8-gnu.
 
diff --git a/freed-ora/current/f25/net-sctp-Avoid-out-of-bounds-reads-from-address-storage.patch b/freed-ora/current/f25/net-sctp-Avoid-out-of-bounds-reads-from-address-storage.patch
new file mode 100644
index 000000000..84968f03f
--- /dev/null
+++ b/freed-ora/current/f25/net-sctp-Avoid-out-of-bounds-reads-from-address-storage.patch
@@ -0,0 +1,196 @@
+From patchwork Wed Aug 23 11:27:13 2017
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+Subject: [net] sctp: Avoid out-of-bounds reads from address storage
+From: Stefano Brivio <sbrivio@redhat.com>
+X-Patchwork-Id: 9917151
+Message-Id: <7763d91bcf14744e49f09fc4bec0fb22c097774f.1502384055.git.sbrivio@redhat.com>
+To: "David S . Miller" <davem@davemloft.net>, netdev@vger.kernel.org,
+ linux-kernel@vger.kernel.org, stable@vger.kernel.org
+Cc: Xin Long <lucien.xin@gmail.com>, Vlad Yasevich <vyasevich@gmail.com>,
+ Neil Horman <nhorman@tuxdriver.com>, linux-sctp@vger.kernel.org
+Date: Wed, 23 Aug 2017 13:27:13 +0200
+
+inet_diag_msg_sctp{,l}addr_fill() and sctp_get_sctp_info() copy
+sizeof(sockaddr_storage) bytes to fill in sockaddr structs used
+to export diagnostic information to userspace.
+
+However, the memory allocated to store sockaddr information is
+smaller than that and depends on the address family, so we leak
+up to 100 uninitialized bytes to userspace. Just use the size of
+the source structs instead, in all the three cases this is what
+userspace expects. Zero out the remaining memory.
+
+Unused bytes (i.e. when IPv4 addresses are used) in source
+structs sctp_sockaddr_entry and sctp_transport are already
+cleared by sctp_add_bind_addr() and sctp_transport_new(),
+respectively.
+
+Noticed while testing KASAN-enabled kernel with 'ss':
+
+[ 2326.885243] BUG: KASAN: slab-out-of-bounds in inet_sctp_diag_fill+0x42c/0x6c0 [sctp_diag] at addr ffff881be8779800
+[ 2326.896800] Read of size 128 by task ss/9527
+[ 2326.901564] CPU: 0 PID: 9527 Comm: ss Not tainted 4.11.0-22.el7a.x86_64 #1
+[ 2326.909236] Hardware name: Dell Inc. PowerEdge R730/072T6D, BIOS 2.4.3 01/17/2017
+[ 2326.917585] Call Trace:
+[ 2326.920312]  dump_stack+0x63/0x8d
+[ 2326.924014]  kasan_object_err+0x21/0x70
+[ 2326.928295]  kasan_report+0x288/0x540
+[ 2326.932380]  ? inet_sctp_diag_fill+0x42c/0x6c0 [sctp_diag]
+[ 2326.938500]  ? skb_put+0x8b/0xd0
+[ 2326.942098]  ? memset+0x31/0x40
+[ 2326.945599]  check_memory_region+0x13c/0x1a0
+[ 2326.950362]  memcpy+0x23/0x50
+[ 2326.953669]  inet_sctp_diag_fill+0x42c/0x6c0 [sctp_diag]
+[ 2326.959596]  ? inet_diag_msg_sctpasoc_fill+0x460/0x460 [sctp_diag]
+[ 2326.966495]  ? __lock_sock+0x102/0x150
+[ 2326.970671]  ? sock_def_wakeup+0x60/0x60
+[ 2326.975048]  ? remove_wait_queue+0xc0/0xc0
+[ 2326.979619]  sctp_diag_dump+0x44a/0x760 [sctp_diag]
+[ 2326.985063]  ? sctp_ep_dump+0x280/0x280 [sctp_diag]
+[ 2326.990504]  ? memset+0x31/0x40
+[ 2326.994007]  ? mutex_lock+0x12/0x40
+[ 2326.997900]  __inet_diag_dump+0x57/0xb0 [inet_diag]
+[ 2327.003340]  ? __sys_sendmsg+0x150/0x150
+[ 2327.007715]  inet_diag_dump+0x4d/0x80 [inet_diag]
+[ 2327.012979]  netlink_dump+0x1e6/0x490
+[ 2327.017064]  __netlink_dump_start+0x28e/0x2c0
+[ 2327.021924]  inet_diag_handler_cmd+0x189/0x1a0 [inet_diag]
+[ 2327.028045]  ? inet_diag_rcv_msg_compat+0x1b0/0x1b0 [inet_diag]
+[ 2327.034651]  ? inet_diag_dump_compat+0x190/0x190 [inet_diag]
+[ 2327.040965]  ? __netlink_lookup+0x1b9/0x260
+[ 2327.045631]  sock_diag_rcv_msg+0x18b/0x1e0
+[ 2327.050199]  netlink_rcv_skb+0x14b/0x180
+[ 2327.054574]  ? sock_diag_bind+0x60/0x60
+[ 2327.058850]  sock_diag_rcv+0x28/0x40
+[ 2327.062837]  netlink_unicast+0x2e7/0x3b0
+[ 2327.067212]  ? netlink_attachskb+0x330/0x330
+[ 2327.071975]  ? kasan_check_write+0x14/0x20
+[ 2327.076544]  netlink_sendmsg+0x5be/0x730
+[ 2327.080918]  ? netlink_unicast+0x3b0/0x3b0
+[ 2327.085486]  ? kasan_check_write+0x14/0x20
+[ 2327.090057]  ? selinux_socket_sendmsg+0x24/0x30
+[ 2327.095109]  ? netlink_unicast+0x3b0/0x3b0
+[ 2327.099678]  sock_sendmsg+0x74/0x80
+[ 2327.103567]  ___sys_sendmsg+0x520/0x530
+[ 2327.107844]  ? __get_locked_pte+0x178/0x200
+[ 2327.112510]  ? copy_msghdr_from_user+0x270/0x270
+[ 2327.117660]  ? vm_insert_page+0x360/0x360
+[ 2327.122133]  ? vm_insert_pfn_prot+0xb4/0x150
+[ 2327.126895]  ? vm_insert_pfn+0x32/0x40
+[ 2327.131077]  ? vvar_fault+0x71/0xd0
+[ 2327.134968]  ? special_mapping_fault+0x69/0x110
+[ 2327.140022]  ? __do_fault+0x42/0x120
+[ 2327.144008]  ? __handle_mm_fault+0x1062/0x17a0
+[ 2327.148965]  ? __fget_light+0xa7/0xc0
+[ 2327.153049]  __sys_sendmsg+0xcb/0x150
+[ 2327.157133]  ? __sys_sendmsg+0xcb/0x150
+[ 2327.161409]  ? SyS_shutdown+0x140/0x140
+[ 2327.165688]  ? exit_to_usermode_loop+0xd0/0xd0
+[ 2327.170646]  ? __do_page_fault+0x55d/0x620
+[ 2327.175216]  ? __sys_sendmsg+0x150/0x150
+[ 2327.179591]  SyS_sendmsg+0x12/0x20
+[ 2327.183384]  do_syscall_64+0xe3/0x230
+[ 2327.187471]  entry_SYSCALL64_slow_path+0x25/0x25
+[ 2327.192622] RIP: 0033:0x7f41d18fa3b0
+[ 2327.196608] RSP: 002b:00007ffc3b731218 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
+[ 2327.205055] RAX: ffffffffffffffda RBX: 00007ffc3b731380 RCX: 00007f41d18fa3b0
+[ 2327.213017] RDX: 0000000000000000 RSI: 00007ffc3b731340 RDI: 0000000000000003
+[ 2327.220978] RBP: 0000000000000002 R08: 0000000000000004 R09: 0000000000000040
+[ 2327.228939] R10: 00007ffc3b730f30 R11: 0000000000000246 R12: 0000000000000003
+[ 2327.236901] R13: 00007ffc3b731340 R14: 00007ffc3b7313d0 R15: 0000000000000084
+[ 2327.244865] Object at ffff881be87797e0, in cache kmalloc-64 size: 64
+[ 2327.251953] Allocated:
+[ 2327.254581] PID = 9484
+[ 2327.257215]  save_stack_trace+0x1b/0x20
+[ 2327.261485]  save_stack+0x46/0xd0
+[ 2327.265179]  kasan_kmalloc+0xad/0xe0
+[ 2327.269165]  kmem_cache_alloc_trace+0xe6/0x1d0
+[ 2327.274138]  sctp_add_bind_addr+0x58/0x180 [sctp]
+[ 2327.279400]  sctp_do_bind+0x208/0x310 [sctp]
+[ 2327.284176]  sctp_bind+0x61/0xa0 [sctp]
+[ 2327.288455]  inet_bind+0x5f/0x3a0
+[ 2327.292151]  SYSC_bind+0x1a4/0x1e0
+[ 2327.295944]  SyS_bind+0xe/0x10
+[ 2327.299349]  do_syscall_64+0xe3/0x230
+[ 2327.303433]  return_from_SYSCALL_64+0x0/0x6a
+[ 2327.308194] Freed:
+[ 2327.310434] PID = 4131
+[ 2327.313065]  save_stack_trace+0x1b/0x20
+[ 2327.317344]  save_stack+0x46/0xd0
+[ 2327.321040]  kasan_slab_free+0x73/0xc0
+[ 2327.325220]  kfree+0x96/0x1a0
+[ 2327.328530]  dynamic_kobj_release+0x15/0x40
+[ 2327.333195]  kobject_release+0x99/0x1e0
+[ 2327.337472]  kobject_put+0x38/0x70
+[ 2327.341266]  free_notes_attrs+0x66/0x80
+[ 2327.345545]  mod_sysfs_teardown+0x1a5/0x270
+[ 2327.350211]  free_module+0x20/0x2a0
+[ 2327.354099]  SyS_delete_module+0x2cb/0x2f0
+[ 2327.358667]  do_syscall_64+0xe3/0x230
+[ 2327.362750]  return_from_SYSCALL_64+0x0/0x6a
+[ 2327.367510] Memory state around the buggy address:
+[ 2327.372855]  ffff881be8779700: fc fc fc fc 00 00 00 00 00 00 00 00 fc fc fc fc
+[ 2327.380914]  ffff881be8779780: fb fb fb fb fb fb fb fb fc fc fc fc 00 00 00 00
+[ 2327.388972] >ffff881be8779800: 00 00 00 00 fc fc fc fc fb fb fb fb fb fb fb fb
+[ 2327.397031]                                ^
+[ 2327.401792]  ffff881be8779880: fc fc fc fc fb fb fb fb fb fb fb fb fc fc fc fc
+[ 2327.409850]  ffff881be8779900: 00 00 00 00 00 04 fc fc fc fc fc fc 00 00 00 00
+[ 2327.417907] ==================================================================
+
+This fixes CVE-2017-7558.
+
+References: https://bugzilla.redhat.com/show_bug.cgi?id=1480266
+Fixes: 8f840e47f190 ("sctp: add the sctp_diag.c file")
+Cc: <stable@vger.kernel.org> # 4.7+
+Cc: Xin Long <lucien.xin@gmail.com>
+Cc: Vlad Yasevich <vyasevich@gmail.com>
+Cc: Neil Horman <nhorman@tuxdriver.com>
+Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
+Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+Reviewed-by: Xin Long <lucien.xin@gmail.com>
+---
+ net/sctp/sctp_diag.c | 7 +++++--
+ net/sctp/socket.c    | 3 +--
+ 2 files changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/net/sctp/sctp_diag.c b/net/sctp/sctp_diag.c
+index 9a647214a91e..e99518e79b52 100644
+--- a/net/sctp/sctp_diag.c
++++ b/net/sctp/sctp_diag.c
+@@ -70,7 +70,8 @@ static int inet_diag_msg_sctpladdrs_fill(struct sk_buff *skb,
+ 
+ 	info = nla_data(attr);
+ 	list_for_each_entry_rcu(laddr, address_list, list) {
+-		memcpy(info, &laddr->a, addrlen);
++		memcpy(info, &laddr->a, sizeof(laddr->a));
++		memset(info + sizeof(laddr->a), 0, addrlen - sizeof(laddr->a));
+ 		info += addrlen;
+ 	}
+ 
+@@ -93,7 +94,9 @@ static int inet_diag_msg_sctpaddrs_fill(struct sk_buff *skb,
+ 	info = nla_data(attr);
+ 	list_for_each_entry(from, &asoc->peer.transport_addr_list,
+ 			    transports) {
+-		memcpy(info, &from->ipaddr, addrlen);
++		memcpy(info, &from->ipaddr, sizeof(from->ipaddr));
++		memset(info + sizeof(from->ipaddr), 0,
++		       addrlen - sizeof(from->ipaddr));
+ 		info += addrlen;
+ 	}
+ 
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index 1db478e34520..8d760863bc41 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -4538,8 +4538,7 @@ int sctp_get_sctp_info(struct sock *sk, struct sctp_association *asoc,
+ 	info->sctpi_ictrlchunks = asoc->stats.ictrlchunks;
+ 
+ 	prim = asoc->peer.primary_path;
+-	memcpy(&info->sctpi_p_address, &prim->ipaddr,
+-	       sizeof(struct sockaddr_storage));
++	memcpy(&info->sctpi_p_address, &prim->ipaddr, sizeof(prim->ipaddr));
+ 	info->sctpi_p_state = prim->state;
+ 	info->sctpi_p_cwnd = prim->cwnd;
+ 	info->sctpi_p_srtt = prim->srtt;
diff --git a/freed-ora/current/f25/patch-4.12-gnu-4.12.8-gnu.xz.sign b/freed-ora/current/f25/patch-4.12-gnu-4.12.8-gnu.xz.sign
deleted file mode 100644
index ca850d4de..000000000
--- a/freed-ora/current/f25/patch-4.12-gnu-4.12.8-gnu.xz.sign
+++ /dev/null
@@ -1,6 +0,0 @@
------BEGIN PGP SIGNATURE-----
-
-iF0EABECAB0WIQRHRALIxYLa++OJxCe8t8+Hfn1HpwUCWZVetAAKCRC8t8+Hfn1H
-pzGFAKCKcuYEGAPUP7niyg14btWWzZkfxwCcDTK0vpOiVcLA6OkwEOixNyHiWe8=
-=yiYh
------END PGP SIGNATURE-----
diff --git a/freed-ora/current/f25/patch-4.12-gnu-4.12.9-gnu.xz.sign b/freed-ora/current/f25/patch-4.12-gnu-4.12.9-gnu.xz.sign
new file mode 100644
index 000000000..dbcd980b3
--- /dev/null
+++ b/freed-ora/current/f25/patch-4.12-gnu-4.12.9-gnu.xz.sign
@@ -0,0 +1,6 @@
+-----BEGIN PGP SIGNATURE-----
+
+iF0EABECAB0WIQRHRALIxYLa++OJxCe8t8+Hfn1HpwUCWaAxQAAKCRC8t8+Hfn1H
+p8XWAJ9V59PVbR7olWwTjGewSxKyFkaN3gCgj5LDy4UHLsqog8GvnjJj8NLxJjI=
+=OOqK
+-----END PGP SIGNATURE-----
diff --git a/freed-ora/current/f25/pci-mark-amd-stoney-gpu-ats-as-broken.patch b/freed-ora/current/f25/pci-mark-amd-stoney-gpu-ats-as-broken.patch
new file mode 100644
index 000000000..167c40223
--- /dev/null
+++ b/freed-ora/current/f25/pci-mark-amd-stoney-gpu-ats-as-broken.patch
@@ -0,0 +1,47 @@
+From 9b44b0b09decfbe388131a345ba780c57240a7a9 Mon Sep 17 00:00:00 2001
+From: Joerg Roedel <jroedel@suse.de>
+Date: Tue, 11 Jul 2017 15:48:00 -0500
+Subject: PCI: Mark AMD Stoney GPU ATS as broken
+
+ATS is broken on this hardware and causes IOMMU stalls and system failure.
+Disable ATS on these devices to make them usable again with IOMMU enabled.
+
+Note that the commit in the Fixes tag is not buggy; it just uncovers the
+problem in the hardware by increasing the ATS flush rate.
+
+Link: https://lists.linuxfoundation.org/pipermail/iommu/2017-March/020836.html
+Link: https://bugzilla.redhat.com/show_bug.cgi?id=1409201
+Fixes: b1516a14657a ("iommu/amd: Implement flush queue")
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+---
+ drivers/pci/quirks.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 6967c6b..15ee4e9 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -4681,3 +4681,18 @@ static void quirk_intel_no_flr(struct pci_dev *dev)
+ }
+ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x1502, quirk_intel_no_flr);
+ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x1503, quirk_intel_no_flr);
++
++#ifdef CONFIG_PCI_ATS
++/*
++ * Some devices have a broken ATS implementation causing IOMMU stalls.
++ * Don't use ATS for those devices.
++ */
++static void quirk_no_ats(struct pci_dev *pdev)
++{
++	dev_info(&pdev->dev, "disabling ATS (broken on this device)\n");
++	pdev->ats_cap = 0;
++}
++
++/* AMD Stoney platform GPU */
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x98e4, quirk_no_ats);
++#endif /* CONFIG_PCI_ATS */
+-- 
+cgit v1.1
+
diff --git a/freed-ora/current/f25/rt2800-fix-TX_PIN_CFG-setting-for-non-MT7620-chips.patch b/freed-ora/current/f25/rt2800-fix-TX_PIN_CFG-setting-for-non-MT7620-chips.patch
new file mode 100644
index 000000000..6c3662103
--- /dev/null
+++ b/freed-ora/current/f25/rt2800-fix-TX_PIN_CFG-setting-for-non-MT7620-chips.patch
@@ -0,0 +1,41 @@
+From patchwork Fri Aug 25 11:38:29 2017
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+Subject: rt2800: fix TX_PIN_CFG setting for non MT7620 chips
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+X-Patchwork-Id: 9921831
+Message-Id: <20170825113828.GA3959@redhat.com>
+To: linux-wireless@vger.kernel.org
+Cc: Daniel Golle <daniel@makrotopia.org>
+Date: Fri, 25 Aug 2017 13:38:29 +0200
+
+Since commit 41977e86c984 ("rt2x00: add support for MT7620") we do not
+initialize TX_PIN_CFG setting. This cause breakage at least on some
+RT3573 devices. To fix the problem patch restores previous behaviour
+for non MT7620 chips.
+
+Fixes: 41977e86c984 ("rt2x00: add support for MT7620")
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1480829
+Reported-and-tested-by: Jussi Eloranta <jussi.eloranta@csun.edu>
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+index d11c7b2..5672aec 100644
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -3699,7 +3699,10 @@ static void rt2800_config_channel(struct rt2x00_dev *rt2x00dev,
+ 	if (rt2x00_rt(rt2x00dev, RT3572))
+ 		rt2800_rfcsr_write(rt2x00dev, 8, 0);
+ 
+-	rt2800_register_read(rt2x00dev, TX_PIN_CFG, &tx_pin);
++	if (rt2x00_rt(rt2x00dev, RT6352))
++		rt2800_register_read(rt2x00dev, TX_PIN_CFG, &tx_pin);
++	else
++		tx_pin = 0;
+ 
+ 	switch (rt2x00dev->default_ant.tx_chain_num) {
+ 	case 3:
diff --git a/freed-ora/current/f25/sources b/freed-ora/current/f25/sources
index 9161c099a..2ec4451e2 100644
--- a/freed-ora/current/f25/sources
+++ b/freed-ora/current/f25/sources
@@ -1,3 +1,3 @@
 SHA512 (linux-libre-4.12-gnu.tar.xz) = d5586dba2e4deeb42ffe98c9305111da56e0741bb4508642d103367a0ef712c837e160366c3656d18f0d636fcd5b60c27593cb9216e10025d6abc74e6cdb05e4
 SHA512 (perf-man-4.12.tar.gz) = 4d3bbda1f520dba0007c351af46f45085fe4842074eb2e01aee736fd369df595f8f72ed6c1192715f1120bf3353279777f9dca1178fe93bffe5be2de700d409c
-SHA512 (patch-4.12-gnu-4.12.8-gnu.xz) = a2352b667dde19560fabf5253f68be6d7551ea1a842c60582633dd9e07669e260394806ccaf38dff68a2980abf73bd4a18ca4714d842b5b287e7e187f2af5211
+SHA512 (patch-4.12-gnu-4.12.9-gnu.xz) = 1c8ede75976fc9cfe3ea189c24f1ffd7e4648705297ac34781333b3e3a274c3fac979636abfc147e7cdef764ae2bb9275c4313480bc6ad3d73c57138d14c611f
diff --git a/freed-ora/current/f25/xsa229.patch b/freed-ora/current/f25/xsa229.patch
deleted file mode 100644
index 47e953843..000000000
--- a/freed-ora/current/f25/xsa229.patch
+++ /dev/null
@@ -1,59 +0,0 @@
-From 84882133e793299f685991e20a9631acfd0a5608 Mon Sep 17 00:00:00 2001
-From: Roger Pau Monne <roger.pau@citrix.com>
-Date: Tue, 18 Jul 2017 15:01:00 +0100
-Subject: xen: fix bio vec merging
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-The current test for bio vec merging is not fully accurate and can be
-tricked into merging bios when certain grant combinations are used.
-The result of these malicious bio merges is a bio that extends past
-the memory page used by any of the originating bios.
-
-Take into account the following scenario, where a guest creates two
-grant references that point to the same mfn, ie: grant 1 -> mfn A,
-grant 2 -> mfn A.
-
-These references are then used in a PV block request, and mapped by
-the backend domain, thus obtaining two different pfns that point to
-the same mfn, pfn B -> mfn A, pfn C -> mfn A.
-
-If those grants happen to be used in two consecutive sectors of a disk
-IO operation becoming two different bios in the backend domain, the
-checks in xen_biovec_phys_mergeable will succeed, because bfn1 == bfn2
-(they both point to the same mfn). However due to the bio merging,
-the backend domain will end up with a bio that expands past mfn A into
-mfn A + 1.
-
-Fix this by making sure the check in xen_biovec_phys_mergeable takes
-into account the offset and the length of the bio, this basically
-replicates whats done in __BIOVEC_PHYS_MERGEABLE using mfns (bus
-addresses). While there also remove the usage of
-__BIOVEC_PHYS_MERGEABLE, since that's already checked by the callers
-of xen_biovec_phys_mergeable.
-
-Reported-by: "Jan H. Schönherr" <jschoenh@amazon.de>
-Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
-Reviewed-by: Juergen Gross <jgross@suse.com>
----
- drivers/xen/biomerge.c | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
-diff --git a/drivers/xen/biomerge.c b/drivers/xen/biomerge.c
-index 4da69dbf7dca..1bdd02a6d6ac 100644
---- a/drivers/xen/biomerge.c
-+++ b/drivers/xen/biomerge.c
-@@ -10,8 +10,7 @@ bool xen_biovec_phys_mergeable(const struct bio_vec *vec1,
- 	unsigned long bfn1 = pfn_to_bfn(page_to_pfn(vec1->bv_page));
- 	unsigned long bfn2 = pfn_to_bfn(page_to_pfn(vec2->bv_page));
- 
--	return __BIOVEC_PHYS_MERGEABLE(vec1, vec2) &&
--		((bfn1 == bfn2) || ((bfn1+1) == bfn2));
-+	return bfn1 + PFN_DOWN(vec1->bv_offset + vec1->bv_len) == bfn2;
- #else
- 	/*
- 	 * XXX: Add support for merging bio_vec when using different page
--- 
-2.11.0 (Apple Git-81)
-