3.19.7-100.fc20.gnu

6 files changed, 94 insertions, 153 deletions

diff --git a/freed-ora/current/f20/Bluetooth-ath3k-Add-support-Atheros-AR5B195-combo-Mi.patch b/freed-ora/current/f20/Bluetooth-ath3k-Add-support-Atheros-AR5B195-combo-Mi.patch
deleted file mode 100644
index 38afde19d..000000000
--- a/freed-ora/current/f20/Bluetooth-ath3k-Add-support-Atheros-AR5B195-combo-Mi.patch
+++ /dev/null
@@ -1,71 +0,0 @@
-From: Alexander Ploumistos <alex.ploumistos@gmail.com>
-Date: Fri, 13 Feb 2015 21:05:11 +0200
-Subject: [PATCH] Bluetooth: ath3k: Add support Atheros AR5B195 combo Mini PCIe
- card
-
-Add 04f2:aff1 to ath3k.c supported devices list and btusb.c blacklist, so
-that the device can load the ath3k firmware and re-enumerate itself as an
-AR3011 device.
-
-T:  Bus=05 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  2 Spd=12   MxCh= 0
-D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
-P:  Vendor=04f2 ProdID=aff1 Rev= 0.01
-C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
-I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
-E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
-E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
-E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
-I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
-E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
-E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
-I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
-E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
-E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
-I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
-E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
-E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
-I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
-E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
-E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
-I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
-E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
-E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
-I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
-E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
-E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
-
-Signed-off-by: Alexander Ploumistos <alexpl@fedoraproject.org>
-Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
-Cc: stable@vger.kernel.org
----
- drivers/bluetooth/ath3k.c | 1 +
- drivers/bluetooth/btusb.c | 1 +
- 2 files changed, 2 insertions(+)
-
-diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
-index 086240cd29c3..b2c68213696a 100644
---- a/drivers/bluetooth/ath3k.c
-+++ b/drivers/bluetooth/ath3k.c
-@@ -65,6 +65,7 @@ static const struct usb_device_id ath3k_table[] = {
- 	/* Atheros AR3011 with sflash firmware*/
- 	{ USB_DEVICE(0x0489, 0xE027) },
- 	{ USB_DEVICE(0x0489, 0xE03D) },
-+	{ USB_DEVICE(0x04F2, 0xAFF1) },
- 	{ USB_DEVICE(0x0930, 0x0215) },
- 	{ USB_DEVICE(0x0CF3, 0x3002) },
- 	{ USB_DEVICE(0x0CF3, 0xE019) },
-diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
-index 091c813df8e9..79e344f9e681 100644
---- a/drivers/bluetooth/btusb.c
-+++ b/drivers/bluetooth/btusb.c
-@@ -142,6 +142,7 @@ static const struct usb_device_id blacklist_table[] = {
- 	/* Atheros 3011 with sflash firmware */
- 	{ USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE },
- 	{ USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE },
-+	{ USB_DEVICE(0x04f2, 0xaff1), .driver_info = BTUSB_IGNORE },
- 	{ USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE },
- 	{ USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE },
- 	{ USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE },
--- 
-2.1.0
-
diff --git a/freed-ora/current/f20/ipv4-Missing-sk_nulls_node_init-in-ping_unhash.patch b/freed-ora/current/f20/ipv4-Missing-sk_nulls_node_init-in-ping_unhash.patch
new file mode 100644
index 000000000..fa08f6a7a
--- /dev/null
+++ b/freed-ora/current/f20/ipv4-Missing-sk_nulls_node_init-in-ping_unhash.patch
@@ -0,0 +1,31 @@
+From: "David S. Miller" <davem@davemloft.net>
+Date: Fri, 1 May 2015 22:02:47 -0400
+Subject: [PATCH] ipv4: Missing sk_nulls_node_init() in ping_unhash().
+
+If we don't do that, then the poison value is left in the ->pprev
+backlink.
+
+This can cause crashes if we do a disconnect, followed by a connect().
+
+Tested-by: Linus Torvalds <torvalds@linux-foundation.org>
+Reported-by: Wen Xu <hotdog3645@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ net/ipv4/ping.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
+index 0ae28f517a9b..c0db43d2e1a6 100644
+--- a/net/ipv4/ping.c
++++ b/net/ipv4/ping.c
+@@ -158,6 +158,7 @@ void ping_unhash(struct sock *sk)
+ 	if (sk_hashed(sk)) {
+ 		write_lock_bh(&ping_table.lock);
+ 		hlist_nulls_del(&sk->sk_nulls_node);
++		sk_nulls_node_init(&sk->sk_nulls_node);
+ 		sock_put(sk);
+ 		isk->inet_num = 0;
+ 		isk->inet_sport = 0;
+-- 
+2.3.6
+
diff --git a/freed-ora/current/f20/kernel.spec b/freed-ora/current/f20/kernel.spec
index 6f785697c..fbde56ff0 100644
--- a/freed-ora/current/f20/kernel.spec
+++ b/freed-ora/current/f20/kernel.spec
@@ -112,7 +112,7 @@ Summary: The Linux kernel
 %if 0%{?released_kernel}
 
 # Do we have a -stable update to apply?
-%define stable_update 6
+%define stable_update 7
 # Is it a -stable RC?
 %define stable_rc 0
 # Set rpm version accordingly
@@ -676,9 +676,6 @@ Patch05: kbuild-AFTER_LINK.patch
 
 Patch07: freedo.patch
 
-# work around a coreboot bug
-Patch08: libreboot-i915.patch
-
 %if !%{nopatches}
 
 
@@ -801,9 +798,6 @@ Patch26136: vhost-scsi-potential-memory-corruption.patch
 #CVE-2015-0275 rhbz 1193907 1195178
 Patch26138: ext4-Allocate-entire-range-in-zero-range.patch
 
-#rhbz 1190947
-Patch26141: Bluetooth-ath3k-Add-support-Atheros-AR5B195-combo-Mi.patch
-
 #rhbz 1200777 1200778
 Patch26159: Input-synaptics-retrieve-the-extended-capabilities-i.patch
 Patch26160: Input-synaptics-remove-TOPBUTTONPAD-property-for-Len.patch
@@ -845,6 +839,12 @@ Patch26189: 0001-cx18-add-missing-caps-for-the-PCM-video-device.patch
 #rhbz 1206036 1215989
 Patch26193: toshiba_acpi-Do-not-register-vendor-backlight-when-a.patch
 
+#CVE-2015-3636 rhbz 1218074 1218110
+Patch26194: ipv4-Missing-sk_nulls_node_init-in-ping_unhash.patch
+
+#rhbz 1218662
+Patch26199: libata-Blacklist-queued-TRIM-on-all-Samsung-800-seri.patch
+
 # END OF PATCH DEFINITIONS
 
 %endif
@@ -1446,8 +1446,6 @@ ApplyPatch freedo.patch
 
 %if !%{nopatches}
 
-ApplyPatch libreboot-i915.patch
-
 # revert patches from upstream that conflict or that we get via other means
 ApplyOptionalPatch upstream-reverts.patch -R
 
@@ -1610,9 +1608,6 @@ ApplyPatch vhost-scsi-potential-memory-corruption.patch
 #CVE-2015-0275 rhbz 1193907 1195178
 ApplyPatch ext4-Allocate-entire-range-in-zero-range.patch
 
-#rhbz 1190947
-ApplyPatch Bluetooth-ath3k-Add-support-Atheros-AR5B195-combo-Mi.patch
-
 #rhbz 1200777 1200778
 ApplyPatch Input-synaptics-retrieve-the-extended-capabilities-i.patch
 ApplyPatch Input-synaptics-remove-TOPBUTTONPAD-property-for-Len.patch
@@ -1658,6 +1653,11 @@ ApplyPatch 0001-cx18-add-missing-caps-for-the-PCM-video-device.patch
 #rhbz 1206036 1215989
 ApplyPatch toshiba_acpi-Do-not-register-vendor-backlight-when-a.patch
 
+#CVE-2015-3636 rhbz 1218074 1218110
+ApplyPatch ipv4-Missing-sk_nulls_node_init-in-ping_unhash.patch
+
+#rhbz 1218662
+ApplyPatch libata-Blacklist-queued-TRIM-on-all-Samsung-800-seri.patch
 
 # END OF PATCH APPLICATIONS
 
@@ -2481,6 +2481,17 @@ fi
 #                 ||----w |
 #                 ||     ||
 %changelog
+* Thu May  7 2015 Alexandre Oliva <lxoliva@fsfla.org> -libre
+- GNU Linux-libre 3.19.7-gnu.
+- Fix for (libre|core)boot bug that causes a boot-time oops is upstream.
+
+* Thu May 07 2015 Laura Abbott <labbott@fedoraproject.org> - 3.19.7-100
+- Linux v3.19.7
+
+* Tue May 05 2015 Josh Boyer <jwboyer@fedoraproject.org>
+- Backport patch to blacklist TRIM on all Samsung 8xx series SSDs (rhbz 1218662)
+- CVE-2015-3636 ping-sockets use-after-free privilege escalation (rhbz 1218074 1218110)
+
 * Thu Apr 30 2015 Alexandre Oliva <lxoliva@fsfla.org> -libre
 - GNU Linux-libre 3.19.6-gnu.
 
diff --git a/freed-ora/current/f20/libata-Blacklist-queued-TRIM-on-all-Samsung-800-seri.patch b/freed-ora/current/f20/libata-Blacklist-queued-TRIM-on-all-Samsung-800-seri.patch
new file mode 100644
index 000000000..ab51df4cd
--- /dev/null
+++ b/freed-ora/current/f20/libata-Blacklist-queued-TRIM-on-all-Samsung-800-seri.patch
@@ -0,0 +1,39 @@
+From: "Martin K. Petersen" <martin.petersen@oracle.com>
+Date: Mon, 4 May 2015 12:20:29 -0400
+Subject: [PATCH] libata: Blacklist queued TRIM on all Samsung 800-series
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The queued TRIM problems appear to be generic to Samsung's firmware and
+not tied to a particular model. A recent update to the 840 EVO firmware
+introduced the same issue as we saw on 850 Pro.
+
+Blacklist queued TRIM on all 800-series drives while we work this issue
+with Samsung.
+
+Reported-by: Günter Waller <g.wal@web.de>
+Reported-by: Sven Köhler <sven.koehler@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Tejun Heo <tj@kernel.org>
+---
+ drivers/ata/libata-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index 00f2f740b425..eabee5ec901f 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -4243,7 +4243,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
+ 						ATA_HORKAGE_ZERO_AFTER_TRIM, },
+ 	{ "Crucial_CT*MX100*",		"MU01",	ATA_HORKAGE_NO_NCQ_TRIM |
+ 						ATA_HORKAGE_ZERO_AFTER_TRIM, },
+-	{ "Samsung SSD 850 PRO*",	NULL,	ATA_HORKAGE_NO_NCQ_TRIM |
++	{ "Samsung SSD 8*",		NULL,	ATA_HORKAGE_NO_NCQ_TRIM |
+ 						ATA_HORKAGE_ZERO_AFTER_TRIM, },
+ 
+ 	/*
+-- 
+2.3.6
+
diff --git a/freed-ora/current/f20/libreboot-i915.patch b/freed-ora/current/f20/libreboot-i915.patch
deleted file mode 100644
index dd7a69095..000000000
--- a/freed-ora/current/f20/libreboot-i915.patch
+++ /dev/null
@@ -1,69 +0,0 @@
-See https://bugzilla.kernel.org/attachment.cgi?id=172941
-and https://bugzilla.kernel.org/show_bug.cgi?id=93171
-
-From b27b2ff4bd6f0327ee550baa0397ccf0a559821f Mon Sep 17 00:00:00 2001
-From: Daniel Vetter <daniel.vetter@ffwll.ch>
-Date: Wed, 1 Apr 2015 13:40:48 +0200
-Subject: [PATCH] drm/i915: Dont enable CS_PARSER_ERROR interrupts at all
-
-We stopped handling them in
-
-commit aaecdf611a05cac26a94713bad25297e60225c29
-Author: Daniel Vetter <daniel.vetter@ffwll.ch>
-Date:   Tue Nov 4 15:52:22 2014 +0100
-
-    drm/i915: Stop gathering error states for CS error interrupts
-
-but just clearing is apparently not enough: A sufficiently dead gpu
-left behind by firmware (*cough* coreboot *cough*) can keep the gpu in
-an endless loop of such interrupts, eventually leading to the nmi
-firing. And definitely to what looks like a machine hang.
-
-Since we don't even enable these interrupts on gen5+ let's do the same
-on earlier platforms.
-
-Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=93171
-Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
----
- drivers/gpu/drm/i915/i915_irq.c | 8 ++------
- 1 file changed, 2 insertions(+), 6 deletions(-)
-
-diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
-index 14ecb4d13a1a..6d494432b19f 100644
---- a/drivers/gpu/drm/i915/i915_irq.c
-+++ b/drivers/gpu/drm/i915/i915_irq.c
-@@ -3598,14 +3598,12 @@ static int i8xx_irq_postinstall(struct drm_device *dev)
- 		~(I915_DISPLAY_PIPE_A_EVENT_INTERRUPT |
- 		  I915_DISPLAY_PIPE_B_EVENT_INTERRUPT |
- 		  I915_DISPLAY_PLANE_A_FLIP_PENDING_INTERRUPT |
--		  I915_DISPLAY_PLANE_B_FLIP_PENDING_INTERRUPT |
--		  I915_RENDER_COMMAND_PARSER_ERROR_INTERRUPT);
-+		  I915_DISPLAY_PLANE_B_FLIP_PENDING_INTERRUPT);
- 	I915_WRITE16(IMR, dev_priv->irq_mask);
- 
- 	I915_WRITE16(IER,
- 		     I915_DISPLAY_PIPE_A_EVENT_INTERRUPT |
- 		     I915_DISPLAY_PIPE_B_EVENT_INTERRUPT |
--		     I915_RENDER_COMMAND_PARSER_ERROR_INTERRUPT |
- 		     I915_USER_INTERRUPT);
- 	POSTING_READ16(IER);
- 
-@@ -3767,14 +3765,12 @@ static int i915_irq_postinstall(struct drm_device *dev)
- 		  I915_DISPLAY_PIPE_A_EVENT_INTERRUPT |
- 		  I915_DISPLAY_PIPE_B_EVENT_INTERRUPT |
- 		  I915_DISPLAY_PLANE_A_FLIP_PENDING_INTERRUPT |
--		  I915_DISPLAY_PLANE_B_FLIP_PENDING_INTERRUPT |
--		  I915_RENDER_COMMAND_PARSER_ERROR_INTERRUPT);
-+		  I915_DISPLAY_PLANE_B_FLIP_PENDING_INTERRUPT);
- 
- 	enable_mask =
- 		I915_ASLE_INTERRUPT |
- 		I915_DISPLAY_PIPE_A_EVENT_INTERRUPT |
- 		I915_DISPLAY_PIPE_B_EVENT_INTERRUPT |
--		I915_RENDER_COMMAND_PARSER_ERROR_INTERRUPT |
- 		I915_USER_INTERRUPT;
- 
- 	if (I915_HAS_HOTPLUG(dev)) {
--- 
-2.1.4
-
diff --git a/freed-ora/current/f20/sources b/freed-ora/current/f20/sources
index 894e9afee..01988a33e 100644
--- a/freed-ora/current/f20/sources
+++ b/freed-ora/current/f20/sources
@@ -1,3 +1,3 @@
 6b6245298a846bae9842bc4558eee172  linux-libre-3.19-gnu.tar.xz
 15d8d2f97ce056488451a5bfb2944603  perf-man-3.19.tar.gz
-8e92e0a77b8311bb89000e8e672dbd63  patch-3.19.6.xz
+b995a018938219892d4312d03b0f58ab  patch-3.19.7.xz