3.19.2-201.fc21.gnu

8 files changed, 266 insertions, 5 deletions

diff --git a/freed-ora/current/f21/acpi-video-Add-force-native-backlight-quirk-for-Leno.patch b/freed-ora/current/f21/acpi-video-Add-force-native-backlight-quirk-for-Leno.patch
new file mode 100644
index 000000000..2b789ac18
--- /dev/null
+++ b/freed-ora/current/f21/acpi-video-Add-force-native-backlight-quirk-for-Leno.patch
@@ -0,0 +1,84 @@
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Tue, 3 Mar 2015 08:31:24 +0100
+Subject: [PATCH] acpi: video: Add force native backlight quirk for Lenovo
+ Ideapad Z570
+
+The Lenovo Ideapad Z570 (which is an Acer in disguise like some other Ideapads)
+has a broken acpi_video interface, this was fixed in commmit a11d342fb8
+("ACPI / video: force vendor backlight on Lenovo Ideapad Z570").
+
+Which stops acpi_video from registering a backlight interface, but this is
+only a partial fix, because for people who have the ideapad-laptop module
+installed that module will now register a backlight interface, which also
+does not work, so we need to use the native intel_backlight interface.
+
+The Lenovo Ideapad 570 is a pre-win8 laptop / too old for the acpi-video code
+to automatically prefer the native backlight interface, so add a quirk for it.
+
+This commit also removes the previous incomplete fix.
+
+BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1187004
+Cc: Stepan Bujnak <stepanbujnak@fastmail.fm>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+ drivers/acpi/video.c        | 17 +++++++++++++++++
+ drivers/acpi/video_detect.c |  8 --------
+ 2 files changed, 17 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
+index 2f1f16df460c..16d744e4552f 100644
+--- a/drivers/acpi/video.c
++++ b/drivers/acpi/video.c
+@@ -425,6 +425,12 @@ static int __init video_disable_native_backlight(const struct dmi_system_id *d)
+ 	return 0;
+ }
+ 
++static int __init video_enable_native_backlight(const struct dmi_system_id *d)
++{
++	use_native_backlight_dmi = NATIVE_BACKLIGHT_ON;
++	return 0;
++}
++
+ static struct dmi_system_id video_dmi_table[] __initdata = {
+ 	/*
+ 	 * Broken _BQC workaround http://bugzilla.kernel.org/show_bug.cgi?id=13121
+@@ -556,6 +562,17 @@ static struct dmi_system_id video_dmi_table[] __initdata = {
+ 		DMI_MATCH(DMI_PRODUCT_NAME, "XPS L521X"),
+ 		},
+ 	},
++
++	/* Non win8 machines which need native backlight nevertheless */
++	{
++	 /* https://bugzilla.redhat.com/show_bug.cgi?id=1187004 */
++	 .callback = video_enable_native_backlight,
++	 .ident = "Lenovo Ideapad Z570",
++	 .matches = {
++		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++		DMI_MATCH(DMI_PRODUCT_NAME, "102434U"),
++		},
++	},
+ 	{}
+ };
+ 
+diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c
+index 27c43499977a..c42feb2bacd0 100644
+--- a/drivers/acpi/video_detect.c
++++ b/drivers/acpi/video_detect.c
+@@ -174,14 +174,6 @@ static struct dmi_system_id video_detect_dmi_table[] = {
+ 		DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 5737"),
+ 		},
+ 	},
+-	{
+-	.callback = video_detect_force_vendor,
+-	.ident = "Lenovo IdeaPad Z570",
+-	.matches = {
+-		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+-		DMI_MATCH(DMI_PRODUCT_VERSION, "Ideapad Z570"),
+-		},
+-	},
+ 	{ },
+ };
+ 
+-- 
+2.1.0
+
diff --git a/freed-ora/current/f21/acpi-video-Allow-forcing-native-backlight-on-non-win.patch b/freed-ora/current/f21/acpi-video-Allow-forcing-native-backlight-on-non-win.patch
new file mode 100644
index 000000000..2a0e1cdba
--- /dev/null
+++ b/freed-ora/current/f21/acpi-video-Allow-forcing-native-backlight-on-non-win.patch
@@ -0,0 +1,76 @@
+From: Aaron Lu <aaron.lu@intel.com>
+Date: Wed, 11 Mar 2015 14:14:56 +0800
+Subject: [PATCH] acpi: video: Allow forcing native backlight on non win8
+ machines
+
+The native backlight behavior (so not registering both the acpi-video
+and the vendor backlight driver) can be useful on some non win8 machines
+too, so change the behavior of the video.use_native_backlight=1 or 0
+kernel cmdline option to be: if user has set video.use_native_backlight=1
+or 0, use that no matter if it is a win8 system or not. Also, we will
+put some known systems into the DMI table to make them either use native
+backlight interface or not, and the use_native_backlight_dmi is used to
+reflect that.
+
+Original-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Aaron Lu <aaron.lu@intel.com>
+Acked-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+ drivers/acpi/video.c | 19 +++++++++++++------
+ 1 file changed, 13 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
+index 497622ce5c31..2f1f16df460c 100644
+--- a/drivers/acpi/video.c
++++ b/drivers/acpi/video.c
+@@ -82,9 +82,15 @@ module_param(allow_duplicates, bool, 0644);
+  * For Windows 8 systems: used to decide if video module
+  * should skip registering backlight interface of its own.
+  */
+-static int use_native_backlight_param = -1;
++enum {
++	NATIVE_BACKLIGHT_NOT_SET = -1,
++	NATIVE_BACKLIGHT_OFF,
++	NATIVE_BACKLIGHT_ON,
++};
++
++static int use_native_backlight_param = NATIVE_BACKLIGHT_NOT_SET;
+ module_param_named(use_native_backlight, use_native_backlight_param, int, 0444);
+-static bool use_native_backlight_dmi = true;
++static int use_native_backlight_dmi = NATIVE_BACKLIGHT_NOT_SET;
+ 
+ static int register_count;
+ static struct mutex video_list_lock;
+@@ -237,15 +243,16 @@ static void acpi_video_switch_brightness(struct work_struct *work);
+ 
+ static bool acpi_video_use_native_backlight(void)
+ {
+-	if (use_native_backlight_param != -1)
++	if (use_native_backlight_param != NATIVE_BACKLIGHT_NOT_SET)
+ 		return use_native_backlight_param;
+-	else
++	else if (use_native_backlight_dmi != NATIVE_BACKLIGHT_NOT_SET)
+ 		return use_native_backlight_dmi;
++	return acpi_osi_is_win8();
+ }
+ 
+ bool acpi_video_verify_backlight_support(void)
+ {
+-	if (acpi_osi_is_win8() && acpi_video_use_native_backlight() &&
++	if (acpi_video_use_native_backlight() &&
+ 	    backlight_device_registered(BACKLIGHT_RAW))
+ 		return false;
+ 	return acpi_video_backlight_support();
+@@ -414,7 +421,7 @@ static int __init video_set_bqc_offset(const struct dmi_system_id *d)
+ 
+ static int __init video_disable_native_backlight(const struct dmi_system_id *d)
+ {
+-	use_native_backlight_dmi = false;
++	use_native_backlight_dmi = NATIVE_BACKLIGHT_OFF;
+ 	return 0;
+ }
+ 
+-- 
+2.1.0
+
diff --git a/freed-ora/current/f21/config-armv7 b/freed-ora/current/f21/config-armv7
index f071dd9a8..bc5e0e6a7 100644
--- a/freed-ora/current/f21/config-armv7
+++ b/freed-ora/current/f21/config-armv7
@@ -531,7 +531,7 @@ CONFIG_INPUT_AB8500_PONKEY=m
 CONFIG_REGULATOR_AB8500=y
 CONFIG_AB8500_USB=m
 CONFIG_USB_MUSB_UX500=m
-CONFIG_USB_UX500_DMA=y
+# CONFIG_USB_UX500_DMA is not set
 CONFIG_RTC_DRV_AB8500=m
 CONFIG_PWM_AB8500=m
 CONFIG_SND_SOC_UX500=m
diff --git a/freed-ora/current/f21/config-armv7-generic b/freed-ora/current/f21/config-armv7-generic
index 5be7d4be6..0a930f3a2 100644
--- a/freed-ora/current/f21/config-armv7-generic
+++ b/freed-ora/current/f21/config-armv7-generic
@@ -410,6 +410,8 @@ CONFIG_USB_OTG=y
 CONFIG_USB_GADGET=m
 CONFIG_USB_GADGET_VBUS_DRAW=100
 CONFIG_USB_GADGET_STORAGE_NUM_BUFFERS=2
+# Use PIO on musb as upstream doesn't support multiple DMA engines yet :-/
+CONFIG_MUSB_PIO_ONLY=y
 # CONFIG_USB_GADGET_XILINX is not set
 CONFIG_USB_MUSB_HDRC=m
 CONFIG_USB_MUSB_DUAL_ROLE=y
@@ -434,7 +436,6 @@ CONFIG_USB_CONFIGFS_SERIAL=y
 # CONFIG_USB_CONFIGFS_F_MIDI is not set
 # CONFIG_USB_CONFIGFS_F_HID is not set
 
-# CONFIG_MUSB_PIO_ONLY is not set
 # CONFIG_USB_GADGET_DEBUG is not set
 # CONFIG_USB_GADGET_DEBUG_FILES is not set
 # CONFIG_USB_GADGET_DEBUG_FS is not set
diff --git a/freed-ora/current/f21/config-generic b/freed-ora/current/f21/config-generic
index 0445f6a92..38d5f1d4d 100644
--- a/freed-ora/current/f21/config-generic
+++ b/freed-ora/current/f21/config-generic
@@ -3564,7 +3564,7 @@ CONFIG_SND_SCS1X=m
 CONFIG_SND_DICE=m
 CONFIG_SND_OXFW=m
 CONFIG_SND_FIREWORKS=m
-# CONFIG_SND_BEBOB is not set
+CONFIG_SND_BEBOB=m
 
 #
 # Open Sound System
diff --git a/freed-ora/current/f21/kernel.spec b/freed-ora/current/f21/kernel.spec
index ac07c0092..db4a2f89a 100644
--- a/freed-ora/current/f21/kernel.spec
+++ b/freed-ora/current/f21/kernel.spec
@@ -42,7 +42,7 @@ Summary: The Linux kernel
 # For non-released -rc kernels, this will be appended after the rcX and
 # gitX tags, so a 3 here would become part of release "0.rcX.gitX.3"
 #
-%global baserelease 200
+%global baserelease 201
 %global fedora_build %{baserelease}
 
 # base_sublevel is the kernel version we're starting with and patching
@@ -694,11 +694,19 @@ Patch26167: IB-core-Prevent-integer-overflow-in-ib_umem_get-addr.patch
 #rhbz 1201532
 Patch26168: HID-multitouch-add-support-of-clickpads.patch
 
+#rhbz 1187004
+Patch26170: acpi-video-Allow-forcing-native-backlight-on-non-win.patch
+Patch26171: acpi-video-Add-force-native-backlight-quirk-for-Leno.patch
+
+#CVE-2015-2666 rhbz 1204724 1204722
+Patch26172: x86-microcode-intel-Guard-against-stack-overflow-in-.patch
 
 # git clone ssh://git.fedorahosted.org/git/kernel-arm64.git, git diff master...devel
 Patch30000: kernel-arm64.patch
 Patch30001: aarch64-fix-tlb-issues.patch
 
+Patch26173: net-validate-the-range-we-feed-to-iov_iter_init-in-s.patch
+
 # END OF PATCH DEFINITIONS
 
 %endif
@@ -1531,6 +1539,13 @@ ApplyPatch IB-core-Prevent-integer-overflow-in-ib_umem_get-addr.patch
 #rhbz 1201532
 ApplyPatch HID-multitouch-add-support-of-clickpads.patch
 
+#rhbz 1187004
+ApplyPatch acpi-video-Allow-forcing-native-backlight-on-non-win.patch
+ApplyPatch acpi-video-Add-force-native-backlight-quirk-for-Leno.patch
+
+#CVE-2015-2666 rhbz 1204724 1204722
+ApplyPatch x86-microcode-intel-Guard-against-stack-overflow-in-.patch
+
 %if 0%{?aarch64patches}
 ApplyPatch kernel-arm64.patch
 # Just needed for 3.19
@@ -1540,6 +1555,8 @@ ApplyPatch kernel-arm64.patch -R
 %endif
 %endif
 
+ApplyPatch net-validate-the-range-we-feed-to-iov_iter_init-in-s.patch
+
 # END OF PATCH APPLICATIONS
 
 %endif
@@ -2412,7 +2429,18 @@ fi
 #                                    ||----w |
 #                                    ||     ||
 %changelog
-* Sun Mar 22 2015 Alexandre Oliva <lxoliva@fsfla.org> -libre
+* Mon Mar 23 2015 Josh Boyer <jwboyer@fedoraproject.org> - 3.19.2-201
+- Enable CONFIG_SND_BEBOB (rhbz 1204342)
+- Validate iovec range in sys_sendto/sys_recvfrom
+- CVE-2015-2666 execution in the early microcode loader (rhbz 1204724 1204722)
+
+* Mon Mar 23 2015 Peter Robinson <pbrobinson@fedoraproject.org>
+- Refix Panda on ARMv7 crash on boot
+
+* Fri Mar 20 2015 Josh Boyer <jwboyer@fedoraproject.org>
+- Fix brightness on Lenovo Ideapad Z570 (rhbz 1187004)
+
+* Fri Mar 20 2015 Alexandre Oliva <lxoliva@fsfla.org> -libre Sun Mar 22
 - GNU Linux-libre 3.19.2-gnu.
 
 * Thu Mar 19 2015 Justin M. Forbes <jforbes@fedoraproject.org> - 3.19.2-200
diff --git a/freed-ora/current/f21/net-validate-the-range-we-feed-to-iov_iter_init-in-s.patch b/freed-ora/current/f21/net-validate-the-range-we-feed-to-iov_iter_init-in-s.patch
new file mode 100644
index 000000000..70c28d7a0
--- /dev/null
+++ b/freed-ora/current/f21/net-validate-the-range-we-feed-to-iov_iter_init-in-s.patch
@@ -0,0 +1,37 @@
+From: Al Viro <viro@ZenIV.linux.org.uk>
+Date: Fri, 20 Mar 2015 17:41:43 +0000
+Subject: [PATCH] net: validate the range we feed to iov_iter_init() in
+ sys_sendto/sys_recvfrom
+
+Cc: stable@vger.kernel.org # v3.19
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ net/socket.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/net/socket.c b/net/socket.c
+index 418795caa897..d50e7ca6aeea 100644
+--- a/net/socket.c
++++ b/net/socket.c
+@@ -1765,6 +1765,8 @@ SYSCALL_DEFINE6(sendto, int, fd, void __user *, buff, size_t, len,
+ 
+ 	if (len > INT_MAX)
+ 		len = INT_MAX;
++	if (unlikely(!access_ok(VERIFY_READ, buff, len)))
++		return -EFAULT;
+ 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
+ 	if (!sock)
+ 		goto out;
+@@ -1823,6 +1825,8 @@ SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
+ 
+ 	if (size > INT_MAX)
+ 		size = INT_MAX;
++	if (unlikely(!access_ok(VERIFY_WRITE, ubuf, size)))
++		return -EFAULT;
+ 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
+ 	if (!sock)
+ 		goto out;
+-- 
+2.1.0
+
diff --git a/freed-ora/current/f21/x86-microcode-intel-Guard-against-stack-overflow-in-.patch b/freed-ora/current/f21/x86-microcode-intel-Guard-against-stack-overflow-in-.patch
new file mode 100644
index 000000000..5f1d232d0
--- /dev/null
+++ b/freed-ora/current/f21/x86-microcode-intel-Guard-against-stack-overflow-in-.patch
@@ -0,0 +1,35 @@
+From: Quentin Casasnovas <quentin.casasnovas@oracle.com>
+Date: Tue, 3 Feb 2015 13:00:22 +0100
+Subject: [PATCH] x86/microcode/intel: Guard against stack overflow in the
+ loader
+
+mc_saved_tmp is a static array allocated on the stack, we need to make
+sure mc_saved_count stays within its bounds, otherwise we're overflowing
+the stack in _save_mc(). A specially crafted microcode header could lead
+to a kernel crash or potentially kernel execution.
+
+Signed-off-by: Quentin Casasnovas <quentin.casasnovas@oracle.com>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: Fenghua Yu <fenghua.yu@intel.com>
+Link: http://lkml.kernel.org/r/1422964824-22056-1-git-send-email-quentin.casasnovas@oracle.com
+Signed-off-by: Borislav Petkov <bp@suse.de>
+---
+ arch/x86/kernel/cpu/microcode/intel_early.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/kernel/cpu/microcode/intel_early.c b/arch/x86/kernel/cpu/microcode/intel_early.c
+index ec9df6f9cd47..5e109a31f62b 100644
+--- a/arch/x86/kernel/cpu/microcode/intel_early.c
++++ b/arch/x86/kernel/cpu/microcode/intel_early.c
+@@ -321,7 +321,7 @@ get_matching_model_microcode(int cpu, unsigned long start,
+ 	unsigned int mc_saved_count = mc_saved_data->mc_saved_count;
+ 	int i;
+ 
+-	while (leftover) {
++	while (leftover && mc_saved_count < ARRAY_SIZE(mc_saved_tmp)) {
+ 		mc_header = (struct microcode_header_intel *)ucode_ptr;
+ 
+ 		mc_size = get_totalsize(mc_header);
+-- 
+2.1.0
+