4.10.16-100.fc24.gnu

6 files changed, 57 insertions, 49 deletions

diff --git a/freed-ora/current/f24/0001-ipx-call-ipxitf_put-in-ioctl-error-path.patch b/freed-ora/current/f24/0001-ipx-call-ipxitf_put-in-ioctl-error-path.patch
new file mode 100644
index 000000000..ca809297a
--- /dev/null
+++ b/freed-ora/current/f24/0001-ipx-call-ipxitf_put-in-ioctl-error-path.patch
@@ -0,0 +1,38 @@
+From ee0d8d8482345ff97a75a7d747efc309f13b0d80 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Tue, 2 May 2017 13:58:53 +0300
+Subject: [PATCH] ipx: call ipxitf_put() in ioctl error path
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+We should call ipxitf_put() if the copy_to_user() fails.
+
+Reported-by: 李强 <liqiang6-s@360.cn>
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ net/ipx/af_ipx.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/net/ipx/af_ipx.c b/net/ipx/af_ipx.c
+index 8a9219f..fa31ef2 100644
+--- a/net/ipx/af_ipx.c
++++ b/net/ipx/af_ipx.c
+@@ -1168,11 +1168,10 @@ static int ipxitf_ioctl(unsigned int cmd, void __user *arg)
+ 		sipx->sipx_network	= ipxif->if_netnum;
+ 		memcpy(sipx->sipx_node, ipxif->if_node,
+ 			sizeof(sipx->sipx_node));
+-		rc = -EFAULT;
++		rc = 0;
+ 		if (copy_to_user(arg, &ifr, sizeof(ifr)))
+-			break;
++			rc = -EFAULT;
+ 		ipxitf_put(ipxif);
+-		rc = 0;
+ 		break;
+ 	}
+ 	case SIOCAIPXITFCRT:
+-- 
+2.9.3
+
diff --git a/freed-ora/current/f24/kernel.spec b/freed-ora/current/f24/kernel.spec
index 847c8c0fa..fa0a9103f 100644
--- a/freed-ora/current/f24/kernel.spec
+++ b/freed-ora/current/f24/kernel.spec
@@ -92,7 +92,7 @@ Summary: The Linux kernel
 %if 0%{?released_kernel}
 
 # Do we have a -stable update to apply?
-%define stable_update 15
+%define stable_update 16
 # Set rpm version accordingly
 %if 0%{?stable_update}
 %define stablerev %{stable_update}
@@ -649,12 +649,12 @@ Patch852: selinux-allow-context-mounts-on-tmpfs-etc.patch
 
 Patch861: 0001-efi-libstub-Treat-missing-SecureBoot-variable-as-Sec.patch
 
-#rhbz 1441310
-Patch863: rhbz_1441310.patch
-
 #rhbz 1436686
 Patch864: dell-laptop-Adds-support-for-keyboard-backlight-timeout-AC-settings.patch
 
+#CVE-2017-7487 rhbz 1447734 1450417
+Patch865: 0001-ipx-call-ipxitf_put-in-ioctl-error-path.patch
+
 # END OF PATCH DEFINITIONS
 
 %endif
@@ -2321,6 +2321,13 @@ fi
 #
 # 
 %changelog
+* Mon May 15 2017 Alexandre Oliva <lxoliva@fsfla.org> -libre
+- GNU Linux-libre 4.10.16-gnu.
+
+* Mon May 15 2017 Justin M. Forbes <jforbes@fedoraproject.org> - 4.10.16-100
+- Linux v4.10.16
+- Fix CVE-2017-7487 (rhbz 1447734 1450417)
+
 * Wed May 10 2017 Alexandre Oliva <lxoliva@fsfla.org> -libre
 - GNU Linux-libre 4.10.15-gnu.
 
diff --git a/freed-ora/current/f24/patch-4.10-gnu-4.10.15-gnu.xz.sign b/freed-ora/current/f24/patch-4.10-gnu-4.10.15-gnu.xz.sign
deleted file mode 100644
index e73846bf9..000000000
--- a/freed-ora/current/f24/patch-4.10-gnu-4.10.15-gnu.xz.sign
+++ /dev/null
@@ -1,7 +0,0 @@
------BEGIN PGP SIGNATURE-----
-Version: GnuPG v2
-
-iEYEABECAAYFAlkRDRUACgkQvLfPh359R6evYACeLoQQyMtPT+biWo3KW/0VKynV
-W4kAniQKZs7HlujbLhlsUM+YOuEfvwhM
-=8bR6
------END PGP SIGNATURE-----
diff --git a/freed-ora/current/f24/patch-4.10-gnu-4.10.16-gnu.xz.sign b/freed-ora/current/f24/patch-4.10-gnu-4.10.16-gnu.xz.sign
new file mode 100644
index 000000000..c5a6f23ad
--- /dev/null
+++ b/freed-ora/current/f24/patch-4.10-gnu-4.10.16-gnu.xz.sign
@@ -0,0 +1,7 @@
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v2
+
+iEYEABECAAYFAlkZs9cACgkQvLfPh359R6d/AwCgjvAfobkc19iYICA4x5iDw3Te
+6N8AoJxQ/3D8SZF6jQ/nQjCv1cMNoKQJ
+=4j83
+-----END PGP SIGNATURE-----
diff --git a/freed-ora/current/f24/rhbz_1441310.patch b/freed-ora/current/f24/rhbz_1441310.patch
deleted file mode 100644
index 63a404ec6..000000000
--- a/freed-ora/current/f24/rhbz_1441310.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From 425df17ce3a26d98f76e2b6b0af2acf4aeb0b026 Mon Sep 17 00:00:00 2001
-From: Jarno Rajahalme <jarno@ovn.org>
-Date: Tue, 14 Feb 2017 21:16:28 -0800
-Subject: openvswitch: Set internal device max mtu to ETH_MAX_MTU.
-
-Commit 91572088e3fd ("net: use core MTU range checking in core net
-infra") changed the openvswitch internal device to use the core net
-infra for controlling the MTU range, but failed to actually set the
-max_mtu as described in the commit message, which now defaults to
-ETH_DATA_LEN.
-
-This patch fixes this by setting max_mtu to ETH_MAX_MTU after
-ether_setup() call.
-
-Fixes: 91572088e3fd ("net: use core MTU range checking in core net infra")
-Signed-off-by: Jarno Rajahalme <jarno@ovn.org>
-Signed-off-by: David S. Miller <davem@davemloft.net>
----
- net/openvswitch/vport-internal_dev.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/net/openvswitch/vport-internal_dev.c b/net/openvswitch/vport-internal_dev.c
-index 09141a1..89193a6 100644
---- a/net/openvswitch/vport-internal_dev.c
-+++ b/net/openvswitch/vport-internal_dev.c
-@@ -149,6 +149,8 @@ static void do_setup(struct net_device *netdev)
- {
- 	ether_setup(netdev);
- 
-+	netdev->max_mtu = ETH_MAX_MTU;
-+
- 	netdev->netdev_ops = &internal_dev_netdev_ops;
- 
- 	netdev->priv_flags &= ~IFF_TX_SKB_SHARING;
--- 
-cgit v1.1
-
diff --git a/freed-ora/current/f24/sources b/freed-ora/current/f24/sources
index c7cc7284d..074917f0e 100644
--- a/freed-ora/current/f24/sources
+++ b/freed-ora/current/f24/sources
@@ -1,3 +1,3 @@
 SHA512 (linux-libre-4.10-gnu.tar.xz) = 44d1774a1d43a15322297d351737fbcbf92c6f433266ce2b17587437d433562cf5811fdae48fafd5a8e00d18ed9ac2e1ad4b12a657f322eb234384316ad131e0
 SHA512 (perf-man-4.10.tar.gz) = 2c830e06f47211d70a8330961487af73a8bc01073019475e6b6131d3bb8c95658b77ca0ae5f1b44371accf103658bc5a3a4366b3e017a4088a8fd408dd6867e8
-SHA512 (patch-4.10-gnu-4.10.15-gnu.xz) = 392a4b5f1afceb04fd867f8bfb707bc7aa359e215a33c311318c8b2c7db56804731fec1d334a32a8b7694d4a08a405556b692773a180afb340a71407b55ddd70
+SHA512 (patch-4.10-gnu-4.10.16-gnu.xz) = 83b92415a071baf8064fe4d6f2a100d3201236fcf46c689b2391a4fecbc4be0005fe8b8e4c73266f968e79a1da0f789a8c482db3ca22013967353d8c52d84697