4.4.7-200.fc22.gnu

author: Alexandre Oliva <lxoliva@fsfla.org> 2016-04-18 11:12:58 +0000
committer: Alexandre Oliva <lxoliva@fsfla.org> 2016-04-18 11:12:58 +0000
commit: 8b88086dfe6576b598b60a5ab9ef467f19285abb (patch)
tree: 8324c0c3eeb368bb3bc2461133773473c4702a23 /freed-ora/current
parent: 80838793c9ca8e246467446af08a0ff40b9893f5 (diff)
download: linux-libre-raptor-8b88086dfe6576b598b60a5ab9ef467f19285abb.tar.gz
linux-libre-raptor-8b88086dfe6576b598b60a5ab9ef467f19285abb.zip
28 files changed, 1085 insertions, 930 deletions
diff --git a/freed-ora/current/f22/0001-Input-synaptics-handle-spurious-release-of-trackstic.patch b/freed-ora/current/f22/0001-Input-synaptics-handle-spurious-release-of-trackstic.patch
deleted file mode 100644
index 52b082b36..000000000
--- a/freed-ora/current/f22/0001-Input-synaptics-handle-spurious-release-of-trackstic.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From cb6fcfe5a7e9197ceb7e9eec56e9c526e4e76354 Mon Sep 17 00:00:00 2001
-From: Benjamin Tissoires <benjamin.tissoires@redhat.com>
-Date: Mon, 14 Mar 2016 19:37:12 +0100
-Subject: [PATCH] Input: synaptics - handle spurious release of trackstick
- buttons, again
-
-Looks like the fimware 8.2 stall has the extra buttons spurious release
-bug.
-
-Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
----
- drivers/input/mouse/synaptics.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
-index 6025eb4..4ef8d7a 100644
---- a/drivers/input/mouse/synaptics.c
-+++ b/drivers/input/mouse/synaptics.c
-@@ -863,7 +863,8 @@ static void synaptics_report_ext_buttons(struct psmouse *psmouse,
- 		return;
- 
- 	/* Bug in FW 8.1, buttons are reported only when ExtBit is 1 */
--	if (SYN_ID_FULL(priv->identity) == 0x801 &&
-+	if ((SYN_ID_FULL(priv->identity) == 0x801 ||
-+	     SYN_ID_FULL(priv->identity) == 0x802) &&
- 	    !((psmouse->packet[0] ^ psmouse->packet[3]) & 0x02))
- 		return;
- 
--- 
-2.5.0
-
diff --git a/freed-ora/current/f22/ALSA-usb-audio-Add-sanity-checks-for-endpoint-access.patch b/freed-ora/current/f22/ALSA-usb-audio-Add-sanity-checks-for-endpoint-access.patch
deleted file mode 100644
index 801434a26..000000000
--- a/freed-ora/current/f22/ALSA-usb-audio-Add-sanity-checks-for-endpoint-access.patch
+++ /dev/null
@@ -1,80 +0,0 @@
-From 873156565ca67779bbf5a3475ccd08ea3bb92522 Mon Sep 17 00:00:00 2001
-From: Takashi Iwai <tiwai@suse.de>
-Date: Tue, 15 Mar 2016 15:20:58 +0100
-Subject: [PATCH 2/2] ALSA: usb-audio: Add sanity checks for endpoint accesses
-
-Add some sanity check codes before actually accessing the endpoint via
-get_endpoint() in order to avoid the invalid access through a
-malformed USB descriptor.  Mostly just checking bNumEndpoints, but in
-one place (snd_microii_spdif_default_get()), the validity of iface and
-altsetting index is checked as well.
-
-Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=971125
-Cc: <stable@vger.kernel.org>
-Signed-off-by: Takashi Iwai <tiwai@suse.de>
----
- sound/usb/clock.c        | 2 ++
- sound/usb/endpoint.c     | 3 +++
- sound/usb/mixer_quirks.c | 4 ++++
- sound/usb/pcm.c          | 2 ++
- 4 files changed, 11 insertions(+)
-
-diff --git a/sound/usb/clock.c b/sound/usb/clock.c
-index 2ed260b10f6d..7ccbcaf6a147 100644
---- a/sound/usb/clock.c
-+++ b/sound/usb/clock.c
-@@ -285,6 +285,8 @@ static int set_sample_rate_v1(struct snd_usb_audio *chip, int iface,
- 	unsigned char data[3];
- 	int err, crate;
- 
-+	if (get_iface_desc(alts)->bNumEndpoints < 1)
-+		return -EINVAL;
- 	ep = get_endpoint(alts, 0)->bEndpointAddress;
- 
- 	/* if endpoint doesn't have sampling rate control, bail out */
-diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c
-index e6f71894ecdc..c2131b851602 100644
---- a/sound/usb/endpoint.c
-+++ b/sound/usb/endpoint.c
-@@ -415,6 +415,9 @@ exit_clear:
-  *
-  * New endpoints will be added to chip->ep_list and must be freed by
-  * calling snd_usb_endpoint_free().
-+ *
-+ * For SND_USB_ENDPOINT_TYPE_SYNC, the caller needs to guarantee that
-+ * bNumEndpoints > 1 beforehand.
-  */
- struct snd_usb_endpoint *snd_usb_add_endpoint(struct snd_usb_audio *chip,
- 					      struct usb_host_interface *alts,
-diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
-index d3608c0a29f3..2d724e3c4cc0 100644
---- a/sound/usb/mixer_quirks.c
-+++ b/sound/usb/mixer_quirks.c
-@@ -1518,7 +1518,11 @@ static int snd_microii_spdif_default_get(struct snd_kcontrol *kcontrol,
- 
- 	/* use known values for that card: interface#1 altsetting#1 */
- 	iface = usb_ifnum_to_if(chip->dev, 1);
-+	if (!iface || iface->num_altsetting < 2)
-+		return -EINVAL;
- 	alts = &iface->altsetting[1];
-+	if (get_iface_desc(alts)->bNumEndpoints < 1)
-+		return -EINVAL;
- 	ep = get_endpoint(alts, 0)->bEndpointAddress;
- 
- 	err = snd_usb_ctl_msg(chip->dev,
-diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
-index cdac5179db3f..4da64896df6d 100644
---- a/sound/usb/pcm.c
-+++ b/sound/usb/pcm.c
-@@ -159,6 +159,8 @@ static int init_pitch_v1(struct snd_usb_audio *chip, int iface,
- 	unsigned char data[1];
- 	int err;
- 
-+	if (get_iface_desc(alts)->bNumEndpoints < 1)
-+		return -EINVAL;
- 	ep = get_endpoint(alts, 0)->bEndpointAddress;
- 
- 	data[0] = 1;
--- 
-2.5.0
-
diff --git a/freed-ora/current/f22/ALSA-usb-audio-Fix-NULL-dereference-in-create_fixed_.patch b/freed-ora/current/f22/ALSA-usb-audio-Fix-NULL-dereference-in-create_fixed_.patch
deleted file mode 100644
index 37cdb213a..000000000
--- a/freed-ora/current/f22/ALSA-usb-audio-Fix-NULL-dereference-in-create_fixed_.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From b0bb5691b38e2f439b071e226bad9f699c33b77d Mon Sep 17 00:00:00 2001
-From: Takashi Iwai <tiwai@suse.de>
-Date: Tue, 15 Mar 2016 12:09:10 +0100
-Subject: [PATCH 1/2] ALSA: usb-audio: Fix NULL dereference in
- create_fixed_stream_quirk()
-
-create_fixed_stream_quirk() may cause a NULL-pointer dereference by
-accessing the non-existing endpoint when a USB device with a malformed
-USB descriptor is used.
-
-This patch avoids it simply by adding a sanity check of bNumEndpoints
-before the accesses.
-
-Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=971125
-Cc: <stable@vger.kernel.org>
-Signed-off-by: Takashi Iwai <tiwai@suse.de>
----
- sound/usb/quirks.c | 6 ++++++
- 1 file changed, 6 insertions(+)
-
-diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
-index eef9b8e4b949..e128ca62eb44 100644
---- a/sound/usb/quirks.c
-+++ b/sound/usb/quirks.c
-@@ -177,6 +177,12 @@ static int create_fixed_stream_quirk(struct snd_usb_audio *chip,
- 	}
- 	alts = &iface->altsetting[fp->altset_idx];
- 	altsd = get_iface_desc(alts);
-+	if (altsd->bNumEndpoints < 1) {
-+		kfree(fp);
-+		kfree(rate_table);
-+		return -EINVAL;
-+	}
-+
- 	fp->protocol = altsd->bInterfaceProtocol;
- 
- 	if (fp->datainterval == 0)
--- 
-2.5.0
-
diff --git a/freed-ora/current/f22/HID-wacom-fix-Bamboo-ONE-oops.patch b/freed-ora/current/f22/HID-wacom-fix-Bamboo-ONE-oops.patch
new file mode 100644
index 000000000..09e83179a
--- /dev/null
+++ b/freed-ora/current/f22/HID-wacom-fix-Bamboo-ONE-oops.patch
@@ -0,0 +1,46 @@
+From 580549ef6b3e3fb3b958de490ca99f43a089a2cf Mon Sep 17 00:00:00 2001
+From: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Date: Fri, 25 Mar 2016 15:26:55 +0100
+Subject: [PATCH] HID: wacom: fix Bamboo ONE oops
+
+Looks like recent changes in the Wacom driver made the Bamboo ONE crashes.
+The tablet behaves as if it was a regular Bamboo device with pen, touch
+and pad, but there is no physical pad connected to it.
+The weird part is that the pad is still sending events and given that
+there is no input node connected to it, we get  anull pointer exception.
+
+Link: https://bugzilla.redhat.com/show_bug.cgi?id=1317116
+
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Acked-by: Ping Cheng <pingc@wacom.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+---
+ drivers/hid/wacom_wac.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
+index bd198bbd4df0..02c4efea241c 100644
+--- a/drivers/hid/wacom_wac.c
++++ b/drivers/hid/wacom_wac.c
+@@ -2426,6 +2426,17 @@ void wacom_setup_device_quirks(struct wacom *wacom)
+ 	}
+ 
+ 	/*
++	 * Hack for the Bamboo One:
++	 * the device presents a PAD/Touch interface as most Bamboos and even
++	 * sends ghosts PAD data on it. However, later, we must disable this
++	 * ghost interface, and we can not detect it unless we set it here
++	 * to WACOM_DEVICETYPE_PAD or WACOM_DEVICETYPE_TOUCH.
++	 */
++	if (features->type == BAMBOO_PEN &&
++	    features->pktlen == WACOM_PKGLEN_BBTOUCH3)
++		features->device_type |= WACOM_DEVICETYPE_PAD;
++
++	/*
+ 	 * Raw Wacom-mode pen and touch events both come from interface
+ 	 * 0, whose HID descriptor has an application usage of 0xFF0D
+ 	 * (i.e., WACOM_VENDORDEFINED_PEN). We route pen packets back
+-- 
+2.5.5
+
diff --git a/freed-ora/current/f22/Input-ati_remote2-fix-crashes-on-detecting-device-wi.patch b/freed-ora/current/f22/Input-ati_remote2-fix-crashes-on-detecting-device-wi.patch
deleted file mode 100644
index c7a461de8..000000000
--- a/freed-ora/current/f22/Input-ati_remote2-fix-crashes-on-detecting-device-wi.patch
+++ /dev/null
@@ -1,107 +0,0 @@
-From 0f8536022831faaba3a952fa633902d9686f535f Mon Sep 17 00:00:00 2001
-From: Vladis Dronov <vdronov@redhat.com>
-Date: Wed, 23 Mar 2016 15:53:07 -0400
-Subject: [PATCH] Input: ati_remote2: fix crashes on detecting device with
- invalid descriptor
-
-The ati_remote2 driver expects at least two interfaces with one
-endpoint each. If given malicious descriptor that specify one
-interface or no endpoints, it will crash in the probe function.
-Ensure there is at least two interfaces and one endpoint for each
-interface before using it.
-
-The full disclosure: http://seclists.org/bugtraq/2016/Mar/90
-
-Reported-by: Ralf Spenneberg <ralf@spenneberg.net>
-Signed-off-by: Vladis Dronov <vdronov@redhat.com>
----
- drivers/input/misc/ati_remote2.c | 36 ++++++++++++++++++++++++++++++------
- 1 file changed, 30 insertions(+), 6 deletions(-)
-
-diff --git a/drivers/input/misc/ati_remote2.c b/drivers/input/misc/ati_remote2.c
-index cfd58e87da26..cf5d1e8d92c7 100644
---- a/drivers/input/misc/ati_remote2.c
-+++ b/drivers/input/misc/ati_remote2.c
-@@ -817,26 +817,49 @@ static int ati_remote2_probe(struct usb_interface *interface, const struct usb_d
- 
- 	ar2->udev = udev;
- 
-+	/* Sanity check, first interface must have an endpoint */
-+	if ((alt->desc.bNumEndpoints < 1) || !alt->endpoint) {
-+		dev_err(&interface->dev,
-+			"%s(): interface 0 must have an endpoint\n", __func__);
-+		r = -ENODEV;
-+		goto fail1;
-+	}
- 	ar2->intf[0] = interface;
- 	ar2->ep[0] = &alt->endpoint[0].desc;
- 
-+	/* Sanity check, the device must have two interfaces */
- 	ar2->intf[1] = usb_ifnum_to_if(udev, 1);
-+	if ((udev->actconfig->desc.bNumInterfaces < 2) || !ar2->intf[1]) {
-+		dev_err(&interface->dev, "%s(): need 2 interfaces, found %d\n",
-+			__func__, udev->actconfig->desc.bNumInterfaces);
-+		r = -ENODEV;
-+		goto fail1;
-+	}
-+
- 	r = usb_driver_claim_interface(&ati_remote2_driver, ar2->intf[1], ar2);
- 	if (r)
- 		goto fail1;
-+
-+	/* Sanity check, second interface must have an endpoint */
- 	alt = ar2->intf[1]->cur_altsetting;
-+	if ((alt->desc.bNumEndpoints < 1) || !alt->endpoint) {
-+		dev_err(&interface->dev,
-+			"%s(): interface 1 must have an endpoint\n", __func__);
-+		r = -ENODEV;
-+		goto fail2;
-+	}
- 	ar2->ep[1] = &alt->endpoint[0].desc;
- 
- 	r = ati_remote2_urb_init(ar2);
- 	if (r)
--		goto fail2;
-+		goto fail3;
- 
- 	ar2->channel_mask = channel_mask;
- 	ar2->mode_mask = mode_mask;
- 
- 	r = ati_remote2_setup(ar2, ar2->channel_mask);
- 	if (r)
--		goto fail2;
-+		goto fail3;
- 
- 	usb_make_path(udev, ar2->phys, sizeof(ar2->phys));
- 	strlcat(ar2->phys, "/input0", sizeof(ar2->phys));
-@@ -845,11 +868,11 @@ static int ati_remote2_probe(struct usb_interface *interface, const struct usb_d
- 
- 	r = sysfs_create_group(&udev->dev.kobj, &ati_remote2_attr_group);
- 	if (r)
--		goto fail2;
-+		goto fail3;
- 
- 	r = ati_remote2_input_init(ar2);
- 	if (r)
--		goto fail3;
-+		goto fail4;
- 
- 	usb_set_intfdata(interface, ar2);
- 
-@@ -857,10 +880,11 @@ static int ati_remote2_probe(struct usb_interface *interface, const struct usb_d
- 
- 	return 0;
- 
-- fail3:
-+ fail4:
- 	sysfs_remove_group(&udev->dev.kobj, &ati_remote2_attr_group);
-- fail2:
-+ fail3:
- 	ati_remote2_urb_cleanup(ar2);
-+ fail2:
- 	usb_driver_release_interface(&ati_remote2_driver, ar2->intf[1]);
-  fail1:
- 	kfree(ar2);
--- 
-2.5.0
-
diff --git a/freed-ora/current/f22/USB-input-powermate-fix-oops-with-malicious-USB-desc.patch b/freed-ora/current/f22/USB-input-powermate-fix-oops-with-malicious-USB-desc.patch
deleted file mode 100644
index 7de890e1b..000000000
--- a/freed-ora/current/f22/USB-input-powermate-fix-oops-with-malicious-USB-desc.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From 0383ff3ba89d3e6c604138e3ba46685621d71f98 Mon Sep 17 00:00:00 2001
-From: Josh Boyer <jwboyer@fedoraproject.org>
-Date: Mon, 14 Mar 2016 10:02:51 -0400
-Subject: [PATCH] USB: input: powermate: fix oops with malicious USB
- descriptors
-
-The powermate driver expects at least one valid USB endpoint in its
-probe function.  If given malicious descriptors that specify 0 for
-the number of endpoints, it will crash.  Validate the number of
-endpoints on the interface before using them.
-
-The full report for this issue can be found here:
-http://seclists.org/bugtraq/2016/Mar/85
-
-Reported-by: Ralf Spenneberg <ralf@spenneberg.net>
-Cc: stable <stable@vger.kernel.org>
-Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org>
----
- drivers/input/misc/powermate.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/drivers/input/misc/powermate.c b/drivers/input/misc/powermate.c
-index 63b539d3daba..84909a12ff36 100644
---- a/drivers/input/misc/powermate.c
-+++ b/drivers/input/misc/powermate.c
-@@ -307,6 +307,9 @@ static int powermate_probe(struct usb_interface *intf, const struct usb_device_i
- 	int error = -ENOMEM;
- 
- 	interface = intf->cur_altsetting;
-+	if (interface->desc.bNumEndpoints < 1)
-+		return -EINVAL;
-+
- 	endpoint = &interface->endpoint[0].desc;
- 	if (!usb_endpoint_is_int_in(endpoint))
- 		return -EIO;
--- 
-2.5.0
-
diff --git a/freed-ora/current/f22/USB-iowarrior-fix-oops-with-malicious-USB-descriptor.patch b/freed-ora/current/f22/USB-iowarrior-fix-oops-with-malicious-USB-descriptor.patch
deleted file mode 100644
index 7df3af2b1..000000000
--- a/freed-ora/current/f22/USB-iowarrior-fix-oops-with-malicious-USB-descriptor.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From 3620ebad64a327113bed34edefd45c3605086fc6 Mon Sep 17 00:00:00 2001
-From: Josh Boyer <jwboyer@fedoraproject.org>
-Date: Mon, 14 Mar 2016 10:38:31 -0400
-Subject: [PATCH] USB: iowarrior: fix oops with malicious USB descriptors
-
-The iowarrior driver expects at least one valid endpoint.  If given
-malicious descriptors that specify 0 for the number of endpoints,
-it will crash in the probe function.  Ensure there is at least
-one endpoint on the interface before using it.
-
-The full report of this issue can be found here:
-http://seclists.org/bugtraq/2016/Mar/87
-
-Reported-by: Ralf Spenneberg <ralf@spenneberg.net>
-Cc: stable <stable@vger.kernel.org>
-Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org>
----
- drivers/usb/misc/iowarrior.c | 6 ++++++
- 1 file changed, 6 insertions(+)
-
-diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c
-index c6bfd13f6c92..1950e87b4219 100644
---- a/drivers/usb/misc/iowarrior.c
-+++ b/drivers/usb/misc/iowarrior.c
-@@ -787,6 +787,12 @@ static int iowarrior_probe(struct usb_interface *interface,
- 	iface_desc = interface->cur_altsetting;
- 	dev->product_id = le16_to_cpu(udev->descriptor.idProduct);
- 
-+	if (iface_desc->desc.bNumEndpoints < 1) {
-+		dev_err(&interface->dev, "Invalid number of endpoints\n");
-+		retval = -EINVAL;
-+		goto error;
-+	}
-+
- 	/* set up the endpoint information */
- 	for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
- 		endpoint = &iface_desc->endpoint[i].desc;
--- 
-2.5.0
-
diff --git a/freed-ora/current/f22/USB-serial-ftdi_sio-Add-support-for-ICP-DAS-I-756xU-.patch b/freed-ora/current/f22/USB-serial-ftdi_sio-Add-support-for-ICP-DAS-I-756xU-.patch
deleted file mode 100644
index ac8e71c72..000000000
--- a/freed-ora/current/f22/USB-serial-ftdi_sio-Add-support-for-ICP-DAS-I-756xU-.patch
+++ /dev/null
@@ -1,59 +0,0 @@
-From 94c78c81df3056e573fb84000a32512e9c16e555 Mon Sep 17 00:00:00 2001
-From: Josh Boyer <jwboyer@fedoraproject.org>
-Date: Thu, 10 Mar 2016 08:49:02 -0500
-Subject: [PATCH] USB: serial: ftdi_sio: Add support for ICP DAS I-756xU
- devices
-
-A Fedora user reports that the ftdi_sio driver works properly for the
-ICP DAS I-7561U device.  Further, the user manual for these devices
-instructs users to load the driver and add the ids using the sysfs
-interface.
-
-Add support for these in the driver directly so that the devices work
-out of the box instead of needing manual configuration.
-
-Reported-by: <thesource@mail.ru>
-CC: stable <stable@vger.kernel.org>
-Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org>
----
- drivers/usb/serial/ftdi_sio.c     | 4 ++++
- drivers/usb/serial/ftdi_sio_ids.h | 8 ++++++++
- 2 files changed, 12 insertions(+)
-
-diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
-index 8c660ae401d8..b61f12160d37 100644
---- a/drivers/usb/serial/ftdi_sio.c
-+++ b/drivers/usb/serial/ftdi_sio.c
-@@ -1004,6 +1004,10 @@ static const struct usb_device_id id_table_combined[] = {
- 	{ USB_DEVICE(FTDI_VID, CHETCO_SEASMART_DISPLAY_PID) },
- 	{ USB_DEVICE(FTDI_VID, CHETCO_SEASMART_LITE_PID) },
- 	{ USB_DEVICE(FTDI_VID, CHETCO_SEASMART_ANALOG_PID) },
-+	/* ICP DAS I-756xU devices */
-+	{ USB_DEVICE(ICPDAS_VID, ICPDAS_I7560U_PID) },
-+	{ USB_DEVICE(ICPDAS_VID, ICPDAS_I7561U_PID) },
-+	{ USB_DEVICE(ICPDAS_VID, ICPDAS_I7563U_PID) },
- 	{ }					/* Terminating entry */
- };
- 
-diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
-index a84df2513994..a4ec24ce6a11 100644
---- a/drivers/usb/serial/ftdi_sio_ids.h
-+++ b/drivers/usb/serial/ftdi_sio_ids.h
-@@ -872,6 +872,14 @@
- #define NOVITUS_BONO_E_PID		0x6010
- 
- /*
-+ * ICPDAS I-756*U devices
-+ */
-+#define ICPDAS_VID				0x1b5c
-+#define ICPDAS_I7560U_PID			0x0103
-+#define ICPDAS_I7561U_PID			0x0104
-+#define ICPDAS_I7563U_PID			0x0105
-+
-+/*
-  * RT Systems programming cables for various ham radios
-  */
- #define RTSYSTEMS_VID		0x2100	/* Vendor ID */
--- 
-2.5.0
-
diff --git a/freed-ora/current/f22/cdc-acm-more-sanity-checking.patch b/freed-ora/current/f22/cdc-acm-more-sanity-checking.patch
deleted file mode 100644
index 99ad43416..000000000
--- a/freed-ora/current/f22/cdc-acm-more-sanity-checking.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From e6a87f147002fa16adcbafebbc458ff90a463474 Mon Sep 17 00:00:00 2001
-From: Oliver Neukum <oneukum@suse.com>
-Date: Tue, 15 Mar 2016 10:14:04 +0100
-Subject: [PATCH] cdc-acm: more sanity checking
-
-An attack has become available which pretends to be a quirky
-device circumventing normal sanity checks and crashes the kernel
-by an insufficient number of interfaces. This patch adds a check
-to the code path for quirky devices.
-
-Signed-off-by: Oliver Neukum <ONeukum@suse.com>
-CC: stable@vger.kernel.org
----
- drivers/usb/class/cdc-acm.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
-index 26ca4f910cb0..a7732f80a912 100644
---- a/drivers/usb/class/cdc-acm.c
-+++ b/drivers/usb/class/cdc-acm.c
-@@ -1113,6 +1113,9 @@ static int acm_probe(struct usb_interface *intf,
- 	if (quirks == NO_UNION_NORMAL) {
- 		data_interface = usb_ifnum_to_if(usb_dev, 1);
- 		control_interface = usb_ifnum_to_if(usb_dev, 0);
-+		/* we would crash */
-+		if (!data_interface || !control_interface)
-+			return -ENODEV;
- 		goto skip_normal_probe;
- 	}
- 
--- 
-2.5.0
-
diff --git a/freed-ora/current/f22/cdc_ncm-do-not-call-usbnet_link_change-from-cdc_ncm_.patch b/freed-ora/current/f22/cdc_ncm-do-not-call-usbnet_link_change-from-cdc_ncm_.patch
new file mode 100644
index 000000000..479914dc2
--- /dev/null
+++ b/freed-ora/current/f22/cdc_ncm-do-not-call-usbnet_link_change-from-cdc_ncm_.patch
@@ -0,0 +1,87 @@
+From 4d06dd537f95683aba3651098ae288b7cbff8274 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn@mork.no>
+Date: Mon, 7 Mar 2016 21:15:36 +0100
+Subject: [PATCH] cdc_ncm: do not call usbnet_link_change from cdc_ncm_bind
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+usbnet_link_change will call schedule_work and should be
+avoided if bind is failing. Otherwise we will end up with
+scheduled work referring to a netdev which has gone away.
+
+Instead of making the call conditional, we can just defer
+it to usbnet_probe, using the driver_info flag made for
+this purpose.
+
+Fixes: 8a34b0ae8778 ("usbnet: cdc_ncm: apply usbnet_link_change")
+Reported-by: Andrey Konovalov <andreyknvl@gmail.com>
+Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Bjørn Mork <bjorn@mork.no>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/usb/cdc_ncm.c | 20 +++++---------------
+ 1 file changed, 5 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
+index be927964375b..86ba30ba35e8 100644
+--- a/drivers/net/usb/cdc_ncm.c
++++ b/drivers/net/usb/cdc_ncm.c
+@@ -988,8 +988,6 @@ EXPORT_SYMBOL_GPL(cdc_ncm_select_altsetting);
+ 
+ static int cdc_ncm_bind(struct usbnet *dev, struct usb_interface *intf)
+ {
+-	int ret;
+-
+ 	/* MBIM backwards compatible function? */
+ 	if (cdc_ncm_select_altsetting(intf) != CDC_NCM_COMM_ALTSETTING_NCM)
+ 		return -ENODEV;
+@@ -998,16 +996,7 @@ static int cdc_ncm_bind(struct usbnet *dev, struct usb_interface *intf)
+ 	 * Additionally, generic NCM devices are assumed to accept arbitrarily
+ 	 * placed NDP.
+ 	 */
+-	ret = cdc_ncm_bind_common(dev, intf, CDC_NCM_DATA_ALTSETTING_NCM, 0);
+-
+-	/*
+-	 * We should get an event when network connection is "connected" or
+-	 * "disconnected". Set network connection in "disconnected" state
+-	 * (carrier is OFF) during attach, so the IP network stack does not
+-	 * start IPv6 negotiation and more.
+-	 */
+-	usbnet_link_change(dev, 0, 0);
+-	return ret;
++	return cdc_ncm_bind_common(dev, intf, CDC_NCM_DATA_ALTSETTING_NCM, 0);
+ }
+ 
+ static void cdc_ncm_align_tail(struct sk_buff *skb, size_t modulus, size_t remainder, size_t max)
+@@ -1590,7 +1579,8 @@ static void cdc_ncm_status(struct usbnet *dev, struct urb *urb)
+ 
+ static const struct driver_info cdc_ncm_info = {
+ 	.description = "CDC NCM",
+-	.flags = FLAG_POINTTOPOINT | FLAG_NO_SETINT | FLAG_MULTI_PACKET,
++	.flags = FLAG_POINTTOPOINT | FLAG_NO_SETINT | FLAG_MULTI_PACKET
++			| FLAG_LINK_INTR,
+ 	.bind = cdc_ncm_bind,
+ 	.unbind = cdc_ncm_unbind,
+ 	.manage_power = usbnet_manage_power,
+@@ -1603,7 +1593,7 @@ static const struct driver_info cdc_ncm_info = {
+ static const struct driver_info wwan_info = {
+ 	.description = "Mobile Broadband Network Device",
+ 	.flags = FLAG_POINTTOPOINT | FLAG_NO_SETINT | FLAG_MULTI_PACKET
+-			| FLAG_WWAN,
++			| FLAG_LINK_INTR | FLAG_WWAN,
+ 	.bind = cdc_ncm_bind,
+ 	.unbind = cdc_ncm_unbind,
+ 	.manage_power = usbnet_manage_power,
+@@ -1616,7 +1606,7 @@ static const struct driver_info wwan_info = {
+ static const struct driver_info wwan_noarp_info = {
+ 	.description = "Mobile Broadband Network Device (NO ARP)",
+ 	.flags = FLAG_POINTTOPOINT | FLAG_NO_SETINT | FLAG_MULTI_PACKET
+-			| FLAG_WWAN | FLAG_NOARP,
++			| FLAG_LINK_INTR | FLAG_WWAN | FLAG_NOARP,
+ 	.bind = cdc_ncm_bind,
+ 	.unbind = cdc_ncm_unbind,
+ 	.manage_power = usbnet_manage_power,
+-- 
+2.5.5
+
diff --git a/freed-ora/current/f22/cypress_m8-add-sanity-checking.patch b/freed-ora/current/f22/cypress_m8-add-sanity-checking.patch
deleted file mode 100644
index fa8513f94..000000000
--- a/freed-ora/current/f22/cypress_m8-add-sanity-checking.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-From f7a3aa353011e38e119adebd845b38551587a26a Mon Sep 17 00:00:00 2001
-From: Oliver Neukum <oneukum@suse.com>
-Date: Thu, 17 Mar 2016 16:25:33 +0100
-Subject: [PATCH] cypress_m8: add sanity checking
-
-An attack using missing endpoints exists.
-CVE-2016-3137
-
-Signed-off-by: Oliver Neukum <ONeukum@suse.com>
-CC: stable@vger.kernel.org
-
-v1 - add sanity check
-v2 - add error logging
-v3 - correct error message
----
- drivers/usb/serial/cypress_m8.c | 11 +++++------
- 1 file changed, 5 insertions(+), 6 deletions(-)
-
-diff --git a/drivers/usb/serial/cypress_m8.c b/drivers/usb/serial/cypress_m8.c
-index 01bf53392819..5e25443fe4ef 100644
---- a/drivers/usb/serial/cypress_m8.c
-+++ b/drivers/usb/serial/cypress_m8.c
-@@ -447,6 +447,11 @@ static int cypress_generic_port_probe(struct usb_serial_port *port)
- 	struct usb_serial *serial = port->serial;
- 	struct cypress_private *priv;
- 
-+	if (!port->interrupt_out_urb || !port->interrupt_in_urb) {
-+		dev_err(&port->dev, "A required endpoint is missing\n");
-+		return -ENODEV;
-+	}
-+
- 	priv = kzalloc(sizeof(struct cypress_private), GFP_KERNEL);
- 	if (!priv)
- 		return -ENOMEM;
-@@ -606,12 +611,6 @@ static int cypress_open(struct tty_struct *tty, struct usb_serial_port *port)
- 		cypress_set_termios(tty, port, &priv->tmp_termios);
- 
- 	/* setup the port and start reading from the device */
--	if (!port->interrupt_in_urb) {
--		dev_err(&port->dev, "%s - interrupt_in_urb is empty!\n",
--			__func__);
--		return -1;
--	}
--
- 	usb_fill_int_urb(port->interrupt_in_urb, serial->dev,
- 		usb_rcvintpipe(serial->dev, port->interrupt_in_endpointAddress),
- 		port->interrupt_in_urb->transfer_buffer,
--- 
-2.5.0
-
diff --git a/freed-ora/current/f22/digi_acceleport-do-sanity-checking-for-the-number-of.patch b/freed-ora/current/f22/digi_acceleport-do-sanity-checking-for-the-number-of.patch
deleted file mode 100644
index eb060eb08..000000000
--- a/freed-ora/current/f22/digi_acceleport-do-sanity-checking-for-the-number-of.patch
+++ /dev/null
@@ -1,70 +0,0 @@
-From e9c2a3972496927631a1a98fef43e9538e9fd5d5 Mon Sep 17 00:00:00 2001
-From: Oliver Neukum <oneukum@suse.com>
-Date: Mon, 14 Mar 2016 15:53:38 +0100
-Subject: [PATCH v2] digi_acceleport: do sanity checking for the number of ports
-
-The driver can be crashed with devices that expose crafted
-descriptors with too few endpoints.
-See:
-http://seclists.org/bugtraq/2016/Mar/61
-
-Signed-off-by: Oliver Neukum <ONeukum@suse.com>
-
-v1 - added sanity checks
-v2 - moved them to probe() to fix problems Johan pointed out
----
- drivers/usb/serial/digi_acceleport.c | 24 +++++++++++++++++++-----
- 1 file changed, 19 insertions(+), 5 deletions(-)
-
-diff --git a/drivers/usb/serial/digi_acceleport.c b/drivers/usb/serial/digi_acceleport.c
-index 12b0e67..dab1dcf 100644
---- a/drivers/usb/serial/digi_acceleport.c
-+++ b/drivers/usb/serial/digi_acceleport.c
-@@ -1252,7 +1252,8 @@ static int digi_port_init(struct usb_serial_port *port, unsigned port_num)
- static int digi_startup(struct usb_serial *serial)
- {
- 	struct digi_serial *serial_priv;
--	int ret;
-+	int ret = -ENODEV;
-+	int i;
- 
- 	serial_priv = kzalloc(sizeof(*serial_priv), GFP_KERNEL);
- 	if (!serial_priv)
-@@ -1260,18 +1261,31 @@ static int digi_startup(struct usb_serial *serial)
- 
- 	spin_lock_init(&serial_priv->ds_serial_lock);
- 	serial_priv->ds_oob_port_num = serial->type->num_ports;
-+
-+	/* Check whether the expected number of ports matches the device */
-+	if (serial->num_ports < serial_priv->ds_oob_port_num)
-+		goto error;
-+	/* all features must be present */
-+	for (i = 0; i < serial->type->num_ports + 1 ; i++) {
-+		if (!serial->port[i]->read_urb)
-+			goto error;
-+		if (!serial->port[i]->write_urb)
-+			goto error;
-+	}
-+
- 	serial_priv->ds_oob_port = serial->port[serial_priv->ds_oob_port_num];
- 
- 	ret = digi_port_init(serial_priv->ds_oob_port,
- 						serial_priv->ds_oob_port_num);
--	if (ret) {
--		kfree(serial_priv);
--		return ret;
--	}
-+	if (ret)
-+		goto error;
- 
- 	usb_set_serial_data(serial, serial_priv);
- 
- 	return 0;
-+error:
-+	kfree(serial_priv);
-+	return ret;
- }
- 
- 
--- 
-2.1.4
diff --git a/freed-ora/current/f22/ext4-fix-races-between-buffered-IO-and-collapse-inse.patch b/freed-ora/current/f22/ext4-fix-races-between-buffered-IO-and-collapse-inse.patch
new file mode 100644
index 000000000..0c89ea77a
--- /dev/null
+++ b/freed-ora/current/f22/ext4-fix-races-between-buffered-IO-and-collapse-inse.patch
@@ -0,0 +1,119 @@
+From 32ebffd3bbb4162da5ff88f9a35dd32d0a28ea70 Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.com>
+Date: Mon, 7 Dec 2015 14:31:11 -0500
+Subject: [PATCH 3/4] ext4: fix races between buffered IO and collapse / insert
+ range
+
+Current code implementing FALLOC_FL_COLLAPSE_RANGE and
+FALLOC_FL_INSERT_RANGE is prone to races with buffered writes and page
+faults. If buffered write or write via mmap manages to squeeze between
+filemap_write_and_wait_range() and truncate_pagecache() in the fallocate
+implementations, the written data is simply discarded by
+truncate_pagecache() although it should have been shifted.
+
+Fix the problem by moving filemap_write_and_wait_range() call inside
+i_mutex and i_mmap_sem. That way we are protected against races with
+both buffered writes and page faults.
+
+Signed-off-by: Jan Kara <jack@suse.com>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+---
+ fs/ext4/extents.c | 59 +++++++++++++++++++++++++++++--------------------------
+ 1 file changed, 31 insertions(+), 28 deletions(-)
+
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index 65b5ada2833f..4b105c96df08 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -5487,21 +5487,7 @@ int ext4_collapse_range(struct inode *inode, loff_t offset, loff_t len)
+ 			return ret;
+ 	}
+ 
+-	/*
+-	 * Need to round down offset to be aligned with page size boundary
+-	 * for page size > block size.
+-	 */
+-	ioffset = round_down(offset, PAGE_SIZE);
+-
+-	/* Write out all dirty pages */
+-	ret = filemap_write_and_wait_range(inode->i_mapping, ioffset,
+-					   LLONG_MAX);
+-	if (ret)
+-		return ret;
+-
+-	/* Take mutex lock */
+ 	mutex_lock(&inode->i_mutex);
+-
+ 	/*
+ 	 * There is no need to overlap collapse range with EOF, in which case
+ 	 * it is effectively a truncate operation
+@@ -5526,6 +5512,27 @@ int ext4_collapse_range(struct inode *inode, loff_t offset, loff_t len)
+ 	 * page cache.
+ 	 */
+ 	down_write(&EXT4_I(inode)->i_mmap_sem);
++	/*
++	 * Need to round down offset to be aligned with page size boundary
++	 * for page size > block size.
++	 */
++	ioffset = round_down(offset, PAGE_SIZE);
++	/*
++	 * Write tail of the last page before removed range since it will get
++	 * removed from the page cache below.
++	 */
++	ret = filemap_write_and_wait_range(inode->i_mapping, ioffset, offset);
++	if (ret)
++		goto out_mmap;
++	/*
++	 * Write data that will be shifted to preserve them when discarding
++	 * page cache below. We are also protected from pages becoming dirty
++	 * by i_mmap_sem.
++	 */
++	ret = filemap_write_and_wait_range(inode->i_mapping, offset + len,
++					   LLONG_MAX);
++	if (ret)
++		goto out_mmap;
+ 	truncate_pagecache(inode, ioffset);
+ 
+ 	credits = ext4_writepage_trans_blocks(inode);
+@@ -5626,21 +5633,7 @@ int ext4_insert_range(struct inode *inode, loff_t offset, loff_t len)
+ 			return ret;
+ 	}
+ 
+-	/*
+-	 * Need to round down to align start offset to page size boundary
+-	 * for page size > block size.
+-	 */
+-	ioffset = round_down(offset, PAGE_SIZE);
+-
+-	/* Write out all dirty pages */
+-	ret = filemap_write_and_wait_range(inode->i_mapping, ioffset,
+-			LLONG_MAX);
+-	if (ret)
+-		return ret;
+-
+-	/* Take mutex lock */
+ 	mutex_lock(&inode->i_mutex);
+-
+ 	/* Currently just for extent based files */
+ 	if (!ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)) {
+ 		ret = -EOPNOTSUPP;
+@@ -5668,6 +5661,16 @@ int ext4_insert_range(struct inode *inode, loff_t offset, loff_t len)
+ 	 * page cache.
+ 	 */
+ 	down_write(&EXT4_I(inode)->i_mmap_sem);
++	/*
++	 * Need to round down to align start offset to page size boundary
++	 * for page size > block size.
++	 */
++	ioffset = round_down(offset, PAGE_SIZE);
++	/* Write out all dirty pages */
++	ret = filemap_write_and_wait_range(inode->i_mapping, ioffset,
++			LLONG_MAX);
++	if (ret)
++		goto out_mmap;
+ 	truncate_pagecache(inode, ioffset);
+ 
+ 	credits = ext4_writepage_trans_blocks(inode);
+-- 
+2.5.5
+
diff --git a/freed-ora/current/f22/ext4-fix-races-between-page-faults-and-hole-punching.patch b/freed-ora/current/f22/ext4-fix-races-between-page-faults-and-hole-punching.patch
new file mode 100644
index 000000000..9034b958c
--- /dev/null
+++ b/freed-ora/current/f22/ext4-fix-races-between-page-faults-and-hole-punching.patch
@@ -0,0 +1,442 @@
+From ea3d7209ca01da209cda6f0dea8be9cc4b7a933b Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.com>
+Date: Mon, 7 Dec 2015 14:28:03 -0500
+Subject: [PATCH 1/4] ext4: fix races between page faults and hole punching
+
+Currently, page faults and hole punching are completely unsynchronized.
+This can result in page fault faulting in a page into a range that we
+are punching after truncate_pagecache_range() has been called and thus
+we can end up with a page mapped to disk blocks that will be shortly
+freed. Filesystem corruption will shortly follow. Note that the same
+race is avoided for truncate by checking page fault offset against
+i_size but there isn't similar mechanism available for punching holes.
+
+Fix the problem by creating new rw semaphore i_mmap_sem in inode and
+grab it for writing over truncate, hole punching, and other functions
+removing blocks from extent tree and for read over page faults. We
+cannot easily use i_data_sem for this since that ranks below transaction
+start and we need something ranking above it so that it can be held over
+the whole truncate / hole punching operation. Also remove various
+workarounds we had in the code to reduce race window when page fault
+could have created pages with stale mapping information.
+
+Signed-off-by: Jan Kara <jack@suse.com>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+---
+ fs/ext4/ext4.h     | 10 +++++++++
+ fs/ext4/extents.c  | 54 ++++++++++++++++++++++++--------------------
+ fs/ext4/file.c     | 66 ++++++++++++++++++++++++++++++++++++++++++++++--------
+ fs/ext4/inode.c    | 36 +++++++++++++++++++++--------
+ fs/ext4/super.c    |  1 +
+ fs/ext4/truncate.h |  2 ++
+ 6 files changed, 127 insertions(+), 42 deletions(-)
+
+diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
+index cc7ca4e87144..348a5ff4a0e2 100644
+--- a/fs/ext4/ext4.h
++++ b/fs/ext4/ext4.h
+@@ -910,6 +910,15 @@ struct ext4_inode_info {
+ 	 * by other means, so we have i_data_sem.
+ 	 */
+ 	struct rw_semaphore i_data_sem;
++	/*
++	 * i_mmap_sem is for serializing page faults with truncate / punch hole
++	 * operations. We have to make sure that new page cannot be faulted in
++	 * a section of the inode that is being punched. We cannot easily use
++	 * i_data_sem for this since we need protection for the whole punch
++	 * operation and i_data_sem ranks below transaction start so we have
++	 * to occasionally drop it.
++	 */
++	struct rw_semaphore i_mmap_sem;
+ 	struct inode vfs_inode;
+ 	struct jbd2_inode *jinode;
+ 
+@@ -2484,6 +2493,7 @@ extern int ext4_chunk_trans_blocks(struct inode *, int nrblocks);
+ extern int ext4_zero_partial_blocks(handle_t *handle, struct inode *inode,
+ 			     loff_t lstart, loff_t lend);
+ extern int ext4_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf);
++extern int ext4_filemap_fault(struct vm_area_struct *vma, struct vm_fault *vmf);
+ extern qsize_t *ext4_get_reserved_space(struct inode *inode);
+ extern void ext4_da_update_reserve_space(struct inode *inode,
+ 					int used, int quota_claim);
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index 551353b1b17a..5be9ca5a8a7a 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -4770,7 +4770,6 @@ static long ext4_zero_range(struct file *file, loff_t offset,
+ 	int partial_begin, partial_end;
+ 	loff_t start, end;
+ 	ext4_lblk_t lblk;
+-	struct address_space *mapping = inode->i_mapping;
+ 	unsigned int blkbits = inode->i_blkbits;
+ 
+ 	trace_ext4_zero_range(inode, offset, len, mode);
+@@ -4786,17 +4785,6 @@ static long ext4_zero_range(struct file *file, loff_t offset,
+ 	}
+ 
+ 	/*
+-	 * Write out all dirty pages to avoid race conditions
+-	 * Then release them.
+-	 */
+-	if (mapping->nrpages && mapping_tagged(mapping, PAGECACHE_TAG_DIRTY)) {
+-		ret = filemap_write_and_wait_range(mapping, offset,
+-						   offset + len - 1);
+-		if (ret)
+-			return ret;
+-	}
+-
+-	/*
+ 	 * Round up offset. This is not fallocate, we neet to zero out
+ 	 * blocks, so convert interior block aligned part of the range to
+ 	 * unwritten and possibly manually zero out unaligned parts of the
+@@ -4856,16 +4844,22 @@ static long ext4_zero_range(struct file *file, loff_t offset,
+ 		flags |= (EXT4_GET_BLOCKS_CONVERT_UNWRITTEN |
+ 			  EXT4_EX_NOCACHE);
+ 
+-		/* Now release the pages and zero block aligned part of pages*/
+-		truncate_pagecache_range(inode, start, end - 1);
+-		inode->i_mtime = inode->i_ctime = ext4_current_time(inode);
+-
+ 		/* Wait all existing dio workers, newcomers will block on i_mutex */
+ 		ext4_inode_block_unlocked_dio(inode);
+ 		inode_dio_wait(inode);
+ 
++		/*
++		 * Prevent page faults from reinstantiating pages we have
++		 * released from page cache.
++		 */
++		down_write(&EXT4_I(inode)->i_mmap_sem);
++		/* Now release the pages and zero block aligned part of pages */
++		truncate_pagecache_range(inode, start, end - 1);
++		inode->i_mtime = inode->i_ctime = ext4_current_time(inode);
++
+ 		ret = ext4_alloc_file_blocks(file, lblk, max_blocks, new_size,
+ 					     flags, mode);
++		up_write(&EXT4_I(inode)->i_mmap_sem);
+ 		if (ret)
+ 			goto out_dio;
+ 	}
+@@ -5524,17 +5518,22 @@ int ext4_collapse_range(struct inode *inode, loff_t offset, loff_t len)
+ 		goto out_mutex;
+ 	}
+ 
+-	truncate_pagecache(inode, ioffset);
+-
+ 	/* Wait for existing dio to complete */
+ 	ext4_inode_block_unlocked_dio(inode);
+ 	inode_dio_wait(inode);
+ 
++	/*
++	 * Prevent page faults from reinstantiating pages we have released from
++	 * page cache.
++	 */
++	down_write(&EXT4_I(inode)->i_mmap_sem);
++	truncate_pagecache(inode, ioffset);
++
+ 	credits = ext4_writepage_trans_blocks(inode);
+ 	handle = ext4_journal_start(inode, EXT4_HT_TRUNCATE, credits);
+ 	if (IS_ERR(handle)) {
+ 		ret = PTR_ERR(handle);
+-		goto out_dio;
++		goto out_mmap;
+ 	}
+ 
+ 	down_write(&EXT4_I(inode)->i_data_sem);
+@@ -5573,7 +5572,8 @@ int ext4_collapse_range(struct inode *inode, loff_t offset, loff_t len)
+ 
+ out_stop:
+ 	ext4_journal_stop(handle);
+-out_dio:
++out_mmap:
++	up_write(&EXT4_I(inode)->i_mmap_sem);
+ 	ext4_inode_resume_unlocked_dio(inode);
+ out_mutex:
+ 	mutex_unlock(&inode->i_mutex);
+@@ -5660,17 +5660,22 @@ int ext4_insert_range(struct inode *inode, loff_t offset, loff_t len)
+ 		goto out_mutex;
+ 	}
+ 
+-	truncate_pagecache(inode, ioffset);
+-
+ 	/* Wait for existing dio to complete */
+ 	ext4_inode_block_unlocked_dio(inode);
+ 	inode_dio_wait(inode);
+ 
++	/*
++	 * Prevent page faults from reinstantiating pages we have released from
++	 * page cache.
++	 */
++	down_write(&EXT4_I(inode)->i_mmap_sem);
++	truncate_pagecache(inode, ioffset);
++
+ 	credits = ext4_writepage_trans_blocks(inode);
+ 	handle = ext4_journal_start(inode, EXT4_HT_TRUNCATE, credits);
+ 	if (IS_ERR(handle)) {
+ 		ret = PTR_ERR(handle);
+-		goto out_dio;
++		goto out_mmap;
+ 	}
+ 
+ 	/* Expand file to avoid data loss if there is error while shifting */
+@@ -5741,7 +5746,8 @@ int ext4_insert_range(struct inode *inode, loff_t offset, loff_t len)
+ 
+ out_stop:
+ 	ext4_journal_stop(handle);
+-out_dio:
++out_mmap:
++	up_write(&EXT4_I(inode)->i_mmap_sem);
+ 	ext4_inode_resume_unlocked_dio(inode);
+ out_mutex:
+ 	mutex_unlock(&inode->i_mutex);
+diff --git a/fs/ext4/file.c b/fs/ext4/file.c
+index 113837e7ba98..0d24ebcd7c9e 100644
+--- a/fs/ext4/file.c
++++ b/fs/ext4/file.c
+@@ -209,15 +209,18 @@ static int ext4_dax_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
+ {
+ 	int result;
+ 	handle_t *handle = NULL;
+-	struct super_block *sb = file_inode(vma->vm_file)->i_sb;
++	struct inode *inode = file_inode(vma->vm_file);
++	struct super_block *sb = inode->i_sb;
+ 	bool write = vmf->flags & FAULT_FLAG_WRITE;
+ 
+ 	if (write) {
+ 		sb_start_pagefault(sb);
+ 		file_update_time(vma->vm_file);
++		down_read(&EXT4_I(inode)->i_mmap_sem);
+ 		handle = ext4_journal_start_sb(sb, EXT4_HT_WRITE_PAGE,
+ 						EXT4_DATA_TRANS_BLOCKS(sb));
+-	}
++	} else
++		down_read(&EXT4_I(inode)->i_mmap_sem);
+ 
+ 	if (IS_ERR(handle))
+ 		result = VM_FAULT_SIGBUS;
+@@ -228,8 +231,10 @@ static int ext4_dax_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
+ 	if (write) {
+ 		if (!IS_ERR(handle))
+ 			ext4_journal_stop(handle);
++		up_read(&EXT4_I(inode)->i_mmap_sem);
+ 		sb_end_pagefault(sb);
+-	}
++	} else
++		up_read(&EXT4_I(inode)->i_mmap_sem);
+ 
+ 	return result;
+ }
+@@ -246,10 +251,12 @@ static int ext4_dax_pmd_fault(struct vm_area_struct *vma, unsigned long addr,
+ 	if (write) {
+ 		sb_start_pagefault(sb);
+ 		file_update_time(vma->vm_file);
++		down_read(&EXT4_I(inode)->i_mmap_sem);
+ 		handle = ext4_journal_start_sb(sb, EXT4_HT_WRITE_PAGE,
+ 				ext4_chunk_trans_blocks(inode,
+ 							PMD_SIZE / PAGE_SIZE));
+-	}
++	} else
++		down_read(&EXT4_I(inode)->i_mmap_sem);
+ 
+ 	if (IS_ERR(handle))
+ 		result = VM_FAULT_SIGBUS;
+@@ -260,30 +267,71 @@ static int ext4_dax_pmd_fault(struct vm_area_struct *vma, unsigned long addr,
+ 	if (write) {
+ 		if (!IS_ERR(handle))
+ 			ext4_journal_stop(handle);
++		up_read(&EXT4_I(inode)->i_mmap_sem);
+ 		sb_end_pagefault(sb);
+-	}
++	} else
++		up_read(&EXT4_I(inode)->i_mmap_sem);
+ 
+ 	return result;
+ }
+ 
+ static int ext4_dax_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf)
+ {
+-	return dax_mkwrite(vma, vmf, ext4_get_block_dax,
+-				ext4_end_io_unwritten);
++	int err;
++	struct inode *inode = file_inode(vma->vm_file);
++
++	sb_start_pagefault(inode->i_sb);
++	file_update_time(vma->vm_file);
++	down_read(&EXT4_I(inode)->i_mmap_sem);
++	err = __dax_mkwrite(vma, vmf, ext4_get_block_dax,
++			    ext4_end_io_unwritten);
++	up_read(&EXT4_I(inode)->i_mmap_sem);
++	sb_end_pagefault(inode->i_sb);
++
++	return err;
++}
++
++/*
++ * Handle write fault for VM_MIXEDMAP mappings. Similarly to ext4_dax_mkwrite()
++ * handler we check for races agaist truncate. Note that since we cycle through
++ * i_mmap_sem, we are sure that also any hole punching that began before we
++ * were called is finished by now and so if it included part of the file we
++ * are working on, our pte will get unmapped and the check for pte_same() in
++ * wp_pfn_shared() fails. Thus fault gets retried and things work out as
++ * desired.
++ */
++static int ext4_dax_pfn_mkwrite(struct vm_area_struct *vma,
++				struct vm_fault *vmf)
++{
++	struct inode *inode = file_inode(vma->vm_file);
++	struct super_block *sb = inode->i_sb;
++	int ret = VM_FAULT_NOPAGE;
++	loff_t size;
++
++	sb_start_pagefault(sb);
++	file_update_time(vma->vm_file);
++	down_read(&EXT4_I(inode)->i_mmap_sem);
++	size = (i_size_read(inode) + PAGE_SIZE - 1) >> PAGE_SHIFT;
++	if (vmf->pgoff >= size)
++		ret = VM_FAULT_SIGBUS;
++	up_read(&EXT4_I(inode)->i_mmap_sem);
++	sb_end_pagefault(sb);
++
++	return ret;
+ }
+ 
+ static const struct vm_operations_struct ext4_dax_vm_ops = {
+ 	.fault		= ext4_dax_fault,
+ 	.pmd_fault	= ext4_dax_pmd_fault,
+ 	.page_mkwrite	= ext4_dax_mkwrite,
+-	.pfn_mkwrite	= dax_pfn_mkwrite,
++	.pfn_mkwrite	= ext4_dax_pfn_mkwrite,
+ };
+ #else
+ #define ext4_dax_vm_ops	ext4_file_vm_ops
+ #endif
+ 
+ static const struct vm_operations_struct ext4_file_vm_ops = {
+-	.fault		= filemap_fault,
++	.fault		= ext4_filemap_fault,
+ 	.map_pages	= filemap_map_pages,
+ 	.page_mkwrite   = ext4_page_mkwrite,
+ };
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index ea433a7f4bca..d1207d03c961 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -3623,6 +3623,15 @@ int ext4_punch_hole(struct inode *inode, loff_t offset, loff_t length)
+ 
+ 	}
+ 
++	/* Wait all existing dio workers, newcomers will block on i_mutex */
++	ext4_inode_block_unlocked_dio(inode);
++	inode_dio_wait(inode);
++
++	/*
++	 * Prevent page faults from reinstantiating pages we have released from
++	 * page cache.
++	 */
++	down_write(&EXT4_I(inode)->i_mmap_sem);
+ 	first_block_offset = round_up(offset, sb->s_blocksize);
+ 	last_block_offset = round_down((offset + length), sb->s_blocksize) - 1;
+ 
+@@ -3631,10 +3640,6 @@ int ext4_punch_hole(struct inode *inode, loff_t offset, loff_t length)
+ 		truncate_pagecache_range(inode, first_block_offset,
+ 					 last_block_offset);
+ 
+-	/* Wait all existing dio workers, newcomers will block on i_mutex */
+-	ext4_inode_block_unlocked_dio(inode);
+-	inode_dio_wait(inode);
+-
+ 	if (ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))
+ 		credits = ext4_writepage_trans_blocks(inode);
+ 	else
+@@ -3680,16 +3685,12 @@ int ext4_punch_hole(struct inode *inode, loff_t offset, loff_t length)
+ 	if (IS_SYNC(inode))
+ 		ext4_handle_sync(handle);
+ 
+-	/* Now release the pages again to reduce race window */
+-	if (last_block_offset > first_block_offset)
+-		truncate_pagecache_range(inode, first_block_offset,
+-					 last_block_offset);
+-
+ 	inode->i_mtime = inode->i_ctime = ext4_current_time(inode);
+ 	ext4_mark_inode_dirty(handle, inode);
+ out_stop:
+ 	ext4_journal_stop(handle);
+ out_dio:
++	up_write(&EXT4_I(inode)->i_mmap_sem);
+ 	ext4_inode_resume_unlocked_dio(inode);
+ out_mutex:
+ 	mutex_unlock(&inode->i_mutex);
+@@ -4823,6 +4824,7 @@ int ext4_setattr(struct dentry *dentry, struct iattr *attr)
+ 			} else
+ 				ext4_wait_for_tail_page_commit(inode);
+ 		}
++		down_write(&EXT4_I(inode)->i_mmap_sem);
+ 		/*
+ 		 * Truncate pagecache after we've waited for commit
+ 		 * in data=journal mode to make pages freeable.
+@@ -4830,6 +4832,7 @@ int ext4_setattr(struct dentry *dentry, struct iattr *attr)
+ 		truncate_pagecache(inode, inode->i_size);
+ 		if (shrink)
+ 			ext4_truncate(inode);
++		up_write(&EXT4_I(inode)->i_mmap_sem);
+ 	}
+ 
+ 	if (!rc) {
+@@ -5278,6 +5281,8 @@ int ext4_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf)
+ 
+ 	sb_start_pagefault(inode->i_sb);
+ 	file_update_time(vma->vm_file);
++
++	down_read(&EXT4_I(inode)->i_mmap_sem);
+ 	/* Delalloc case is easy... */
+ 	if (test_opt(inode->i_sb, DELALLOC) &&
+ 	    !ext4_should_journal_data(inode) &&
+@@ -5347,6 +5352,19 @@ retry_alloc:
+ out_ret:
+ 	ret = block_page_mkwrite_return(ret);
+ out:
++	up_read(&EXT4_I(inode)->i_mmap_sem);
+ 	sb_end_pagefault(inode->i_sb);
+ 	return ret;
+ }
++
++int ext4_filemap_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
++{
++	struct inode *inode = file_inode(vma->vm_file);
++	int err;
++
++	down_read(&EXT4_I(inode)->i_mmap_sem);
++	err = filemap_fault(vma, vmf);
++	up_read(&EXT4_I(inode)->i_mmap_sem);
++
++	return err;
++}
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index c9ab67da6e5a..493370e6590e 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -958,6 +958,7 @@ static void init_once(void *foo)
+ 	INIT_LIST_HEAD(&ei->i_orphan);
+ 	init_rwsem(&ei->xattr_sem);
+ 	init_rwsem(&ei->i_data_sem);
++	init_rwsem(&ei->i_mmap_sem);
+ 	inode_init_once(&ei->vfs_inode);
+ }
+ 
+diff --git a/fs/ext4/truncate.h b/fs/ext4/truncate.h
+index 011ba6670d99..c70d06a383e2 100644
+--- a/fs/ext4/truncate.h
++++ b/fs/ext4/truncate.h
+@@ -10,8 +10,10 @@
+  */
+ static inline void ext4_truncate_failed_write(struct inode *inode)
+ {
++	down_write(&EXT4_I(inode)->i_mmap_sem);
+ 	truncate_inode_pages(inode->i_mapping, inode->i_size);
+ 	ext4_truncate(inode);
++	up_write(&EXT4_I(inode)->i_mmap_sem);
+ }
+ 
+ /*
+-- 
+2.5.5
+
diff --git a/freed-ora/current/f22/ext4-fix-races-of-writeback-with-punch-hole-and-zero.patch b/freed-ora/current/f22/ext4-fix-races-of-writeback-with-punch-hole-and-zero.patch
new file mode 100644
index 000000000..9ff9e2761
--- /dev/null
+++ b/freed-ora/current/f22/ext4-fix-races-of-writeback-with-punch-hole-and-zero.patch
@@ -0,0 +1,110 @@
+From 011278485ecc3cd2a3954b5d4c73101d919bf1fa Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.com>
+Date: Mon, 7 Dec 2015 14:34:49 -0500
+Subject: [PATCH 4/4] ext4: fix races of writeback with punch hole and zero
+ range
+
+When doing delayed allocation, update of on-disk inode size is postponed
+until IO submission time. However hole punch or zero range fallocate
+calls can end up discarding the tail page cache page and thus on-disk
+inode size would never be properly updated.
+
+Make sure the on-disk inode size is updated before truncating page
+cache.
+
+Signed-off-by: Jan Kara <jack@suse.com>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+---
+ fs/ext4/ext4.h    |  3 +++
+ fs/ext4/extents.c |  5 +++++
+ fs/ext4/inode.c   | 35 ++++++++++++++++++++++++++++++++++-
+ 3 files changed, 42 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
+index 348a5ff4a0e2..80f76f092079 100644
+--- a/fs/ext4/ext4.h
++++ b/fs/ext4/ext4.h
+@@ -2858,6 +2858,9 @@ static inline int ext4_update_inode_size(struct inode *inode, loff_t newsize)
+ 	return changed;
+ }
+ 
++int ext4_update_disksize_before_punch(struct inode *inode, loff_t offset,
++				      loff_t len);
++
+ struct ext4_group_info {
+ 	unsigned long   bb_state;
+ 	struct rb_root  bb_free_root;
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index 4b105c96df08..3578b25fccfd 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -4847,6 +4847,11 @@ static long ext4_zero_range(struct file *file, loff_t offset,
+ 		 * released from page cache.
+ 		 */
+ 		down_write(&EXT4_I(inode)->i_mmap_sem);
++		ret = ext4_update_disksize_before_punch(inode, offset, len);
++		if (ret) {
++			up_write(&EXT4_I(inode)->i_mmap_sem);
++			goto out_dio;
++		}
+ 		/* Now release the pages and zero block aligned part of pages */
+ 		truncate_pagecache_range(inode, start, end - 1);
+ 		inode->i_mtime = inode->i_ctime = ext4_current_time(inode);
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index d1207d03c961..472e608da13d 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -3559,6 +3559,35 @@ int ext4_can_truncate(struct inode *inode)
+ }
+ 
+ /*
++ * We have to make sure i_disksize gets properly updated before we truncate
++ * page cache due to hole punching or zero range. Otherwise i_disksize update
++ * can get lost as it may have been postponed to submission of writeback but
++ * that will never happen after we truncate page cache.
++ */
++int ext4_update_disksize_before_punch(struct inode *inode, loff_t offset,
++				      loff_t len)
++{
++	handle_t *handle;
++	loff_t size = i_size_read(inode);
++
++	WARN_ON(!mutex_is_locked(&inode->i_mutex));
++	if (offset > size || offset + len < size)
++		return 0;
++
++	if (EXT4_I(inode)->i_disksize >= size)
++		return 0;
++
++	handle = ext4_journal_start(inode, EXT4_HT_MISC, 1);
++	if (IS_ERR(handle))
++		return PTR_ERR(handle);
++	ext4_update_i_disksize(inode, size);
++	ext4_mark_inode_dirty(handle, inode);
++	ext4_journal_stop(handle);
++
++	return 0;
++}
++
++/*
+  * ext4_punch_hole: punches a hole in a file by releaseing the blocks
+  * associated with the given offset and length
+  *
+@@ -3636,9 +3665,13 @@ int ext4_punch_hole(struct inode *inode, loff_t offset, loff_t length)
+ 	last_block_offset = round_down((offset + length), sb->s_blocksize) - 1;
+ 
+ 	/* Now release the pages and zero block aligned part of pages*/
+-	if (last_block_offset > first_block_offset)
++	if (last_block_offset > first_block_offset) {
++		ret = ext4_update_disksize_before_punch(inode, offset, length);
++		if (ret)
++			goto out_dio;
+ 		truncate_pagecache_range(inode, first_block_offset,
+ 					 last_block_offset);
++	}
+ 
+ 	if (ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))
+ 		credits = ext4_writepage_trans_blocks(inode);
+-- 
+2.5.5
+
diff --git a/freed-ora/current/f22/ext4-move-unlocked-dio-protection-from-ext4_alloc_fi.patch b/freed-ora/current/f22/ext4-move-unlocked-dio-protection-from-ext4_alloc_fi.patch
new file mode 100644
index 000000000..3bf6765fa
--- /dev/null
+++ b/freed-ora/current/f22/ext4-move-unlocked-dio-protection-from-ext4_alloc_fi.patch
@@ -0,0 +1,93 @@
+From 17048e8a083fec7ad841d88ef0812707fbc7e39f Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.com>
+Date: Mon, 7 Dec 2015 14:29:17 -0500
+Subject: [PATCH 2/4] ext4: move unlocked dio protection from
+ ext4_alloc_file_blocks()
+
+Currently ext4_alloc_file_blocks() was handling protection against
+unlocked DIO. However we now need to sometimes call it under i_mmap_sem
+and sometimes not and DIO protection ranks above it (although strictly
+speaking this cannot currently create any deadlocks). Also
+ext4_zero_range() was actually getting & releasing unlocked DIO
+protection twice in some cases. Luckily it didn't introduce any real bug
+but it was a land mine waiting to be stepped on.  So move DIO protection
+out from ext4_alloc_file_blocks() into the two callsites.
+
+Signed-off-by: Jan Kara <jack@suse.com>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+---
+ fs/ext4/extents.c | 21 ++++++++++-----------
+ 1 file changed, 10 insertions(+), 11 deletions(-)
+
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index 5be9ca5a8a7a..65b5ada2833f 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -4685,10 +4685,6 @@ static int ext4_alloc_file_blocks(struct file *file, ext4_lblk_t offset,
+ 	if (len <= EXT_UNWRITTEN_MAX_LEN)
+ 		flags |= EXT4_GET_BLOCKS_NO_NORMALIZE;
+ 
+-	/* Wait all existing dio workers, newcomers will block on i_mutex */
+-	ext4_inode_block_unlocked_dio(inode);
+-	inode_dio_wait(inode);
+-
+ 	/*
+ 	 * credits to insert 1 extent into extent tree
+ 	 */
+@@ -4752,8 +4748,6 @@ retry:
+ 		goto retry;
+ 	}
+ 
+-	ext4_inode_resume_unlocked_dio(inode);
+-
+ 	return ret > 0 ? ret2 : ret;
+ }
+ 
+@@ -4827,6 +4821,10 @@ static long ext4_zero_range(struct file *file, loff_t offset,
+ 	if (mode & FALLOC_FL_KEEP_SIZE)
+ 		flags |= EXT4_GET_BLOCKS_KEEP_SIZE;
+ 
++	/* Wait all existing dio workers, newcomers will block on i_mutex */
++	ext4_inode_block_unlocked_dio(inode);
++	inode_dio_wait(inode);
++
+ 	/* Preallocate the range including the unaligned edges */
+ 	if (partial_begin || partial_end) {
+ 		ret = ext4_alloc_file_blocks(file,
+@@ -4835,7 +4833,7 @@ static long ext4_zero_range(struct file *file, loff_t offset,
+ 				 round_down(offset, 1 << blkbits)) >> blkbits,
+ 				new_size, flags, mode);
+ 		if (ret)
+-			goto out_mutex;
++			goto out_dio;
+ 
+ 	}
+ 
+@@ -4844,10 +4842,6 @@ static long ext4_zero_range(struct file *file, loff_t offset,
+ 		flags |= (EXT4_GET_BLOCKS_CONVERT_UNWRITTEN |
+ 			  EXT4_EX_NOCACHE);
+ 
+-		/* Wait all existing dio workers, newcomers will block on i_mutex */
+-		ext4_inode_block_unlocked_dio(inode);
+-		inode_dio_wait(inode);
+-
+ 		/*
+ 		 * Prevent page faults from reinstantiating pages we have
+ 		 * released from page cache.
+@@ -4992,8 +4986,13 @@ long ext4_fallocate(struct file *file, int mode, loff_t offset, loff_t len)
+ 			goto out;
+ 	}
+ 
++	/* Wait all existing dio workers, newcomers will block on i_mutex */
++	ext4_inode_block_unlocked_dio(inode);
++	inode_dio_wait(inode);
++
+ 	ret = ext4_alloc_file_blocks(file, lblk, max_blocks, new_size,
+ 				     flags, mode);
++	ext4_inode_resume_unlocked_dio(inode);
+ 	if (ret)
+ 		goto out;
+ 
+-- 
+2.5.5
+
diff --git a/freed-ora/current/f22/ims-pcu-sanity-check-against-missing-interfaces.patch b/freed-ora/current/f22/ims-pcu-sanity-check-against-missing-interfaces.patch
deleted file mode 100644
index 827a2b7ee..000000000
--- a/freed-ora/current/f22/ims-pcu-sanity-check-against-missing-interfaces.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From a4200b7eb26271108586d3a7cf34a2f16d460e48 Mon Sep 17 00:00:00 2001
-From: Oliver Neukum <oneukum@suse.com>
-Date: Thu, 17 Mar 2016 15:10:47 +0100
-Subject: [PATCH] ims-pcu: sanity check against missing interfaces
-
-A malicious device missing interface can make the driver oops.
-Add sanity checking.
-
-Signed-off-by: Oliver Neukum <ONeukum@suse.com>
-CC: stable@vger.kernel.org
----
- drivers/input/misc/ims-pcu.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/drivers/input/misc/ims-pcu.c b/drivers/input/misc/ims-pcu.c
-index ac1fa5f44580..9c0ea36913b4 100644
---- a/drivers/input/misc/ims-pcu.c
-+++ b/drivers/input/misc/ims-pcu.c
-@@ -1663,6 +1663,8 @@ static int ims_pcu_parse_cdc_data(struct usb_interface *intf, struct ims_pcu *pc
- 
- 	pcu->ctrl_intf = usb_ifnum_to_if(pcu->udev,
- 					 union_desc->bMasterInterface0);
-+	if (!pcu->ctrl_intf)
-+		return -EINVAL;
- 
- 	alt = pcu->ctrl_intf->cur_altsetting;
- 	pcu->ep_ctrl = &alt->endpoint[0].desc;
-@@ -1670,6 +1672,8 @@ static int ims_pcu_parse_cdc_data(struct usb_interface *intf, struct ims_pcu *pc
- 
- 	pcu->data_intf = usb_ifnum_to_if(pcu->udev,
- 					 union_desc->bSlaveInterface0);
-+	if (!pcu->data_intf)
-+		return -EINVAL;
- 
- 	alt = pcu->data_intf->cur_altsetting;
- 	if (alt->desc.bNumEndpoints != 2) {
--- 
-2.5.0
-
diff --git a/freed-ora/current/f22/kernel.spec b/freed-ora/current/f22/kernel.spec
index d86f21397..c7e027659 100644
--- a/freed-ora/current/f22/kernel.spec
+++ b/freed-ora/current/f22/kernel.spec
@@ -40,7 +40,7 @@ Summary: The Linux kernel
 # For non-released -rc kernels, this will be appended after the rcX and
 # gitX tags, so a 3 here would become part of release "0.rcX.gitX.3"
 #
-%global baserelease 201
+%global baserelease 200
 %global fedora_build %{baserelease}
 
 # base_sublevel is the kernel version we're starting with and patching
@@ -90,7 +90,7 @@ Summary: The Linux kernel
 %if 0%{?released_kernel}
 
 # Do we have a -stable update to apply?
-%define stable_update 6
+%define stable_update 7
 # Set rpm version accordingly
 %if 0%{?stable_update}
 %define stablerev %{stable_update}
@@ -672,9 +672,6 @@ Patch660: 0001-drm-i915-Pretend-cursor-is-always-on-for-ILK-style-W.patch
 #rhbz 1316719
 Patch662: 0001-cdc-acm-fix-NULL-pointer-reference.patch
 
-#rhbz 1316136
-Patch663: USB-serial-ftdi_sio-Add-support-for-ICP-DAS-I-756xU-.patch
-
 #CVE-2016-3135 rhbz 1317386 1317387
 Patch664: netfilter-x_tables-check-for-size-overflow.patch
 
@@ -684,51 +681,30 @@ Patch665: netfilter-x_tables-deal-with-bogus-nextoffset-values.patch
 #CVE-2016-3135 rhbz 1318172 1318270
 Patch666: ipv4-Dont-do-expensive-useless-work-during-inetdev-des.patch
 
-#CVE-2016-2184 rhbz 1317012 1317470
-Patch670: ALSA-usb-audio-Fix-NULL-dereference-in-create_fixed_.patch
-Patch671: ALSA-usb-audio-Add-sanity-checks-for-endpoint-access.patch
-
-#CVE-2016-3137 rhbz 1317010 1316996
-Patch672: cypress_m8-add-sanity-checking.patch
-
-#CVE-2016-2186 rhbz 1317015 1317464
-Patch673: USB-input-powermate-fix-oops-with-malicious-USB-desc.patch
-
-#CVE-2016-2188 rhbz 1317018 1317467
-Patch674: USB-iowarrior-fix-oops-with-malicious-USB-descriptor.patch
-
-#CVE-2016-2185 rhbz 1317014 1317471
-Patch675: usb_driver_claim_interface-add-sanity-checking.patch
-Patch669: Input-ati_remote2-fix-crashes-on-detecting-device-wi.patch
-
-#CVE-2016-3138 rhbz 1317010 1316204
-Patch676: cdc-acm-more-sanity-checking.patch
-
-#CVE-2016-3140 rhbz 1317010 1316995
-Patch677: digi_acceleport-do-sanity-checking-for-the-number-of.patch
-
-Patch678: ims-pcu-sanity-check-against-missing-interfaces.patch
-
 #rhbz 1315013
 Patch679: 0001-uas-Limit-qdepth-at-the-scsi-host-level.patch
 
-#rhbz 1317190
-Patch680: thermal-fix.patch
-
-#rhbz 1318079
-Patch681: 0001-Input-synaptics-handle-spurious-release-of-trackstic.patch
-
 #CVE-2016-2187 rhbz 1317017 1317010
 Patch686: input-gtco-fix-crash-on-detecting-device-without-end.patch
 
-#CVE-2016-3136 rhbz 1317007 1317010
-Patch687: mct_u232-sanity-checking-in-probe.patch
-
 #rhbz 1295646
 Patch688: 09-29-drm-udl-Use-unlocked-gem-unreferencing.patch
 
-# CVE-2016-3157 rhbz 1315711 1321948
-Patch689: x86-iopl-64-Properly-context-switch-IOPL-on-Xen-PV.patch
+# CVE-2016-3672 rhbz 1324749 1324750
+Patch690: x86-mm-32-Enable-full-randomization-on-i386-and-X86_.patch
+
+#CVE-2015-8839 rhbz 1323577 1323579
+Patch691: ext4-fix-races-between-page-faults-and-hole-punching.patch
+Patch692: ext4-move-unlocked-dio-protection-from-ext4_alloc_fi.patch
+Patch693: ext4-fix-races-between-buffered-IO-and-collapse-inse.patch
+Patch694: ext4-fix-races-of-writeback-with-punch-hole-and-zero.patch
+
+#CVE-2016-3951 rhbz 1324782 1324815
+Patch695: cdc_ncm-do-not-call-usbnet_link_change-from-cdc_ncm_.patch
+Patch696: usbnet-cleanup-after-bind-in-probe.patch
+
+#rhbz 1317116
+Patch697: HID-wacom-fix-Bamboo-ONE-oops.patch
 
 # END OF PATCH DEFINITIONS
 %endif
@@ -1502,9 +1478,6 @@ ApplyPatch 0001-drm-i915-Pretend-cursor-is-always-on-for-ILK-style-W.patch
 
 ApplyPatch 0001-cdc-acm-fix-NULL-pointer-reference.patch
 
-#rhbz 1316136
-ApplyPatch USB-serial-ftdi_sio-Add-support-for-ICP-DAS-I-756xU-.patch
-
 #CVE-2016-3135 rhbz 1317386 1317387
 ApplyPatch netfilter-x_tables-check-for-size-overflow.patch
 
@@ -1514,51 +1487,30 @@ ApplyPatch netfilter-x_tables-deal-with-bogus-nextoffset-values.patch
 #CVE-2016-3135 rhbz 1318172 1318270
 ApplyPatch ipv4-Dont-do-expensive-useless-work-during-inetdev-des.patch
 
-#CVE-2016-2184 rhbz 1317012 1317470
-ApplyPatch ALSA-usb-audio-Fix-NULL-dereference-in-create_fixed_.patch
-ApplyPatch ALSA-usb-audio-Add-sanity-checks-for-endpoint-access.patch
-
-#CVE-2016-3137 rhbz 1317010 1316996
-ApplyPatch cypress_m8-add-sanity-checking.patch
-
-#CVE-2016-2186 rhbz 1317015 1317464
-ApplyPatch USB-input-powermate-fix-oops-with-malicious-USB-desc.patch
-
-#CVE-2016-2188 rhbz 1317018 1317467
-ApplyPatch USB-iowarrior-fix-oops-with-malicious-USB-descriptor.patch
-
-#CVE-2016-2185 rhbz 1317014 1317471
-ApplyPatch usb_driver_claim_interface-add-sanity-checking.patch
-ApplyPatch Input-ati_remote2-fix-crashes-on-detecting-device-wi.patch
-
-#CVE-2016-3138 rhbz 1317010 1316204
-ApplyPatch cdc-acm-more-sanity-checking.patch
-
-#CVE-2016-3140 rhbz 1317010 1316995
-ApplyPatch digi_acceleport-do-sanity-checking-for-the-number-of.patch
-
-ApplyPatch ims-pcu-sanity-check-against-missing-interfaces.patch
-
 #rhbz 1315013
 ApplyPatch 0001-uas-Limit-qdepth-at-the-scsi-host-level.patch
 
-#rhbz 1317190
-ApplyPatch thermal-fix.patch
-
-#rhbz 1318079
-ApplyPatch 0001-Input-synaptics-handle-spurious-release-of-trackstic.patch
-
 #CVE-2016-2187 rhbz 1317017 1317010
 ApplyPatch input-gtco-fix-crash-on-detecting-device-without-end.patch
 
-#CVE-2016-3136 rhbz 1317007 1317010
-ApplyPatch mct_u232-sanity-checking-in-probe.patch
-
 #rhbz 1295646
 ApplyPatch 09-29-drm-udl-Use-unlocked-gem-unreferencing.patch
 
-# CVE-2016-3157 rhbz 1315711 1321948
-ApplyPatch x86-iopl-64-Properly-context-switch-IOPL-on-Xen-PV.patch
+# CVE-2016-3672 rhbz 1324749 1324750
+ApplyPatch x86-mm-32-Enable-full-randomization-on-i386-and-X86_.patch
+
+#CVE-2015-8839 rhbz 1323577 1323579
+ApplyPatch ext4-fix-races-between-page-faults-and-hole-punching.patch
+ApplyPatch ext4-move-unlocked-dio-protection-from-ext4_alloc_fi.patch
+ApplyPatch ext4-fix-races-between-buffered-IO-and-collapse-inse.patch
+ApplyPatch ext4-fix-races-of-writeback-with-punch-hole-and-zero.patch
+
+#CVE-2016-3951 rhbz 1324782 1324815
+ApplyPatch cdc_ncm-do-not-call-usbnet_link_change-from-cdc_ncm_.patch
+ApplyPatch usbnet-cleanup-after-bind-in-probe.patch
+
+#rhbz 1317116
+ApplyPatch HID-wacom-fix-Bamboo-ONE-oops.patch
 
 # END OF PATCH APPLICATIONS
 
@@ -2422,6 +2374,25 @@ fi
 #
 # 
 %changelog
+* Wed Apr 13 2016 Alexandre Oliva <lxoliva@fsfla.org> -libre
+- GNU Linux-libre 4.4.7-gnu.
+
+* Tue Apr 12 2016 Laura Abbott <labbott@redhat.com> - 4.4.7-200
+- Linux v4.4.7
+
+* Tue Apr 12 2016 Josh Boyer <jwboyer@fedoraproject.org>
+- Fix Bamboo ONE issues (rhbz 1317116)
+
+* Mon Apr 11 2016 Josh Boyer <jwboyer@fedoraproject.org>
+- CVE-2016-3951 usbnet: crash on invalid USB descriptors (rhbz 1324782 1324815)
+- CVE-2015-8839 ext4: data corruption due to punch hole races (rhbz 1323577 1323579)
+
+* Thu Apr 07 2016 Justin M. Forbes <jforbes@fedoraproject.org>
+- Enable Full Randomization on 32bit x86 CVE-2016-3672 (rhbz 1324749 1324750)
+`
+* Thu Mar 31 2016 Josh Boyer <jwboyer@fedoraproject.org>
+- Add two more patches for CVE-2016-2184
+
 * Wed Mar 30 2016 Laura Abbott <labbott@redhat.com> - 4.4.6-201
 - Bump and build
 
diff --git a/freed-ora/current/f22/mct_u232-sanity-checking-in-probe.patch b/freed-ora/current/f22/mct_u232-sanity-checking-in-probe.patch
deleted file mode 100644
index 006faf15f..000000000
--- a/freed-ora/current/f22/mct_u232-sanity-checking-in-probe.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-Subject:    [PATCH v2] mct_u232: sanity checking in probe
-From:       Oliver Neukum <oneukum@suse.com>
-Date:       2016-03-21 13:14:37
-
-An attack using the lack of sanity checking in probe
-is known. This patch checks for the existance of a
-second port.
-CVE-2016-3136
-
-Signed-off-by: Oliver Neukum <ONeukum@suse.com>
-CC: stable@vger.kernel.org
-
-v1 - add sanity check for presence of a second port
-v2 - add sanity check for an interrupt endpoint
----
- drivers/usb/serial/mct_u232.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/drivers/usb/serial/mct_u232.c b/drivers/usb/serial/mct_u232.c
-index 4446b8d..3e64538 100644
---- a/drivers/usb/serial/mct_u232.c
-+++ b/drivers/usb/serial/mct_u232.c
-@@ -378,6 +378,10 @@ static int mct_u232_port_probe(struct usb_serial_port *port)
- {
- 	struct mct_u232_private *priv;
- 
-+	/* check first to simplify error handling */
-+	if (!port->serial->port[1] || !port->serial->port[1]->interrupt_in_urb)
-+		return -ENODEV;
-+
- 	priv = kzalloc(sizeof(*priv), GFP_KERNEL);
- 	if (!priv)
- 		return -ENOMEM;
--- 
-2.1.4
diff --git a/freed-ora/current/f22/patch-4.4-gnu-4.4.6-gnu.xz.sign b/freed-ora/current/f22/patch-4.4-gnu-4.4.6-gnu.xz.sign
deleted file mode 100644
index ba7483893..000000000
--- a/freed-ora/current/f22/patch-4.4-gnu-4.4.6-gnu.xz.sign
+++ /dev/null
@@ -1,7 +0,0 @@
------BEGIN PGP SIGNATURE-----
-Version: GnuPG v2
-
-iEYEABECAAYFAlbrHfoACgkQvLfPh359R6cADgCfVaNk0iUSn4hASJqxOBo6Ltjb
-2MMAoJ/3/d6YRxfkGIeROHlBQLWhv+6y
-=rn1y
------END PGP SIGNATURE-----
diff --git a/freed-ora/current/f22/patch-4.4-gnu-4.4.7-gnu.xz.sign b/freed-ora/current/f22/patch-4.4-gnu-4.4.7-gnu.xz.sign
new file mode 100644
index 000000000..d0e6050ae
--- /dev/null
+++ b/freed-ora/current/f22/patch-4.4-gnu-4.4.7-gnu.xz.sign
@@ -0,0 +1,7 @@
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v2
+
+iEYEABECAAYFAlcNsGEACgkQvLfPh359R6c9cwCfSdOaJ1+mC8Nu/wG+I0EXvpH0
+k60AoIJSLJ1ArfscPS54tiRBbPLgUPFK
+=Lbgj
+-----END PGP SIGNATURE-----
diff --git a/freed-ora/current/f22/sources b/freed-ora/current/f22/sources
index ec748b0b0..5121999be 100644
--- a/freed-ora/current/f22/sources
+++ b/freed-ora/current/f22/sources
@@ -1,3 +1,3 @@
 5f34e3272b5229cd1868113e321267bd  linux-libre-4.4-gnu.tar.xz
 dcbc8fe378a676d5d0dd208cf524e144  perf-man-4.4.tar.gz
-9814d68c54f8e40660c8cbae1ae1fc7a  patch-4.4-gnu-4.4.6-gnu.xz
+3593290a9fe1be0c59b399b3c2c1f75a  patch-4.4-gnu-4.4.7-gnu.xz
diff --git a/freed-ora/current/f22/thermal-fix.patch b/freed-ora/current/f22/thermal-fix.patch
deleted file mode 100644
index bca27cfbe..000000000
--- a/freed-ora/current/f22/thermal-fix.patch
+++ /dev/null
@@ -1,77 +0,0 @@
-From 81ad4276b505e987dd8ebbdf63605f92cd172b52 Mon Sep 17 00:00:00 2001
-From: Zhang Rui <rui.zhang@intel.com>
-Date: Fri, 18 Mar 2016 10:03:24 +0800
-Subject: [PATCH] Thermal: Ignore invalid trip points
-
-In some cases, platform thermal driver may report invalid trip points,
-thermal core should not take any action for these trip points.
-
-CC: <stable@vger.kernel.org> #3.18+
-Link: https://bugzilla.redhat.com/show_bug.cgi?id=1317190
-Link: https://bugzilla.kernel.org/show_bug.cgi?id=114551
-Signed-off-by: Zhang Rui <rui.zhang@intel.com>
----
- drivers/thermal/thermal_core.c | 13 ++++++++++++-
- include/linux/thermal.h        |  2 ++
- 2 files changed, 14 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
-index a0a8fd1..d4b5465 100644
---- a/drivers/thermal/thermal_core.c
-+++ b/drivers/thermal/thermal_core.c
-@@ -454,6 +454,10 @@ static void handle_thermal_trip(struct thermal_zone_device *tz, int trip)
- {
- 	enum thermal_trip_type type;
- 
-+	/* Ignore disabled trip points */
-+	if (test_bit(trip, &tz->trips_disabled))
-+		return;
-+
- 	tz->ops->get_trip_type(tz, trip, &type);
- 
- 	if (type == THERMAL_TRIP_CRITICAL || type == THERMAL_TRIP_HOT)
-@@ -1800,6 +1804,7 @@ struct thermal_zone_device *thermal_zone_device_register(const char *type,
- {
- 	struct thermal_zone_device *tz;
- 	enum thermal_trip_type trip_type;
-+	int trip_temp;
- 	int result;
- 	int count;
- 	int passive = 0;
-@@ -1871,9 +1876,15 @@ struct thermal_zone_device *thermal_zone_device_register(const char *type,
- 		goto unregister;
- 
- 	for (count = 0; count < trips; count++) {
--		tz->ops->get_trip_type(tz, count, &trip_type);
-+		if (tz->ops->get_trip_type(tz, count, &trip_type))
-+			set_bit(count, &tz->trips_disabled);
- 		if (trip_type == THERMAL_TRIP_PASSIVE)
- 			passive = 1;
-+		if (tz->ops->get_trip_temp(tz, count, &trip_temp))
-+			set_bit(count, &tz->trips_disabled);
-+		/* Check for bogus trip points */
-+		if (trip_temp == 0)
-+			set_bit(count, &tz->trips_disabled);
- 	}
- 
- 	if (!passive) {
-diff --git a/include/linux/thermal.h b/include/linux/thermal.h
-index 9c48199..a55d052 100644
---- a/include/linux/thermal.h
-+++ b/include/linux/thermal.h
-@@ -156,6 +156,7 @@ struct thermal_attr {
-  * @trip_hyst_attrs:	attributes for trip points for sysfs: trip hysteresis
-  * @devdata:	private pointer for device private data
-  * @trips:	number of trip points the thermal zone supports
-+ * @trips_disabled;	bitmap for disabled trips
-  * @passive_delay:	number of milliseconds to wait between polls when
-  *			performing passive cooling.
-  * @polling_delay:	number of milliseconds to wait between polls when
-@@ -191,6 +192,7 @@ struct thermal_zone_device {
- 	struct thermal_attr *trip_hyst_attrs;
- 	void *devdata;
- 	int trips;
-+	unsigned long trips_disabled;	/* bitmap for disabled trips */
- 	int passive_delay;
- 	int polling_delay;
- 	int temperature;
diff --git a/freed-ora/current/f22/usb_driver_claim_interface-add-sanity-checking.patch b/freed-ora/current/f22/usb_driver_claim_interface-add-sanity-checking.patch
deleted file mode 100644
index 079ff03fd..000000000
--- a/freed-ora/current/f22/usb_driver_claim_interface-add-sanity-checking.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From de0784bdf6314b70c69416d8c576eb83237d5b1e Mon Sep 17 00:00:00 2001
-From: Oliver Neukum <oneukum@suse.com>
-Date: Wed, 16 Mar 2016 12:26:17 -0400
-Subject: [PATCH] usb_driver_claim_interface: add sanity checking
-
-Attacks that trick drivers into passing a NULL pointer
-to usb_driver_claim_interface() using forged descriptors are
-known. This thwarts them by sanity checking.
-
-Signed-off-by: Oliver Neukum <ONeukum@suse.com>
-CC: stable@vger.kernel.org
----
- drivers/usb/core/driver.c | 6 +++++-
- 1 file changed, 5 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
-index 6b5063e7943f..e2d242b68d4b 100644
---- a/drivers/usb/core/driver.c
-+++ b/drivers/usb/core/driver.c
-@@ -500,11 +500,15 @@ static int usb_unbind_interface(struct device *dev)
- int usb_driver_claim_interface(struct usb_driver *driver,
- 				struct usb_interface *iface, void *priv)
- {
--	struct device *dev = &iface->dev;
-+	struct device *dev;
- 	struct usb_device *udev;
- 	int retval = 0;
- 	int lpm_disable_error;
- 
-+	if (!iface)
-+		return -ENODEV;
-+
-+	dev = &iface->dev;
- 	if (dev->driver)
- 		return -EBUSY;
- 
--- 
-2.5.0
-
diff --git a/freed-ora/current/f22/usbnet-cleanup-after-bind-in-probe.patch b/freed-ora/current/f22/usbnet-cleanup-after-bind-in-probe.patch
new file mode 100644
index 000000000..dc231a943
--- /dev/null
+++ b/freed-ora/current/f22/usbnet-cleanup-after-bind-in-probe.patch
@@ -0,0 +1,39 @@
+From 1666984c8625b3db19a9abc298931d35ab7bc64b Mon Sep 17 00:00:00 2001
+From: Oliver Neukum <oneukum@suse.com>
+Date: Mon, 7 Mar 2016 11:31:10 +0100
+Subject: [PATCH] usbnet: cleanup after bind() in probe()
+
+In case bind() works, but a later error forces bailing
+in probe() in error cases work and a timer may be scheduled.
+They must be killed. This fixes an error case related to
+the double free reported in
+http://www.spinics.net/lists/netdev/msg367669.html
+and needs to go on top of Linus' fix to cdc-ncm.
+
+Signed-off-by: Oliver Neukum <ONeukum@suse.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/usb/usbnet.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
+index 0b0ba7ef14e4..10798128c03f 100644
+--- a/drivers/net/usb/usbnet.c
++++ b/drivers/net/usb/usbnet.c
+@@ -1769,6 +1769,13 @@ out3:
+ 	if (info->unbind)
+ 		info->unbind (dev, udev);
+ out1:
++	/* subdrivers must undo all they did in bind() if they
++	 * fail it, but we may fail later and a deferred kevent
++	 * may trigger an error resubmitting itself and, worse,
++	 * schedule a timer. So we kill it all just in case.
++	 */
++	cancel_work_sync(&dev->kevent);
++	del_timer_sync(&dev->delay);
+ 	free_netdev(net);
+ out:
+ 	return status;
+-- 
+2.5.5
+
diff --git a/freed-ora/current/f22/x86-Lock-down-IO-port-access-when-module-security-is.patch b/freed-ora/current/f22/x86-Lock-down-IO-port-access-when-module-security-is.patch
index 708006c2e..185b1da99 100644
--- a/freed-ora/current/f22/x86-Lock-down-IO-port-access-when-module-security-is.patch
+++ b/freed-ora/current/f22/x86-Lock-down-IO-port-access-when-module-security-is.patch
@@ -1,8 +1,7 @@
-From 7a3cdd26e6d38031338a6cb591ec2f3faaa9234b Mon Sep 17 00:00:00 2001
+From 8010b5eb4680df797575e6306d4d891200e303ab Mon Sep 17 00:00:00 2001
 From: Matthew Garrett <matthew.garrett@nebula.com>
 Date: Thu, 8 Mar 2012 10:35:59 -0500
-Subject: [PATCH 03/20] x86: Lock down IO port access when module security is
- enabled
+Subject: [PATCH] x86: Lock down IO port access when module security is enabled
 
 IO port access would permit users to gain access to PCI configuration
 registers, which in turn (on a lot of hardware) give access to MMIO register
@@ -16,7 +15,7 @@ Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
  2 files changed, 7 insertions(+), 2 deletions(-)
 
 diff --git a/arch/x86/kernel/ioport.c b/arch/x86/kernel/ioport.c
-index 37dae792dbbe..1ecc03ca3c15 100644
+index 589b3193f102..ab8372443efb 100644
 --- a/arch/x86/kernel/ioport.c
 +++ b/arch/x86/kernel/ioport.c
 @@ -15,6 +15,7 @@
@@ -36,7 +35,7 @@ index 37dae792dbbe..1ecc03ca3c15 100644
  		return -EPERM;
  
  	/*
-@@ -103,7 +104,7 @@ SYSCALL_DEFINE1(iopl, unsigned int, level)
+@@ -108,7 +109,7 @@ SYSCALL_DEFINE1(iopl, unsigned int, level)
  		return -EINVAL;
  	/* Trying to gain more privileges? */
  	if (level > old) {
@@ -44,9 +43,9 @@ index 37dae792dbbe..1ecc03ca3c15 100644
 +		if (!capable(CAP_SYS_RAWIO) || secure_modules())
  			return -EPERM;
  	}
- 	regs->flags = (regs->flags & ~X86_EFLAGS_IOPL) | (level << 12);
+ 	regs->flags = (regs->flags & ~X86_EFLAGS_IOPL) |
 diff --git a/drivers/char/mem.c b/drivers/char/mem.c
-index 6b1721f978c2..53fe675f9bd7 100644
+index 71025c2f6bbb..86e5bfa91563 100644
 --- a/drivers/char/mem.c
 +++ b/drivers/char/mem.c
 @@ -27,6 +27,7 @@
@@ -68,5 +67,5 @@ index 6b1721f978c2..53fe675f9bd7 100644
  		return -EFAULT;
  	while (count-- > 0 && i < 65536) {
 -- 
-2.4.3
+2.5.5
 
diff --git a/freed-ora/current/f22/x86-iopl-64-Properly-context-switch-IOPL-on-Xen-PV.patch b/freed-ora/current/f22/x86-iopl-64-Properly-context-switch-IOPL-on-Xen-PV.patch
deleted file mode 100644
index 38f7bfbb0..000000000
--- a/freed-ora/current/f22/x86-iopl-64-Properly-context-switch-IOPL-on-Xen-PV.patch
+++ /dev/null
@@ -1,96 +0,0 @@
-From b7a584598aea7ca73140cb87b40319944dd3393f Mon Sep 17 00:00:00 2001
-From: Andy Lutomirski <luto@kernel.org>
-Date: Wed, 16 Mar 2016 14:14:21 -0700
-Subject: [PATCH] x86/iopl/64: Properly context-switch IOPL on Xen PV
-
-On Xen PV, regs->flags doesn't reliably reflect IOPL and the
-exit-to-userspace code doesn't change IOPL.  We need to context
-switch it manually.
-
-I'm doing this without going through paravirt because this is
-specific to Xen PV.  After the dust settles, we can merge this with
-the 32-bit code, tidy up the iopl syscall implementation, and remove
-the set_iopl pvop entirely.
-
-Fixes XSA-171.
-
-Reviewewd-by: Jan Beulich <JBeulich@suse.com>
-Signed-off-by: Andy Lutomirski <luto@kernel.org>
-Cc: Andrew Cooper <andrew.cooper3@citrix.com>
-Cc: Andy Lutomirski <luto@amacapital.net>
-Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
-Cc: Borislav Petkov <bp@alien8.de>
-Cc: Brian Gerst <brgerst@gmail.com>
-Cc: David Vrabel <david.vrabel@citrix.com>
-Cc: Denys Vlasenko <dvlasenk@redhat.com>
-Cc: H. Peter Anvin <hpa@zytor.com>
-Cc: Jan Beulich <JBeulich@suse.com>
-Cc: Linus Torvalds <torvalds@linux-foundation.org>
-Cc: Peter Zijlstra <peterz@infradead.org>
-Cc: Thomas Gleixner <tglx@linutronix.de>
-Cc: stable@vger.kernel.org
-Link: http://lkml.kernel.org/r/693c3bd7aeb4d3c27c92c622b7d0f554a458173c.1458162709.git.luto@kernel.org
-Signed-off-by: Ingo Molnar <mingo@kernel.org>
----
- arch/x86/include/asm/xen/hypervisor.h |  2 ++
- arch/x86/kernel/process_64.c          | 12 ++++++++++++
- arch/x86/xen/enlighten.c              |  2 +-
- 3 files changed, 15 insertions(+), 1 deletion(-)
-
-diff --git a/arch/x86/include/asm/xen/hypervisor.h b/arch/x86/include/asm/xen/hypervisor.h
-index 8b2d4bea9962..39171b3646bb 100644
---- a/arch/x86/include/asm/xen/hypervisor.h
-+++ b/arch/x86/include/asm/xen/hypervisor.h
-@@ -62,4 +62,6 @@ void xen_arch_register_cpu(int num);
- void xen_arch_unregister_cpu(int num);
- #endif
- 
-+extern void xen_set_iopl_mask(unsigned mask);
-+
- #endif /* _ASM_X86_XEN_HYPERVISOR_H */
-diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
-index b9d99e0f82c4..9f751876066f 100644
---- a/arch/x86/kernel/process_64.c
-+++ b/arch/x86/kernel/process_64.c
-@@ -48,6 +48,7 @@
- #include <asm/syscalls.h>
- #include <asm/debugreg.h>
- #include <asm/switch_to.h>
-+#include <asm/xen/hypervisor.h>
- 
- asmlinkage extern void ret_from_fork(void);
- 
-@@ -411,6 +412,17 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
- 		     task_thread_info(prev_p)->flags & _TIF_WORK_CTXSW_PREV))
- 		__switch_to_xtra(prev_p, next_p, tss);
- 
-+#ifdef CONFIG_XEN
-+	/*
-+	 * On Xen PV, IOPL bits in pt_regs->flags have no effect, and
-+	 * current_pt_regs()->flags may not match the current task's
-+	 * intended IOPL.  We need to switch it manually.
-+	 */
-+	if (unlikely(static_cpu_has(X86_FEATURE_XENPV) &&
-+		     prev->iopl != next->iopl))
-+		xen_set_iopl_mask(next->iopl);
-+#endif
-+
- 	if (static_cpu_has_bug(X86_BUG_SYSRET_SS_ATTRS)) {
- 		/*
- 		 * AMD CPUs have a misfeature: SYSRET sets the SS selector but
-diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
-index 2c261082eadf..8381fb990c7f 100644
---- a/arch/x86/xen/enlighten.c
-+++ b/arch/x86/xen/enlighten.c
-@@ -961,7 +961,7 @@ static void xen_load_sp0(struct tss_struct *tss,
- 	tss->x86_tss.sp0 = thread->sp0;
- }
- 
--static void xen_set_iopl_mask(unsigned mask)
-+void xen_set_iopl_mask(unsigned mask)
- {
- 	struct physdev_set_iopl set_iopl;
- 
--- 
-2.5.5
-
diff --git a/freed-ora/current/f22/x86-mm-32-Enable-full-randomization-on-i386-and-X86_.patch b/freed-ora/current/f22/x86-mm-32-Enable-full-randomization-on-i386-and-X86_.patch
new file mode 100644
index 000000000..0776982c1
--- /dev/null
+++ b/freed-ora/current/f22/x86-mm-32-Enable-full-randomization-on-i386-and-X86_.patch
@@ -0,0 +1,83 @@
+From 8b8addf891de8a00e4d39fc32f93f7c5eb8feceb Mon Sep 17 00:00:00 2001
+From: Hector Marco-Gisbert <hecmargi@upv.es>
+Date: Thu, 10 Mar 2016 20:51:00 +0100
+Subject: [PATCH] x86/mm/32: Enable full randomization on i386 and X86_32
+
+Currently on i386 and on X86_64 when emulating X86_32 in legacy mode, only
+the stack and the executable are randomized but not other mmapped files
+(libraries, vDSO, etc.). This patch enables randomization for the
+libraries, vDSO and mmap requests on i386 and in X86_32 in legacy mode.
+
+By default on i386 there are 8 bits for the randomization of the libraries,
+vDSO and mmaps which only uses 1MB of VA.
+
+This patch preserves the original randomness, using 1MB of VA out of 3GB or
+4GB. We think that 1MB out of 3GB is not a big cost for having the ASLR.
+
+The first obvious security benefit is that all objects are randomized (not
+only the stack and the executable) in legacy mode which highly increases
+the ASLR effectiveness, otherwise the attackers may use these
+non-randomized areas. But also sensitive setuid/setgid applications are
+more secure because currently, attackers can disable the randomization of
+these applications by setting the ulimit stack to "unlimited". This is a
+very old and widely known trick to disable the ASLR in i386 which has been
+allowed for too long.
+
+Another trick used to disable the ASLR was to set the ADDR_NO_RANDOMIZE
+personality flag, but fortunately this doesn't work on setuid/setgid
+applications because there is security checks which clear Security-relevant
+flags.
+
+This patch always randomizes the mmap_legacy_base address, removing the
+possibility to disable the ASLR by setting the stack to "unlimited".
+
+Signed-off-by: Hector Marco-Gisbert <hecmargi@upv.es>
+Acked-by: Ismael Ripoll Ripoll <iripoll@upv.es>
+Acked-by: Kees Cook <keescook@chromium.org>
+Acked-by: Arjan van de Ven <arjan@linux.intel.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: akpm@linux-foundation.org
+Cc: kees Cook <keescook@chromium.org>
+Link: http://lkml.kernel.org/r/1457639460-5242-1-git-send-email-hecmargi@upv.es
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+---
+ arch/x86/mm/mmap.c | 14 +-------------
+ 1 file changed, 1 insertion(+), 13 deletions(-)
+
+diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c
+index 96bd1e2..389939f 100644
+--- a/arch/x86/mm/mmap.c
++++ b/arch/x86/mm/mmap.c
+@@ -94,18 +94,6 @@ static unsigned long mmap_base(unsigned long rnd)
+ }
+
+ /*
+- * Bottom-up (legacy) layout on X86_32 did not support randomization, X86_64
+- * does, but not when emulating X86_32
+- */
+-static unsigned long mmap_legacy_base(unsigned long rnd)
+-{
+-	if (mmap_is_ia32())
+-		return TASK_UNMAPPED_BASE;
+-	else
+-		return TASK_UNMAPPED_BASE + rnd;
+-}
+-
+-/*
+  * This function, called very early during the creation of a new
+  * process VM image, sets up which VM layout function to use:
+  */
+@@ -116,7 +104,7 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
+ 	if (current->flags & PF_RANDOMIZE)
+ 		random_factor = arch_mmap_rnd();
+
+-	mm->mmap_legacy_base = mmap_legacy_base(random_factor);
++	mm->mmap_legacy_base = TASK_UNMAPPED_BASE + random_factor;
+
+ 	if (mmap_is_legacy()) {
+ 		mm->mmap_base = mm->mmap_legacy_base;
+-- 
+2.7.3
+
author	Alexandre Oliva <lxoliva@fsfla.org>	2016-04-18 11:12:58 +0000
committer	Alexandre Oliva <lxoliva@fsfla.org>	2016-04-18 11:12:58 +0000
commit	8b88086dfe6576b598b60a5ab9ef467f19285abb (patch)
tree	8324c0c3eeb368bb3bc2461133773473c4702a23 /freed-ora/current
parent	80838793c9ca8e246467446af08a0ff40b9893f5 (diff)
download	linux-libre-raptor-8b88086dfe6576b598b60a5ab9ef467f19285abb.tar.gz linux-libre-raptor-8b88086dfe6576b598b60a5ab9ef467f19285abb.zip