diff options
| author | Alexandre Oliva <lxoliva@fsfla.org> | 2016-04-15 04:51:27 +0000 |
|---|---|---|
| committer | Alexandre Oliva <lxoliva@fsfla.org> | 2016-04-15 04:51:27 +0000 |
| commit | 0240de54b1cc6e2bfe3d941e0644edc05c4d575b (patch) | |
| tree | 67d4f96fff6831c7ca09b9bba117bb2a0db80dbc /freed-ora | |
| parent | 79542fa4c8bbb628c5a6705ed144e9320eb440c5 (diff) | |
| download | linux-libre-raptor-0240de54b1cc6e2bfe3d941e0644edc05c4d575b.tar.gz linux-libre-raptor-0240de54b1cc6e2bfe3d941e0644edc05c4d575b.zip | |
4.4.7-300.fc23.gnu
Diffstat (limited to 'freed-ora')
28 files changed, 1070 insertions, 891 deletions
diff --git a/freed-ora/current/f23/0001-Input-synaptics-handle-spurious-release-of-trackstic.patch b/freed-ora/current/f23/0001-Input-synaptics-handle-spurious-release-of-trackstic.patch deleted file mode 100644 index 52b082b36..000000000 --- a/freed-ora/current/f23/0001-Input-synaptics-handle-spurious-release-of-trackstic.patch +++ /dev/null @@ -1,31 +0,0 @@ -From cb6fcfe5a7e9197ceb7e9eec56e9c526e4e76354 Mon Sep 17 00:00:00 2001 -From: Benjamin Tissoires <benjamin.tissoires@redhat.com> -Date: Mon, 14 Mar 2016 19:37:12 +0100 -Subject: [PATCH] Input: synaptics - handle spurious release of trackstick - buttons, again - -Looks like the fimware 8.2 stall has the extra buttons spurious release -bug. - -Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> ---- - drivers/input/mouse/synaptics.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c -index 6025eb4..4ef8d7a 100644 ---- a/drivers/input/mouse/synaptics.c -+++ b/drivers/input/mouse/synaptics.c -@@ -863,7 +863,8 @@ static void synaptics_report_ext_buttons(struct psmouse *psmouse, - return; - - /* Bug in FW 8.1, buttons are reported only when ExtBit is 1 */ -- if (SYN_ID_FULL(priv->identity) == 0x801 && -+ if ((SYN_ID_FULL(priv->identity) == 0x801 || -+ SYN_ID_FULL(priv->identity) == 0x802) && - !((psmouse->packet[0] ^ psmouse->packet[3]) & 0x02)) - return; - --- -2.5.0 - diff --git a/freed-ora/current/f23/ALSA-usb-audio-Add-sanity-checks-for-endpoint-access.patch b/freed-ora/current/f23/ALSA-usb-audio-Add-sanity-checks-for-endpoint-access.patch deleted file mode 100644 index 801434a26..000000000 --- a/freed-ora/current/f23/ALSA-usb-audio-Add-sanity-checks-for-endpoint-access.patch +++ /dev/null @@ -1,80 +0,0 @@ -From 873156565ca67779bbf5a3475ccd08ea3bb92522 Mon Sep 17 00:00:00 2001 -From: Takashi Iwai <tiwai@suse.de> -Date: Tue, 15 Mar 2016 15:20:58 +0100 -Subject: [PATCH 2/2] ALSA: usb-audio: Add sanity checks for endpoint accesses - -Add some sanity check codes before actually accessing the endpoint via -get_endpoint() in order to avoid the invalid access through a -malformed USB descriptor. Mostly just checking bNumEndpoints, but in -one place (snd_microii_spdif_default_get()), the validity of iface and -altsetting index is checked as well. - -Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=971125 -Cc: <stable@vger.kernel.org> -Signed-off-by: Takashi Iwai <tiwai@suse.de> ---- - sound/usb/clock.c | 2 ++ - sound/usb/endpoint.c | 3 +++ - sound/usb/mixer_quirks.c | 4 ++++ - sound/usb/pcm.c | 2 ++ - 4 files changed, 11 insertions(+) - -diff --git a/sound/usb/clock.c b/sound/usb/clock.c -index 2ed260b10f6d..7ccbcaf6a147 100644 ---- a/sound/usb/clock.c -+++ b/sound/usb/clock.c -@@ -285,6 +285,8 @@ static int set_sample_rate_v1(struct snd_usb_audio *chip, int iface, - unsigned char data[3]; - int err, crate; - -+ if (get_iface_desc(alts)->bNumEndpoints < 1) -+ return -EINVAL; - ep = get_endpoint(alts, 0)->bEndpointAddress; - - /* if endpoint doesn't have sampling rate control, bail out */ -diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c -index e6f71894ecdc..c2131b851602 100644 ---- a/sound/usb/endpoint.c -+++ b/sound/usb/endpoint.c -@@ -415,6 +415,9 @@ exit_clear: - * - * New endpoints will be added to chip->ep_list and must be freed by - * calling snd_usb_endpoint_free(). -+ * -+ * For SND_USB_ENDPOINT_TYPE_SYNC, the caller needs to guarantee that -+ * bNumEndpoints > 1 beforehand. - */ - struct snd_usb_endpoint *snd_usb_add_endpoint(struct snd_usb_audio *chip, - struct usb_host_interface *alts, -diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c -index d3608c0a29f3..2d724e3c4cc0 100644 ---- a/sound/usb/mixer_quirks.c -+++ b/sound/usb/mixer_quirks.c -@@ -1518,7 +1518,11 @@ static int snd_microii_spdif_default_get(struct snd_kcontrol *kcontrol, - - /* use known values for that card: interface#1 altsetting#1 */ - iface = usb_ifnum_to_if(chip->dev, 1); -+ if (!iface || iface->num_altsetting < 2) -+ return -EINVAL; - alts = &iface->altsetting[1]; -+ if (get_iface_desc(alts)->bNumEndpoints < 1) -+ return -EINVAL; - ep = get_endpoint(alts, 0)->bEndpointAddress; - - err = snd_usb_ctl_msg(chip->dev, -diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c -index cdac5179db3f..4da64896df6d 100644 ---- a/sound/usb/pcm.c -+++ b/sound/usb/pcm.c -@@ -159,6 +159,8 @@ static int init_pitch_v1(struct snd_usb_audio *chip, int iface, - unsigned char data[1]; - int err; - -+ if (get_iface_desc(alts)->bNumEndpoints < 1) -+ return -EINVAL; - ep = get_endpoint(alts, 0)->bEndpointAddress; - - data[0] = 1; --- -2.5.0 - diff --git a/freed-ora/current/f23/ALSA-usb-audio-Fix-NULL-dereference-in-create_fixed_.patch b/freed-ora/current/f23/ALSA-usb-audio-Fix-NULL-dereference-in-create_fixed_.patch deleted file mode 100644 index 37cdb213a..000000000 --- a/freed-ora/current/f23/ALSA-usb-audio-Fix-NULL-dereference-in-create_fixed_.patch +++ /dev/null @@ -1,40 +0,0 @@ -From b0bb5691b38e2f439b071e226bad9f699c33b77d Mon Sep 17 00:00:00 2001 -From: Takashi Iwai <tiwai@suse.de> -Date: Tue, 15 Mar 2016 12:09:10 +0100 -Subject: [PATCH 1/2] ALSA: usb-audio: Fix NULL dereference in - create_fixed_stream_quirk() - -create_fixed_stream_quirk() may cause a NULL-pointer dereference by -accessing the non-existing endpoint when a USB device with a malformed -USB descriptor is used. - -This patch avoids it simply by adding a sanity check of bNumEndpoints -before the accesses. - -Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=971125 -Cc: <stable@vger.kernel.org> -Signed-off-by: Takashi Iwai <tiwai@suse.de> ---- - sound/usb/quirks.c | 6 ++++++ - 1 file changed, 6 insertions(+) - -diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c -index eef9b8e4b949..e128ca62eb44 100644 ---- a/sound/usb/quirks.c -+++ b/sound/usb/quirks.c -@@ -177,6 +177,12 @@ static int create_fixed_stream_quirk(struct snd_usb_audio *chip, - } - alts = &iface->altsetting[fp->altset_idx]; - altsd = get_iface_desc(alts); -+ if (altsd->bNumEndpoints < 1) { -+ kfree(fp); -+ kfree(rate_table); -+ return -EINVAL; -+ } -+ - fp->protocol = altsd->bInterfaceProtocol; - - if (fp->datainterval == 0) --- -2.5.0 - diff --git a/freed-ora/current/f23/HID-wacom-fix-Bamboo-ONE-oops.patch b/freed-ora/current/f23/HID-wacom-fix-Bamboo-ONE-oops.patch new file mode 100644 index 000000000..09e83179a --- /dev/null +++ b/freed-ora/current/f23/HID-wacom-fix-Bamboo-ONE-oops.patch @@ -0,0 +1,46 @@ +From 580549ef6b3e3fb3b958de490ca99f43a089a2cf Mon Sep 17 00:00:00 2001 +From: Benjamin Tissoires <benjamin.tissoires@redhat.com> +Date: Fri, 25 Mar 2016 15:26:55 +0100 +Subject: [PATCH] HID: wacom: fix Bamboo ONE oops + +Looks like recent changes in the Wacom driver made the Bamboo ONE crashes. +The tablet behaves as if it was a regular Bamboo device with pen, touch +and pad, but there is no physical pad connected to it. +The weird part is that the pad is still sending events and given that +there is no input node connected to it, we get anull pointer exception. + +Link: https://bugzilla.redhat.com/show_bug.cgi?id=1317116 + +Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> +Acked-by: Ping Cheng <pingc@wacom.com> +Cc: stable@vger.kernel.org +Signed-off-by: Jiri Kosina <jkosina@suse.cz> +--- + drivers/hid/wacom_wac.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c +index bd198bbd4df0..02c4efea241c 100644 +--- a/drivers/hid/wacom_wac.c ++++ b/drivers/hid/wacom_wac.c +@@ -2426,6 +2426,17 @@ void wacom_setup_device_quirks(struct wacom *wacom) + } + + /* ++ * Hack for the Bamboo One: ++ * the device presents a PAD/Touch interface as most Bamboos and even ++ * sends ghosts PAD data on it. However, later, we must disable this ++ * ghost interface, and we can not detect it unless we set it here ++ * to WACOM_DEVICETYPE_PAD or WACOM_DEVICETYPE_TOUCH. ++ */ ++ if (features->type == BAMBOO_PEN && ++ features->pktlen == WACOM_PKGLEN_BBTOUCH3) ++ features->device_type |= WACOM_DEVICETYPE_PAD; ++ ++ /* + * Raw Wacom-mode pen and touch events both come from interface + * 0, whose HID descriptor has an application usage of 0xFF0D + * (i.e., WACOM_VENDORDEFINED_PEN). We route pen packets back +-- +2.5.5 + diff --git a/freed-ora/current/f23/Input-ati_remote2-fix-crashes-on-detecting-device-wi.patch b/freed-ora/current/f23/Input-ati_remote2-fix-crashes-on-detecting-device-wi.patch deleted file mode 100644 index c7a461de8..000000000 --- a/freed-ora/current/f23/Input-ati_remote2-fix-crashes-on-detecting-device-wi.patch +++ /dev/null @@ -1,107 +0,0 @@ -From 0f8536022831faaba3a952fa633902d9686f535f Mon Sep 17 00:00:00 2001 -From: Vladis Dronov <vdronov@redhat.com> -Date: Wed, 23 Mar 2016 15:53:07 -0400 -Subject: [PATCH] Input: ati_remote2: fix crashes on detecting device with - invalid descriptor - -The ati_remote2 driver expects at least two interfaces with one -endpoint each. If given malicious descriptor that specify one -interface or no endpoints, it will crash in the probe function. -Ensure there is at least two interfaces and one endpoint for each -interface before using it. - -The full disclosure: http://seclists.org/bugtraq/2016/Mar/90 - -Reported-by: Ralf Spenneberg <ralf@spenneberg.net> -Signed-off-by: Vladis Dronov <vdronov@redhat.com> ---- - drivers/input/misc/ati_remote2.c | 36 ++++++++++++++++++++++++++++++------ - 1 file changed, 30 insertions(+), 6 deletions(-) - -diff --git a/drivers/input/misc/ati_remote2.c b/drivers/input/misc/ati_remote2.c -index cfd58e87da26..cf5d1e8d92c7 100644 ---- a/drivers/input/misc/ati_remote2.c -+++ b/drivers/input/misc/ati_remote2.c -@@ -817,26 +817,49 @@ static int ati_remote2_probe(struct usb_interface *interface, const struct usb_d - - ar2->udev = udev; - -+ /* Sanity check, first interface must have an endpoint */ -+ if ((alt->desc.bNumEndpoints < 1) || !alt->endpoint) { -+ dev_err(&interface->dev, -+ "%s(): interface 0 must have an endpoint\n", __func__); -+ r = -ENODEV; -+ goto fail1; -+ } - ar2->intf[0] = interface; - ar2->ep[0] = &alt->endpoint[0].desc; - -+ /* Sanity check, the device must have two interfaces */ - ar2->intf[1] = usb_ifnum_to_if(udev, 1); -+ if ((udev->actconfig->desc.bNumInterfaces < 2) || !ar2->intf[1]) { -+ dev_err(&interface->dev, "%s(): need 2 interfaces, found %d\n", -+ __func__, udev->actconfig->desc.bNumInterfaces); -+ r = -ENODEV; -+ goto fail1; -+ } -+ - r = usb_driver_claim_interface(&ati_remote2_driver, ar2->intf[1], ar2); - if (r) - goto fail1; -+ -+ /* Sanity check, second interface must have an endpoint */ - alt = ar2->intf[1]->cur_altsetting; -+ if ((alt->desc.bNumEndpoints < 1) || !alt->endpoint) { -+ dev_err(&interface->dev, -+ "%s(): interface 1 must have an endpoint\n", __func__); -+ r = -ENODEV; -+ goto fail2; -+ } - ar2->ep[1] = &alt->endpoint[0].desc; - - r = ati_remote2_urb_init(ar2); - if (r) -- goto fail2; -+ goto fail3; - - ar2->channel_mask = channel_mask; - ar2->mode_mask = mode_mask; - - r = ati_remote2_setup(ar2, ar2->channel_mask); - if (r) -- goto fail2; -+ goto fail3; - - usb_make_path(udev, ar2->phys, sizeof(ar2->phys)); - strlcat(ar2->phys, "/input0", sizeof(ar2->phys)); -@@ -845,11 +868,11 @@ static int ati_remote2_probe(struct usb_interface *interface, const struct usb_d - - r = sysfs_create_group(&udev->dev.kobj, &ati_remote2_attr_group); - if (r) -- goto fail2; -+ goto fail3; - - r = ati_remote2_input_init(ar2); - if (r) -- goto fail3; -+ goto fail4; - - usb_set_intfdata(interface, ar2); - -@@ -857,10 +880,11 @@ static int ati_remote2_probe(struct usb_interface *interface, const struct usb_d - - return 0; - -- fail3: -+ fail4: - sysfs_remove_group(&udev->dev.kobj, &ati_remote2_attr_group); -- fail2: -+ fail3: - ati_remote2_urb_cleanup(ar2); -+ fail2: - usb_driver_release_interface(&ati_remote2_driver, ar2->intf[1]); - fail1: - kfree(ar2); --- -2.5.0 - diff --git a/freed-ora/current/f23/USB-input-powermate-fix-oops-with-malicious-USB-desc.patch b/freed-ora/current/f23/USB-input-powermate-fix-oops-with-malicious-USB-desc.patch deleted file mode 100644 index 7de890e1b..000000000 --- a/freed-ora/current/f23/USB-input-powermate-fix-oops-with-malicious-USB-desc.patch +++ /dev/null @@ -1,38 +0,0 @@ -From 0383ff3ba89d3e6c604138e3ba46685621d71f98 Mon Sep 17 00:00:00 2001 -From: Josh Boyer <jwboyer@fedoraproject.org> -Date: Mon, 14 Mar 2016 10:02:51 -0400 -Subject: [PATCH] USB: input: powermate: fix oops with malicious USB - descriptors - -The powermate driver expects at least one valid USB endpoint in its -probe function. If given malicious descriptors that specify 0 for -the number of endpoints, it will crash. Validate the number of -endpoints on the interface before using them. - -The full report for this issue can be found here: -http://seclists.org/bugtraq/2016/Mar/85 - -Reported-by: Ralf Spenneberg <ralf@spenneberg.net> -Cc: stable <stable@vger.kernel.org> -Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org> ---- - drivers/input/misc/powermate.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/drivers/input/misc/powermate.c b/drivers/input/misc/powermate.c -index 63b539d3daba..84909a12ff36 100644 ---- a/drivers/input/misc/powermate.c -+++ b/drivers/input/misc/powermate.c -@@ -307,6 +307,9 @@ static int powermate_probe(struct usb_interface *intf, const struct usb_device_i - int error = -ENOMEM; - - interface = intf->cur_altsetting; -+ if (interface->desc.bNumEndpoints < 1) -+ return -EINVAL; -+ - endpoint = &interface->endpoint[0].desc; - if (!usb_endpoint_is_int_in(endpoint)) - return -EIO; --- -2.5.0 - diff --git a/freed-ora/current/f23/USB-iowarrior-fix-oops-with-malicious-USB-descriptor.patch b/freed-ora/current/f23/USB-iowarrior-fix-oops-with-malicious-USB-descriptor.patch deleted file mode 100644 index 7df3af2b1..000000000 --- a/freed-ora/current/f23/USB-iowarrior-fix-oops-with-malicious-USB-descriptor.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 3620ebad64a327113bed34edefd45c3605086fc6 Mon Sep 17 00:00:00 2001 -From: Josh Boyer <jwboyer@fedoraproject.org> -Date: Mon, 14 Mar 2016 10:38:31 -0400 -Subject: [PATCH] USB: iowarrior: fix oops with malicious USB descriptors - -The iowarrior driver expects at least one valid endpoint. If given -malicious descriptors that specify 0 for the number of endpoints, -it will crash in the probe function. Ensure there is at least -one endpoint on the interface before using it. - -The full report of this issue can be found here: -http://seclists.org/bugtraq/2016/Mar/87 - -Reported-by: Ralf Spenneberg <ralf@spenneberg.net> -Cc: stable <stable@vger.kernel.org> -Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org> ---- - drivers/usb/misc/iowarrior.c | 6 ++++++ - 1 file changed, 6 insertions(+) - -diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c -index c6bfd13f6c92..1950e87b4219 100644 ---- a/drivers/usb/misc/iowarrior.c -+++ b/drivers/usb/misc/iowarrior.c -@@ -787,6 +787,12 @@ static int iowarrior_probe(struct usb_interface *interface, - iface_desc = interface->cur_altsetting; - dev->product_id = le16_to_cpu(udev->descriptor.idProduct); - -+ if (iface_desc->desc.bNumEndpoints < 1) { -+ dev_err(&interface->dev, "Invalid number of endpoints\n"); -+ retval = -EINVAL; -+ goto error; -+ } -+ - /* set up the endpoint information */ - for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) { - endpoint = &iface_desc->endpoint[i].desc; --- -2.5.0 - diff --git a/freed-ora/current/f23/USB-serial-ftdi_sio-Add-support-for-ICP-DAS-I-756xU-.patch b/freed-ora/current/f23/USB-serial-ftdi_sio-Add-support-for-ICP-DAS-I-756xU-.patch deleted file mode 100644 index ac8e71c72..000000000 --- a/freed-ora/current/f23/USB-serial-ftdi_sio-Add-support-for-ICP-DAS-I-756xU-.patch +++ /dev/null @@ -1,59 +0,0 @@ -From 94c78c81df3056e573fb84000a32512e9c16e555 Mon Sep 17 00:00:00 2001 -From: Josh Boyer <jwboyer@fedoraproject.org> -Date: Thu, 10 Mar 2016 08:49:02 -0500 -Subject: [PATCH] USB: serial: ftdi_sio: Add support for ICP DAS I-756xU - devices - -A Fedora user reports that the ftdi_sio driver works properly for the -ICP DAS I-7561U device. Further, the user manual for these devices -instructs users to load the driver and add the ids using the sysfs -interface. - -Add support for these in the driver directly so that the devices work -out of the box instead of needing manual configuration. - -Reported-by: <thesource@mail.ru> -CC: stable <stable@vger.kernel.org> -Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org> ---- - drivers/usb/serial/ftdi_sio.c | 4 ++++ - drivers/usb/serial/ftdi_sio_ids.h | 8 ++++++++ - 2 files changed, 12 insertions(+) - -diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c -index 8c660ae401d8..b61f12160d37 100644 ---- a/drivers/usb/serial/ftdi_sio.c -+++ b/drivers/usb/serial/ftdi_sio.c -@@ -1004,6 +1004,10 @@ static const struct usb_device_id id_table_combined[] = { - { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_DISPLAY_PID) }, - { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_LITE_PID) }, - { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_ANALOG_PID) }, -+ /* ICP DAS I-756xU devices */ -+ { USB_DEVICE(ICPDAS_VID, ICPDAS_I7560U_PID) }, -+ { USB_DEVICE(ICPDAS_VID, ICPDAS_I7561U_PID) }, -+ { USB_DEVICE(ICPDAS_VID, ICPDAS_I7563U_PID) }, - { } /* Terminating entry */ - }; - -diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h -index a84df2513994..a4ec24ce6a11 100644 ---- a/drivers/usb/serial/ftdi_sio_ids.h -+++ b/drivers/usb/serial/ftdi_sio_ids.h -@@ -872,6 +872,14 @@ - #define NOVITUS_BONO_E_PID 0x6010 - - /* -+ * ICPDAS I-756*U devices -+ */ -+#define ICPDAS_VID 0x1b5c -+#define ICPDAS_I7560U_PID 0x0103 -+#define ICPDAS_I7561U_PID 0x0104 -+#define ICPDAS_I7563U_PID 0x0105 -+ -+/* - * RT Systems programming cables for various ham radios - */ - #define RTSYSTEMS_VID 0x2100 /* Vendor ID */ --- -2.5.0 - diff --git a/freed-ora/current/f23/cdc-acm-more-sanity-checking.patch b/freed-ora/current/f23/cdc-acm-more-sanity-checking.patch deleted file mode 100644 index 99ad43416..000000000 --- a/freed-ora/current/f23/cdc-acm-more-sanity-checking.patch +++ /dev/null @@ -1,33 +0,0 @@ -From e6a87f147002fa16adcbafebbc458ff90a463474 Mon Sep 17 00:00:00 2001 -From: Oliver Neukum <oneukum@suse.com> -Date: Tue, 15 Mar 2016 10:14:04 +0100 -Subject: [PATCH] cdc-acm: more sanity checking - -An attack has become available which pretends to be a quirky -device circumventing normal sanity checks and crashes the kernel -by an insufficient number of interfaces. This patch adds a check -to the code path for quirky devices. - -Signed-off-by: Oliver Neukum <ONeukum@suse.com> -CC: stable@vger.kernel.org ---- - drivers/usb/class/cdc-acm.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c -index 26ca4f910cb0..a7732f80a912 100644 ---- a/drivers/usb/class/cdc-acm.c -+++ b/drivers/usb/class/cdc-acm.c -@@ -1113,6 +1113,9 @@ static int acm_probe(struct usb_interface *intf, - if (quirks == NO_UNION_NORMAL) { - data_interface = usb_ifnum_to_if(usb_dev, 1); - control_interface = usb_ifnum_to_if(usb_dev, 0); -+ /* we would crash */ -+ if (!data_interface || !control_interface) -+ return -ENODEV; - goto skip_normal_probe; - } - --- -2.5.0 - diff --git a/freed-ora/current/f23/cdc_ncm-do-not-call-usbnet_link_change-from-cdc_ncm_.patch b/freed-ora/current/f23/cdc_ncm-do-not-call-usbnet_link_change-from-cdc_ncm_.patch new file mode 100644 index 000000000..479914dc2 --- /dev/null +++ b/freed-ora/current/f23/cdc_ncm-do-not-call-usbnet_link_change-from-cdc_ncm_.patch @@ -0,0 +1,87 @@ +From 4d06dd537f95683aba3651098ae288b7cbff8274 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn@mork.no> +Date: Mon, 7 Mar 2016 21:15:36 +0100 +Subject: [PATCH] cdc_ncm: do not call usbnet_link_change from cdc_ncm_bind +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +usbnet_link_change will call schedule_work and should be +avoided if bind is failing. Otherwise we will end up with +scheduled work referring to a netdev which has gone away. + +Instead of making the call conditional, we can just defer +it to usbnet_probe, using the driver_info flag made for +this purpose. + +Fixes: 8a34b0ae8778 ("usbnet: cdc_ncm: apply usbnet_link_change") +Reported-by: Andrey Konovalov <andreyknvl@gmail.com> +Suggested-by: Linus Torvalds <torvalds@linux-foundation.org> +Signed-off-by: Bjørn Mork <bjorn@mork.no> +Signed-off-by: David S. Miller <davem@davemloft.net> +--- + drivers/net/usb/cdc_ncm.c | 20 +++++--------------- + 1 file changed, 5 insertions(+), 15 deletions(-) + +diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c +index be927964375b..86ba30ba35e8 100644 +--- a/drivers/net/usb/cdc_ncm.c ++++ b/drivers/net/usb/cdc_ncm.c +@@ -988,8 +988,6 @@ EXPORT_SYMBOL_GPL(cdc_ncm_select_altsetting); + + static int cdc_ncm_bind(struct usbnet *dev, struct usb_interface *intf) + { +- int ret; +- + /* MBIM backwards compatible function? */ + if (cdc_ncm_select_altsetting(intf) != CDC_NCM_COMM_ALTSETTING_NCM) + return -ENODEV; +@@ -998,16 +996,7 @@ static int cdc_ncm_bind(struct usbnet *dev, struct usb_interface *intf) + * Additionally, generic NCM devices are assumed to accept arbitrarily + * placed NDP. + */ +- ret = cdc_ncm_bind_common(dev, intf, CDC_NCM_DATA_ALTSETTING_NCM, 0); +- +- /* +- * We should get an event when network connection is "connected" or +- * "disconnected". Set network connection in "disconnected" state +- * (carrier is OFF) during attach, so the IP network stack does not +- * start IPv6 negotiation and more. +- */ +- usbnet_link_change(dev, 0, 0); +- return ret; ++ return cdc_ncm_bind_common(dev, intf, CDC_NCM_DATA_ALTSETTING_NCM, 0); + } + + static void cdc_ncm_align_tail(struct sk_buff *skb, size_t modulus, size_t remainder, size_t max) +@@ -1590,7 +1579,8 @@ static void cdc_ncm_status(struct usbnet *dev, struct urb *urb) + + static const struct driver_info cdc_ncm_info = { + .description = "CDC NCM", +- .flags = FLAG_POINTTOPOINT | FLAG_NO_SETINT | FLAG_MULTI_PACKET, ++ .flags = FLAG_POINTTOPOINT | FLAG_NO_SETINT | FLAG_MULTI_PACKET ++ | FLAG_LINK_INTR, + .bind = cdc_ncm_bind, + .unbind = cdc_ncm_unbind, + .manage_power = usbnet_manage_power, +@@ -1603,7 +1593,7 @@ static const struct driver_info cdc_ncm_info = { + static const struct driver_info wwan_info = { + .description = "Mobile Broadband Network Device", + .flags = FLAG_POINTTOPOINT | FLAG_NO_SETINT | FLAG_MULTI_PACKET +- | FLAG_WWAN, ++ | FLAG_LINK_INTR | FLAG_WWAN, + .bind = cdc_ncm_bind, + .unbind = cdc_ncm_unbind, + .manage_power = usbnet_manage_power, +@@ -1616,7 +1606,7 @@ static const struct driver_info wwan_info = { + static const struct driver_info wwan_noarp_info = { + .description = "Mobile Broadband Network Device (NO ARP)", + .flags = FLAG_POINTTOPOINT | FLAG_NO_SETINT | FLAG_MULTI_PACKET +- | FLAG_WWAN | FLAG_NOARP, ++ | FLAG_LINK_INTR | FLAG_WWAN | FLAG_NOARP, + .bind = cdc_ncm_bind, + .unbind = cdc_ncm_unbind, + .manage_power = usbnet_manage_power, +-- +2.5.5 + diff --git a/freed-ora/current/f23/cypress_m8-add-sanity-checking.patch b/freed-ora/current/f23/cypress_m8-add-sanity-checking.patch deleted file mode 100644 index fa8513f94..000000000 --- a/freed-ora/current/f23/cypress_m8-add-sanity-checking.patch +++ /dev/null @@ -1,50 +0,0 @@ -From f7a3aa353011e38e119adebd845b38551587a26a Mon Sep 17 00:00:00 2001 -From: Oliver Neukum <oneukum@suse.com> -Date: Thu, 17 Mar 2016 16:25:33 +0100 -Subject: [PATCH] cypress_m8: add sanity checking - -An attack using missing endpoints exists. -CVE-2016-3137 - -Signed-off-by: Oliver Neukum <ONeukum@suse.com> -CC: stable@vger.kernel.org - -v1 - add sanity check -v2 - add error logging -v3 - correct error message ---- - drivers/usb/serial/cypress_m8.c | 11 +++++------ - 1 file changed, 5 insertions(+), 6 deletions(-) - -diff --git a/drivers/usb/serial/cypress_m8.c b/drivers/usb/serial/cypress_m8.c -index 01bf53392819..5e25443fe4ef 100644 ---- a/drivers/usb/serial/cypress_m8.c -+++ b/drivers/usb/serial/cypress_m8.c -@@ -447,6 +447,11 @@ static int cypress_generic_port_probe(struct usb_serial_port *port) - struct usb_serial *serial = port->serial; - struct cypress_private *priv; - -+ if (!port->interrupt_out_urb || !port->interrupt_in_urb) { -+ dev_err(&port->dev, "A required endpoint is missing\n"); -+ return -ENODEV; -+ } -+ - priv = kzalloc(sizeof(struct cypress_private), GFP_KERNEL); - if (!priv) - return -ENOMEM; -@@ -606,12 +611,6 @@ static int cypress_open(struct tty_struct *tty, struct usb_serial_port *port) - cypress_set_termios(tty, port, &priv->tmp_termios); - - /* setup the port and start reading from the device */ -- if (!port->interrupt_in_urb) { -- dev_err(&port->dev, "%s - interrupt_in_urb is empty!\n", -- __func__); -- return -1; -- } -- - usb_fill_int_urb(port->interrupt_in_urb, serial->dev, - usb_rcvintpipe(serial->dev, port->interrupt_in_endpointAddress), - port->interrupt_in_urb->transfer_buffer, --- -2.5.0 - diff --git a/freed-ora/current/f23/digi_acceleport-do-sanity-checking-for-the-number-of.patch b/freed-ora/current/f23/digi_acceleport-do-sanity-checking-for-the-number-of.patch deleted file mode 100644 index eb060eb08..000000000 --- a/freed-ora/current/f23/digi_acceleport-do-sanity-checking-for-the-number-of.patch +++ /dev/null @@ -1,70 +0,0 @@ -From e9c2a3972496927631a1a98fef43e9538e9fd5d5 Mon Sep 17 00:00:00 2001 -From: Oliver Neukum <oneukum@suse.com> -Date: Mon, 14 Mar 2016 15:53:38 +0100 -Subject: [PATCH v2] digi_acceleport: do sanity checking for the number of ports - -The driver can be crashed with devices that expose crafted -descriptors with too few endpoints. -See: -http://seclists.org/bugtraq/2016/Mar/61 - -Signed-off-by: Oliver Neukum <ONeukum@suse.com> - -v1 - added sanity checks -v2 - moved them to probe() to fix problems Johan pointed out ---- - drivers/usb/serial/digi_acceleport.c | 24 +++++++++++++++++++----- - 1 file changed, 19 insertions(+), 5 deletions(-) - -diff --git a/drivers/usb/serial/digi_acceleport.c b/drivers/usb/serial/digi_acceleport.c -index 12b0e67..dab1dcf 100644 ---- a/drivers/usb/serial/digi_acceleport.c -+++ b/drivers/usb/serial/digi_acceleport.c -@@ -1252,7 +1252,8 @@ static int digi_port_init(struct usb_serial_port *port, unsigned port_num) - static int digi_startup(struct usb_serial *serial) - { - struct digi_serial *serial_priv; -- int ret; -+ int ret = -ENODEV; -+ int i; - - serial_priv = kzalloc(sizeof(*serial_priv), GFP_KERNEL); - if (!serial_priv) -@@ -1260,18 +1261,31 @@ static int digi_startup(struct usb_serial *serial) - - spin_lock_init(&serial_priv->ds_serial_lock); - serial_priv->ds_oob_port_num = serial->type->num_ports; -+ -+ /* Check whether the expected number of ports matches the device */ -+ if (serial->num_ports < serial_priv->ds_oob_port_num) -+ goto error; -+ /* all features must be present */ -+ for (i = 0; i < serial->type->num_ports + 1 ; i++) { -+ if (!serial->port[i]->read_urb) -+ goto error; -+ if (!serial->port[i]->write_urb) -+ goto error; -+ } -+ - serial_priv->ds_oob_port = serial->port[serial_priv->ds_oob_port_num]; - - ret = digi_port_init(serial_priv->ds_oob_port, - serial_priv->ds_oob_port_num); -- if (ret) { -- kfree(serial_priv); -- return ret; -- } -+ if (ret) -+ goto error; - - usb_set_serial_data(serial, serial_priv); - - return 0; -+error: -+ kfree(serial_priv); -+ return ret; - } - - --- -2.1.4 diff --git a/freed-ora/current/f23/ext4-fix-races-between-buffered-IO-and-collapse-inse.patch b/freed-ora/current/f23/ext4-fix-races-between-buffered-IO-and-collapse-inse.patch new file mode 100644 index 000000000..0c89ea77a --- /dev/null +++ b/freed-ora/current/f23/ext4-fix-races-between-buffered-IO-and-collapse-inse.patch @@ -0,0 +1,119 @@ +From 32ebffd3bbb4162da5ff88f9a35dd32d0a28ea70 Mon Sep 17 00:00:00 2001 +From: Jan Kara <jack@suse.com> +Date: Mon, 7 Dec 2015 14:31:11 -0500 +Subject: [PATCH 3/4] ext4: fix races between buffered IO and collapse / insert + range + +Current code implementing FALLOC_FL_COLLAPSE_RANGE and +FALLOC_FL_INSERT_RANGE is prone to races with buffered writes and page +faults. If buffered write or write via mmap manages to squeeze between +filemap_write_and_wait_range() and truncate_pagecache() in the fallocate +implementations, the written data is simply discarded by +truncate_pagecache() although it should have been shifted. + +Fix the problem by moving filemap_write_and_wait_range() call inside +i_mutex and i_mmap_sem. That way we are protected against races with +both buffered writes and page faults. + +Signed-off-by: Jan Kara <jack@suse.com> +Signed-off-by: Theodore Ts'o <tytso@mit.edu> +--- + fs/ext4/extents.c | 59 +++++++++++++++++++++++++++++-------------------------- + 1 file changed, 31 insertions(+), 28 deletions(-) + +diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c +index 65b5ada2833f..4b105c96df08 100644 +--- a/fs/ext4/extents.c ++++ b/fs/ext4/extents.c +@@ -5487,21 +5487,7 @@ int ext4_collapse_range(struct inode *inode, loff_t offset, loff_t len) + return ret; + } + +- /* +- * Need to round down offset to be aligned with page size boundary +- * for page size > block size. +- */ +- ioffset = round_down(offset, PAGE_SIZE); +- +- /* Write out all dirty pages */ +- ret = filemap_write_and_wait_range(inode->i_mapping, ioffset, +- LLONG_MAX); +- if (ret) +- return ret; +- +- /* Take mutex lock */ + mutex_lock(&inode->i_mutex); +- + /* + * There is no need to overlap collapse range with EOF, in which case + * it is effectively a truncate operation +@@ -5526,6 +5512,27 @@ int ext4_collapse_range(struct inode *inode, loff_t offset, loff_t len) + * page cache. + */ + down_write(&EXT4_I(inode)->i_mmap_sem); ++ /* ++ * Need to round down offset to be aligned with page size boundary ++ * for page size > block size. ++ */ ++ ioffset = round_down(offset, PAGE_SIZE); ++ /* ++ * Write tail of the last page before removed range since it will get ++ * removed from the page cache below. ++ */ ++ ret = filemap_write_and_wait_range(inode->i_mapping, ioffset, offset); ++ if (ret) ++ goto out_mmap; ++ /* ++ * Write data that will be shifted to preserve them when discarding ++ * page cache below. We are also protected from pages becoming dirty ++ * by i_mmap_sem. ++ */ ++ ret = filemap_write_and_wait_range(inode->i_mapping, offset + len, ++ LLONG_MAX); ++ if (ret) ++ goto out_mmap; + truncate_pagecache(inode, ioffset); + + credits = ext4_writepage_trans_blocks(inode); +@@ -5626,21 +5633,7 @@ int ext4_insert_range(struct inode *inode, loff_t offset, loff_t len) + return ret; + } + +- /* +- * Need to round down to align start offset to page size boundary +- * for page size > block size. +- */ +- ioffset = round_down(offset, PAGE_SIZE); +- +- /* Write out all dirty pages */ +- ret = filemap_write_and_wait_range(inode->i_mapping, ioffset, +- LLONG_MAX); +- if (ret) +- return ret; +- +- /* Take mutex lock */ + mutex_lock(&inode->i_mutex); +- + /* Currently just for extent based files */ + if (!ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)) { + ret = -EOPNOTSUPP; +@@ -5668,6 +5661,16 @@ int ext4_insert_range(struct inode *inode, loff_t offset, loff_t len) + * page cache. + */ + down_write(&EXT4_I(inode)->i_mmap_sem); ++ /* ++ * Need to round down to align start offset to page size boundary ++ * for page size > block size. ++ */ ++ ioffset = round_down(offset, PAGE_SIZE); ++ /* Write out all dirty pages */ ++ ret = filemap_write_and_wait_range(inode->i_mapping, ioffset, ++ LLONG_MAX); ++ if (ret) ++ goto out_mmap; + truncate_pagecache(inode, ioffset); + + credits = ext4_writepage_trans_blocks(inode); +-- +2.5.5 + diff --git a/freed-ora/current/f23/ext4-fix-races-between-page-faults-and-hole-punching.patch b/freed-ora/current/f23/ext4-fix-races-between-page-faults-and-hole-punching.patch new file mode 100644 index 000000000..9034b958c --- /dev/null +++ b/freed-ora/current/f23/ext4-fix-races-between-page-faults-and-hole-punching.patch @@ -0,0 +1,442 @@ +From ea3d7209ca01da209cda6f0dea8be9cc4b7a933b Mon Sep 17 00:00:00 2001 +From: Jan Kara <jack@suse.com> +Date: Mon, 7 Dec 2015 14:28:03 -0500 +Subject: [PATCH 1/4] ext4: fix races between page faults and hole punching + +Currently, page faults and hole punching are completely unsynchronized. +This can result in page fault faulting in a page into a range that we +are punching after truncate_pagecache_range() has been called and thus +we can end up with a page mapped to disk blocks that will be shortly +freed. Filesystem corruption will shortly follow. Note that the same +race is avoided for truncate by checking page fault offset against +i_size but there isn't similar mechanism available for punching holes. + +Fix the problem by creating new rw semaphore i_mmap_sem in inode and +grab it for writing over truncate, hole punching, and other functions +removing blocks from extent tree and for read over page faults. We +cannot easily use i_data_sem for this since that ranks below transaction +start and we need something ranking above it so that it can be held over +the whole truncate / hole punching operation. Also remove various +workarounds we had in the code to reduce race window when page fault +could have created pages with stale mapping information. + +Signed-off-by: Jan Kara <jack@suse.com> +Signed-off-by: Theodore Ts'o <tytso@mit.edu> +--- + fs/ext4/ext4.h | 10 +++++++++ + fs/ext4/extents.c | 54 ++++++++++++++++++++++++-------------------- + fs/ext4/file.c | 66 ++++++++++++++++++++++++++++++++++++++++++++++-------- + fs/ext4/inode.c | 36 +++++++++++++++++++++-------- + fs/ext4/super.c | 1 + + fs/ext4/truncate.h | 2 ++ + 6 files changed, 127 insertions(+), 42 deletions(-) + +diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h +index cc7ca4e87144..348a5ff4a0e2 100644 +--- a/fs/ext4/ext4.h ++++ b/fs/ext4/ext4.h +@@ -910,6 +910,15 @@ struct ext4_inode_info { + * by other means, so we have i_data_sem. + */ + struct rw_semaphore i_data_sem; ++ /* ++ * i_mmap_sem is for serializing page faults with truncate / punch hole ++ * operations. We have to make sure that new page cannot be faulted in ++ * a section of the inode that is being punched. We cannot easily use ++ * i_data_sem for this since we need protection for the whole punch ++ * operation and i_data_sem ranks below transaction start so we have ++ * to occasionally drop it. ++ */ ++ struct rw_semaphore i_mmap_sem; + struct inode vfs_inode; + struct jbd2_inode *jinode; + +@@ -2484,6 +2493,7 @@ extern int ext4_chunk_trans_blocks(struct inode *, int nrblocks); + extern int ext4_zero_partial_blocks(handle_t *handle, struct inode *inode, + loff_t lstart, loff_t lend); + extern int ext4_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf); ++extern int ext4_filemap_fault(struct vm_area_struct *vma, struct vm_fault *vmf); + extern qsize_t *ext4_get_reserved_space(struct inode *inode); + extern void ext4_da_update_reserve_space(struct inode *inode, + int used, int quota_claim); +diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c +index 551353b1b17a..5be9ca5a8a7a 100644 +--- a/fs/ext4/extents.c ++++ b/fs/ext4/extents.c +@@ -4770,7 +4770,6 @@ static long ext4_zero_range(struct file *file, loff_t offset, + int partial_begin, partial_end; + loff_t start, end; + ext4_lblk_t lblk; +- struct address_space *mapping = inode->i_mapping; + unsigned int blkbits = inode->i_blkbits; + + trace_ext4_zero_range(inode, offset, len, mode); +@@ -4786,17 +4785,6 @@ static long ext4_zero_range(struct file *file, loff_t offset, + } + + /* +- * Write out all dirty pages to avoid race conditions +- * Then release them. +- */ +- if (mapping->nrpages && mapping_tagged(mapping, PAGECACHE_TAG_DIRTY)) { +- ret = filemap_write_and_wait_range(mapping, offset, +- offset + len - 1); +- if (ret) +- return ret; +- } +- +- /* + * Round up offset. This is not fallocate, we neet to zero out + * blocks, so convert interior block aligned part of the range to + * unwritten and possibly manually zero out unaligned parts of the +@@ -4856,16 +4844,22 @@ static long ext4_zero_range(struct file *file, loff_t offset, + flags |= (EXT4_GET_BLOCKS_CONVERT_UNWRITTEN | + EXT4_EX_NOCACHE); + +- /* Now release the pages and zero block aligned part of pages*/ +- truncate_pagecache_range(inode, start, end - 1); +- inode->i_mtime = inode->i_ctime = ext4_current_time(inode); +- + /* Wait all existing dio workers, newcomers will block on i_mutex */ + ext4_inode_block_unlocked_dio(inode); + inode_dio_wait(inode); + ++ /* ++ * Prevent page faults from reinstantiating pages we have ++ * released from page cache. ++ */ ++ down_write(&EXT4_I(inode)->i_mmap_sem); ++ /* Now release the pages and zero block aligned part of pages */ ++ truncate_pagecache_range(inode, start, end - 1); ++ inode->i_mtime = inode->i_ctime = ext4_current_time(inode); ++ + ret = ext4_alloc_file_blocks(file, lblk, max_blocks, new_size, + flags, mode); ++ up_write(&EXT4_I(inode)->i_mmap_sem); + if (ret) + goto out_dio; + } +@@ -5524,17 +5518,22 @@ int ext4_collapse_range(struct inode *inode, loff_t offset, loff_t len) + goto out_mutex; + } + +- truncate_pagecache(inode, ioffset); +- + /* Wait for existing dio to complete */ + ext4_inode_block_unlocked_dio(inode); + inode_dio_wait(inode); + ++ /* ++ * Prevent page faults from reinstantiating pages we have released from ++ * page cache. ++ */ ++ down_write(&EXT4_I(inode)->i_mmap_sem); ++ truncate_pagecache(inode, ioffset); ++ + credits = ext4_writepage_trans_blocks(inode); + handle = ext4_journal_start(inode, EXT4_HT_TRUNCATE, credits); + if (IS_ERR(handle)) { + ret = PTR_ERR(handle); +- goto out_dio; ++ goto out_mmap; + } + + down_write(&EXT4_I(inode)->i_data_sem); +@@ -5573,7 +5572,8 @@ int ext4_collapse_range(struct inode *inode, loff_t offset, loff_t len) + + out_stop: + ext4_journal_stop(handle); +-out_dio: ++out_mmap: ++ up_write(&EXT4_I(inode)->i_mmap_sem); + ext4_inode_resume_unlocked_dio(inode); + out_mutex: + mutex_unlock(&inode->i_mutex); +@@ -5660,17 +5660,22 @@ int ext4_insert_range(struct inode *inode, loff_t offset, loff_t len) + goto out_mutex; + } + +- truncate_pagecache(inode, ioffset); +- + /* Wait for existing dio to complete */ + ext4_inode_block_unlocked_dio(inode); + inode_dio_wait(inode); + ++ /* ++ * Prevent page faults from reinstantiating pages we have released from ++ * page cache. ++ */ ++ down_write(&EXT4_I(inode)->i_mmap_sem); ++ truncate_pagecache(inode, ioffset); ++ + credits = ext4_writepage_trans_blocks(inode); + handle = ext4_journal_start(inode, EXT4_HT_TRUNCATE, credits); + if (IS_ERR(handle)) { + ret = PTR_ERR(handle); +- goto out_dio; ++ goto out_mmap; + } + + /* Expand file to avoid data loss if there is error while shifting */ +@@ -5741,7 +5746,8 @@ int ext4_insert_range(struct inode *inode, loff_t offset, loff_t len) + + out_stop: + ext4_journal_stop(handle); +-out_dio: ++out_mmap: ++ up_write(&EXT4_I(inode)->i_mmap_sem); + ext4_inode_resume_unlocked_dio(inode); + out_mutex: + mutex_unlock(&inode->i_mutex); +diff --git a/fs/ext4/file.c b/fs/ext4/file.c +index 113837e7ba98..0d24ebcd7c9e 100644 +--- a/fs/ext4/file.c ++++ b/fs/ext4/file.c +@@ -209,15 +209,18 @@ static int ext4_dax_fault(struct vm_area_struct *vma, struct vm_fault *vmf) + { + int result; + handle_t *handle = NULL; +- struct super_block *sb = file_inode(vma->vm_file)->i_sb; ++ struct inode *inode = file_inode(vma->vm_file); ++ struct super_block *sb = inode->i_sb; + bool write = vmf->flags & FAULT_FLAG_WRITE; + + if (write) { + sb_start_pagefault(sb); + file_update_time(vma->vm_file); ++ down_read(&EXT4_I(inode)->i_mmap_sem); + handle = ext4_journal_start_sb(sb, EXT4_HT_WRITE_PAGE, + EXT4_DATA_TRANS_BLOCKS(sb)); +- } ++ } else ++ down_read(&EXT4_I(inode)->i_mmap_sem); + + if (IS_ERR(handle)) + result = VM_FAULT_SIGBUS; +@@ -228,8 +231,10 @@ static int ext4_dax_fault(struct vm_area_struct *vma, struct vm_fault *vmf) + if (write) { + if (!IS_ERR(handle)) + ext4_journal_stop(handle); ++ up_read(&EXT4_I(inode)->i_mmap_sem); + sb_end_pagefault(sb); +- } ++ } else ++ up_read(&EXT4_I(inode)->i_mmap_sem); + + return result; + } +@@ -246,10 +251,12 @@ static int ext4_dax_pmd_fault(struct vm_area_struct *vma, unsigned long addr, + if (write) { + sb_start_pagefault(sb); + file_update_time(vma->vm_file); ++ down_read(&EXT4_I(inode)->i_mmap_sem); + handle = ext4_journal_start_sb(sb, EXT4_HT_WRITE_PAGE, + ext4_chunk_trans_blocks(inode, + PMD_SIZE / PAGE_SIZE)); +- } ++ } else ++ down_read(&EXT4_I(inode)->i_mmap_sem); + + if (IS_ERR(handle)) + result = VM_FAULT_SIGBUS; +@@ -260,30 +267,71 @@ static int ext4_dax_pmd_fault(struct vm_area_struct *vma, unsigned long addr, + if (write) { + if (!IS_ERR(handle)) + ext4_journal_stop(handle); ++ up_read(&EXT4_I(inode)->i_mmap_sem); + sb_end_pagefault(sb); +- } ++ } else ++ up_read(&EXT4_I(inode)->i_mmap_sem); + + return result; + } + + static int ext4_dax_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf) + { +- return dax_mkwrite(vma, vmf, ext4_get_block_dax, +- ext4_end_io_unwritten); ++ int err; ++ struct inode *inode = file_inode(vma->vm_file); ++ ++ sb_start_pagefault(inode->i_sb); ++ file_update_time(vma->vm_file); ++ down_read(&EXT4_I(inode)->i_mmap_sem); ++ err = __dax_mkwrite(vma, vmf, ext4_get_block_dax, ++ ext4_end_io_unwritten); ++ up_read(&EXT4_I(inode)->i_mmap_sem); ++ sb_end_pagefault(inode->i_sb); ++ ++ return err; ++} ++ ++/* ++ * Handle write fault for VM_MIXEDMAP mappings. Similarly to ext4_dax_mkwrite() ++ * handler we check for races agaist truncate. Note that since we cycle through ++ * i_mmap_sem, we are sure that also any hole punching that began before we ++ * were called is finished by now and so if it included part of the file we ++ * are working on, our pte will get unmapped and the check for pte_same() in ++ * wp_pfn_shared() fails. Thus fault gets retried and things work out as ++ * desired. ++ */ ++static int ext4_dax_pfn_mkwrite(struct vm_area_struct *vma, ++ struct vm_fault *vmf) ++{ ++ struct inode *inode = file_inode(vma->vm_file); ++ struct super_block *sb = inode->i_sb; ++ int ret = VM_FAULT_NOPAGE; ++ loff_t size; ++ ++ sb_start_pagefault(sb); ++ file_update_time(vma->vm_file); ++ down_read(&EXT4_I(inode)->i_mmap_sem); ++ size = (i_size_read(inode) + PAGE_SIZE - 1) >> PAGE_SHIFT; ++ if (vmf->pgoff >= size) ++ ret = VM_FAULT_SIGBUS; ++ up_read(&EXT4_I(inode)->i_mmap_sem); ++ sb_end_pagefault(sb); ++ ++ return ret; + } + + static const struct vm_operations_struct ext4_dax_vm_ops = { + .fault = ext4_dax_fault, + .pmd_fault = ext4_dax_pmd_fault, + .page_mkwrite = ext4_dax_mkwrite, +- .pfn_mkwrite = dax_pfn_mkwrite, ++ .pfn_mkwrite = ext4_dax_pfn_mkwrite, + }; + #else + #define ext4_dax_vm_ops ext4_file_vm_ops + #endif + + static const struct vm_operations_struct ext4_file_vm_ops = { +- .fault = filemap_fault, ++ .fault = ext4_filemap_fault, + .map_pages = filemap_map_pages, + .page_mkwrite = ext4_page_mkwrite, + }; +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index ea433a7f4bca..d1207d03c961 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -3623,6 +3623,15 @@ int ext4_punch_hole(struct inode *inode, loff_t offset, loff_t length) + + } + ++ /* Wait all existing dio workers, newcomers will block on i_mutex */ ++ ext4_inode_block_unlocked_dio(inode); ++ inode_dio_wait(inode); ++ ++ /* ++ * Prevent page faults from reinstantiating pages we have released from ++ * page cache. ++ */ ++ down_write(&EXT4_I(inode)->i_mmap_sem); + first_block_offset = round_up(offset, sb->s_blocksize); + last_block_offset = round_down((offset + length), sb->s_blocksize) - 1; + +@@ -3631,10 +3640,6 @@ int ext4_punch_hole(struct inode *inode, loff_t offset, loff_t length) + truncate_pagecache_range(inode, first_block_offset, + last_block_offset); + +- /* Wait all existing dio workers, newcomers will block on i_mutex */ +- ext4_inode_block_unlocked_dio(inode); +- inode_dio_wait(inode); +- + if (ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)) + credits = ext4_writepage_trans_blocks(inode); + else +@@ -3680,16 +3685,12 @@ int ext4_punch_hole(struct inode *inode, loff_t offset, loff_t length) + if (IS_SYNC(inode)) + ext4_handle_sync(handle); + +- /* Now release the pages again to reduce race window */ +- if (last_block_offset > first_block_offset) +- truncate_pagecache_range(inode, first_block_offset, +- last_block_offset); +- + inode->i_mtime = inode->i_ctime = ext4_current_time(inode); + ext4_mark_inode_dirty(handle, inode); + out_stop: + ext4_journal_stop(handle); + out_dio: ++ up_write(&EXT4_I(inode)->i_mmap_sem); + ext4_inode_resume_unlocked_dio(inode); + out_mutex: + mutex_unlock(&inode->i_mutex); +@@ -4823,6 +4824,7 @@ int ext4_setattr(struct dentry *dentry, struct iattr *attr) + } else + ext4_wait_for_tail_page_commit(inode); + } ++ down_write(&EXT4_I(inode)->i_mmap_sem); + /* + * Truncate pagecache after we've waited for commit + * in data=journal mode to make pages freeable. +@@ -4830,6 +4832,7 @@ int ext4_setattr(struct dentry *dentry, struct iattr *attr) + truncate_pagecache(inode, inode->i_size); + if (shrink) + ext4_truncate(inode); ++ up_write(&EXT4_I(inode)->i_mmap_sem); + } + + if (!rc) { +@@ -5278,6 +5281,8 @@ int ext4_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf) + + sb_start_pagefault(inode->i_sb); + file_update_time(vma->vm_file); ++ ++ down_read(&EXT4_I(inode)->i_mmap_sem); + /* Delalloc case is easy... */ + if (test_opt(inode->i_sb, DELALLOC) && + !ext4_should_journal_data(inode) && +@@ -5347,6 +5352,19 @@ retry_alloc: + out_ret: + ret = block_page_mkwrite_return(ret); + out: ++ up_read(&EXT4_I(inode)->i_mmap_sem); + sb_end_pagefault(inode->i_sb); + return ret; + } ++ ++int ext4_filemap_fault(struct vm_area_struct *vma, struct vm_fault *vmf) ++{ ++ struct inode *inode = file_inode(vma->vm_file); ++ int err; ++ ++ down_read(&EXT4_I(inode)->i_mmap_sem); ++ err = filemap_fault(vma, vmf); ++ up_read(&EXT4_I(inode)->i_mmap_sem); ++ ++ return err; ++} +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index c9ab67da6e5a..493370e6590e 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -958,6 +958,7 @@ static void init_once(void *foo) + INIT_LIST_HEAD(&ei->i_orphan); + init_rwsem(&ei->xattr_sem); + init_rwsem(&ei->i_data_sem); ++ init_rwsem(&ei->i_mmap_sem); + inode_init_once(&ei->vfs_inode); + } + +diff --git a/fs/ext4/truncate.h b/fs/ext4/truncate.h +index 011ba6670d99..c70d06a383e2 100644 +--- a/fs/ext4/truncate.h ++++ b/fs/ext4/truncate.h +@@ -10,8 +10,10 @@ + */ + static inline void ext4_truncate_failed_write(struct inode *inode) + { ++ down_write(&EXT4_I(inode)->i_mmap_sem); + truncate_inode_pages(inode->i_mapping, inode->i_size); + ext4_truncate(inode); ++ up_write(&EXT4_I(inode)->i_mmap_sem); + } + + /* +-- +2.5.5 + diff --git a/freed-ora/current/f23/ext4-fix-races-of-writeback-with-punch-hole-and-zero.patch b/freed-ora/current/f23/ext4-fix-races-of-writeback-with-punch-hole-and-zero.patch new file mode 100644 index 000000000..9ff9e2761 --- /dev/null +++ b/freed-ora/current/f23/ext4-fix-races-of-writeback-with-punch-hole-and-zero.patch @@ -0,0 +1,110 @@ +From 011278485ecc3cd2a3954b5d4c73101d919bf1fa Mon Sep 17 00:00:00 2001 +From: Jan Kara <jack@suse.com> +Date: Mon, 7 Dec 2015 14:34:49 -0500 +Subject: [PATCH 4/4] ext4: fix races of writeback with punch hole and zero + range + +When doing delayed allocation, update of on-disk inode size is postponed +until IO submission time. However hole punch or zero range fallocate +calls can end up discarding the tail page cache page and thus on-disk +inode size would never be properly updated. + +Make sure the on-disk inode size is updated before truncating page +cache. + +Signed-off-by: Jan Kara <jack@suse.com> +Signed-off-by: Theodore Ts'o <tytso@mit.edu> +--- + fs/ext4/ext4.h | 3 +++ + fs/ext4/extents.c | 5 +++++ + fs/ext4/inode.c | 35 ++++++++++++++++++++++++++++++++++- + 3 files changed, 42 insertions(+), 1 deletion(-) + +diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h +index 348a5ff4a0e2..80f76f092079 100644 +--- a/fs/ext4/ext4.h ++++ b/fs/ext4/ext4.h +@@ -2858,6 +2858,9 @@ static inline int ext4_update_inode_size(struct inode *inode, loff_t newsize) + return changed; + } + ++int ext4_update_disksize_before_punch(struct inode *inode, loff_t offset, ++ loff_t len); ++ + struct ext4_group_info { + unsigned long bb_state; + struct rb_root bb_free_root; +diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c +index 4b105c96df08..3578b25fccfd 100644 +--- a/fs/ext4/extents.c ++++ b/fs/ext4/extents.c +@@ -4847,6 +4847,11 @@ static long ext4_zero_range(struct file *file, loff_t offset, + * released from page cache. + */ + down_write(&EXT4_I(inode)->i_mmap_sem); ++ ret = ext4_update_disksize_before_punch(inode, offset, len); ++ if (ret) { ++ up_write(&EXT4_I(inode)->i_mmap_sem); ++ goto out_dio; ++ } + /* Now release the pages and zero block aligned part of pages */ + truncate_pagecache_range(inode, start, end - 1); + inode->i_mtime = inode->i_ctime = ext4_current_time(inode); +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index d1207d03c961..472e608da13d 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -3559,6 +3559,35 @@ int ext4_can_truncate(struct inode *inode) + } + + /* ++ * We have to make sure i_disksize gets properly updated before we truncate ++ * page cache due to hole punching or zero range. Otherwise i_disksize update ++ * can get lost as it may have been postponed to submission of writeback but ++ * that will never happen after we truncate page cache. ++ */ ++int ext4_update_disksize_before_punch(struct inode *inode, loff_t offset, ++ loff_t len) ++{ ++ handle_t *handle; ++ loff_t size = i_size_read(inode); ++ ++ WARN_ON(!mutex_is_locked(&inode->i_mutex)); ++ if (offset > size || offset + len < size) ++ return 0; ++ ++ if (EXT4_I(inode)->i_disksize >= size) ++ return 0; ++ ++ handle = ext4_journal_start(inode, EXT4_HT_MISC, 1); ++ if (IS_ERR(handle)) ++ return PTR_ERR(handle); ++ ext4_update_i_disksize(inode, size); ++ ext4_mark_inode_dirty(handle, inode); ++ ext4_journal_stop(handle); ++ ++ return 0; ++} ++ ++/* + * ext4_punch_hole: punches a hole in a file by releaseing the blocks + * associated with the given offset and length + * +@@ -3636,9 +3665,13 @@ int ext4_punch_hole(struct inode *inode, loff_t offset, loff_t length) + last_block_offset = round_down((offset + length), sb->s_blocksize) - 1; + + /* Now release the pages and zero block aligned part of pages*/ +- if (last_block_offset > first_block_offset) ++ if (last_block_offset > first_block_offset) { ++ ret = ext4_update_disksize_before_punch(inode, offset, length); ++ if (ret) ++ goto out_dio; + truncate_pagecache_range(inode, first_block_offset, + last_block_offset); ++ } + + if (ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)) + credits = ext4_writepage_trans_blocks(inode); +-- +2.5.5 + diff --git a/freed-ora/current/f23/ext4-move-unlocked-dio-protection-from-ext4_alloc_fi.patch b/freed-ora/current/f23/ext4-move-unlocked-dio-protection-from-ext4_alloc_fi.patch new file mode 100644 index 000000000..3bf6765fa --- /dev/null +++ b/freed-ora/current/f23/ext4-move-unlocked-dio-protection-from-ext4_alloc_fi.patch @@ -0,0 +1,93 @@ +From 17048e8a083fec7ad841d88ef0812707fbc7e39f Mon Sep 17 00:00:00 2001 +From: Jan Kara <jack@suse.com> +Date: Mon, 7 Dec 2015 14:29:17 -0500 +Subject: [PATCH 2/4] ext4: move unlocked dio protection from + ext4_alloc_file_blocks() + +Currently ext4_alloc_file_blocks() was handling protection against +unlocked DIO. However we now need to sometimes call it under i_mmap_sem +and sometimes not and DIO protection ranks above it (although strictly +speaking this cannot currently create any deadlocks). Also +ext4_zero_range() was actually getting & releasing unlocked DIO +protection twice in some cases. Luckily it didn't introduce any real bug +but it was a land mine waiting to be stepped on. So move DIO protection +out from ext4_alloc_file_blocks() into the two callsites. + +Signed-off-by: Jan Kara <jack@suse.com> +Signed-off-by: Theodore Ts'o <tytso@mit.edu> +--- + fs/ext4/extents.c | 21 ++++++++++----------- + 1 file changed, 10 insertions(+), 11 deletions(-) + +diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c +index 5be9ca5a8a7a..65b5ada2833f 100644 +--- a/fs/ext4/extents.c ++++ b/fs/ext4/extents.c +@@ -4685,10 +4685,6 @@ static int ext4_alloc_file_blocks(struct file *file, ext4_lblk_t offset, + if (len <= EXT_UNWRITTEN_MAX_LEN) + flags |= EXT4_GET_BLOCKS_NO_NORMALIZE; + +- /* Wait all existing dio workers, newcomers will block on i_mutex */ +- ext4_inode_block_unlocked_dio(inode); +- inode_dio_wait(inode); +- + /* + * credits to insert 1 extent into extent tree + */ +@@ -4752,8 +4748,6 @@ retry: + goto retry; + } + +- ext4_inode_resume_unlocked_dio(inode); +- + return ret > 0 ? ret2 : ret; + } + +@@ -4827,6 +4821,10 @@ static long ext4_zero_range(struct file *file, loff_t offset, + if (mode & FALLOC_FL_KEEP_SIZE) + flags |= EXT4_GET_BLOCKS_KEEP_SIZE; + ++ /* Wait all existing dio workers, newcomers will block on i_mutex */ ++ ext4_inode_block_unlocked_dio(inode); ++ inode_dio_wait(inode); ++ + /* Preallocate the range including the unaligned edges */ + if (partial_begin || partial_end) { + ret = ext4_alloc_file_blocks(file, +@@ -4835,7 +4833,7 @@ static long ext4_zero_range(struct file *file, loff_t offset, + round_down(offset, 1 << blkbits)) >> blkbits, + new_size, flags, mode); + if (ret) +- goto out_mutex; ++ goto out_dio; + + } + +@@ -4844,10 +4842,6 @@ static long ext4_zero_range(struct file *file, loff_t offset, + flags |= (EXT4_GET_BLOCKS_CONVERT_UNWRITTEN | + EXT4_EX_NOCACHE); + +- /* Wait all existing dio workers, newcomers will block on i_mutex */ +- ext4_inode_block_unlocked_dio(inode); +- inode_dio_wait(inode); +- + /* + * Prevent page faults from reinstantiating pages we have + * released from page cache. +@@ -4992,8 +4986,13 @@ long ext4_fallocate(struct file *file, int mode, loff_t offset, loff_t len) + goto out; + } + ++ /* Wait all existing dio workers, newcomers will block on i_mutex */ ++ ext4_inode_block_unlocked_dio(inode); ++ inode_dio_wait(inode); ++ + ret = ext4_alloc_file_blocks(file, lblk, max_blocks, new_size, + flags, mode); ++ ext4_inode_resume_unlocked_dio(inode); + if (ret) + goto out; + +-- +2.5.5 + diff --git a/freed-ora/current/f23/ims-pcu-sanity-check-against-missing-interfaces.patch b/freed-ora/current/f23/ims-pcu-sanity-check-against-missing-interfaces.patch deleted file mode 100644 index 827a2b7ee..000000000 --- a/freed-ora/current/f23/ims-pcu-sanity-check-against-missing-interfaces.patch +++ /dev/null @@ -1,39 +0,0 @@ -From a4200b7eb26271108586d3a7cf34a2f16d460e48 Mon Sep 17 00:00:00 2001 -From: Oliver Neukum <oneukum@suse.com> -Date: Thu, 17 Mar 2016 15:10:47 +0100 -Subject: [PATCH] ims-pcu: sanity check against missing interfaces - -A malicious device missing interface can make the driver oops. -Add sanity checking. - -Signed-off-by: Oliver Neukum <ONeukum@suse.com> -CC: stable@vger.kernel.org ---- - drivers/input/misc/ims-pcu.c | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/drivers/input/misc/ims-pcu.c b/drivers/input/misc/ims-pcu.c -index ac1fa5f44580..9c0ea36913b4 100644 ---- a/drivers/input/misc/ims-pcu.c -+++ b/drivers/input/misc/ims-pcu.c -@@ -1663,6 +1663,8 @@ static int ims_pcu_parse_cdc_data(struct usb_interface *intf, struct ims_pcu *pc - - pcu->ctrl_intf = usb_ifnum_to_if(pcu->udev, - union_desc->bMasterInterface0); -+ if (!pcu->ctrl_intf) -+ return -EINVAL; - - alt = pcu->ctrl_intf->cur_altsetting; - pcu->ep_ctrl = &alt->endpoint[0].desc; -@@ -1670,6 +1672,8 @@ static int ims_pcu_parse_cdc_data(struct usb_interface *intf, struct ims_pcu *pc - - pcu->data_intf = usb_ifnum_to_if(pcu->udev, - union_desc->bSlaveInterface0); -+ if (!pcu->data_intf) -+ return -EINVAL; - - alt = pcu->data_intf->cur_altsetting; - if (alt->desc.bNumEndpoints != 2) { --- -2.5.0 - diff --git a/freed-ora/current/f23/kernel.spec b/freed-ora/current/f23/kernel.spec index 7aefbf19b..ea0754add 100644 --- a/freed-ora/current/f23/kernel.spec +++ b/freed-ora/current/f23/kernel.spec @@ -40,7 +40,7 @@ Summary: The Linux kernel # For non-released -rc kernels, this will be appended after the rcX and # gitX tags, so a 3 here would become part of release "0.rcX.gitX.3" # -%global baserelease 301 +%global baserelease 300 %global fedora_build %{baserelease} # base_sublevel is the kernel version we're starting with and patching @@ -90,7 +90,7 @@ Summary: The Linux kernel %if 0%{?released_kernel} # Do we have a -stable update to apply? -%define stable_update 6 +%define stable_update 7 # Set rpm version accordingly %if 0%{?stable_update} %define stablerev %{stable_update} @@ -666,9 +666,6 @@ Patch660: 0001-drm-i915-Pretend-cursor-is-always-on-for-ILK-style-W.patch #rhbz 1316719 Patch662: 0001-cdc-acm-fix-NULL-pointer-reference.patch -#rhbz 1316136 -Patch663: USB-serial-ftdi_sio-Add-support-for-ICP-DAS-I-756xU-.patch - #CVE-2016-3135 rhbz 1317386 1317387 Patch664: netfilter-x_tables-check-for-size-overflow.patch @@ -678,51 +675,30 @@ Patch665: netfilter-x_tables-deal-with-bogus-nextoffset-values.patch #CVE-2016-3135 rhbz 1318172 1318270 Patch666: ipv4-Dont-do-expensive-useless-work-during-inetdev-des.patch -#CVE-2016-2184 rhbz 1317012 1317470 -Patch670: ALSA-usb-audio-Fix-NULL-dereference-in-create_fixed_.patch -Patch671: ALSA-usb-audio-Add-sanity-checks-for-endpoint-access.patch - -#CVE-2016-3137 rhbz 1317010 1316996 -Patch672: cypress_m8-add-sanity-checking.patch - -#CVE-2016-2186 rhbz 1317015 1317464 -Patch673: USB-input-powermate-fix-oops-with-malicious-USB-desc.patch - -#CVE-2016-2188 rhbz 1317018 1317467 -Patch674: USB-iowarrior-fix-oops-with-malicious-USB-descriptor.patch - -#CVE-2016-2185 rhbz 1317014 1317471 -Patch675: usb_driver_claim_interface-add-sanity-checking.patch -Patch669: Input-ati_remote2-fix-crashes-on-detecting-device-wi.patch - -#CVE-2016-3138 rhbz 1317010 1316204 -Patch676: cdc-acm-more-sanity-checking.patch - -#CVE-2016-3140 rhbz 1317010 1316995 -Patch677: digi_acceleport-do-sanity-checking-for-the-number-of.patch - -Patch678: ims-pcu-sanity-check-against-missing-interfaces.patch - #rhbz 1315013 Patch679: 0001-uas-Limit-qdepth-at-the-scsi-host-level.patch -#rhbz 1317190 -Patch680: thermal-fix.patch - -#rhbz 1318079 -Patch681: 0001-Input-synaptics-handle-spurious-release-of-trackstic.patch - #CVE-2016-2187 rhbz 1317017 1317010 Patch686: input-gtco-fix-crash-on-detecting-device-without-end.patch -#CVE-2016-3136 rhbz 1317007 1317010 -Patch687: mct_u232-sanity-checking-in-probe.patch - #rhbz 1295646 Patch688: 09-29-drm-udl-Use-unlocked-gem-unreferencing.patch -# CVE-2016-3157 rhbz 1315711 1321948 -Patch689: x86-iopl-64-Properly-context-switch-IOPL-on-Xen-PV.patch +# CVE-2016-3672 rhbz 1324749 1324750 +Patch690: x86-mm-32-Enable-full-randomization-on-i386-and-X86_.patch + +#CVE-2015-8839 rhbz 1323577 1323579 +Patch691: ext4-fix-races-between-page-faults-and-hole-punching.patch +Patch692: ext4-move-unlocked-dio-protection-from-ext4_alloc_fi.patch +Patch693: ext4-fix-races-between-buffered-IO-and-collapse-inse.patch +Patch694: ext4-fix-races-of-writeback-with-punch-hole-and-zero.patch + +#CVE-2016-3951 rhbz 1324782 1324815 +Patch695: cdc_ncm-do-not-call-usbnet_link_change-from-cdc_ncm_.patch +Patch696: usbnet-cleanup-after-bind-in-probe.patch + +#rhbz 1317116 +Patch697: HID-wacom-fix-Bamboo-ONE-oops.patch # END OF PATCH DEFINITIONS %endif @@ -2264,6 +2240,25 @@ fi # # %changelog +* Wed Apr 13 2016 Alexandre Oliva <lxoliva@fsfla.org> -libre +- GNU Linux-libre 4.4.7-gnu. + +* Tue Apr 12 2016 Laura Abbott <labbott@redhat.com> - 4.4.7-300 +- Linux v4.4.7 + +* Tue Apr 12 2016 Josh Boyer <jwboyer@fedoraproject.org> +- Fix Bamboo ONE issues (rhbz 1317116) + +* Mon Apr 11 2016 Josh Boyer <jwboyer@fedoraproject.org> +- CVE-2016-3951 usbnet: crash on invalid USB descriptors (rhbz 1324782 1324815) +- CVE-2015-8839 ext4: data corruption due to punch hole races (rhbz 1323577 1323579) + +* Thu Apr 07 2016 Justin M. Forbes <jforbes@fedoraproject.org> +- Enable Full Randomization on 32bit x86 CVE-2016-3672 (rhbz 1324749 1324750) + +* Thu Mar 31 2016 Josh Boyer <jwboyer@fedoraproject.org> +- Add two more patches for CVE-2016-2184 + * Wed Mar 30 2016 Laura Abbott <labbott@redhat.com> - 4.4.6-301 - Bump and build diff --git a/freed-ora/current/f23/mct_u232-sanity-checking-in-probe.patch b/freed-ora/current/f23/mct_u232-sanity-checking-in-probe.patch deleted file mode 100644 index 006faf15f..000000000 --- a/freed-ora/current/f23/mct_u232-sanity-checking-in-probe.patch +++ /dev/null @@ -1,35 +0,0 @@ -Subject: [PATCH v2] mct_u232: sanity checking in probe -From: Oliver Neukum <oneukum@suse.com> -Date: 2016-03-21 13:14:37 - -An attack using the lack of sanity checking in probe -is known. This patch checks for the existance of a -second port. -CVE-2016-3136 - -Signed-off-by: Oliver Neukum <ONeukum@suse.com> -CC: stable@vger.kernel.org - -v1 - add sanity check for presence of a second port -v2 - add sanity check for an interrupt endpoint ---- - drivers/usb/serial/mct_u232.c | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/drivers/usb/serial/mct_u232.c b/drivers/usb/serial/mct_u232.c -index 4446b8d..3e64538 100644 ---- a/drivers/usb/serial/mct_u232.c -+++ b/drivers/usb/serial/mct_u232.c -@@ -378,6 +378,10 @@ static int mct_u232_port_probe(struct usb_serial_port *port) - { - struct mct_u232_private *priv; - -+ /* check first to simplify error handling */ -+ if (!port->serial->port[1] || !port->serial->port[1]->interrupt_in_urb) -+ return -ENODEV; -+ - priv = kzalloc(sizeof(*priv), GFP_KERNEL); - if (!priv) - return -ENOMEM; --- -2.1.4 diff --git a/freed-ora/current/f23/patch-4.4-gnu-4.4.6-gnu.xz.sign b/freed-ora/current/f23/patch-4.4-gnu-4.4.6-gnu.xz.sign deleted file mode 100644 index ba7483893..000000000 --- a/freed-ora/current/f23/patch-4.4-gnu-4.4.6-gnu.xz.sign +++ /dev/null @@ -1,7 +0,0 @@ ------BEGIN PGP SIGNATURE----- -Version: GnuPG v2 - -iEYEABECAAYFAlbrHfoACgkQvLfPh359R6cADgCfVaNk0iUSn4hASJqxOBo6Ltjb -2MMAoJ/3/d6YRxfkGIeROHlBQLWhv+6y -=rn1y ------END PGP SIGNATURE----- diff --git a/freed-ora/current/f23/patch-4.4-gnu-4.4.7-gnu.xz.sign b/freed-ora/current/f23/patch-4.4-gnu-4.4.7-gnu.xz.sign new file mode 100644 index 000000000..d0e6050ae --- /dev/null +++ b/freed-ora/current/f23/patch-4.4-gnu-4.4.7-gnu.xz.sign @@ -0,0 +1,7 @@ +-----BEGIN PGP SIGNATURE----- +Version: GnuPG v2 + +iEYEABECAAYFAlcNsGEACgkQvLfPh359R6c9cwCfSdOaJ1+mC8Nu/wG+I0EXvpH0 +k60AoIJSLJ1ArfscPS54tiRBbPLgUPFK +=Lbgj +-----END PGP SIGNATURE----- diff --git a/freed-ora/current/f23/sources b/freed-ora/current/f23/sources index ec748b0b0..5121999be 100644 --- a/freed-ora/current/f23/sources +++ b/freed-ora/current/f23/sources @@ -1,3 +1,3 @@ 5f34e3272b5229cd1868113e321267bd linux-libre-4.4-gnu.tar.xz dcbc8fe378a676d5d0dd208cf524e144 perf-man-4.4.tar.gz -9814d68c54f8e40660c8cbae1ae1fc7a patch-4.4-gnu-4.4.6-gnu.xz +3593290a9fe1be0c59b399b3c2c1f75a patch-4.4-gnu-4.4.7-gnu.xz diff --git a/freed-ora/current/f23/thermal-fix.patch b/freed-ora/current/f23/thermal-fix.patch deleted file mode 100644 index bca27cfbe..000000000 --- a/freed-ora/current/f23/thermal-fix.patch +++ /dev/null @@ -1,77 +0,0 @@ -From 81ad4276b505e987dd8ebbdf63605f92cd172b52 Mon Sep 17 00:00:00 2001 -From: Zhang Rui <rui.zhang@intel.com> -Date: Fri, 18 Mar 2016 10:03:24 +0800 -Subject: [PATCH] Thermal: Ignore invalid trip points - -In some cases, platform thermal driver may report invalid trip points, -thermal core should not take any action for these trip points. - -CC: <stable@vger.kernel.org> #3.18+ -Link: https://bugzilla.redhat.com/show_bug.cgi?id=1317190 -Link: https://bugzilla.kernel.org/show_bug.cgi?id=114551 -Signed-off-by: Zhang Rui <rui.zhang@intel.com> ---- - drivers/thermal/thermal_core.c | 13 ++++++++++++- - include/linux/thermal.h | 2 ++ - 2 files changed, 14 insertions(+), 1 deletion(-) - -diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c -index a0a8fd1..d4b5465 100644 ---- a/drivers/thermal/thermal_core.c -+++ b/drivers/thermal/thermal_core.c -@@ -454,6 +454,10 @@ static void handle_thermal_trip(struct thermal_zone_device *tz, int trip) - { - enum thermal_trip_type type; - -+ /* Ignore disabled trip points */ -+ if (test_bit(trip, &tz->trips_disabled)) -+ return; -+ - tz->ops->get_trip_type(tz, trip, &type); - - if (type == THERMAL_TRIP_CRITICAL || type == THERMAL_TRIP_HOT) -@@ -1800,6 +1804,7 @@ struct thermal_zone_device *thermal_zone_device_register(const char *type, - { - struct thermal_zone_device *tz; - enum thermal_trip_type trip_type; -+ int trip_temp; - int result; - int count; - int passive = 0; -@@ -1871,9 +1876,15 @@ struct thermal_zone_device *thermal_zone_device_register(const char *type, - goto unregister; - - for (count = 0; count < trips; count++) { -- tz->ops->get_trip_type(tz, count, &trip_type); -+ if (tz->ops->get_trip_type(tz, count, &trip_type)) -+ set_bit(count, &tz->trips_disabled); - if (trip_type == THERMAL_TRIP_PASSIVE) - passive = 1; -+ if (tz->ops->get_trip_temp(tz, count, &trip_temp)) -+ set_bit(count, &tz->trips_disabled); -+ /* Check for bogus trip points */ -+ if (trip_temp == 0) -+ set_bit(count, &tz->trips_disabled); - } - - if (!passive) { -diff --git a/include/linux/thermal.h b/include/linux/thermal.h -index 9c48199..a55d052 100644 ---- a/include/linux/thermal.h -+++ b/include/linux/thermal.h -@@ -156,6 +156,7 @@ struct thermal_attr { - * @trip_hyst_attrs: attributes for trip points for sysfs: trip hysteresis - * @devdata: private pointer for device private data - * @trips: number of trip points the thermal zone supports -+ * @trips_disabled; bitmap for disabled trips - * @passive_delay: number of milliseconds to wait between polls when - * performing passive cooling. - * @polling_delay: number of milliseconds to wait between polls when -@@ -191,6 +192,7 @@ struct thermal_zone_device { - struct thermal_attr *trip_hyst_attrs; - void *devdata; - int trips; -+ unsigned long trips_disabled; /* bitmap for disabled trips */ - int passive_delay; - int polling_delay; - int temperature; diff --git a/freed-ora/current/f23/usb_driver_claim_interface-add-sanity-checking.patch b/freed-ora/current/f23/usb_driver_claim_interface-add-sanity-checking.patch deleted file mode 100644 index 079ff03fd..000000000 --- a/freed-ora/current/f23/usb_driver_claim_interface-add-sanity-checking.patch +++ /dev/null @@ -1,39 +0,0 @@ -From de0784bdf6314b70c69416d8c576eb83237d5b1e Mon Sep 17 00:00:00 2001 -From: Oliver Neukum <oneukum@suse.com> -Date: Wed, 16 Mar 2016 12:26:17 -0400 -Subject: [PATCH] usb_driver_claim_interface: add sanity checking - -Attacks that trick drivers into passing a NULL pointer -to usb_driver_claim_interface() using forged descriptors are -known. This thwarts them by sanity checking. - -Signed-off-by: Oliver Neukum <ONeukum@suse.com> -CC: stable@vger.kernel.org ---- - drivers/usb/core/driver.c | 6 +++++- - 1 file changed, 5 insertions(+), 1 deletion(-) - -diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c -index 6b5063e7943f..e2d242b68d4b 100644 ---- a/drivers/usb/core/driver.c -+++ b/drivers/usb/core/driver.c -@@ -500,11 +500,15 @@ static int usb_unbind_interface(struct device *dev) - int usb_driver_claim_interface(struct usb_driver *driver, - struct usb_interface *iface, void *priv) - { -- struct device *dev = &iface->dev; -+ struct device *dev; - struct usb_device *udev; - int retval = 0; - int lpm_disable_error; - -+ if (!iface) -+ return -ENODEV; -+ -+ dev = &iface->dev; - if (dev->driver) - return -EBUSY; - --- -2.5.0 - diff --git a/freed-ora/current/f23/usbnet-cleanup-after-bind-in-probe.patch b/freed-ora/current/f23/usbnet-cleanup-after-bind-in-probe.patch new file mode 100644 index 000000000..dc231a943 --- /dev/null +++ b/freed-ora/current/f23/usbnet-cleanup-after-bind-in-probe.patch @@ -0,0 +1,39 @@ +From 1666984c8625b3db19a9abc298931d35ab7bc64b Mon Sep 17 00:00:00 2001 +From: Oliver Neukum <oneukum@suse.com> +Date: Mon, 7 Mar 2016 11:31:10 +0100 +Subject: [PATCH] usbnet: cleanup after bind() in probe() + +In case bind() works, but a later error forces bailing +in probe() in error cases work and a timer may be scheduled. +They must be killed. This fixes an error case related to +the double free reported in +http://www.spinics.net/lists/netdev/msg367669.html +and needs to go on top of Linus' fix to cdc-ncm. + +Signed-off-by: Oliver Neukum <ONeukum@suse.com> +Signed-off-by: David S. Miller <davem@davemloft.net> +--- + drivers/net/usb/usbnet.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c +index 0b0ba7ef14e4..10798128c03f 100644 +--- a/drivers/net/usb/usbnet.c ++++ b/drivers/net/usb/usbnet.c +@@ -1769,6 +1769,13 @@ out3: + if (info->unbind) + info->unbind (dev, udev); + out1: ++ /* subdrivers must undo all they did in bind() if they ++ * fail it, but we may fail later and a deferred kevent ++ * may trigger an error resubmitting itself and, worse, ++ * schedule a timer. So we kill it all just in case. ++ */ ++ cancel_work_sync(&dev->kevent); ++ del_timer_sync(&dev->delay); + free_netdev(net); + out: + return status; +-- +2.5.5 + diff --git a/freed-ora/current/f23/x86-Lock-down-IO-port-access-when-module-security-is.patch b/freed-ora/current/f23/x86-Lock-down-IO-port-access-when-module-security-is.patch index 708006c2e..185b1da99 100644 --- a/freed-ora/current/f23/x86-Lock-down-IO-port-access-when-module-security-is.patch +++ b/freed-ora/current/f23/x86-Lock-down-IO-port-access-when-module-security-is.patch @@ -1,8 +1,7 @@ -From 7a3cdd26e6d38031338a6cb591ec2f3faaa9234b Mon Sep 17 00:00:00 2001 +From 8010b5eb4680df797575e6306d4d891200e303ab Mon Sep 17 00:00:00 2001 From: Matthew Garrett <matthew.garrett@nebula.com> Date: Thu, 8 Mar 2012 10:35:59 -0500 -Subject: [PATCH 03/20] x86: Lock down IO port access when module security is - enabled +Subject: [PATCH] x86: Lock down IO port access when module security is enabled IO port access would permit users to gain access to PCI configuration registers, which in turn (on a lot of hardware) give access to MMIO register @@ -16,7 +15,7 @@ Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com> 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/arch/x86/kernel/ioport.c b/arch/x86/kernel/ioport.c -index 37dae792dbbe..1ecc03ca3c15 100644 +index 589b3193f102..ab8372443efb 100644 --- a/arch/x86/kernel/ioport.c +++ b/arch/x86/kernel/ioport.c @@ -15,6 +15,7 @@ @@ -36,7 +35,7 @@ index 37dae792dbbe..1ecc03ca3c15 100644 return -EPERM; /* -@@ -103,7 +104,7 @@ SYSCALL_DEFINE1(iopl, unsigned int, level) +@@ -108,7 +109,7 @@ SYSCALL_DEFINE1(iopl, unsigned int, level) return -EINVAL; /* Trying to gain more privileges? */ if (level > old) { @@ -44,9 +43,9 @@ index 37dae792dbbe..1ecc03ca3c15 100644 + if (!capable(CAP_SYS_RAWIO) || secure_modules()) return -EPERM; } - regs->flags = (regs->flags & ~X86_EFLAGS_IOPL) | (level << 12); + regs->flags = (regs->flags & ~X86_EFLAGS_IOPL) | diff --git a/drivers/char/mem.c b/drivers/char/mem.c -index 6b1721f978c2..53fe675f9bd7 100644 +index 71025c2f6bbb..86e5bfa91563 100644 --- a/drivers/char/mem.c +++ b/drivers/char/mem.c @@ -27,6 +27,7 @@ @@ -68,5 +67,5 @@ index 6b1721f978c2..53fe675f9bd7 100644 return -EFAULT; while (count-- > 0 && i < 65536) { -- -2.4.3 +2.5.5 diff --git a/freed-ora/current/f23/x86-iopl-64-Properly-context-switch-IOPL-on-Xen-PV.patch b/freed-ora/current/f23/x86-iopl-64-Properly-context-switch-IOPL-on-Xen-PV.patch deleted file mode 100644 index 38f7bfbb0..000000000 --- a/freed-ora/current/f23/x86-iopl-64-Properly-context-switch-IOPL-on-Xen-PV.patch +++ /dev/null @@ -1,96 +0,0 @@ -From b7a584598aea7ca73140cb87b40319944dd3393f Mon Sep 17 00:00:00 2001 -From: Andy Lutomirski <luto@kernel.org> -Date: Wed, 16 Mar 2016 14:14:21 -0700 -Subject: [PATCH] x86/iopl/64: Properly context-switch IOPL on Xen PV - -On Xen PV, regs->flags doesn't reliably reflect IOPL and the -exit-to-userspace code doesn't change IOPL. We need to context -switch it manually. - -I'm doing this without going through paravirt because this is -specific to Xen PV. After the dust settles, we can merge this with -the 32-bit code, tidy up the iopl syscall implementation, and remove -the set_iopl pvop entirely. - -Fixes XSA-171. - -Reviewewd-by: Jan Beulich <JBeulich@suse.com> -Signed-off-by: Andy Lutomirski <luto@kernel.org> -Cc: Andrew Cooper <andrew.cooper3@citrix.com> -Cc: Andy Lutomirski <luto@amacapital.net> -Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com> -Cc: Borislav Petkov <bp@alien8.de> -Cc: Brian Gerst <brgerst@gmail.com> -Cc: David Vrabel <david.vrabel@citrix.com> -Cc: Denys Vlasenko <dvlasenk@redhat.com> -Cc: H. Peter Anvin <hpa@zytor.com> -Cc: Jan Beulich <JBeulich@suse.com> -Cc: Linus Torvalds <torvalds@linux-foundation.org> -Cc: Peter Zijlstra <peterz@infradead.org> -Cc: Thomas Gleixner <tglx@linutronix.de> -Cc: stable@vger.kernel.org -Link: http://lkml.kernel.org/r/693c3bd7aeb4d3c27c92c622b7d0f554a458173c.1458162709.git.luto@kernel.org -Signed-off-by: Ingo Molnar <mingo@kernel.org> ---- - arch/x86/include/asm/xen/hypervisor.h | 2 ++ - arch/x86/kernel/process_64.c | 12 ++++++++++++ - arch/x86/xen/enlighten.c | 2 +- - 3 files changed, 15 insertions(+), 1 deletion(-) - -diff --git a/arch/x86/include/asm/xen/hypervisor.h b/arch/x86/include/asm/xen/hypervisor.h -index 8b2d4bea9962..39171b3646bb 100644 ---- a/arch/x86/include/asm/xen/hypervisor.h -+++ b/arch/x86/include/asm/xen/hypervisor.h -@@ -62,4 +62,6 @@ void xen_arch_register_cpu(int num); - void xen_arch_unregister_cpu(int num); - #endif - -+extern void xen_set_iopl_mask(unsigned mask); -+ - #endif /* _ASM_X86_XEN_HYPERVISOR_H */ -diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c -index b9d99e0f82c4..9f751876066f 100644 ---- a/arch/x86/kernel/process_64.c -+++ b/arch/x86/kernel/process_64.c -@@ -48,6 +48,7 @@ - #include <asm/syscalls.h> - #include <asm/debugreg.h> - #include <asm/switch_to.h> -+#include <asm/xen/hypervisor.h> - - asmlinkage extern void ret_from_fork(void); - -@@ -411,6 +412,17 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p) - task_thread_info(prev_p)->flags & _TIF_WORK_CTXSW_PREV)) - __switch_to_xtra(prev_p, next_p, tss); - -+#ifdef CONFIG_XEN -+ /* -+ * On Xen PV, IOPL bits in pt_regs->flags have no effect, and -+ * current_pt_regs()->flags may not match the current task's -+ * intended IOPL. We need to switch it manually. -+ */ -+ if (unlikely(static_cpu_has(X86_FEATURE_XENPV) && -+ prev->iopl != next->iopl)) -+ xen_set_iopl_mask(next->iopl); -+#endif -+ - if (static_cpu_has_bug(X86_BUG_SYSRET_SS_ATTRS)) { - /* - * AMD CPUs have a misfeature: SYSRET sets the SS selector but -diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c -index 2c261082eadf..8381fb990c7f 100644 ---- a/arch/x86/xen/enlighten.c -+++ b/arch/x86/xen/enlighten.c -@@ -961,7 +961,7 @@ static void xen_load_sp0(struct tss_struct *tss, - tss->x86_tss.sp0 = thread->sp0; - } - --static void xen_set_iopl_mask(unsigned mask) -+void xen_set_iopl_mask(unsigned mask) - { - struct physdev_set_iopl set_iopl; - --- -2.5.5 - diff --git a/freed-ora/current/f23/x86-mm-32-Enable-full-randomization-on-i386-and-X86_.patch b/freed-ora/current/f23/x86-mm-32-Enable-full-randomization-on-i386-and-X86_.patch new file mode 100644 index 000000000..0776982c1 --- /dev/null +++ b/freed-ora/current/f23/x86-mm-32-Enable-full-randomization-on-i386-and-X86_.patch @@ -0,0 +1,83 @@ +From 8b8addf891de8a00e4d39fc32f93f7c5eb8feceb Mon Sep 17 00:00:00 2001 +From: Hector Marco-Gisbert <hecmargi@upv.es> +Date: Thu, 10 Mar 2016 20:51:00 +0100 +Subject: [PATCH] x86/mm/32: Enable full randomization on i386 and X86_32 + +Currently on i386 and on X86_64 when emulating X86_32 in legacy mode, only +the stack and the executable are randomized but not other mmapped files +(libraries, vDSO, etc.). This patch enables randomization for the +libraries, vDSO and mmap requests on i386 and in X86_32 in legacy mode. + +By default on i386 there are 8 bits for the randomization of the libraries, +vDSO and mmaps which only uses 1MB of VA. + +This patch preserves the original randomness, using 1MB of VA out of 3GB or +4GB. We think that 1MB out of 3GB is not a big cost for having the ASLR. + +The first obvious security benefit is that all objects are randomized (not +only the stack and the executable) in legacy mode which highly increases +the ASLR effectiveness, otherwise the attackers may use these +non-randomized areas. But also sensitive setuid/setgid applications are +more secure because currently, attackers can disable the randomization of +these applications by setting the ulimit stack to "unlimited". This is a +very old and widely known trick to disable the ASLR in i386 which has been +allowed for too long. + +Another trick used to disable the ASLR was to set the ADDR_NO_RANDOMIZE +personality flag, but fortunately this doesn't work on setuid/setgid +applications because there is security checks which clear Security-relevant +flags. + +This patch always randomizes the mmap_legacy_base address, removing the +possibility to disable the ASLR by setting the stack to "unlimited". + +Signed-off-by: Hector Marco-Gisbert <hecmargi@upv.es> +Acked-by: Ismael Ripoll Ripoll <iripoll@upv.es> +Acked-by: Kees Cook <keescook@chromium.org> +Acked-by: Arjan van de Ven <arjan@linux.intel.com> +Cc: Linus Torvalds <torvalds@linux-foundation.org> +Cc: Peter Zijlstra <peterz@infradead.org> +Cc: Thomas Gleixner <tglx@linutronix.de> +Cc: akpm@linux-foundation.org +Cc: kees Cook <keescook@chromium.org> +Link: http://lkml.kernel.org/r/1457639460-5242-1-git-send-email-hecmargi@upv.es +Signed-off-by: Ingo Molnar <mingo@kernel.org> +--- + arch/x86/mm/mmap.c | 14 +------------- + 1 file changed, 1 insertion(+), 13 deletions(-) + +diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c +index 96bd1e2..389939f 100644 +--- a/arch/x86/mm/mmap.c ++++ b/arch/x86/mm/mmap.c +@@ -94,18 +94,6 @@ static unsigned long mmap_base(unsigned long rnd) + } + + /* +- * Bottom-up (legacy) layout on X86_32 did not support randomization, X86_64 +- * does, but not when emulating X86_32 +- */ +-static unsigned long mmap_legacy_base(unsigned long rnd) +-{ +- if (mmap_is_ia32()) +- return TASK_UNMAPPED_BASE; +- else +- return TASK_UNMAPPED_BASE + rnd; +-} +- +-/* + * This function, called very early during the creation of a new + * process VM image, sets up which VM layout function to use: + */ +@@ -116,7 +104,7 @@ void arch_pick_mmap_layout(struct mm_struct *mm) + if (current->flags & PF_RANDOMIZE) + random_factor = arch_mmap_rnd(); + +- mm->mmap_legacy_base = mmap_legacy_base(random_factor); ++ mm->mmap_legacy_base = TASK_UNMAPPED_BASE + random_factor; + + if (mmap_is_legacy()) { + mm->mmap_base = mm->mmap_legacy_base; +-- +2.7.3 + |
