From 69575927cebd0b9f793fc04807c1d1bb6b187d12 Mon Sep 17 00:00:00 2001 From: Justin M. Forbes Date: Oct 10 2014 01:57:39 +0000 Subject: Linux v3.16.5 --- diff --git a/kernel.spec b/kernel.spec index 0a9bd34..4077ff6 100644 --- a/kernel.spec +++ b/kernel.spec @@ -62,7 +62,7 @@ Summary: The Linux kernel # For non-released -rc kernels, this will be appended after the rcX and # gitX tags, so a 3 here would become part of release "0.rcX.gitX.3" # -%global baserelease 201 +%global baserelease 200 %global fedora_build %{baserelease} # base_sublevel is the kernel version we're starting with and patching @@ -74,7 +74,7 @@ Summary: The Linux kernel %if 0%{?released_kernel} # Do we have a -stable update to apply? -%define stable_update 4 +%define stable_update 5 # Is it a -stable RC? %define stable_rc 0 # Set rpm version accordingly @@ -714,9 +714,6 @@ Patch26021: i8042-Also-store-the-aux-firmware-id-in-multi-plexed.patch Patch26022: psmouse-Add-psmouse_matches_pnp_id-helper-function.patch Patch26023: psmouse-Add-support-for-detecting-FocalTech-PS-2-tou.patch -#CVE-2014-6410 rhbz 1141809 1141810 -Patch26026: udf-Avoid-infinite-loop-when-processing-indirect-ICB.patch - #rhbz 1143812 Patch26027: HID-i2c-hid-call-the-hid-driver-s-suspend-and-resume.patch @@ -1407,9 +1404,6 @@ ApplyPatch i8042-Also-store-the-aux-firmware-id-in-multi-plexed.patch ApplyPatch psmouse-Add-psmouse_matches_pnp_id-helper-function.patch ApplyPatch psmouse-Add-support-for-detecting-FocalTech-PS-2-tou.patch -#CVE-2014-6410 rhbz 1141809 1141810 -ApplyPatch udf-Avoid-infinite-loop-when-processing-indirect-ICB.patch - #rhbz 1143812 ApplyPatch HID-i2c-hid-call-the-hid-driver-s-suspend-and-resume.patch @@ -2236,6 +2230,9 @@ fi # ||----w | # || || %changelog +* Thu Oct 09 2014 Justin M. Forbes - 3.16.5-200 +- Linux v3.16.5 + * Tue Oct 07 2014 Josh Boyer - Add patch to fix GFS2 regression (from Bob Peterson) diff --git a/sources b/sources index 1428bde..bc5ff1e 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ 5c569ed649a0c9711879f333e90c5386 linux-3.16.tar.xz 49868ce6467b35cd9ffea1120d129462 perf-man-3.16.tar.gz -38298e5acfdf188e264cc2984e50410c patch-3.16.4.xz +e0f930caadf77bf95ea4c9569dfbfaed patch-3.16.5.xz diff --git a/udf-Avoid-infinite-loop-when-processing-indirect-ICB.patch b/udf-Avoid-infinite-loop-when-processing-indirect-ICB.patch deleted file mode 100644 index a883966..0000000 --- a/udf-Avoid-infinite-loop-when-processing-indirect-ICB.patch +++ /dev/null @@ -1,92 +0,0 @@ -From a45318b5ff8c505afcbf04a1c5fa7dbe426d9588 Mon Sep 17 00:00:00 2001 -From: Jan Kara -Date: Thu, 4 Sep 2014 14:06:55 +0200 -Subject: [PATCH] udf: Avoid infinite loop when processing indirect ICBs - -We did not implement any bound on number of indirect ICBs we follow when -loading inode. Thus corrupted medium could cause kernel to go into an -infinite loop, possibly causing a stack overflow. - -Fix the possible stack overflow by removing recursion from -__udf_read_inode() and limit number of indirect ICBs we follow to avoid -infinite loops. - -Bugzilla: 1141810 -Upstream-status: 3.17 - -Signed-off-by: Jan Kara ---- - fs/udf/inode.c | 35 +++++++++++++++++++++-------------- - 1 file changed, 21 insertions(+), 14 deletions(-) - -diff --git a/fs/udf/inode.c b/fs/udf/inode.c -index 236cd48184c2..a932f7740b51 100644 ---- a/fs/udf/inode.c -+++ b/fs/udf/inode.c -@@ -1271,13 +1271,22 @@ update_time: - return 0; - } - -+/* -+ * Maximum length of linked list formed by ICB hierarchy. The chosen number is -+ * arbitrary - just that we hopefully don't limit any real use of rewritten -+ * inode on write-once media but avoid looping for too long on corrupted media. -+ */ -+#define UDF_MAX_ICB_NESTING 1024 -+ - static void __udf_read_inode(struct inode *inode) - { - struct buffer_head *bh = NULL; - struct fileEntry *fe; - uint16_t ident; - struct udf_inode_info *iinfo = UDF_I(inode); -+ unsigned int indirections = 0; - -+reread: - /* - * Set defaults, but the inode is still incomplete! - * Note: get_new_inode() sets the following on a new inode: -@@ -1314,28 +1323,26 @@ static void __udf_read_inode(struct inode *inode) - ibh = udf_read_ptagged(inode->i_sb, &iinfo->i_location, 1, - &ident); - if (ident == TAG_IDENT_IE && ibh) { -- struct buffer_head *nbh = NULL; - struct kernel_lb_addr loc; - struct indirectEntry *ie; - - ie = (struct indirectEntry *)ibh->b_data; - loc = lelb_to_cpu(ie->indirectICB.extLocation); - -- if (ie->indirectICB.extLength && -- (nbh = udf_read_ptagged(inode->i_sb, &loc, 0, -- &ident))) { -- if (ident == TAG_IDENT_FE || -- ident == TAG_IDENT_EFE) { -- memcpy(&iinfo->i_location, -- &loc, -- sizeof(struct kernel_lb_addr)); -- brelse(bh); -- brelse(ibh); -- brelse(nbh); -- __udf_read_inode(inode); -+ if (ie->indirectICB.extLength) { -+ brelse(bh); -+ brelse(ibh); -+ memcpy(&iinfo->i_location, &loc, -+ sizeof(struct kernel_lb_addr)); -+ if (++indirections > UDF_MAX_ICB_NESTING) { -+ udf_err(inode->i_sb, -+ "too many ICBs in ICB hierarchy" -+ " (max %d supported)\n", -+ UDF_MAX_ICB_NESTING); -+ make_bad_inode(inode); - return; - } -- brelse(nbh); -+ goto reread; - } - } - brelse(ibh); --- -2.1.0 -