diff --git a/0001-xhci-Add-spurious-wakeup-quirk-for-LynxPoint-LP-cont.patch b/0001-xhci-Add-spurious-wakeup-quirk-for-LynxPoint-LP-cont.patch deleted file mode 100644 index 884f685..0000000 --- a/0001-xhci-Add-spurious-wakeup-quirk-for-LynxPoint-LP-cont.patch +++ /dev/null @@ -1,61 +0,0 @@ -From fd7cd061adcf5f7503515ba52b6a724642a839c8 Mon Sep 17 00:00:00 2001 -From: Laura Abbott -Date: Mon, 12 Oct 2015 11:30:13 +0300 -Subject: [PATCH] xhci: Add spurious wakeup quirk for LynxPoint-LP controllers - -We received several reports of systems rebooting and powering on -after an attempted shutdown. Testing showed that setting -XHCI_SPURIOUS_WAKEUP quirk in addition to the XHCI_SPURIOUS_REBOOT -quirk allowed the system to shutdown as expected for LynxPoint-LP -xHCI controllers. Set the quirk back. - -Note that the quirk was originally introduced for LynxPoint and -LynxPoint-LP just for this same reason. See: - -commit 638298dc66ea ("xhci: Fix spurious wakeups after S5 on Haswell") - -It was later limited to only concern HP machines as it caused -regression on some machines, see both bug and commit: - -Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=66171 -commit 6962d914f317 ("xhci: Limit the spurious wakeup fix only to HP machines") - -Later it was discovered that the powering on after shutdown -was limited to LynxPoint-LP (Haswell-ULT) and that some non-LP HP -machine suffered from spontaneous resume from S3 (which should -not be related to the SPURIOUS_WAKEUP quirk at all). An attempt -to fix this then removed the SPURIOUS_WAKEUP flag usage completely. - -commit b45abacde3d5 ("xhci: no switching back on non-ULT Haswell") - -Current understanding is that LynxPoint-LP (Haswell ULT) machines -need the SPURIOUS_WAKEUP quirk, otherwise they will restart, and -plain Lynxpoint (Haswell) machines may _not_ have the quirk -set otherwise they again will restart. - -Signed-off-by: Laura Abbott -Cc: Takashi Iwai -Cc: Oliver Neukum -[Added more history to commit message -Mathias] -Cc: stable -Signed-off-by: Mathias Nyman -Signed-off-by: Greg Kroah-Hartman ---- - drivers/usb/host/xhci-pci.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c -index c79d336..c47d3e4 100644 ---- a/drivers/usb/host/xhci-pci.c -+++ b/drivers/usb/host/xhci-pci.c -@@ -147,6 +147,7 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) - if (pdev->vendor == PCI_VENDOR_ID_INTEL && - pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI) { - xhci->quirks |= XHCI_SPURIOUS_REBOOT; -+ xhci->quirks |= XHCI_SPURIOUS_WAKEUP; - } - if (pdev->vendor == PCI_VENDOR_ID_INTEL && - (pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI || --- -2.4.3 - diff --git a/drm-radeon-fix-dpms-when-driver-backlight-control-is.patch b/drm-radeon-fix-dpms-when-driver-backlight-control-is.patch deleted file mode 100644 index ab75971..0000000 --- a/drm-radeon-fix-dpms-when-driver-backlight-control-is.patch +++ /dev/null @@ -1,62 +0,0 @@ -From ae93580ee59c02395c1711d3e6b90546b8137b86 Mon Sep 17 00:00:00 2001 -From: Alex Deucher -Date: Tue, 27 Oct 2015 10:56:44 -0400 -Subject: [PATCH 2/2] drm/radeon: fix dpms when driver backlight control is - disabled -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -If driver backlight control is disabled, either by driver -parameter or default per-asic setting, revert to the old behavior. - -Fixes a regression in commit: -4281f46ef839050d2ef60348f661eb463c21cc2e - -Reviewed-by: Michel Dänzer -Signed-off-by: Alex Deucher -Cc: stable@vger.kernel.org ---- - drivers/gpu/drm/radeon/atombios_encoders.c | 18 ++++++++++++++---- - 1 file changed, 14 insertions(+), 4 deletions(-) - -diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c -index 933fd1bc849b..bb292143997e 100644 ---- a/drivers/gpu/drm/radeon/atombios_encoders.c -+++ b/drivers/gpu/drm/radeon/atombios_encoders.c -@@ -1625,9 +1625,14 @@ radeon_atom_encoder_dpms_avivo(struct drm_encoder *encoder, int mode) - } else - atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); - if (radeon_encoder->devices & (ATOM_DEVICE_LCD_SUPPORT)) { -- struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv; -+ if (rdev->mode_info.bl_encoder) { -+ struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv; - -- atombios_set_backlight_level(radeon_encoder, dig->backlight_level); -+ atombios_set_backlight_level(radeon_encoder, dig->backlight_level); -+ } else { -+ args.ucAction = ATOM_LCD_BLON; -+ atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); -+ } - } - break; - case DRM_MODE_DPMS_STANDBY: -@@ -1707,8 +1712,13 @@ radeon_atom_encoder_dpms_dig(struct drm_encoder *encoder, int mode) - if (ASIC_IS_DCE4(rdev)) - atombios_dig_encoder_setup(encoder, ATOM_ENCODER_CMD_DP_VIDEO_ON, 0); - } -- if (radeon_encoder->devices & (ATOM_DEVICE_LCD_SUPPORT)) -- atombios_set_backlight_level(radeon_encoder, dig->backlight_level); -+ if (radeon_encoder->devices & (ATOM_DEVICE_LCD_SUPPORT)) { -+ if (rdev->mode_info.bl_encoder) -+ atombios_set_backlight_level(radeon_encoder, dig->backlight_level); -+ else -+ atombios_dig_transmitter_setup(encoder, -+ ATOM_TRANSMITTER_ACTION_LCD_BLON, 0, 0); -+ } - if (ext_encoder) - atombios_external_encoder_setup(encoder, ext_encoder, ATOM_ENABLE); - break; --- -2.4.3 - diff --git a/drm-radeon-move-bl-encoder-assignment-into-bl-init.patch b/drm-radeon-move-bl-encoder-assignment-into-bl-init.patch deleted file mode 100644 index b6cc574..0000000 --- a/drm-radeon-move-bl-encoder-assignment-into-bl-init.patch +++ /dev/null @@ -1,59 +0,0 @@ -From 4cee6a9057d5e13911f0cb6e143d11dc1a3245dd Mon Sep 17 00:00:00 2001 -From: Alex Deucher -Date: Wed, 28 Oct 2015 14:26:32 -0400 -Subject: [PATCH 1/2] drm/radeon: move bl encoder assignment into bl init -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -So that the bl encoder will be null if the GPU does not -control the backlight. - -Reviewed-by: Michel Dänzer -Signed-off-by: Alex Deucher -Cc: stable@vger.kernel.org ---- - drivers/gpu/drm/radeon/atombios_encoders.c | 1 + - drivers/gpu/drm/radeon/radeon_encoders.c | 1 - - drivers/gpu/drm/radeon/radeon_legacy_encoders.c | 1 + - 3 files changed, 2 insertions(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c -index 65adb9c72377..933fd1bc849b 100644 ---- a/drivers/gpu/drm/radeon/atombios_encoders.c -+++ b/drivers/gpu/drm/radeon/atombios_encoders.c -@@ -237,6 +237,7 @@ void radeon_atom_backlight_init(struct radeon_encoder *radeon_encoder, - backlight_update_status(bd); - - DRM_INFO("radeon atom DIG backlight initialized\n"); -+ rdev->mode_info.bl_encoder = radeon_encoder; - - return; - -diff --git a/drivers/gpu/drm/radeon/radeon_encoders.c b/drivers/gpu/drm/radeon/radeon_encoders.c -index ef99917f000d..c6ee80216cf4 100644 ---- a/drivers/gpu/drm/radeon/radeon_encoders.c -+++ b/drivers/gpu/drm/radeon/radeon_encoders.c -@@ -194,7 +194,6 @@ static void radeon_encoder_add_backlight(struct radeon_encoder *radeon_encoder, - radeon_atom_backlight_init(radeon_encoder, connector); - else - radeon_legacy_backlight_init(radeon_encoder, connector); -- rdev->mode_info.bl_encoder = radeon_encoder; - } - } - -diff --git a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c -index 45715307db71..30de43366eae 100644 ---- a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c -+++ b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c -@@ -441,6 +441,7 @@ void radeon_legacy_backlight_init(struct radeon_encoder *radeon_encoder, - backlight_update_status(bd); - - DRM_INFO("radeon legacy LVDS backlight initialized\n"); -+ rdev->mode_info.bl_encoder = radeon_encoder; - - return; - --- -2.4.3 - diff --git a/kernel.spec b/kernel.spec index e6595eb..3cc6d6e 100644 --- a/kernel.spec +++ b/kernel.spec @@ -52,7 +52,7 @@ Summary: The Linux kernel %if 0%{?released_kernel} # Do we have a -stable update to apply? -%define stable_update 5 +%define stable_update 6 # Set rpm version accordingly %if 0%{?stable_update} %define stablerev %{stable_update} @@ -613,25 +613,14 @@ Patch523: RDS-verify-the-underlying-transport-exists-before-cr.patch #CVE-2015-7990 rhbz 1276437 1276438 Patch524: RDS-fix-race-condition-when-sending-a-message-on-unb.patch -#rhbz 1265978 -Patch536: si2168-Bounds-check-firmware.patch -Patch537: si2157-Bounds-check-firmware.patch - #rhbz 1272172 Patch540: 0001-KEYS-Fix-crash-when-attempt-to-garbage-collect-an-un.patch Patch541: 0002-KEYS-Don-t-permit-request_key-to-construct-a-new-key.patch -#rhbz 1257131 -Patch542: 0001-xhci-Add-spurious-wakeup-quirk-for-LynxPoint-LP-cont.patch - #CVE-2015-7799 rhbz 1271134 1271135 Patch543: isdn_ppp-Add-checks-for-allocation-failure-in-isdn_p.patch Patch544: ppp-slip-Validate-VJ-compression-slot-parameters-com.patch -#rhbz 1278407 -Patch545: drm-radeon-move-bl-encoder-assignment-into-bl-init.patch -Patch546: drm-radeon-fix-dpms-when-driver-backlight-control-is.patch - #CVE-2015-5307 rhbz 1277172 1279688 Patch550: KVM-x86-work-around-infinite-loop-in-microcode-when-.patch @@ -2085,6 +2074,9 @@ fi # # %changelog +* Tue Nov 10 2015 Justin M. Forbes - 4.2.6-300 +- Linux v4.2.6 + * Tue Nov 10 2015 Josh Boyer - Fix incorrect size calculations in megaraid with 64K pages (rhbz 1269300) - CVE-2015-8104 kvm: DoS infinite loop in microcode DB exception (rhbz 1278496 1279691) diff --git a/si2157-Bounds-check-firmware.patch b/si2157-Bounds-check-firmware.patch deleted file mode 100644 index 2840061..0000000 --- a/si2157-Bounds-check-firmware.patch +++ /dev/null @@ -1,39 +0,0 @@ -From 526fbce5b0e44c67a97c57656b3be9911f0a9b9b Mon Sep 17 00:00:00 2001 -From: Laura Abbott -Date: Tue, 29 Sep 2015 16:59:20 -0700 -Subject: [PATCH 2/2] si2157: Bounds check firmware -To: Antti Palosaari -To: Mauro Carvalho Chehab -Cc: Olli Salonen -Cc: linux-media@vger.kernel.org -Cc: linux-kernel@vger.kernel.org - -When reading the firmware and sending commands, the length -must be bounds checked to avoid overrunning the size of the command -buffer and smashing the stack if the firmware is not in the -expected format. Add the proper check. - -Cc: stable@kernel.org -Signed-off-by: Laura Abbott ---- - drivers/media/tuners/si2157.c | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/drivers/media/tuners/si2157.c b/drivers/media/tuners/si2157.c -index 5073821..ce157ed 100644 ---- a/drivers/media/tuners/si2157.c -+++ b/drivers/media/tuners/si2157.c -@@ -166,6 +166,10 @@ static int si2157_init(struct dvb_frontend *fe) - - for (remaining = fw->size; remaining > 0; remaining -= 17) { - len = fw->data[fw->size - remaining]; -+ if (len > SI2157_ARGLEN) { -+ dev_err(&client->dev, "Bad firmware length\n"); -+ goto err_release_firmware; -+ } - memcpy(cmd.args, &fw->data[(fw->size - remaining) + 1], len); - cmd.wlen = len; - cmd.rlen = 1; --- -2.4.3 - diff --git a/si2168-Bounds-check-firmware.patch b/si2168-Bounds-check-firmware.patch deleted file mode 100644 index e9c5bcc..0000000 --- a/si2168-Bounds-check-firmware.patch +++ /dev/null @@ -1,50 +0,0 @@ -From 43018528944fa4965a4048fee91d76b47dcaf60e Mon Sep 17 00:00:00 2001 -From: Laura Abbott -Date: Mon, 28 Sep 2015 14:10:34 -0700 -Subject: [PATCH 1/2] si2168: Bounds check firmware -To: Antti Palosaari -To: Mauro Carvalho Chehab -Cc: Olli Salonen -Cc: linux-media@vger.kernel.org -Cc: linux-kernel@vger.kernel.org -Cc: Stuart Auchterlonie - - -When reading the firmware and sending commands, the length must -be bounds checked to avoid overrunning the size of the command -buffer and smashing the stack if the firmware is not in the expected -format: - -si2168 11-0064: found a 'Silicon Labs Si2168-B40' -si2168 11-0064: downloading firmware from file 'dvb-demod-si2168-b40-01.fw' -si2168 11-0064: firmware download failed -95 -Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ffffffffa085708f - -Add the proper check. - -Cc: stable@kernel.org -Reported-by: Stuart Auchterlonie -Reviewed-by: Antti Palosaari -Signed-off-by: Laura Abbott ---- - drivers/media/dvb-frontends/si2168.c | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/drivers/media/dvb-frontends/si2168.c b/drivers/media/dvb-frontends/si2168.c -index 81788c5..821a8f4 100644 ---- a/drivers/media/dvb-frontends/si2168.c -+++ b/drivers/media/dvb-frontends/si2168.c -@@ -502,6 +502,10 @@ static int si2168_init(struct dvb_frontend *fe) - /* firmware is in the new format */ - for (remaining = fw->size; remaining > 0; remaining -= 17) { - len = fw->data[fw->size - remaining]; -+ if (len > SI2168_ARGLEN) { -+ ret = -EINVAL; -+ break; -+ } - memcpy(cmd.args, &fw->data[(fw->size - remaining) + 1], len); - cmd.wlen = len; - cmd.rlen = 1; --- -2.4.3 - diff --git a/sources b/sources index 6a57612..95e48c5 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ 3d5ea06d767e2f35c999eeadafc76523 linux-4.2.tar.xz 4c964bfba54d65b5b54cc898baddecad perf-man-4.2.tar.gz -19e47863ca441b2e11f90f25fb6c41ec patch-4.2.5.xz +408f9975969da326b5804a04dbf0d4de patch-4.2.6.xz