Update to 3.9.8
svn path=/dists/sid/linux/; revision=20297
This commit is contained in:
parent
87274a8083
commit
14ff6dca8d
|
@ -1,4 +1,4 @@
|
||||||
linux (3.9.7-1) UNRELEASED; urgency=low
|
linux (3.9.8-1) UNRELEASED; urgency=low
|
||||||
|
|
||||||
* New upstream stable update:
|
* New upstream stable update:
|
||||||
http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.9.7
|
http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.9.7
|
||||||
|
@ -18,11 +18,42 @@ linux (3.9.7-1) UNRELEASED; urgency=low
|
||||||
- USB: pl2303: fix device initialisation at open
|
- USB: pl2303: fix device initialisation at open
|
||||||
- USB: f81232: fix device initialisation at open
|
- USB: f81232: fix device initialisation at open
|
||||||
- USB: spcp8x5: fix device initialisation at open
|
- USB: spcp8x5: fix device initialisation at open
|
||||||
|
* New upstream stable update:
|
||||||
|
http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.9.8
|
||||||
|
- ARM: 7752/1: errata: LoUIS bit field in CLIDR register is incorrect
|
||||||
|
- clk: remove notifier from list before freeing it
|
||||||
|
- [hppa] make interrupt and interruption stack allocation reentrant
|
||||||
|
- ACPI / dock: Take ACPI scan lock in write_undock()
|
||||||
|
- net: fec: fix kernel oops when plug/unplug cable many times
|
||||||
|
- tcp: fix tcp_md5_hash_skb_data()
|
||||||
|
- net/802/mrp: fix lockdep splat
|
||||||
|
- ipv6: fix possible crashes in ip6_cork_release()
|
||||||
|
- r8169: fix offloaded tx checksum for small packets.
|
||||||
|
- xfrm: properly handle invalid states as an error
|
||||||
|
- ip_tunnel: fix kernel panic with icmp_dest_unreach
|
||||||
|
- net: Block MSG_CMSG_COMPAT in send(m)msg and recv(m)msg
|
||||||
|
- net: force a reload of first item in hlist_nulls_for_each_entry_rcu
|
||||||
|
- vhost_net: clear msg.control for non-zerocopy case during tx
|
||||||
|
- net: sctp: fix NULL pointer dereference in socket destruction
|
||||||
|
- team: check return value of team_get_port_by_index_rcu() for NULL
|
||||||
|
- team: move add to port list before port enablement
|
||||||
|
- l2tp: Fix PPP header erasure and memory leak
|
||||||
|
- sctp: fully initialize sctp_outq in sctp_outq_init
|
||||||
|
- macvtap: set transport header before passing skb to lower device
|
||||||
|
- tuntap: set transport header before passing it to kernel
|
||||||
|
- packet: set transport header before doing xmit
|
||||||
|
- netback: set transport header before passing it to kernel
|
||||||
|
- net_sched: better precise estimation on packet length for untrusted
|
||||||
|
packets
|
||||||
|
- firmware loader: fix use-after-free by double abort
|
||||||
|
- target/iscsi: don't corrupt bh_count in iscsit_stop_time2retain_timer()
|
||||||
|
- rbd: use the correct length for format 2 object names
|
||||||
|
- perf: Fix perf mmap bugs
|
||||||
|
- perf: Fix mmap() accounting hole
|
||||||
|
|
||||||
[ Ben Hutchings ]
|
[ Ben Hutchings ]
|
||||||
* yama: Disable ptrace restrictions by default, and change boot message
|
* yama: Disable ptrace restrictions by default, and change boot message
|
||||||
to indicate this (Closes: #712740)
|
to indicate this (Closes: #712740)
|
||||||
* [x86] efi: Fix dummy variable buffer allocation
|
|
||||||
* fanotify: info leak in copy_event_to_user() (CVE-2013-2148)
|
* fanotify: info leak in copy_event_to_user() (CVE-2013-2148)
|
||||||
* drivers/cdrom/cdrom.c: use kzalloc() for failing hardware (CVE-2013-2164)
|
* drivers/cdrom/cdrom.c: use kzalloc() for failing hardware (CVE-2013-2164)
|
||||||
* block: do not pass disk names as format strings (CVE-2013-2851)
|
* block: do not pass disk names as format strings (CVE-2013-2851)
|
||||||
|
|
|
@ -19,7 +19,7 @@ removed in later patches.
|
||||||
|
|
||||||
--- a/drivers/base/firmware_class.c
|
--- a/drivers/base/firmware_class.c
|
||||||
+++ b/drivers/base/firmware_class.c
|
+++ b/drivers/base/firmware_class.c
|
||||||
@@ -604,14 +604,23 @@ static ssize_t firmware_loading_store(st
|
@@ -619,14 +619,23 @@ static ssize_t firmware_loading_store(st
|
||||||
* is completed.
|
* is completed.
|
||||||
* */
|
* */
|
||||||
fw_map_pages_buf(fw_buf);
|
fw_map_pages_buf(fw_buf);
|
||||||
|
@ -45,17 +45,17 @@ removed in later patches.
|
||||||
fw_load_abort(fw_priv);
|
fw_load_abort(fw_priv);
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
@@ -781,6 +790,9 @@ static void firmware_class_timeout_work(
|
@@ -792,6 +801,9 @@ static void firmware_class_timeout_work(
|
||||||
mutex_unlock(&fw_lock);
|
struct firmware_priv, timeout_work.work);
|
||||||
return;
|
|
||||||
}
|
mutex_lock(&fw_lock);
|
||||||
+ dev_err(fw_priv->dev.parent,
|
+ dev_err(fw_priv->dev.parent,
|
||||||
+ "firmware: agent did not handle request for %s\n",
|
+ "firmware: agent did not handle request for %s\n",
|
||||||
+ fw_priv->buf->fw_id);
|
+ fw_priv->buf->fw_id);
|
||||||
fw_load_abort(fw_priv);
|
fw_load_abort(fw_priv);
|
||||||
mutex_unlock(&fw_lock);
|
mutex_unlock(&fw_lock);
|
||||||
}
|
}
|
||||||
@@ -832,25 +844,28 @@ static int _request_firmware_load(struct
|
@@ -843,25 +855,28 @@ static int _request_firmware_load(struct
|
||||||
|
|
||||||
retval = device_add(f_dev);
|
retval = device_add(f_dev);
|
||||||
if (retval) {
|
if (retval) {
|
||||||
|
@ -88,7 +88,7 @@ removed in later patches.
|
||||||
if (timeout != MAX_SCHEDULE_TIMEOUT)
|
if (timeout != MAX_SCHEDULE_TIMEOUT)
|
||||||
schedule_delayed_work(&fw_priv->timeout_work, timeout);
|
schedule_delayed_work(&fw_priv->timeout_work, timeout);
|
||||||
|
|
||||||
@@ -940,7 +955,8 @@ _request_firmware_prepare(struct firmwar
|
@@ -949,7 +964,8 @@ _request_firmware_prepare(struct firmwar
|
||||||
}
|
}
|
||||||
|
|
||||||
if (fw_get_builtin_firmware(firmware, name)) {
|
if (fw_get_builtin_firmware(firmware, name)) {
|
||||||
|
@ -98,7 +98,7 @@ removed in later patches.
|
||||||
return 0; /* assigned */
|
return 0; /* assigned */
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -970,9 +986,16 @@ static int assign_firmware_buf(struct fi
|
@@ -979,9 +995,16 @@ static int assign_firmware_buf(struct fi
|
||||||
struct firmware_buf *buf = fw->priv;
|
struct firmware_buf *buf = fw->priv;
|
||||||
|
|
||||||
mutex_lock(&fw_lock);
|
mutex_lock(&fw_lock);
|
||||||
|
@ -116,7 +116,7 @@ removed in later patches.
|
||||||
}
|
}
|
||||||
|
|
||||||
/*
|
/*
|
||||||
@@ -1021,7 +1044,7 @@ _request_firmware(const struct firmware
|
@@ -1030,7 +1053,7 @@ _request_firmware(const struct firmware
|
||||||
if (nowait) {
|
if (nowait) {
|
||||||
timeout = usermodehelper_read_lock_wait(timeout);
|
timeout = usermodehelper_read_lock_wait(timeout);
|
||||||
if (!timeout) {
|
if (!timeout) {
|
||||||
|
@ -125,7 +125,7 @@ removed in later patches.
|
||||||
name);
|
name);
|
||||||
ret = -EBUSY;
|
ret = -EBUSY;
|
||||||
goto out;
|
goto out;
|
||||||
@@ -1047,6 +1070,9 @@ _request_firmware(const struct firmware
|
@@ -1056,6 +1079,9 @@ _request_firmware(const struct firmware
|
||||||
if (ret < 0) {
|
if (ret < 0) {
|
||||||
release_firmware(fw);
|
release_firmware(fw);
|
||||||
fw = NULL;
|
fw = NULL;
|
||||||
|
|
|
@ -1,43 +0,0 @@
|
||||||
From: Ben Hutchings <ben@decadent.org.uk>
|
|
||||||
Date: Sun, 16 Jun 2013 21:27:12 +0100
|
|
||||||
Subject: x86/efi: Fix dummy variable buffer allocation
|
|
||||||
|
|
||||||
commit b8cb62f82103083a6e8fa5470bfe634a2c06514d upstream.
|
|
||||||
|
|
||||||
1. Check for allocation failure
|
|
||||||
2. Clear the buffer contents, as they may actually be written to flash
|
|
||||||
3. Don't leak the buffer
|
|
||||||
|
|
||||||
Compile-tested only.
|
|
||||||
|
|
||||||
[ Tested successfully on my buggy ASUS machine - Matt ]
|
|
||||||
|
|
||||||
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
|
|
||||||
Signed-off-by: Matt Fleming <matt.fleming@intel.com>
|
|
||||||
---
|
|
||||||
arch/x86/platform/efi/efi.c | 7 ++++++-
|
|
||||||
1 file changed, 6 insertions(+), 1 deletion(-)
|
|
||||||
|
|
||||||
--- a/arch/x86/platform/efi/efi.c
|
|
||||||
+++ b/arch/x86/platform/efi/efi.c
|
|
||||||
@@ -1074,7 +1074,10 @@ efi_status_t efi_query_variable_store(u3
|
|
||||||
* that by attempting to use more space than is available.
|
|
||||||
*/
|
|
||||||
unsigned long dummy_size = remaining_size + 1024;
|
|
||||||
- void *dummy = kmalloc(dummy_size, GFP_ATOMIC);
|
|
||||||
+ void *dummy = kzalloc(dummy_size, GFP_ATOMIC);
|
|
||||||
+
|
|
||||||
+ if (!dummy)
|
|
||||||
+ return EFI_OUT_OF_RESOURCES;
|
|
||||||
|
|
||||||
status = efi.set_variable(efi_dummy_name, &EFI_DUMMY_GUID,
|
|
||||||
EFI_VARIABLE_NON_VOLATILE |
|
|
||||||
@@ -1094,6 +1097,8 @@ efi_status_t efi_query_variable_store(u3
|
|
||||||
0, dummy);
|
|
||||||
}
|
|
||||||
|
|
||||||
+ kfree(dummy);
|
|
||||||
+
|
|
||||||
/*
|
|
||||||
* The runtime code may now have triggered a garbage collection
|
|
||||||
* run, so check the variable info again
|
|
|
@ -107,7 +107,6 @@ features/arm/0001-ARM-mvebu-Add-thermal-support-to-Armada-XP-device-tr.patch
|
||||||
bugfix/x86/viafb-autoload-on-olpc-xo1.5-only.patch
|
bugfix/x86/viafb-autoload-on-olpc-xo1.5-only.patch
|
||||||
debian/powerpc-machdep-avoid-abi-change-in-3.9.6.patch
|
debian/powerpc-machdep-avoid-abi-change-in-3.9.6.patch
|
||||||
debian/yama-disable-by-default.patch
|
debian/yama-disable-by-default.patch
|
||||||
bugfix/x86/x86-efi-Fix-dummy-variable-buffer-allocation.patch
|
|
||||||
bugfix/all/fanotify-info-leak-in-copy_event_to_user.patch
|
bugfix/all/fanotify-info-leak-in-copy_event_to_user.patch
|
||||||
bugfix/all/drivers-cdrom-cdrom.c-use-kzalloc-for-failing-hardwa.patch
|
bugfix/all/drivers-cdrom-cdrom.c-use-kzalloc-for-failing-hardwa.patch
|
||||||
bugfix/all/block-do-not-pass-disk-names-as-format-strings.patch
|
bugfix/all/block-do-not-pass-disk-names-as-format-strings.patch
|
||||||
|
|
Loading…
Reference in New Issue