Merge changes from sid up to 3.2.35-1
Exclude RT changes and ABI fudges. Refresh firmware-remove-redundant-log-messages-from-drivers.patch against 3.6, but don't attempt to cover anything new yet. svn path=/dists/trunk/linux/; revision=19603
This commit is contained in:
Ben Hutchings
commit
ef781eb6ee
|
|
@ -0,0 +1,78 @@
|
|||
#!/bin/bash -eu
|
||||
|
||||
if [ $# -ne 2 ]; then
|
||||
echo >&2 "Usage: $0 REPO VERSION"
|
||||
echo >&2 "REPO is the git repository to generate a changelog from"
|
||||
echo >&2 "VERSION is the stable version (without leading v)"
|
||||
exit 2
|
||||
fi
|
||||
|
||||
# Get base version, i.e. the Linus stable release that a version is based on
|
||||
base_version() {
|
||||
local ver
|
||||
ver="${1%-rc*}"
|
||||
case "$ver" in
|
||||
2.6.*.* | [3-9].*.* | ??.*.*)
|
||||
ver="${ver%.*}"
|
||||
;;
|
||||
esac
|
||||
echo "$ver"
|
||||
}
|
||||
|
||||
add_update() {
|
||||
local base update
|
||||
base="$(base_version "$1")"
|
||||
update="${1#$base.}"
|
||||
if [ "$update" = "$1" ]; then
|
||||
update=0
|
||||
fi
|
||||
update="$((update + $2))"
|
||||
if [ $update = 0 ]; then
|
||||
echo "$base"
|
||||
else
|
||||
echo "$base.$update"
|
||||
fi
|
||||
}
|
||||
|
||||
# Get next stable update version
|
||||
next_update() {
|
||||
add_update "$1" 1
|
||||
}
|
||||
|
||||
export GIT_DIR="$1/.git"
|
||||
|
||||
new_ver="$2"
|
||||
cur_pkg_ver="$(dpkg-parsechangelog | sed -n 's/^Version: //p')"
|
||||
cur_ver="${cur_pkg_ver%-*}"
|
||||
|
||||
if [ "$(base_version "$new_ver")" != "$(base_version "$cur_ver")" ]; then
|
||||
echo >&2 "$new_ver is not on the same stable series as $cur_ver"
|
||||
exit 2
|
||||
fi
|
||||
|
||||
case "$cur_pkg_ver" in
|
||||
*~experimental*)
|
||||
new_pkg_ver="$new_ver-1~experimental.1"
|
||||
;;
|
||||
*)
|
||||
new_pkg_ver="$new_ver-1"
|
||||
;;
|
||||
esac
|
||||
|
||||
# dch insists on word-wrapping everything, so just add the URLs initially
|
||||
dch -v "$new_pkg_ver" --preserve --multimaint-merge -D UNRELEASED \
|
||||
--release-heuristic=changelog "$(
|
||||
echo "New upstream stable update: "
|
||||
while [ "v$cur_ver" != "v$new_ver" ]; do
|
||||
cur_ver="$(next_update "$cur_ver")"
|
||||
echo "http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-$cur_ver"
|
||||
done)"
|
||||
|
||||
# Then insert the shortlogs with sed
|
||||
while [ "v$cur_ver" != "v$new_ver" ]; do
|
||||
next_ver="$(next_update "$cur_ver")"
|
||||
sed -i '/ChangeLog-'"${next_ver//./\\.}"'/a\
|
||||
'"$(git log --reverse --pretty=' - %s\' "v$cur_ver..v$next_ver^")"'
|
||||
' debian/changelog
|
||||
cur_ver="$next_ver"
|
||||
done
|
||||
|
|
@ -261,6 +261,140 @@ linux-2.6 (3.3~rc6-1~experimental.1) experimental; urgency=low
|
|||
|
||||
-- Ben Hutchings <ben@decadent.org.uk> Sun, 04 Mar 2012 20:27:42 +0000
|
||||
|
||||
linux (3.2.35-1) unstable; urgency=low
|
||||
|
||||
* New upstream stable update:
|
||||
http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.33
|
||||
- samsung-laptop: don't handle backlight if handled by acpi/video
|
||||
(Closes: #693190)
|
||||
- e1000: fix vlan processing regression (Closes: #690956)
|
||||
- [x86] drm/i915: no lvds quirk for Zotac ZDBOX SD ID12/ID13
|
||||
(Closes: #691122)
|
||||
- au0828: fix case where STREAMOFF being called on stopped stream
|
||||
causes BUG()
|
||||
- net: Fix skb_under_panic oops in neigh_resolve_output
|
||||
- vlan: don't deliver frames for unknown vlans to protocols
|
||||
- RDS: fix rds-ping spinlock recursion
|
||||
- tcp: resets are misrouted
|
||||
- nfsd4: fix nfs4 stateid leak
|
||||
- [arm] vfp: fix saving d16-d31 vfp registers on v6+ kernels
|
||||
- scsi_debug: Fix off-by-one bug when unmapping region
|
||||
- storvsc: Account for in-transit packets in the RESET path
|
||||
- tmpfs,ceph,gfs2,isofs,reiserfs,xfs: fix fh_len checking
|
||||
- ext4: race-condition protection for ext4_convert_unwritten_extents_endio
|
||||
(CVE-2012-4508)
|
||||
- md/raid10: use correct limit variable
|
||||
- net/wireless: ipw2200: Fix panic occurring in ipw_handle_promiscuous_tx()
|
||||
- USB: cdc-acm: fix pipe type of write endpoint
|
||||
- [x86] xen: don't corrupt %eip when returning from a signal handler
|
||||
- sysfs: sysfs_pathname/sysfs_add_one: Use strlcat() instead of strcat()
|
||||
- fs/compat_ioctl.c: VIDEO_SET_SPU_PALETTE missing error check
|
||||
- netfilter: nf_conntrack: fix racy timer handling with reliable events
|
||||
http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.34
|
||||
- x86: Remove the ancient and deprecated disable_hlt() and enable_hlt()
|
||||
facility (Closes: #667501)
|
||||
- ALSA: PCM: Fix some races at disconnection
|
||||
- ALSA: usb-audio: Fix races at disconnection
|
||||
- crypto: cryptd - disable softirqs in cryptd_queue_worker to prevent
|
||||
data corruption
|
||||
- mac80211: Only process mesh config header on frames that RA_MATCH
|
||||
- mac80211: fix SSID copy on IBSS JOIN
|
||||
- mac80211: check management frame header length
|
||||
- mac80211: verify that skb data is present
|
||||
- mac80211: make sure data is accessible in EAPOL check
|
||||
- ath9k: Test for TID only in BlockAcks while checking tx status
|
||||
- nfs: Show original device name verbatim in /proc/*/mount{s,info}
|
||||
(Closes: #669314)
|
||||
- target: Avoid integer overflow in se_dev_align_max_sectors()
|
||||
- hwmon: (w83627ehf) Force initial bank selection
|
||||
- xfs: fix reading of wrapped log data
|
||||
- fanotify: fix missing break
|
||||
- drm/vmwgfx: Fix a case where the code would BUG when trying to pin
|
||||
GMR memory
|
||||
- sctp: fix call to SCTP_CMD_PROCESS_SACK in sctp_cmd_interpreter()
|
||||
- netlink: use kfree_rcu() in netlink_release()
|
||||
- tcp: fix FIONREAD/SIOCINQ
|
||||
- net: fix divide by zero in tcp algorithm illinois (CVE-2012-4565)
|
||||
- af-packet: fix oops when socket is not present
|
||||
- r8169: Fix WoL on RTL8168d/8111d. (Closes: #674154)
|
||||
- sky2: Fix for interrupt handler (Closes: #681280)
|
||||
http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.35
|
||||
- UBIFS: fix mounting problems after power cuts
|
||||
- [s390] gup: add missing TASK_SIZE check to get_user_pages_fast()
|
||||
- [x86] Exclude E820_RESERVED regions and memory holes above 4 GB from
|
||||
direct mapping.
|
||||
- netfilter: Mark SYN/ACK packets as invalid from original direction
|
||||
- netfilter: Validate the sequence number of dataless ACK packets as well
|
||||
- ipv4: avoid undefined behavior in do_ip_setsockopt()
|
||||
- Input: i8042 - also perform controller reset when suspending
|
||||
(Closes: #693934)
|
||||
- brcm80211: smac: only print block-ack timeout message at trace level
|
||||
(Closes: #674430)
|
||||
- GFS2: Test bufdata with buffer locked and gfs2_log_lock held
|
||||
- [x86] mce, therm_throt: Don't report power limit and package level
|
||||
thermal throttle events in mcelog (Closes: #695209)
|
||||
- [hppa] fix virtual aliasing issue in get_shared_area()
|
||||
- xfs: drop buffer io reference when a bad bio is built
|
||||
- reiserfs: Protect reiserfs_quota_{on,write}() with write lock
|
||||
- md: Reassigned the parameters if read_seqretry returned true in func
|
||||
md_is_badblock.
|
||||
- md: Avoid write invalid address if read_seqretry returned true.
|
||||
- [i386] Fix invalid stack address while in softirq
|
||||
- selinux: fix sel_netnode_insert() suspicious rcu dereference
|
||||
- [hppa] fix user-triggerable panic on parisc
|
||||
- block: Don't access request after it might be freed
|
||||
- futex: avoid wake_futex() for a PI futex_q
|
||||
|
||||
[ Ben Hutchings ]
|
||||
* [x86] udeb: Re-add isci to scsi-extra-modules (Closes: #690886;
|
||||
regression of #652897 in version 3.2~rc7-1~experimental.1 due to
|
||||
mis-merge)
|
||||
* udeb: Add missing net drivers:
|
||||
- Add 8021q (Closes: #689159), cxgb4, cxgb4vf, igbvf, ixgbevf, micrel,
|
||||
mlx4_en, pch_gbe, qlge, smsc9420, tehuti, vxge to nic-extra-modules
|
||||
- Add int51x1, smsc75xx, smsc95xx to nic-usb-modules
|
||||
- Add adm8211, at76c50x-usb, b43legacy, iwl4965, libertas_tf_usb,
|
||||
mwifiex_pcie, mwl8k, orinoco_usb, prism2_usb, r8187se, r8192e_pci,
|
||||
r8712u, rtl8192ce (Closes: #686605), rtl8192cu, rtl8192de, rtl8192se
|
||||
vt6656_stage to nic-wireless-modules
|
||||
- Move broadcom to nic-modules, as it may be needed by tg3
|
||||
* udeb: Add bnx2fc, fnic, pmcraid to scsi-extra-modules
|
||||
* udeb: Move rtl8180 to nic-wireless-modules
|
||||
* [x86] asus-laptop: Do not call HWRS on init (Closes: #692436)
|
||||
* [x86] drm/i915: Only kick out vesafb if we takeover the fbcon with KMS
|
||||
(Closes: #686284)
|
||||
* [!x86] radeon: Disable DRM_RADEON_KMS, as this is still not expected to
|
||||
work (Closes: #628972)
|
||||
* radeon: Disable KMS earlier if firmware is not installed (Closes: #607194)
|
||||
* [amd64] linux-image: Include VIA Nano in package description
|
||||
* linux-image-dbg: Change package description to use the phrase
|
||||
'debugging symbols' and correct grammar
|
||||
* usb: Disable UAS; it is known to be broken, and the supported devices
|
||||
can also work with usb-storage
|
||||
* ipv6: Treat ND option 31 as userland (DNSSL support) (Closes: #694522)
|
||||
* rt2x00: Add device IDs 5362, 5392, 539b (Closes: #694312)
|
||||
* udeb: Add pata_piccolo to pata-modules (Closes: #695437)
|
||||
* firmware_class: Log every success and failure against given device
|
||||
* firmware: Remove redundant log messages from drivers
|
||||
* [x86] ACPI / video: ignore BIOS initial backlight value for
|
||||
HP Folio 13-2000 (Closes: #692361)
|
||||
* [x86] KVM: x86: invalid opcode oops on SET_SREGS with OSXSAVE bit set
|
||||
(CVE-2012-4461)
|
||||
* kmod: make __request_module() killable (CVE-2012-4398)
|
||||
* exec: do not leave bprm->interp on stack (CVE-2012-4530)
|
||||
* exec: use -ELOOP for max recursion depth
|
||||
* [rt] Update to 3.2.34-rt51:
|
||||
- hrtimer: Raise softirq if hrtimer irq stalled
|
||||
- rcu: Disable RCU_FAST_NO_HZ on RT
|
||||
- net: netfilter: Serialize xt_write_recseq sections on RT
|
||||
* megaraid_sas: fix memory leak if SGL has zero length entries
|
||||
(Closes: #688198)
|
||||
|
||||
[ Ian Campbell ]
|
||||
* [xen] add support for microcode updating. (Closes: #693053)
|
||||
|
||||
-- Ben Hutchings <ben@decadent.org.uk> Mon, 10 Dec 2012 00:14:55 +0000
|
||||
|
||||
linux (3.2.32-1) unstable; urgency=low
|
||||
|
||||
* New upstream stable update:
|
||||
|
|
|
|||
|
|
@ -14,7 +14,7 @@ configs:
|
|||
|
||||
[amd64_description]
|
||||
hardware: 64-bit PCs
|
||||
hardware-long: PCs with AMD64 or Intel 64 processors
|
||||
hardware-long: PCs with AMD64, Intel 64 or VIA Nano processors
|
||||
parts: xen
|
||||
|
||||
[amd64_image]
|
||||
|
|
|
|||
|
|
@ -391,7 +391,7 @@ CONFIG_DRM_NOUVEAU_BACKLIGHT=y
|
|||
##
|
||||
## file: drivers/gpu/drm/radeon/Kconfig
|
||||
##
|
||||
CONFIG_DRM_RADEON_KMS=y
|
||||
# CONFIG_DRM_RADEON_KMS is not set
|
||||
|
||||
##
|
||||
## file: drivers/gpu/drm/vmwgfx/Kconfig
|
||||
|
|
@ -3172,7 +3172,6 @@ CONFIG_USB_STORAGE_ONETOUCH=m
|
|||
CONFIG_USB_STORAGE_KARMA=m
|
||||
CONFIG_USB_STORAGE_CYPRESS_ATACB=m
|
||||
CONFIG_USB_STORAGE_ENE_UB6250=m
|
||||
CONFIG_USB_UAS=m
|
||||
# CONFIG_USB_LIBUSUAL is not set
|
||||
|
||||
##
|
||||
|
|
|
|||
|
|
@ -48,7 +48,7 @@ flavours:
|
|||
|
||||
[amd64_description]
|
||||
hardware: 64-bit PCs
|
||||
hardware-long: PCs with AMD64 or Intel 64 processors
|
||||
hardware-long: PCs with AMD64, Intel 64 or VIA Nano processors
|
||||
parts: xen
|
||||
|
||||
[amd64_image]
|
||||
|
|
|
|||
|
|
@ -452,6 +452,11 @@ CONFIG_DRM_NOUVEAU_BACKLIGHT=y
|
|||
CONFIG_DRM_I2C_CH7006=m
|
||||
CONFIG_DRM_I2C_SIL164=m
|
||||
|
||||
##
|
||||
## file: drivers/gpu/drm/radeon/Kconfig
|
||||
##
|
||||
CONFIG_DRM_RADEON_KMS=y
|
||||
|
||||
##
|
||||
## file: drivers/gpu/stub/Kconfig
|
||||
##
|
||||
|
|
|
|||
|
|
@ -1,5 +1,3 @@
|
|||
# Note that this is an incomplete list that tries to be a common subset
|
||||
# that is right for most kernels. Suppliment with any others.
|
||||
82596 ?
|
||||
ac3200 ?
|
||||
amd8111e ?
|
||||
|
|
@ -97,13 +95,24 @@ jme ?
|
|||
enic ?
|
||||
be2net ?
|
||||
myri10ge ?
|
||||
sc92031 ?
|
||||
# inet_lro is shared but now only used by myri10ge (and the iw_nes IB driver)
|
||||
inet_lro ?
|
||||
sc92031 ?
|
||||
qlcnic ?
|
||||
bna ?
|
||||
cxgb4 ?
|
||||
cxgb4vf ?
|
||||
igbvf ?
|
||||
ixgbevf ?
|
||||
mlx4_en ?
|
||||
vxge ?
|
||||
pch_gbe ?
|
||||
qlge ?
|
||||
smsc9420 ?
|
||||
tehuti ?
|
||||
|
||||
# phy drivers
|
||||
broadcom ?
|
||||
# broadcom is in nic-modules
|
||||
cicada ?
|
||||
davicom ?
|
||||
et1011c ?
|
||||
|
|
@ -111,6 +120,7 @@ icplus ?
|
|||
lxt ?
|
||||
marvell ?
|
||||
mdio-bitbang ?
|
||||
micrel ?
|
||||
national ?
|
||||
qsemi ?
|
||||
realtek ?
|
||||
|
|
@ -120,3 +130,6 @@ vitesse ?
|
|||
|
||||
# VMWare
|
||||
vmxnet3 ?
|
||||
|
||||
# VLAN
|
||||
8021q
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
# Some very common nic modules.
|
||||
# Some historically common net drivers
|
||||
3c59x
|
||||
8139too
|
||||
e100
|
||||
|
|
@ -9,3 +9,6 @@ tulip
|
|||
winbond-840
|
||||
eth1394 ?
|
||||
xen-netfront ?
|
||||
|
||||
# PHY driver, may be needed by tg3
|
||||
broadcom ?
|
||||
|
|
|
|||
|
|
@ -11,6 +11,8 @@ mcs7830 ?
|
|||
dm9601 ?
|
||||
zd1211rw ?
|
||||
rndis_wlan ?
|
||||
rtl8180 ?
|
||||
rtl8187 ?
|
||||
g_ether ?
|
||||
int51x1 ?
|
||||
smsc75xx ?
|
||||
smsc95xx ?
|
||||
|
|
|
|||
|
|
@ -19,10 +19,9 @@ ath9k_htc ?
|
|||
carl9170 ?
|
||||
iwlwifi ?
|
||||
iwl3945 ?
|
||||
iwl4965 ?
|
||||
b43 ?
|
||||
brcmsmac ?
|
||||
|
||||
# rt2x00 drivers
|
||||
rt2400pci ?
|
||||
rt2500pci ?
|
||||
rt2500usb ?
|
||||
|
|
@ -30,6 +29,23 @@ rt2800pci ?
|
|||
rt2800usb ?
|
||||
rt61pci ?
|
||||
rt73usb ?
|
||||
adm8211 ?
|
||||
at76c50x-usb ?
|
||||
b43legacy ?
|
||||
libertas_tf_usb ?
|
||||
mwifiex_pcie ?
|
||||
mwl8k ?
|
||||
orinoco_usb ?
|
||||
rtl8180 ?
|
||||
rtl8192ce ?
|
||||
rtl8192cu ?
|
||||
rtl8192de ?
|
||||
rtl8192se ?
|
||||
r8187se ?
|
||||
r8192e_pci ?
|
||||
r8712u ?
|
||||
vt6656_stage ?
|
||||
prism2_usb ?
|
||||
|
||||
# lib80211 encryption algorithms
|
||||
lib80211_crypt_wep ?
|
||||
|
|
|
|||
|
|
@ -25,6 +25,7 @@ pata_opti ?
|
|||
pata_optidma ?
|
||||
pata_pdc2027x ?
|
||||
pata_pdc202xx_old ?
|
||||
pata_piccolo ?
|
||||
pata_qdi ?
|
||||
pata_radisys ?
|
||||
pata_rz1000 ?
|
||||
|
|
|
|||
|
|
@ -1,3 +1,4 @@
|
|||
# Some historically common SCSI drivers
|
||||
aic79xx
|
||||
aic7xxx
|
||||
BusLogic ?
|
||||
|
|
|
|||
|
|
@ -35,6 +35,10 @@ hptiop ?
|
|||
qla4xxx ?
|
||||
qla2xxx ?
|
||||
pm8001 ?
|
||||
isci ?
|
||||
bnx2fc ?
|
||||
fnic ?
|
||||
pmcraid ?
|
||||
|
||||
# VMWare
|
||||
vmw_pvscsi ?
|
||||
|
|
|
|||
|
|
@ -14,3 +14,4 @@ prism54 ?
|
|||
p54pci
|
||||
p54usb
|
||||
yellowfin
|
||||
8021q
|
||||
|
|
|
|||
|
|
@ -0,0 +1,115 @@
|
|||
From: Kees Cook <keescook@chromium.org>
|
||||
Date: Thu, 6 Dec 2012 17:00:21 +1100
|
||||
Subject: [1/2] exec: do not leave bprm->interp on stack
|
||||
|
||||
commit 1e1b8374592f5fb347625e84d8a5f2f40d858a24 upstream.
|
||||
|
||||
If a series of scripts are executed, each triggering module loading via
|
||||
unprintable bytes in the script header, kernel stack contents can leak
|
||||
into the command line.
|
||||
|
||||
Normally execution of binfmt_script and binfmt_misc happens recursively.
|
||||
However, when modules are enabled, and unprintable bytes exist in the
|
||||
bprm->buf, execution will restart after attempting to load matching binfmt
|
||||
modules. Unfortunately, the logic in binfmt_script and binfmt_misc does
|
||||
not expect to get restarted. They leave bprm->interp pointing to their
|
||||
local stack. This means on restart bprm->interp is left pointing into
|
||||
unused stack memory which can then be copied into the userspace argv
|
||||
areas.
|
||||
|
||||
After additional study, it seems that both recursion and restart remains
|
||||
the desirable way to handle exec with scripts, misc, and modules. As
|
||||
such, we need to protect the changes to interp.
|
||||
|
||||
This changes the logic to require allocation for any changes to the
|
||||
bprm->interp. To avoid adding a new kmalloc to every exec, the default
|
||||
value is left as-is. Only when passing through binfmt_script or
|
||||
binfmt_misc does an allocation take place.
|
||||
|
||||
For a proof of concept, see DoTest.sh from:
|
||||
http://www.halfdog.net/Security/2012/LinuxKernelBinfmtScriptStackDataDisclosure/
|
||||
|
||||
Signed-off-by: Kees Cook <keescook@chromium.org>
|
||||
Cc: halfdog <me@halfdog.net>
|
||||
Cc: P J P <ppandit@redhat.com>
|
||||
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
|
||||
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
|
||||
---
|
||||
fs/binfmt_misc.c | 5 ++++-
|
||||
fs/binfmt_script.c | 4 +++-
|
||||
fs/exec.c | 15 +++++++++++++++
|
||||
include/linux/binfmts.h | 1 +
|
||||
4 files changed, 23 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/fs/binfmt_misc.c b/fs/binfmt_misc.c
|
||||
index b0b70fb..b0c1755 100644
|
||||
--- a/fs/binfmt_misc.c
|
||||
+++ b/fs/binfmt_misc.c
|
||||
@@ -176,7 +176,10 @@ static int load_misc_binary(struct linux_binprm *bprm)
|
||||
goto _error;
|
||||
bprm->argc ++;
|
||||
|
||||
- bprm->interp = iname; /* for binfmt_script */
|
||||
+ /* Update interp in case binfmt_script needs it. */
|
||||
+ retval = bprm_change_interp(iname, bprm);
|
||||
+ if (retval < 0)
|
||||
+ goto _error;
|
||||
|
||||
interp_file = open_exec (iname);
|
||||
retval = PTR_ERR (interp_file);
|
||||
diff --git a/fs/binfmt_script.c b/fs/binfmt_script.c
|
||||
index 8c95499..4834f2c 100644
|
||||
--- a/fs/binfmt_script.c
|
||||
+++ b/fs/binfmt_script.c
|
||||
@@ -82,7 +82,9 @@ static int load_script(struct linux_binprm *bprm)
|
||||
retval = copy_strings_kernel(1, &i_name, bprm);
|
||||
if (retval) return retval;
|
||||
bprm->argc++;
|
||||
- bprm->interp = interp;
|
||||
+ retval = bprm_change_interp(interp, bprm);
|
||||
+ if (retval < 0)
|
||||
+ return retval;
|
||||
|
||||
/*
|
||||
* OK, now restart the process with the interpreter's dentry.
|
||||
diff --git a/fs/exec.c b/fs/exec.c
|
||||
index b71b08c..bf50973 100644
|
||||
--- a/fs/exec.c
|
||||
+++ b/fs/exec.c
|
||||
@@ -1175,9 +1175,24 @@ void free_bprm(struct linux_binprm *bprm)
|
||||
mutex_unlock(¤t->signal->cred_guard_mutex);
|
||||
abort_creds(bprm->cred);
|
||||
}
|
||||
+ /* If a binfmt changed the interp, free it. */
|
||||
+ if (bprm->interp != bprm->filename)
|
||||
+ kfree(bprm->interp);
|
||||
kfree(bprm);
|
||||
}
|
||||
|
||||
+int bprm_change_interp(char *interp, struct linux_binprm *bprm)
|
||||
+{
|
||||
+ /* If a binfmt changed the interp, free it first. */
|
||||
+ if (bprm->interp != bprm->filename)
|
||||
+ kfree(bprm->interp);
|
||||
+ bprm->interp = kstrdup(interp, GFP_KERNEL);
|
||||
+ if (!bprm->interp)
|
||||
+ return -ENOMEM;
|
||||
+ return 0;
|
||||
+}
|
||||
+EXPORT_SYMBOL(bprm_change_interp);
|
||||
+
|
||||
/*
|
||||
* install the new credentials for this executable
|
||||
*/
|
||||
diff --git a/include/linux/binfmts.h b/include/linux/binfmts.h
|
||||
index 2630c9b..7f0e297 100644
|
||||
--- a/include/linux/binfmts.h
|
||||
+++ b/include/linux/binfmts.h
|
||||
@@ -114,6 +114,7 @@ extern int setup_arg_pages(struct linux_binprm * bprm,
|
||||
unsigned long stack_top,
|
||||
int executable_stack);
|
||||
extern int bprm_mm_init(struct linux_binprm *bprm);
|
||||
+extern int bprm_change_interp(char *interp, struct linux_binprm *bprm);
|
||||
extern int copy_strings_kernel(int argc, const char *const *argv,
|
||||
struct linux_binprm *bprm);
|
||||
extern int prepare_bprm_creds(struct linux_binprm *bprm);
|
||||
|
|
@ -0,0 +1,133 @@
|
|||
From: Kees Cook <keescook@chromium.org>
|
||||
Date: Thu, 6 Dec 2012 17:00:21 +1100
|
||||
Subject: [2/2] exec: use -ELOOP for max recursion depth
|
||||
|
||||
commit a4706fd3dc5d23f58da814d03f3ef92fd9a4fc16 upstream.
|
||||
|
||||
To avoid an explosion of request_module calls on a chain of abusive
|
||||
scripts, fail maximum recursion with -ELOOP instead of -ENOEXEC. As soon
|
||||
as maximum recursion depth is hit, the error will fail all the way back
|
||||
up the chain, aborting immediately.
|
||||
|
||||
This also has the side-effect of stopping the user's shell from attempting
|
||||
to reexecute the top-level file as a shell script. As seen in the
|
||||
dash source:
|
||||
|
||||
if (cmd != path_bshell && errno == ENOEXEC) {
|
||||
*argv-- = cmd;
|
||||
*argv = cmd = path_bshell;
|
||||
goto repeat;
|
||||
}
|
||||
|
||||
The above logic was designed for running scripts automatically that lacked
|
||||
the "#!" header, not to re-try failed recursion. On a legitimate -ENOEXEC,
|
||||
things continue to behave as the shell expects.
|
||||
|
||||
Additionally, when tracking recursion, the binfmt handlers should not be
|
||||
involved. The recursion being tracked is the depth of calls through
|
||||
search_binary_handler(), so that function should be exclusively responsible
|
||||
for tracking the depth.
|
||||
|
||||
Signed-off-by: Kees Cook <keescook@chromium.org>
|
||||
Cc: halfdog <me@halfdog.net>
|
||||
Cc: P J P <ppandit@redhat.com>
|
||||
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
|
||||
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
|
||||
[bwh: Backported to 3.6: adjust context]
|
||||
---
|
||||
fs/binfmt_em86.c | 1 -
|
||||
fs/binfmt_misc.c | 6 ------
|
||||
fs/binfmt_script.c | 4 +---
|
||||
fs/exec.c | 10 +++++-----
|
||||
include/linux/binfmts.h | 2 --
|
||||
5 files changed, 6 insertions(+), 17 deletions(-)
|
||||
|
||||
--- a/fs/binfmt_em86.c
|
||||
+++ b/fs/binfmt_em86.c
|
||||
@@ -42,7 +42,6 @@ static int load_em86(struct linux_binprm
|
||||
return -ENOEXEC;
|
||||
}
|
||||
|
||||
- bprm->recursion_depth++; /* Well, the bang-shell is implicit... */
|
||||
allow_write_access(bprm->file);
|
||||
fput(bprm->file);
|
||||
bprm->file = NULL;
|
||||
--- a/fs/binfmt_misc.c
|
||||
+++ b/fs/binfmt_misc.c
|
||||
@@ -117,10 +117,6 @@ static int load_misc_binary(struct linux
|
||||
if (!enabled)
|
||||
goto _ret;
|
||||
|
||||
- retval = -ENOEXEC;
|
||||
- if (bprm->recursion_depth > BINPRM_MAX_RECURSION)
|
||||
- goto _ret;
|
||||
-
|
||||
/* to keep locking time low, we copy the interpreter string */
|
||||
read_lock(&entries_lock);
|
||||
fmt = check_file(bprm);
|
||||
@@ -200,8 +196,6 @@ static int load_misc_binary(struct linux
|
||||
if (retval < 0)
|
||||
goto _error;
|
||||
|
||||
- bprm->recursion_depth++;
|
||||
-
|
||||
retval = search_binary_handler (bprm, regs);
|
||||
if (retval < 0)
|
||||
goto _error;
|
||||
--- a/fs/binfmt_script.c
|
||||
+++ b/fs/binfmt_script.c
|
||||
@@ -22,15 +22,13 @@ static int load_script(struct linux_binp
|
||||
char interp[BINPRM_BUF_SIZE];
|
||||
int retval;
|
||||
|
||||
- if ((bprm->buf[0] != '#') || (bprm->buf[1] != '!') ||
|
||||
- (bprm->recursion_depth > BINPRM_MAX_RECURSION))
|
||||
+ if ((bprm->buf[0] != '#') || (bprm->buf[1] != '!'))
|
||||
return -ENOEXEC;
|
||||
/*
|
||||
* This section does the #! interpretation.
|
||||
* Sorta complicated, but hopefully it will work. -TYT
|
||||
*/
|
||||
|
||||
- bprm->recursion_depth++;
|
||||
allow_write_access(bprm->file);
|
||||
fput(bprm->file);
|
||||
bprm->file = NULL;
|
||||
--- a/fs/exec.c
|
||||
+++ b/fs/exec.c
|
||||
@@ -1398,6 +1398,10 @@ int search_binary_handler(struct linux_b
|
||||
struct linux_binfmt *fmt;
|
||||
pid_t old_pid, old_vpid;
|
||||
|
||||
+ /* This allows 4 levels of binfmt rewrites before failing hard. */
|
||||
+ if (depth > 5)
|
||||
+ return -ELOOP;
|
||||
+
|
||||
retval = security_bprm_check(bprm);
|
||||
if (retval)
|
||||
return retval;
|
||||
@@ -1422,12 +1426,8 @@ int search_binary_handler(struct linux_b
|
||||
if (!try_module_get(fmt->module))
|
||||
continue;
|
||||
read_unlock(&binfmt_lock);
|
||||
+ bprm->recursion_depth = depth + 1;
|
||||
retval = fn(bprm, regs);
|
||||
- /*
|
||||
- * Restore the depth counter to its starting value
|
||||
- * in this call, so we don't have to rely on every
|
||||
- * load_binary function to restore it on return.
|
||||
- */
|
||||
bprm->recursion_depth = depth;
|
||||
if (retval >= 0) {
|
||||
if (depth == 0) {
|
||||
--- a/include/linux/binfmts.h
|
||||
+++ b/include/linux/binfmts.h
|
||||
@@ -68,8 +68,6 @@ struct linux_binprm {
|
||||
#define BINPRM_FLAGS_EXECFD_BIT 1
|
||||
#define BINPRM_FLAGS_EXECFD (1 << BINPRM_FLAGS_EXECFD_BIT)
|
||||
|
||||
-#define BINPRM_MAX_RECURSION 4
|
||||
-
|
||||
/* Function parameter for binfmt->coredump */
|
||||
struct coredump_params {
|
||||
long signr;
|
||||
2897
debian/patches/bugfix/all/firmware-remove-redundant-log-messages-from-drivers.patch
vendored
Normal file
2897
debian/patches/bugfix/all/firmware-remove-redundant-log-messages-from-drivers.patch
vendored
Normal file
File diff suppressed because it is too large
Load Diff
138
debian/patches/bugfix/all/firmware_class-log-every-success-and-failure.patch
vendored
Normal file
138
debian/patches/bugfix/all/firmware_class-log-every-success-and-failure.patch
vendored
Normal file
|
|
@ -0,0 +1,138 @@
|
|||
From: Ben Hutchings <ben@decadent.org.uk>
|
||||
Subject: firmware_class: Log every success and failure against given device
|
||||
Date: Sun, 09 Dec 2012 16:02:00 +0000
|
||||
|
||||
The hundreds of users of request_firmware() have nearly as many
|
||||
different log formats for reporting failures. They also have only the
|
||||
vaguest hint as to what went wrong; only firmware_class really knows
|
||||
that. Therefore, add specific log messages for the failure modes that
|
||||
aren't currently logged.
|
||||
|
||||
In case of a driver that tries multiple names, this may result in the
|
||||
impression that it failed to initialise. Therefore, also log successes.
|
||||
|
||||
Change existing log messages to consistently use the given device, not
|
||||
the temporary child device we create.
|
||||
|
||||
This makes many error messages in drivers redundant, which will be
|
||||
removed in later patches.
|
||||
|
||||
--- a/drivers/base/firmware_class.c
|
||||
+++ b/drivers/base/firmware_class.c
|
||||
@@ -255,7 +255,8 @@ static ssize_t firmware_loading_store(st
|
||||
fw_priv->nr_pages,
|
||||
0, PAGE_KERNEL_RO);
|
||||
if (!fw_priv->fw->data) {
|
||||
- dev_err(dev, "%s: vmap() failed\n", __func__);
|
||||
+ dev_err(dev->parent, "%s: vmap() failed\n",
|
||||
+ __func__);
|
||||
goto err;
|
||||
}
|
||||
/* Pages are now owned by 'struct firmware' */
|
||||
@@ -270,9 +271,14 @@ static ssize_t firmware_loading_store(st
|
||||
}
|
||||
/* fallthrough */
|
||||
default:
|
||||
- dev_err(dev, "%s: unexpected value (%d)\n", __func__, loading);
|
||||
- /* fallthrough */
|
||||
+ dev_err(dev->parent, "%s: unexpected value (%d)\n",
|
||||
+ __func__, loading);
|
||||
+ goto err;
|
||||
case -1:
|
||||
+ dev_err(dev->parent,
|
||||
+ "firmware: agent aborted loading %s (not found?)\n",
|
||||
+ fw_priv->fw_id);
|
||||
+ /* fallthrough */
|
||||
err:
|
||||
fw_load_abort(fw_priv);
|
||||
break;
|
||||
@@ -435,6 +441,9 @@ static void firmware_class_timeout(u_lon
|
||||
{
|
||||
struct firmware_priv *fw_priv = (struct firmware_priv *) data;
|
||||
|
||||
+ dev_err(fw_priv->dev.parent,
|
||||
+ "firmware: agent did not handle request for %s\n",
|
||||
+ fw_priv->fw_id);
|
||||
fw_load_abort(fw_priv);
|
||||
}
|
||||
|
||||
@@ -486,7 +495,8 @@ _request_firmware_prepare(const struct f
|
||||
}
|
||||
|
||||
if (fw_get_builtin_firmware(firmware, name)) {
|
||||
- dev_dbg(device, "firmware: using built-in firmware %s\n", name);
|
||||
+ dev_info(device, "firmware: using built-in firmware %s\n",
|
||||
+ name);
|
||||
return NULL;
|
||||
}
|
||||
|
||||
@@ -517,25 +527,29 @@ static int _request_firmware_load(struct
|
||||
|
||||
retval = device_add(f_dev);
|
||||
if (retval) {
|
||||
- dev_err(f_dev, "%s: device_register failed\n", __func__);
|
||||
+ dev_err(f_dev->parent, "%s: device_register failed\n",
|
||||
+ __func__);
|
||||
goto err_put_dev;
|
||||
}
|
||||
|
||||
retval = device_create_bin_file(f_dev, &firmware_attr_data);
|
||||
if (retval) {
|
||||
- dev_err(f_dev, "%s: sysfs_create_bin_file failed\n", __func__);
|
||||
+ dev_err(f_dev->parent, "%s: sysfs_create_bin_file failed\n",
|
||||
+ __func__);
|
||||
goto err_del_dev;
|
||||
}
|
||||
|
||||
retval = device_create_file(f_dev, &dev_attr_loading);
|
||||
if (retval) {
|
||||
- dev_err(f_dev, "%s: device_create_file failed\n", __func__);
|
||||
+ dev_err(f_dev->parent, "%s: device_create_file failed\n",
|
||||
+ __func__);
|
||||
goto err_del_bin_attr;
|
||||
}
|
||||
|
||||
if (uevent) {
|
||||
dev_set_uevent_suppress(f_dev, false);
|
||||
- dev_dbg(f_dev, "firmware: requesting %s\n", fw_priv->fw_id);
|
||||
+ dev_dbg(f_dev->parent, "firmware: requesting %s\n",
|
||||
+ fw_priv->fw_id);
|
||||
if (timeout != MAX_SCHEDULE_TIMEOUT)
|
||||
mod_timer(&fw_priv->timeout,
|
||||
round_jiffies_up(jiffies + timeout));
|
||||
@@ -549,8 +563,15 @@ static int _request_firmware_load(struct
|
||||
del_timer_sync(&fw_priv->timeout);
|
||||
|
||||
mutex_lock(&fw_lock);
|
||||
- if (!fw_priv->fw->size || test_bit(FW_STATUS_ABORT, &fw_priv->status))
|
||||
+ if (test_bit(FW_STATUS_ABORT, &fw_priv->status)) {
|
||||
+ /* failure has already been logged */
|
||||
+ retval = -ENOENT;
|
||||
+ } else if (!fw_priv->fw->size) {
|
||||
+ dev_err(f_dev->parent,
|
||||
+ "firmware: agent loaded no data for %s (not found?)\n",
|
||||
+ name);
|
||||
retval = -ENOENT;
|
||||
+ }
|
||||
fw_priv->fw = NULL;
|
||||
mutex_unlock(&fw_lock);
|
||||
|
||||
@@ -601,6 +622,9 @@ request_firmware(const struct firmware *
|
||||
}
|
||||
if (ret)
|
||||
_request_firmware_cleanup(firmware_p);
|
||||
+ else
|
||||
+ dev_info(device, "firmware: agent loaded %s into memory\n",
|
||||
+ name);
|
||||
|
||||
return ret;
|
||||
}
|
||||
@@ -650,7 +674,7 @@ static void request_firmware_work_func(s
|
||||
ret = _request_firmware_load(fw_priv, fw_work->uevent, timeout);
|
||||
usermodehelper_read_unlock();
|
||||
} else {
|
||||
- dev_dbg(fw_work->device, "firmware: %s loading timed out\n",
|
||||
+ dev_err(fw_work->device, "firmware: %s loading timed out\n",
|
||||
fw_work->name);
|
||||
ret = -EAGAIN;
|
||||
}
|
||||
39
debian/patches/bugfix/all/megaraid_sas-fix-memory-leak-if-SGL-has-zero-length-entries.patch
vendored
Normal file
39
debian/patches/bugfix/all/megaraid_sas-fix-memory-leak-if-SGL-has-zero-length-entries.patch
vendored
Normal file
|
|
@ -0,0 +1,39 @@
|
|||
From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn@mork.no>
|
||||
Date: Wed, 21 Nov 2012 09:54:48 +0100
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Subject: [PATCH] megaraid_sas: fix memory leak if SGL has zero length entries
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
commit 98cb7e44 ([SCSI] megaraid_sas: Sanity check user
|
||||
supplied length before passing it to dma_alloc_coherent())
|
||||
introduced a memory leak. Memory allocated for entries
|
||||
following zero length SGL entries will not be freed.
|
||||
|
||||
Reference: http://bugs.debian.org/688198
|
||||
Cc: <stable@vger.kernel.org>
|
||||
Signed-off-by: Bjørn Mork <bjorn@mork.no>
|
||||
Acked-by: Adam Radford <aradford@gmail.com>
|
||||
---
|
||||
drivers/scsi/megaraid/megaraid_sas_base.c | 10 ++++++----
|
||||
1 file changed, 6 insertions(+), 4 deletions(-)
|
||||
|
||||
--- a/drivers/scsi/megaraid/megaraid_sas_base.c
|
||||
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
|
||||
@@ -4886,10 +4886,12 @@ megasas_mgmt_fw_ioctl(struct megasas_ins
|
||||
sense, sense_handle);
|
||||
}
|
||||
|
||||
- for (i = 0; i < ioc->sge_count && kbuff_arr[i]; i++) {
|
||||
- dma_free_coherent(&instance->pdev->dev,
|
||||
- kern_sge32[i].length,
|
||||
- kbuff_arr[i], kern_sge32[i].phys_addr);
|
||||
+ for (i = 0; i < ioc->sge_count; i++) {
|
||||
+ if (kbuff_arr[i])
|
||||
+ dma_free_coherent(&instance->pdev->dev,
|
||||
+ kern_sge32[i].length,
|
||||
+ kbuff_arr[i],
|
||||
+ kern_sge32[i].phys_addr);
|
||||
}
|
||||
|
||||
megasas_return_cmd(instance, cmd);
|
||||
49
debian/patches/bugfix/x86/ACPI-video-ignore-BIOS-initial-backlight-value-for-H.patch
vendored
Normal file
49
debian/patches/bugfix/x86/ACPI-video-ignore-BIOS-initial-backlight-value-for-H.patch
vendored
Normal file
|
|
@ -0,0 +1,49 @@
|
|||
From: Zhang Rui <rui.zhang@intel.com>
|
||||
Date: Tue, 4 Dec 2012 23:30:19 +0100
|
||||
Subject: ACPI / video: ignore BIOS initial backlight value for HP Folio
|
||||
13-2000
|
||||
|
||||
commit 129ff8f8d58297b04f47b5d6fad81aa2d08404e1 upstream.
|
||||
|
||||
Or else the laptop will boot with a dimmed screen.
|
||||
|
||||
References: https://bugzilla.kernel.org/show_bug.cgi?id=51141
|
||||
Tested-by: Stefan Nagy <public@stefan-nagy.at>
|
||||
Signed-off-by: Zhang Rui <rui.zhang@intel.com>
|
||||
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
|
||||
---
|
||||
drivers/acpi/video.c | 14 ++++++++++++++
|
||||
1 file changed, 14 insertions(+)
|
||||
|
||||
diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
|
||||
index 0230cb6..ac9a69c 100644
|
||||
--- a/drivers/acpi/video.c
|
||||
+++ b/drivers/acpi/video.c
|
||||
@@ -389,6 +389,12 @@ static int __init video_set_bqc_offset(const struct dmi_system_id *d)
|
||||
return 0;
|
||||
}
|
||||
|
||||
+static int video_ignore_initial_backlight(const struct dmi_system_id *d)
|
||||
+{
|
||||
+ use_bios_initial_backlight = 0;
|
||||
+ return 0;
|
||||
+}
|
||||
+
|
||||
static struct dmi_system_id video_dmi_table[] __initdata = {
|
||||
/*
|
||||
* Broken _BQC workaround http://bugzilla.kernel.org/show_bug.cgi?id=13121
|
||||
@@ -433,6 +439,14 @@ static struct dmi_system_id video_dmi_table[] __initdata = {
|
||||
DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 7720"),
|
||||
},
|
||||
},
|
||||
+ {
|
||||
+ .callback = video_ignore_initial_backlight,
|
||||
+ .ident = "HP Folio 13-2000",
|
||||
+ .matches = {
|
||||
+ DMI_MATCH(DMI_BOARD_VENDOR, "Hewlett-Packard"),
|
||||
+ DMI_MATCH(DMI_PRODUCT_NAME, "HP Folio 13 - 2000 Notebook PC"),
|
||||
+ },
|
||||
+ },
|
||||
{}
|
||||
};
|
||||
|
||||
|
|
@ -0,0 +1,63 @@
|
|||
From: Ben Hutchings <ben@decadent.org.uk>
|
||||
Date: Fri, 9 Nov 2012 02:43:00 +0000
|
||||
Subject: asus-laptop: Do not call HWRS on init
|
||||
|
||||
Since commit 8871e99f89b7 ('asus-laptop: HRWS/HWRS typo'), module
|
||||
initialisation is very slow on the Asus UL30A. The HWRS method takes
|
||||
about 12 seconds to run, and subsequent initialisation also seems to
|
||||
be delayed. Since we don't really need the result, don't bother
|
||||
calling it on init. Those who are curious can still get the result
|
||||
through the 'infos' device attribute.
|
||||
|
||||
Update the comment about HWRS in show_infos().
|
||||
|
||||
Reported-by: ryan <draziw+deb@gmail.com>
|
||||
References: http://bugs.debian.org/692436
|
||||
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
|
||||
---
|
||||
drivers/platform/x86/asus-laptop.c | 17 ++++-------------
|
||||
1 file changed, 4 insertions(+), 13 deletions(-)
|
||||
|
||||
diff --git a/drivers/platform/x86/asus-laptop.c b/drivers/platform/x86/asus-laptop.c
|
||||
index 4b568df..a961156 100644
|
||||
--- a/drivers/platform/x86/asus-laptop.c
|
||||
+++ b/drivers/platform/x86/asus-laptop.c
|
||||
@@ -860,8 +860,10 @@ static ssize_t show_infos(struct device *dev,
|
||||
/*
|
||||
* The HWRS method return informations about the hardware.
|
||||
* 0x80 bit is for WLAN, 0x100 for Bluetooth.
|
||||
+ * 0x40 for WWAN, 0x10 for WIMAX.
|
||||
* The significance of others is yet to be found.
|
||||
- * If we don't find the method, we assume the device are present.
|
||||
+ * We don't currently use this for device detection, and it
|
||||
+ * takes several seconds to run on some systems.
|
||||
*/
|
||||
rv = acpi_evaluate_integer(asus->handle, "HWRS", NULL, &temp);
|
||||
if (!ACPI_FAILURE(rv))
|
||||
@@ -1682,7 +1684,7 @@ static int asus_laptop_get_info(struct asus_laptop *asus)
|
||||
{
|
||||
struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
|
||||
union acpi_object *model = NULL;
|
||||
- unsigned long long bsts_result, hwrs_result;
|
||||
+ unsigned long long bsts_result;
|
||||
char *string = NULL;
|
||||
acpi_status status;
|
||||
|
||||
@@ -1744,17 +1746,6 @@ static int asus_laptop_get_info(struct asus_laptop *asus)
|
||||
if (*string)
|
||||
pr_notice(" %s model detected\n", string);
|
||||
|
||||
- /*
|
||||
- * The HWRS method return informations about the hardware.
|
||||
- * 0x80 bit is for WLAN, 0x100 for Bluetooth,
|
||||
- * 0x40 for WWAN, 0x10 for WIMAX.
|
||||
- * The significance of others is yet to be found.
|
||||
- */
|
||||
- status =
|
||||
- acpi_evaluate_integer(asus->handle, "HWRS", NULL, &hwrs_result);
|
||||
- if (!ACPI_FAILURE(status))
|
||||
- pr_notice(" HWRS returned %x", (int)hwrs_result);
|
||||
-
|
||||
if (!acpi_check_handle(asus->handle, METHOD_WL_STATUS, NULL))
|
||||
asus->have_rsts = true;
|
||||
|
||||
|
|
@ -0,0 +1,83 @@
|
|||
From: Ben Hutchings <ben@decadent.org.uk>
|
||||
Subject: radeon: No MODESET without firmware
|
||||
Date: Sat, 17 Nov 2012 05:28:53 +0000
|
||||
Bug-Debian: http://bugs.debian.org/607194
|
||||
Bug-Debian: http://bugs.debian.org/607471
|
||||
Bug-Debian: http://bugs.debian.org/610851
|
||||
Bug-Debian: http://bugs.debian.org/627497
|
||||
Bug-Debian: http://bugs.debian.org/632212
|
||||
Bug-Debian: http://bugs.debian.org/637943
|
||||
Bug-Debian: http://bugs.debian.org/649448
|
||||
|
||||
radeon requires firmware/microcode for the GPU all chips, but for
|
||||
newer chips (apparently R600 'Evergreen' onward) it also expects
|
||||
firmware for the memory controller and other sub-blocks.
|
||||
|
||||
radeon attempts to gracefully fall back and disable some features if
|
||||
the firmware is not available, but becomes unstable - the framebuffer
|
||||
and/or system memory may be corrupted, or the display may stay black.
|
||||
This does not seem to happen if KMS is disabled.
|
||||
|
||||
Unfortunately, it is not possible to properly disable KMS once the
|
||||
missing firmware is discovered. Each driver registers with the DRM
|
||||
core as having certain capabilities such as DRIVER_MODESET (KMS) and
|
||||
the DRM does not allow for individual devices to have different
|
||||
capabilities!
|
||||
|
||||
Therefore, perform a basic check for the existence of
|
||||
/lib/firmware/radeon when the driver is loaded, and disable KMS
|
||||
if it is missing. I apologise for this gross hack, but I cannot
|
||||
see any more reliable solution that doesn't involve major changes
|
||||
to both DRM and radeon.
|
||||
|
||||
---
|
||||
--- a/drivers/gpu/drm/radeon/radeon_drv.c
|
||||
+++ b/drivers/gpu/drm/radeon/radeon_drv.c
|
||||
@@ -37,6 +37,8 @@
|
||||
#include "drm_pciids.h"
|
||||
#include <linux/console.h>
|
||||
#include <linux/module.h>
|
||||
+#include <linux/namei.h>
|
||||
+#include <linux/path.h>
|
||||
|
||||
|
||||
/*
|
||||
@@ -378,6 +380,24 @@ static struct pci_driver radeon_kms_pci_
|
||||
.resume = radeon_pci_resume,
|
||||
};
|
||||
|
||||
+/* Test that /lib/firmware/radeon is a directory (or symlink to a
|
||||
+ * directory). We could try to match the udev search path, but let's
|
||||
+ * assume people take the easy route and install
|
||||
+ * firmware-linux-nonfree.
|
||||
+ */
|
||||
+static bool __init radeon_firmware_installed(void)
|
||||
+{
|
||||
+ struct path path;
|
||||
+
|
||||
+ if (kern_path("/lib/firmware/radeon", LOOKUP_DIRECTORY | LOOKUP_FOLLOW,
|
||||
+ &path) == 0) {
|
||||
+ path_put(&path);
|
||||
+ return true;
|
||||
+ }
|
||||
+
|
||||
+ return false;
|
||||
+}
|
||||
+
|
||||
static int __init radeon_init(void)
|
||||
{
|
||||
driver = &driver_old;
|
||||
@@ -402,6 +422,13 @@ static int __init radeon_init(void)
|
||||
radeon_modeset = 0;
|
||||
#endif
|
||||
}
|
||||
+ /* We have to commit to KMS before we've seen any devices, so
|
||||
+ * make a basic check to reduce the risk of failure later.
|
||||
+ */
|
||||
+ if (radeon_modeset == 1 && !radeon_firmware_installed()) {
|
||||
+ DRM_INFO("radeon kernel modesetting disabled; it requires firmware-linux-nonfree.\n");
|
||||
+ radeon_modeset = 0;
|
||||
+ }
|
||||
if (radeon_modeset == 1) {
|
||||
DRM_INFO("radeon kernel modesetting enabled.\n");
|
||||
driver = &kms_driver;
|
||||
|
|
@ -0,0 +1,39 @@
|
|||
From a47f7cb2f0dbe097b7c848aea05c3224bde07e3c Mon Sep 17 00:00:00 2001
|
||||
From: Ian Campbell <ijc@hellion.org.uk>
|
||||
Date: Mon, 26 Nov 2012 09:41:02 +0000
|
||||
Subject: [PATCH] microcode_xen: Add support for AMD family >= 15h
|
||||
|
||||
Signed-off-by: Ian Campbell <ijc@hellion.org.uk>
|
||||
---
|
||||
arch/x86/kernel/microcode_xen.c | 8 ++++++--
|
||||
1 file changed, 6 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/arch/x86/kernel/microcode_xen.c b/arch/x86/kernel/microcode_xen.c
|
||||
index 9d2a06b..5fe87a6 100644
|
||||
--- a/arch/x86/kernel/microcode_xen.c
|
||||
+++ b/arch/x86/kernel/microcode_xen.c
|
||||
@@ -58,7 +58,7 @@ static int xen_microcode_update(int cpu)
|
||||
|
||||
static enum ucode_state xen_request_microcode_fw(int cpu, struct device *device)
|
||||
{
|
||||
- char name[30];
|
||||
+ char name[36];
|
||||
struct cpuinfo_x86 *c = &cpu_data(cpu);
|
||||
const struct firmware *firmware;
|
||||
struct ucode_cpu_info *uci = ucode_cpu_info + cpu;
|
||||
@@ -74,7 +74,11 @@ static enum ucode_state xen_request_microcode_fw(int cpu, struct device *device)
|
||||
break;
|
||||
|
||||
case X86_VENDOR_AMD:
|
||||
- snprintf(name, sizeof(name), "amd-ucode/microcode_amd.bin");
|
||||
+ /* Beginning with family 15h AMD uses family-specific firmware files. */
|
||||
+ if (c->x86 >= 0x15)
|
||||
+ snprintf(name, sizeof(name), "amd-ucode/microcode_amd_fam%.2xh.bin", c->x86);
|
||||
+ else
|
||||
+ snprintf(name, sizeof(name), "amd-ucode/microcode_amd.bin");
|
||||
break;
|
||||
|
||||
default:
|
||||
--
|
||||
1.7.10.4
|
||||
|
||||
|
|
@ -0,0 +1,15 @@
|
|||
http://git.kernel.org/?p=linux/kernel/git/konrad/xen.git;a=commitdiff;h=f6c958ff0d00ffbf1cdc8fcf2f2a82f06fbbb5f4
|
||||
|
||||
Index: linux/arch/x86/kernel/microcode_xen.c
|
||||
===================================================================
|
||||
--- linux.orig/arch/x86/kernel/microcode_xen.c 2012-12-05 13:31:49.000000000 +0000
|
||||
+++ linux/arch/x86/kernel/microcode_xen.c 2012-12-05 13:32:10.000000000 +0000
|
||||
@@ -161,7 +161,7 @@
|
||||
ret = UCODE_OK;
|
||||
|
||||
out:
|
||||
- if (ret == 0)
|
||||
+ if (ret == UCODE_OK)
|
||||
uci->mc = uc;
|
||||
else
|
||||
vfree(uc);
|
||||
|
|
@ -0,0 +1,284 @@
|
|||
From 23757fb5d6781bf945d21d1f5373aa71122cbea9 Mon Sep 17 00:00:00 2001
|
||||
From: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
|
||||
Date: Fri, 27 Mar 2009 17:39:15 -0700
|
||||
Subject: [PATCH] xen: add CPU microcode update driver
|
||||
|
||||
Xen does all the hard work for us, including choosing the right update
|
||||
method for this cpu type and actually doing it for all cpus. We just
|
||||
need to supply it with the firmware blob.
|
||||
|
||||
Because Xen updates all CPUs (and the kernel's virtual cpu numbers have
|
||||
no fixed relationship with the underlying physical cpus), we only bother
|
||||
doing anything for cpu "0".
|
||||
|
||||
[ Impact: allow CPU microcode update in Xen dom0 ]
|
||||
Signed-off-by: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
|
||||
---
|
||||
|
||||
Takes from git://git.kernel.org/pub/scm/linux/kernel/git/jeremy/xen.git#upstream/microcode
|
||||
|
||||
arch/x86/include/asm/microcode.h | 9 ++
|
||||
arch/x86/kernel/Makefile | 1 +
|
||||
arch/x86/kernel/microcode_core.c | 5 +-
|
||||
arch/x86/kernel/microcode_xen.c | 198 ++++++++++++++++++++++++++++++++++++++
|
||||
arch/x86/xen/Kconfig | 4 +
|
||||
5 files changed, 216 insertions(+), 1 deletion(-)
|
||||
create mode 100644 arch/x86/kernel/microcode_xen.c
|
||||
|
||||
--- a/arch/x86/include/asm/microcode.h
|
||||
+++ b/arch/x86/include/asm/microcode.h
|
||||
@@ -63,4 +63,13 @@ static inline struct microcode_ops * __i
|
||||
static inline void __exit exit_amd_microcode(void) {}
|
||||
#endif
|
||||
|
||||
+#ifdef CONFIG_MICROCODE_XEN
|
||||
+extern struct microcode_ops * __init init_xen_microcode(void);
|
||||
+#else
|
||||
+static inline struct microcode_ops * __init init_xen_microcode(void)
|
||||
+{
|
||||
+ return NULL;
|
||||
+}
|
||||
+#endif
|
||||
+
|
||||
#endif /* _ASM_X86_MICROCODE_H */
|
||||
--- a/arch/x86/kernel/Makefile
|
||||
+++ b/arch/x86/kernel/Makefile
|
||||
@@ -92,6 +92,7 @@ obj-$(CONFIG_PCSPKR_PLATFORM) += pcspeak
|
||||
microcode-y := microcode_core.o
|
||||
microcode-$(CONFIG_MICROCODE_INTEL) += microcode_intel.o
|
||||
microcode-$(CONFIG_MICROCODE_AMD) += microcode_amd.o
|
||||
+microcode-$(CONFIG_MICROCODE_XEN) += microcode_xen.o
|
||||
obj-$(CONFIG_MICROCODE) += microcode.o
|
||||
|
||||
obj-$(CONFIG_X86_CHECK_BIOS_CORRUPTION) += check.o
|
||||
--- a/arch/x86/kernel/microcode_core.c
|
||||
+++ b/arch/x86/kernel/microcode_core.c
|
||||
@@ -84,6 +84,7 @@
|
||||
#include <linux/mm.h>
|
||||
#include <linux/syscore_ops.h>
|
||||
|
||||
+#include <xen/xen.h>
|
||||
#include <asm/microcode.h>
|
||||
#include <asm/processor.h>
|
||||
#include <asm/cpu_device_id.h>
|
||||
@@ -544,7 +545,9 @@ static int __init microcode_init(void)
|
||||
struct cpuinfo_x86 *c = &cpu_data(0);
|
||||
int error;
|
||||
|
||||
- if (c->x86_vendor == X86_VENDOR_INTEL)
|
||||
+ if (xen_pv_domain())
|
||||
+ microcode_ops = init_xen_microcode();
|
||||
+ else if (c->x86_vendor == X86_VENDOR_INTEL)
|
||||
microcode_ops = init_intel_microcode();
|
||||
else if (c->x86_vendor == X86_VENDOR_AMD)
|
||||
microcode_ops = init_amd_microcode();
|
||||
--- /dev/null
|
||||
+++ b/arch/x86/kernel/microcode_xen.c
|
||||
@@ -0,0 +1,198 @@
|
||||
+/*
|
||||
+ * Xen microcode update driver
|
||||
+ *
|
||||
+ * Xen does most of the work here. We just pass the whole blob into
|
||||
+ * Xen, and it will apply it to all CPUs as appropriate. Xen will
|
||||
+ * worry about how different CPU models are actually updated.
|
||||
+ */
|
||||
+#include <linux/sched.h>
|
||||
+#include <linux/module.h>
|
||||
+#include <linux/firmware.h>
|
||||
+#include <linux/vmalloc.h>
|
||||
+#include <linux/uaccess.h>
|
||||
+
|
||||
+#include <asm/microcode.h>
|
||||
+
|
||||
+#include <xen/xen.h>
|
||||
+#include <xen/interface/platform.h>
|
||||
+#include <xen/interface/xen.h>
|
||||
+
|
||||
+#include <asm/xen/hypercall.h>
|
||||
+#include <asm/xen/hypervisor.h>
|
||||
+
|
||||
+MODULE_DESCRIPTION("Xen microcode update driver");
|
||||
+MODULE_LICENSE("GPL");
|
||||
+
|
||||
+struct xen_microcode {
|
||||
+ size_t len;
|
||||
+ char data[0];
|
||||
+};
|
||||
+
|
||||
+static int xen_microcode_update(int cpu)
|
||||
+{
|
||||
+ int err;
|
||||
+ struct xen_platform_op op;
|
||||
+ struct ucode_cpu_info *uci = ucode_cpu_info + cpu;
|
||||
+ struct xen_microcode *uc = uci->mc;
|
||||
+
|
||||
+ if (uc == NULL || uc->len == 0) {
|
||||
+ /*
|
||||
+ * We do all cpus at once, so we don't need to do
|
||||
+ * other cpus explicitly (besides, these vcpu numbers
|
||||
+ * have no relationship to underlying physical cpus).
|
||||
+ */
|
||||
+ return 0;
|
||||
+ }
|
||||
+
|
||||
+ op.cmd = XENPF_microcode_update;
|
||||
+ set_xen_guest_handle(op.u.microcode.data, uc->data);
|
||||
+ op.u.microcode.length = uc->len;
|
||||
+
|
||||
+ err = HYPERVISOR_dom0_op(&op);
|
||||
+
|
||||
+ if (err != 0)
|
||||
+ printk(KERN_WARNING "microcode_xen: microcode update failed: %d\n", err);
|
||||
+
|
||||
+ return err;
|
||||
+}
|
||||
+
|
||||
+static enum ucode_state xen_request_microcode_fw(int cpu, struct device *device)
|
||||
+{
|
||||
+ char name[30];
|
||||
+ struct cpuinfo_x86 *c = &cpu_data(cpu);
|
||||
+ const struct firmware *firmware;
|
||||
+ struct ucode_cpu_info *uci = ucode_cpu_info + cpu;
|
||||
+ enum ucode_state ret;
|
||||
+ struct xen_microcode *uc;
|
||||
+ size_t size;
|
||||
+ int err;
|
||||
+
|
||||
+ switch (c->x86_vendor) {
|
||||
+ case X86_VENDOR_INTEL:
|
||||
+ snprintf(name, sizeof(name), "intel-ucode/%02x-%02x-%02x",
|
||||
+ c->x86, c->x86_model, c->x86_mask);
|
||||
+ break;
|
||||
+
|
||||
+ case X86_VENDOR_AMD:
|
||||
+ snprintf(name, sizeof(name), "amd-ucode/microcode_amd.bin");
|
||||
+ break;
|
||||
+
|
||||
+ default:
|
||||
+ return UCODE_NFOUND;
|
||||
+ }
|
||||
+
|
||||
+ err = request_firmware(&firmware, name, device);
|
||||
+ if (err) {
|
||||
+ pr_debug("microcode: data file %s load failed\n", name);
|
||||
+ return UCODE_NFOUND;
|
||||
+ }
|
||||
+
|
||||
+ /*
|
||||
+ * Only bother getting real firmware for cpu 0; the others get
|
||||
+ * dummy placeholders.
|
||||
+ */
|
||||
+ if (cpu == 0)
|
||||
+ size = firmware->size;
|
||||
+ else
|
||||
+ size = 0;
|
||||
+
|
||||
+ if (uci->mc != NULL) {
|
||||
+ vfree(uci->mc);
|
||||
+ uci->mc = NULL;
|
||||
+ }
|
||||
+
|
||||
+ ret = UCODE_ERROR;
|
||||
+ uc = vmalloc(sizeof(*uc) + size);
|
||||
+ if (uc == NULL)
|
||||
+ goto out;
|
||||
+
|
||||
+ ret = UCODE_OK;
|
||||
+ uc->len = size;
|
||||
+ memcpy(uc->data, firmware->data, uc->len);
|
||||
+
|
||||
+ uci->mc = uc;
|
||||
+
|
||||
+out:
|
||||
+ release_firmware(firmware);
|
||||
+
|
||||
+ return ret;
|
||||
+}
|
||||
+
|
||||
+static enum ucode_state xen_request_microcode_user(int cpu,
|
||||
+ const void __user *buf, size_t size)
|
||||
+{
|
||||
+ struct ucode_cpu_info *uci = ucode_cpu_info + cpu;
|
||||
+ struct xen_microcode *uc;
|
||||
+ enum ucode_state ret;
|
||||
+ size_t unread;
|
||||
+
|
||||
+ if (cpu != 0) {
|
||||
+ /* No real firmware for non-zero cpus; just store a
|
||||
+ placeholder */
|
||||
+ size = 0;
|
||||
+ }
|
||||
+
|
||||
+ if (uci->mc != NULL) {
|
||||
+ vfree(uci->mc);
|
||||
+ uci->mc = NULL;
|
||||
+ }
|
||||
+
|
||||
+ ret = UCODE_ERROR;
|
||||
+ uc = vmalloc(sizeof(*uc) + size);
|
||||
+ if (uc == NULL)
|
||||
+ goto out;
|
||||
+
|
||||
+ uc->len = size;
|
||||
+
|
||||
+ ret = UCODE_NFOUND;
|
||||
+
|
||||
+ unread = copy_from_user(uc->data, buf, size);
|
||||
+
|
||||
+ if (unread != 0) {
|
||||
+ printk(KERN_WARNING "failed to read %zd of %zd bytes at %p -> %p\n",
|
||||
+ unread, size, buf, uc->data);
|
||||
+ goto out;
|
||||
+ }
|
||||
+
|
||||
+ ret = UCODE_OK;
|
||||
+
|
||||
+out:
|
||||
+ if (ret == 0)
|
||||
+ uci->mc = uc;
|
||||
+ else
|
||||
+ vfree(uc);
|
||||
+
|
||||
+ return ret;
|
||||
+}
|
||||
+
|
||||
+static void xen_microcode_fini_cpu(int cpu)
|
||||
+{
|
||||
+ struct ucode_cpu_info *uci = ucode_cpu_info + cpu;
|
||||
+
|
||||
+ vfree(uci->mc);
|
||||
+ uci->mc = NULL;
|
||||
+}
|
||||
+
|
||||
+static int xen_collect_cpu_info(int cpu, struct cpu_signature *sig)
|
||||
+{
|
||||
+ sig->sig = 0;
|
||||
+ sig->pf = 0;
|
||||
+ sig->rev = 0;
|
||||
+
|
||||
+ return 0;
|
||||
+}
|
||||
+
|
||||
+static struct microcode_ops microcode_xen_ops = {
|
||||
+ .request_microcode_user = xen_request_microcode_user,
|
||||
+ .request_microcode_fw = xen_request_microcode_fw,
|
||||
+ .collect_cpu_info = xen_collect_cpu_info,
|
||||
+ .apply_microcode = xen_microcode_update,
|
||||
+ .microcode_fini_cpu = xen_microcode_fini_cpu,
|
||||
+};
|
||||
+
|
||||
+struct microcode_ops * __init init_xen_microcode(void)
|
||||
+{
|
||||
+ if (!xen_initial_domain())
|
||||
+ return NULL;
|
||||
+ return µcode_xen_ops;
|
||||
+}
|
||||
--- a/arch/x86/xen/Kconfig
|
||||
+++ b/arch/x86/xen/Kconfig
|
||||
@@ -50,3 +50,6 @@ config XEN_DEBUG_FS
|
||||
Enable statistics output and various tuning options in debugfs.
|
||||
Enabling this option may incur a significant performance overhead.
|
||||
|
||||
+config MICROCODE_XEN
|
||||
+ def_bool y
|
||||
+ depends on XEN_DOM0 && MICROCODE
|
||||
|
|
@ -55,3 +55,17 @@ bugfix/arm/0001-usb-phy-add-a-new-driver-for-omap-usb2-phy.patch
|
|||
bugfix/arm/0001-usb-otg-make-twl6030_usb-as-a-comparator-driver-to-o.patch
|
||||
bugfix/arm/0001-usb-otg-Fix-build-errors-if-USB_MUSB_OMAP2PLUS-is-se.patch
|
||||
bugfix/arm/omap-musb-choice.patch
|
||||
bugfix/x86/asus-laptop-Do-not-call-HWRS-on-init.patch
|
||||
|
||||
features/all/xen/microcode.patch
|
||||
debian/radeon-no-modeset-without-firmware.patch
|
||||
features/all/xen/microcode-amd-fam15plus.patch
|
||||
features/all/xen/microcode-typo.patch
|
||||
|
||||
bugfix/all/firmware_class-log-every-success-and-failure.patch
|
||||
bugfix/all/firmware-remove-redundant-log-messages-from-drivers.patch
|
||||
|
||||
bugfix/x86/ACPI-video-ignore-BIOS-initial-backlight-value-for-H.patch
|
||||
bugfix/all/exec-do-not-leave-bprm-interp-on-stack.patch
|
||||
bugfix/all/exec-use-ELOOP-for-max-recursion-depth.patch
|
||||
bugfix/all/megaraid_sas-fix-memory-leak-if-SGL-has-zero-length-entries.patch
|
||||
|
|
|
|||
|
|
@ -2,6 +2,6 @@ Package: linux-image-@abiname@@localversion@-dbg
|
|||
Depends: ${misc:Depends}
|
||||
Section: debug
|
||||
Priority: extra
|
||||
Description: Debugging infos for Linux @abiname@@localversion@
|
||||
This package provides the binary debug image and pre-built debug loadable
|
||||
modules for Linux kernel @upstreamversion@ on @longclass@ machines.
|
||||
Description: Debugging symbols for Linux @abiname@@localversion@
|
||||
This package provides the detached debugging symbols for the Linux kernel
|
||||
and modules in linux-image-@abiname@@localversion@.
|
||||
|
|
|
|||
Loading…
Reference in New Issue