Commit 6c5c3a2e authored by Hauke Mehrtens's avatar Hauke Mehrtens
Browse files

kernel: Update to version 4.4.182



Fixes:
- CVE-2019-11479
- CVE-2019-11478
- CVE-2019-11477
- CVE-2019-11833
- CVE-2019-11091
- CVE-2018-12126
- CVE-2018-12130
- CVE-2018-12127
- CVE-2019-3882
- CVE-2019-6974
- CVE-2019-3819
- CVE-2019-7221
- CVE-2019-7222
- CVE-2019-3701
- CVE-2018-19985
- CVE-2018-1120
And probably more
Signed-off-by: default avatarHauke Mehrtens <hauke@hauke-m.de>
parent af50ce32
......@@ -3,10 +3,10 @@
LINUX_RELEASE?=1
LINUX_VERSION-3.18 = .43
LINUX_VERSION-4.4 = .167
LINUX_VERSION-4.4 = .182
LINUX_KERNEL_HASH-3.18.43 = 1236e8123a6ce537d5029232560966feed054ae31776fe8481dd7d18cdd5492c
LINUX_KERNEL_HASH-4.4.167 = 33ca4c28a565404fc7b07f9d6b734c291035f7e7e46c280131494b04e3953edf
LINUX_KERNEL_HASH-4.4.182 = c409d88f61cd9a37cbba36d5d9c8162263eb1e5c9380efaf880a3ec10cd88527
ifdef KERNEL_PATCHVER
LINUX_VERSION:=$(KERNEL_PATCHVER)$(strip $(LINUX_VERSION-$(KERNEL_PATCHVER)))
......
--- a/backport-include/linux/mm.h
+++ b/backport-include/linux/mm.h
@@ -39,8 +39,20 @@ static inline
long backport_get_user_pages_locked(unsigned long start, unsigned long nr_pages,
int write, int force, struct page **pages, int *locked)
{
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(4,4,168))
return get_user_pages_locked(current, current->mm, start, nr_pages,
write, force, pages, locked);
+#else
+ int flags = 0;
+
+ if (write)
+ flags |= FOLL_WRITE;
+ if (force)
+ flags |= FOLL_FORCE;
+
+ return get_user_pages_locked(current, current->mm, start, nr_pages,
+ flags, pages, locked);
+#endif
}
#define get_user_pages_locked LINUX_BACKPORT(get_user_pages_locked)
@@ -48,8 +60,20 @@ static inline
long backport_get_user_pages_unlocked(unsigned long start, unsigned long nr_pages,
int write, int force, struct page **pages)
{
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(4,4,168))
return get_user_pages_unlocked(current, current->mm, start, nr_pages,
write, force, pages);
+#else
+ int flags = 0;
+
+ if (write)
+ flags |= FOLL_WRITE;
+ if (force)
+ flags |= FOLL_FORCE;
+
+ return get_user_pages_unlocked(current, current->mm, start, nr_pages,
+ pages, flags);
+#endif
}
#define get_user_pages_unlocked LINUX_BACKPORT(get_user_pages_unlocked)
#endif
@@ -60,8 +84,20 @@ long backport_get_user_pages(unsigned lo
int write, int force, struct page **pages,
struct vm_area_struct **vmas)
{
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(4,4,168))
return get_user_pages(current, current->mm, start, nr_pages,
write, force, pages, vmas);
+#else
+ int flags = 0;
+
+ if (write)
+ flags |= FOLL_WRITE;
+ if (force)
+ flags |= FOLL_FORCE;
+
+ return get_user_pages(current, current->mm, start, nr_pages,
+ flags, pages, vmas);
+#endif
}
#define get_user_pages LINUX_BACKPORT(get_user_pages)
#endif
......@@ -240,7 +240,7 @@ Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
#define PPC4XX_SEC_VERSION_STR "0.5"
@@ -1221,6 +1222,7 @@ static int crypto4xx_probe(struct platfo
@@ -1230,6 +1231,7 @@ static int crypto4xx_probe(struct platfo
if (rc)
goto err_start_dev;
......@@ -248,7 +248,7 @@ Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
return 0;
err_start_dev:
@@ -1247,6 +1249,8 @@ static int crypto4xx_remove(struct platf
@@ -1256,6 +1258,8 @@ static int crypto4xx_remove(struct platf
struct device *dev = &ofdev->dev;
struct crypto4xx_core_device *core_dev = dev_get_drvdata(dev);
......@@ -257,7 +257,7 @@ Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
free_irq(core_dev->irq, dev);
irq_dispose_mapping(core_dev->irq);
@@ -1267,7 +1271,7 @@ MODULE_DEVICE_TABLE(of, crypto4xx_match)
@@ -1276,7 +1280,7 @@ MODULE_DEVICE_TABLE(of, crypto4xx_match)
static struct platform_driver crypto4xx_driver = {
.driver = {
......@@ -266,7 +266,7 @@ Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
.of_match_table = crypto4xx_match,
},
.probe = crypto4xx_probe,
@@ -1279,4 +1283,3 @@ module_platform_driver(crypto4xx_driver)
@@ -1288,4 +1292,3 @@ module_platform_driver(crypto4xx_driver)
MODULE_LICENSE("GPL");
MODULE_AUTHOR("James Hsiao <jhsiao@amcc.com>");
MODULE_DESCRIPTION("Driver for AMCC PPC4xx crypto accelerator");
......
......@@ -47,7 +47,7 @@ Signed-off-by: Jacek Anaszewski <j.anaszewski@samsung.com>
#include <linux/pm_runtime.h>
#include <linux/platform_device.h>
@@ -4945,6 +4946,9 @@ void ata_qc_complete(struct ata_queued_c
@@ -4946,6 +4947,9 @@ void ata_qc_complete(struct ata_queued_c
{
struct ata_port *ap = qc->ap;
......
......@@ -24,7 +24,7 @@ produce a noisy warning.
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -388,10 +388,14 @@ static int xhci_try_enable_msi(struct us
@@ -386,10 +386,14 @@ static int xhci_try_enable_msi(struct us
free_irq(hcd->irq, hcd);
hcd->irq = 0;
......@@ -44,7 +44,7 @@ produce a noisy warning.
/* hcd->irq is 0, we have MSI */
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -1656,6 +1656,7 @@ struct xhci_hcd {
@@ -1657,6 +1657,7 @@ struct xhci_hcd {
/* support xHCI 0.96 spec USB2 software LPM */
unsigned sw_lpm_support:1;
/* support xHCI 1.0 spec USB2 hardware LPM */
......
......@@ -10,7 +10,7 @@
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -1118,6 +1118,9 @@ config MIPS_MSC
@@ -1121,6 +1121,9 @@ config MIPS_MSC
config MIPS_NILE4
bool
......
......@@ -241,7 +241,7 @@
*/
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -433,7 +433,7 @@ int ipv6_recv_error(struct sock *sk, str
@@ -434,7 +434,7 @@ int ipv6_recv_error(struct sock *sk, str
ipv6_iface_scope_id(&sin->sin6_addr,
IP6CB(skb)->iif);
} else {
......@@ -250,7 +250,7 @@
&sin->sin6_addr);
sin->sin6_scope_id = 0;
}
@@ -773,12 +773,12 @@ int ip6_datagram_send_ctl(struct net *ne
@@ -772,12 +772,12 @@ int ip6_datagram_send_ctl(struct net *ne
}
if (fl6->flowlabel&IPV6_FLOWINFO_MASK) {
......@@ -664,7 +664,7 @@
#define IP6_MF 0x0001
#define IP6_OFFSET 0xFFF8
@@ -418,8 +418,8 @@ static inline void __ipv6_addr_set_half(
@@ -411,8 +411,8 @@ static inline void __ipv6_addr_set_half(
}
#endif
#endif
......@@ -675,7 +675,7 @@
}
static inline void ipv6_addr_set(struct in6_addr *addr,
@@ -478,6 +478,8 @@ static inline bool ipv6_prefix_equal(con
@@ -471,6 +471,8 @@ static inline bool ipv6_prefix_equal(con
const __be32 *a1 = addr1->s6_addr32;
const __be32 *a2 = addr2->s6_addr32;
unsigned int pdw, pbi;
......@@ -684,7 +684,7 @@
/* check complete u32 in prefix */
pdw = prefixlen >> 5;
@@ -486,7 +488,9 @@ static inline bool ipv6_prefix_equal(con
@@ -479,7 +481,9 @@ static inline bool ipv6_prefix_equal(con
/* check incomplete u32 in prefix */
pbi = prefixlen & 0x1f;
......@@ -695,7 +695,7 @@
return false;
return true;
@@ -630,13 +634,13 @@ static inline void ipv6_addr_set_v4mappe
@@ -608,13 +612,13 @@ static inline void ipv6_addr_set_v4mappe
*/
static inline int __ipv6_addr_diff32(const void *token1, const void *token2, int addrlen)
{
......@@ -711,7 +711,7 @@
if (xb)
return i * 32 + 31 - __fls(ntohl(xb));
}
@@ -805,17 +809,18 @@ static inline int ip6_default_np_autolab
@@ -783,17 +787,18 @@ static inline int ip6_default_np_autolab
static inline void ip6_flow_hdr(struct ipv6hdr *hdr, unsigned int tclass,
__be32 flowlabel)
{
......@@ -814,7 +814,7 @@
static struct fib6_node *node_alloc(void)
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -456,7 +456,7 @@ static void tcp_sack(const struct sk_buf
@@ -458,7 +458,7 @@ static void tcp_sack(const struct sk_buf
/* Fast path for timestamp-only option */
if (length == TCPOLEN_TSTAMP_ALIGNED
......@@ -838,7 +838,7 @@
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -3836,14 +3836,16 @@ static bool tcp_parse_aligned_timestamp(
@@ -3852,14 +3852,16 @@ static bool tcp_parse_aligned_timestamp(
{
const __be32 *ptr = (const __be32 *)(th + 1);
......
......@@ -40,7 +40,7 @@ it on BCM4708 family.
/* called during probe() after chip reset completes */
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -152,6 +152,49 @@ static int xhci_start(struct xhci_hcd *x
@@ -150,6 +150,49 @@ static int xhci_start(struct xhci_hcd *x
return ret;
}
......@@ -90,7 +90,7 @@ it on BCM4708 family.
/*
* Reset a halted HC.
*
@@ -568,10 +611,20 @@ int xhci_init(struct usb_hcd *hcd)
@@ -566,10 +609,20 @@ int xhci_init(struct usb_hcd *hcd)
static int xhci_run_finished(struct xhci_hcd *xhci)
{
......@@ -114,7 +114,7 @@ it on BCM4708 family.
xhci->shared_hcd->state = HC_STATE_RUNNING;
xhci->cmd_ring_state = CMD_RING_STATE_RUNNING;
@@ -581,6 +634,10 @@ static int xhci_run_finished(struct xhci
@@ -579,6 +632,10 @@ static int xhci_run_finished(struct xhci
xhci_dbg_trace(xhci, trace_xhci_dbg_init,
"Finished xhci_run for USB3 roothub");
return 0;
......@@ -127,7 +127,7 @@ it on BCM4708 family.
/*
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -1639,6 +1639,7 @@ struct xhci_hcd {
@@ -1640,6 +1640,7 @@ struct xhci_hcd {
#define XHCI_BROKEN_STREAMS (1 << 19)
#define XHCI_PME_STUCK_QUIRK (1 << 20)
#define XHCI_MISSING_CAS (1 << 24)
......
......@@ -13,7 +13,7 @@ http://www.spinics.net/lists/linux-mm/msg72236.html
--- a/include/linux/vmstat.h
+++ b/include/linux/vmstat.h
@@ -219,7 +219,11 @@ static inline void __inc_zone_state(stru
@@ -220,7 +220,11 @@ static inline void __inc_zone_state(stru
static inline void __dec_zone_state(struct zone *zone, enum zone_stat_item item)
{
atomic_long_dec(&zone->vm_stat[item]);
......
......@@ -19,7 +19,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
--- a/drivers/spi/spi-bcm2835.c
+++ b/drivers/spi/spi-bcm2835.c
@@ -688,6 +688,8 @@ static int bcm2835_spi_setup(struct spi_
@@ -686,6 +686,8 @@ static int bcm2835_spi_setup(struct spi_
{
int err;
struct gpio_chip *chip;
......@@ -28,7 +28,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
/*
* sanity checking the native-chipselects
*/
@@ -704,15 +706,42 @@ static int bcm2835_spi_setup(struct spi_
@@ -702,15 +704,42 @@ static int bcm2835_spi_setup(struct spi_
"setup: only two native chip-selects are supported\n");
return -EINVAL;
}
......
......@@ -659,7 +659,7 @@ dwc_otg: Remove duplicate gadget probe/unregister function
}
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -5007,7 +5007,7 @@ static void port_event(struct usb_hub *h
@@ -5014,7 +5014,7 @@ static void port_event(struct usb_hub *h
if (portchange & USB_PORT_STAT_C_OVERCURRENT) {
u16 status = 0, unused;
......@@ -670,7 +670,7 @@ dwc_otg: Remove duplicate gadget probe/unregister function
msleep(100); /* Cool down */
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -1924,6 +1924,85 @@ free_interfaces:
@@ -1925,6 +1925,85 @@ free_interfaces:
if (cp->string == NULL &&
!(dev->quirks & USB_QUIRK_CONFIG_INTF_STRINGS))
cp->string = usb_cache_string(dev, cp->desc.iConfiguration);
......@@ -17,7 +17,7 @@ Signed-off-by: Siarhei Siamashka <siarhei.siamashka@gmail.com>
--- a/drivers/video/fbdev/core/fbmem.c
+++ b/drivers/video/fbdev/core/fbmem.c
@@ -1084,6 +1084,25 @@ fb_blank(struct fb_info *info, int blank
@@ -1091,6 +1091,25 @@ fb_blank(struct fb_info *info, int blank
}
EXPORT_SYMBOL(fb_blank);
......@@ -43,7 +43,7 @@ Signed-off-by: Siarhei Siamashka <siarhei.siamashka@gmail.com>
static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
unsigned long arg)
{
@@ -1094,6 +1113,7 @@ static long do_fb_ioctl(struct fb_info *
@@ -1101,6 +1120,7 @@ static long do_fb_ioctl(struct fb_info *
struct fb_cmap cmap_from;
struct fb_cmap_user cmap;
struct fb_event event;
......@@ -51,7 +51,7 @@ Signed-off-by: Siarhei Siamashka <siarhei.siamashka@gmail.com>
void __user *argp = (void __user *)arg;
long ret = 0;
@@ -1211,6 +1231,15 @@ static long do_fb_ioctl(struct fb_info *
@@ -1218,6 +1238,15 @@ static long do_fb_ioctl(struct fb_info *
unlock_fb_info(info);
console_unlock();
break;
......@@ -67,7 +67,7 @@ Signed-off-by: Siarhei Siamashka <siarhei.siamashka@gmail.com>
default:
if (!lock_fb_info(info))
return -ENODEV;
@@ -1365,6 +1394,7 @@ static long fb_compat_ioctl(struct file
@@ -1372,6 +1401,7 @@ static long fb_compat_ioctl(struct file
case FBIOPAN_DISPLAY:
case FBIOGET_CON2FBMAP:
case FBIOPUT_CON2FBMAP:
......
......@@ -16,7 +16,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
--- a/drivers/mmc/card/block.c
+++ b/drivers/mmc/card/block.c
@@ -2553,6 +2553,13 @@ static const struct mmc_fixup blk_fixups
@@ -2547,6 +2547,13 @@ static const struct mmc_fixup blk_fixups
MMC_FIXUP("V10016", CID_MANFID_KINGSTON, CID_OEMID_ANY, add_quirk_mmc,
MMC_QUIRK_TRIM_BROKEN),
......@@ -32,7 +32,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
--- a/drivers/mmc/core/core.c
+++ b/drivers/mmc/core/core.c
@@ -2253,7 +2253,8 @@ EXPORT_SYMBOL(mmc_erase);
@@ -2257,7 +2257,8 @@ EXPORT_SYMBOL(mmc_erase);
int mmc_can_erase(struct mmc_card *card)
{
if ((card->host->caps & MMC_CAP_ERASE) &&
......
......@@ -10,7 +10,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
--- a/drivers/mmc/card/block.c
+++ b/drivers/mmc/card/block.c
@@ -2559,6 +2559,10 @@ static const struct mmc_fixup blk_fixups
@@ -2553,6 +2553,10 @@ static const struct mmc_fixup blk_fixups
*/
MMC_FIXUP("SD16G", 0x41, 0x3432, add_quirk_mmc,
MMC_QUIRK_ERASE_BROKEN),
......
......@@ -17,7 +17,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
--- a/drivers/mmc/card/block.c
+++ b/drivers/mmc/card/block.c
@@ -137,6 +137,13 @@ enum {
@@ -134,6 +134,13 @@ enum {
module_param(perdev_minors, int, 0444);
MODULE_PARM_DESC(perdev_minors, "Minors numbers to allocate per device");
......@@ -31,7 +31,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
static inline int mmc_blk_part_switch(struct mmc_card *card,
struct mmc_blk_data *md);
static int get_card_status(struct mmc_card *card, u32 *status, int retries);
@@ -2571,6 +2578,7 @@ static int mmc_blk_probe(struct mmc_card
@@ -2565,6 +2572,7 @@ static int mmc_blk_probe(struct mmc_card
{
struct mmc_blk_data *md, *part_md;
char cap_str[10];
......@@ -39,7 +39,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
/*
* Check that the card supports the command class(es) we need.
@@ -2578,7 +2586,16 @@ static int mmc_blk_probe(struct mmc_card
@@ -2572,7 +2580,16 @@ static int mmc_blk_probe(struct mmc_card
if (!(card->csd.cmdclass & CCC_BLOCK_READ))
return -ENODEV;
......@@ -57,7 +57,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
md = mmc_blk_alloc(card);
if (IS_ERR(md))
@@ -2586,9 +2603,14 @@ static int mmc_blk_probe(struct mmc_card
@@ -2580,9 +2597,14 @@ static int mmc_blk_probe(struct mmc_card
string_get_size((u64)get_capacity(md->disk), 512, STRING_UNITS_2,
cap_str, sizeof(cap_str));
......
......@@ -10,7 +10,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
--- a/drivers/mmc/card/block.c
+++ b/drivers/mmc/card/block.c
@@ -2564,12 +2564,9 @@ static const struct mmc_fixup blk_fixups
@@ -2558,12 +2558,9 @@ static const struct mmc_fixup blk_fixups
* On some Kingston SD cards, multiple erases of less than 64
* sectors can cause corruption.
*/
......
......@@ -28,7 +28,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
i2c0: i2c@7e205000 {
--- a/drivers/spi/spi-bcm2835.c
+++ b/drivers/spi/spi-bcm2835.c
@@ -707,6 +707,7 @@ static int bcm2835_spi_setup(struct spi_
@@ -705,6 +705,7 @@ static int bcm2835_spi_setup(struct spi_
return -EINVAL;
}
......@@ -36,7 +36,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
/* now translate native cs to GPIO */
/* first look for chip select pins in the devices pin groups */
for (pingroup_index = 0;
@@ -761,6 +762,7 @@ static int bcm2835_spi_setup(struct spi_
@@ -759,6 +760,7 @@ static int bcm2835_spi_setup(struct spi_
* so we are setting it here explicitly
*/
gpio_set_value(spi->cs_gpio, (spi->mode & SPI_CS_HIGH) ? 0 : 1);
......
......@@ -10,7 +10,7 @@ Subject: [PATCH] fbmem: Ensure that parameters are properly checked within
--- a/drivers/video/fbdev/core/fbmem.c
+++ b/drivers/video/fbdev/core/fbmem.c
@@ -1090,7 +1090,13 @@ static int fb_copyarea_user(struct fb_in
@@ -1097,7 +1097,13 @@ static int fb_copyarea_user(struct fb_in
int ret = 0;
if (!lock_fb_info(info))
return -ENODEV;
......
......@@ -9,7 +9,7 @@ Subject: [PATCH] spi-bcm2835: Remove unused code
--- a/drivers/spi/spi-bcm2835.c
+++ b/drivers/spi/spi-bcm2835.c
@@ -679,17 +679,8 @@ static void bcm2835_spi_set_cs(struct sp
@@ -677,17 +677,8 @@ static void bcm2835_spi_set_cs(struct sp
bcm2835_wr(bs, BCM2835_SPI_CS, cs);
}
......@@ -27,7 +27,7 @@ Subject: [PATCH] spi-bcm2835: Remove unused code
/*
* sanity checking the native-chipselects
*/
@@ -707,63 +698,6 @@ static int bcm2835_spi_setup(struct spi_
@@ -705,63 +696,6 @@ static int bcm2835_spi_setup(struct spi_
return -EINVAL;
}
......
--- a/arch/arm/mach-cns3xxx/pcie.c
+++ b/arch/arm/mach-cns3xxx/pcie.c
@@ -86,6 +86,79 @@ static void __iomem *cns3xxx_pci_map_bus
return base + (where & 0xffc) + (devfn << 12);
return base + where + (devfn << 12);
}
+static inline int check_master_abort(struct pci_bus *bus, unsigned int devfn, int where)
......@@ -82,7 +82,7 @@
{
@@ -95,6 +168,11 @@ static int cns3xxx_pci_read_config(struc
ret = pci_generic_config_read32(bus, devfn, where, size, val);
ret = pci_generic_config_read(bus, devfn, where, size, val);
+ if (check_master_abort(bus, devfn, where)) {
+ printk(KERN_ERR "pci error: %04d:%02x:%02x.%02x %02x(%d)= master_abort on read\n", pci_domain_nr(bus), bus->number, PCI_SLOT(devfn), PCI_FUNC(devfn), where, size);
......
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment