From ba1ae3317f7a021ff91b969f5226500c6d879367 Mon Sep 17 00:00:00 2001 From: Bruno Cichon Date: Tue, 30 Jan 2018 22:41:05 +0000 Subject: Update libre/linux-libre to 4.14.15-gnu --- libre/linux-libre-lts/linux.install.pkg | 31 ++++++ ...to-disallow-unprivileged-CLONE_NEWUSER-by.patch | 12 +-- ...CVE-2017-8824-use-after-free-in-DCCP-code.patch | 56 ++++++++++ ...e1000_check_for_copper_link_ich8lan-retur.patch | 75 -------------- ...CVE-2017-8824-use-after-free-in-DCCP-code.patch | 12 +-- ...ack-out-of-bounds-read-on-socket-policy-l.patch | 48 +++++++++ ...p-Only-use-the-alternate-fixed-mode-if-it.patch | 41 ++++++++ ...ack-out-of-bounds-read-on-socket-policy-l.patch | 12 +-- ...css_task_iter-crash-on-CSS_TASK_ITER_PROC.patch | 114 --------------------- ...p-Only-use-the-alternate-fixed-mode-if-it.patch | 12 +-- libre/linux-libre/PKGBUILD | 47 ++++----- libre/linux-libre/config.armv7h | 1 + libre/linux-libre/config.i686 | 2 + libre/linux-libre/config.x86_64 | 2 + libre/linux-libre/linux.install.pkg | 12 +++ 15 files changed, 237 insertions(+), 240 deletions(-) create mode 100644 libre/linux-libre-lts/linux.install.pkg create mode 100644 libre/linux-libre/0002-dccp-CVE-2017-8824-use-after-free-in-DCCP-code.patch delete mode 100644 libre/linux-libre/0002-e1000e-Fix-e1000_check_for_copper_link_ich8lan-retur.patch create mode 100644 libre/linux-libre/0003-xfrm-Fix-stack-out-of-bounds-read-on-socket-policy-l.patch create mode 100644 libre/linux-libre/0004-drm-i915-edp-Only-use-the-alternate-fixed-mode-if-it.patch delete mode 100644 libre/linux-libre/0005-cgroup-fix-css_task_iter-crash-on-CSS_TASK_ITER_PROC.patch create mode 100644 libre/linux-libre/linux.install.pkg diff --git a/libre/linux-libre-lts/linux.install.pkg b/libre/linux-libre-lts/linux.install.pkg new file mode 100644 index 000000000..dccacd0bc --- /dev/null +++ b/libre/linux-libre-lts/linux.install.pkg @@ -0,0 +1,31 @@ +post_install () { + # updating module dependencies + echo ">>> Updating module dependencies. Please wait ..." + depmod 4.9.78-gnu-1-lts + if [ "$(uname -m)" = "armv7l" ]; then + echo ">>> WARNING: Using this kernel requires an updated U-Boot!" + fi +} + +post_upgrade() { + # updating module dependencies + echo ">>> Updating module dependencies. Please wait ..." + depmod 4.9.78-gnu-1-lts + if [ "$(uname -m)" = "x86_64" ] || [ "$(uname -m)" = "i686" ]; then + if findmnt --fstab -uno SOURCE /boot &>/dev/null && ! mountpoint -q /boot; then + echo "WARNING: /boot appears to be a separate partition but is not mounted." + fi + + if [ $(vercmp $2 3.13) -lt 0 ]; then + echo ">>> WARNING: AT keyboard support is no longer built into the kernel." + echo ">>> In order to use your keyboard during early init, you MUST" + echo ">>> include the 'keyboard' hook in your mkinitcpio.conf." + fi + fi +} + +post_remove() { + # also remove the compat symlinks + rm -f boot/initramfs-linux-libre-lts.img + rm -f boot/initramfs-linux-libre-lts-fallback.img +} diff --git a/libre/linux-libre/0001-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch b/libre/linux-libre/0001-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch index 64341b9b7..a989d666a 100644 --- a/libre/linux-libre/0001-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch +++ b/libre/linux-libre/0001-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch @@ -1,8 +1,8 @@ -From fb89d912d5f7289d3a922c77b671e36e1c740f5e Mon Sep 17 00:00:00 2001 -Message-Id: +From 4e54373158caa50df5402fdd3db1794c5394026b Mon Sep 17 00:00:00 2001 +Message-Id: <4e54373158caa50df5402fdd3db1794c5394026b.1516188238.git.jan.steffens@gmail.com> From: Serge Hallyn Date: Fri, 31 May 2013 19:12:12 +0100 -Subject: [PATCH 1/7] add sysctl to disallow unprivileged CLONE_NEWUSER by +Subject: [PATCH 1/4] add sysctl to disallow unprivileged CLONE_NEWUSER by default Signed-off-by: Serge Hallyn @@ -15,7 +15,7 @@ Signed-off-by: Daniel Micay 3 files changed, 30 insertions(+) diff --git a/kernel/fork.c b/kernel/fork.c -index 500ce64517d93e68..35f5860958b40e9b 100644 +index 500ce64517d9..35f5860958b4 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -102,6 +102,11 @@ @@ -55,7 +55,7 @@ index 500ce64517d93e68..35f5860958b40e9b 100644 if (err) goto bad_unshare_out; diff --git a/kernel/sysctl.c b/kernel/sysctl.c -index 56aca862c4f584f5..e8402ba393c1915d 100644 +index 56aca862c4f5..e8402ba393c1 100644 --- a/kernel/sysctl.c +++ b/kernel/sysctl.c @@ -105,6 +105,9 @@ extern int core_uses_pid; @@ -85,7 +85,7 @@ index 56aca862c4f584f5..e8402ba393c1915d 100644 { .procname = "tainted", diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c -index c490f1e4313b998a..dd03bd39d7bf194d 100644 +index c490f1e4313b..dd03bd39d7bf 100644 --- a/kernel/user_namespace.c +++ b/kernel/user_namespace.c @@ -24,6 +24,9 @@ diff --git a/libre/linux-libre/0002-dccp-CVE-2017-8824-use-after-free-in-DCCP-code.patch b/libre/linux-libre/0002-dccp-CVE-2017-8824-use-after-free-in-DCCP-code.patch new file mode 100644 index 000000000..daa9a9fc2 --- /dev/null +++ b/libre/linux-libre/0002-dccp-CVE-2017-8824-use-after-free-in-DCCP-code.patch @@ -0,0 +1,56 @@ +From 8514970bf07bd1cc522f50e882e0159a51a39264 Mon Sep 17 00:00:00 2001 +Message-Id: <8514970bf07bd1cc522f50e882e0159a51a39264.1516188238.git.jan.steffens@gmail.com> +In-Reply-To: <4e54373158caa50df5402fdd3db1794c5394026b.1516188238.git.jan.steffens@gmail.com> +References: <4e54373158caa50df5402fdd3db1794c5394026b.1516188238.git.jan.steffens@gmail.com> +From: Mohamed Ghannam +Date: Tue, 5 Dec 2017 20:58:35 +0000 +Subject: [PATCH 2/4] dccp: CVE-2017-8824: use-after-free in DCCP code + +Whenever the sock object is in DCCP_CLOSED state, +dccp_disconnect() must free dccps_hc_tx_ccid and +dccps_hc_rx_ccid and set to NULL. + +Signed-off-by: Mohamed Ghannam +Reviewed-by: Eric Dumazet +Signed-off-by: David S. Miller +--- + net/dccp/proto.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/net/dccp/proto.c b/net/dccp/proto.c +index b68168fcc06a..9d43c1f40274 100644 +--- a/net/dccp/proto.c ++++ b/net/dccp/proto.c +@@ -259,25 +259,30 @@ int dccp_disconnect(struct sock *sk, int flags) + { + struct inet_connection_sock *icsk = inet_csk(sk); + struct inet_sock *inet = inet_sk(sk); ++ struct dccp_sock *dp = dccp_sk(sk); + int err = 0; + const int old_state = sk->sk_state; + + if (old_state != DCCP_CLOSED) + dccp_set_state(sk, DCCP_CLOSED); + + /* + * This corresponds to the ABORT function of RFC793, sec. 3.8 + * TCP uses a RST segment, DCCP a Reset packet with Code 2, "Aborted". + */ + if (old_state == DCCP_LISTEN) { + inet_csk_listen_stop(sk); + } else if (dccp_need_reset(old_state)) { + dccp_send_reset(sk, DCCP_RESET_CODE_ABORTED); + sk->sk_err = ECONNRESET; + } else if (old_state == DCCP_REQUESTING) + sk->sk_err = ECONNRESET; + + dccp_clear_xmit_timers(sk); ++ ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk); ++ ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk); ++ dp->dccps_hc_rx_ccid = NULL; ++ dp->dccps_hc_tx_ccid = NULL; + + __skb_queue_purge(&sk->sk_receive_queue); + __skb_queue_purge(&sk->sk_write_queue); +-- +2.15.1 diff --git a/libre/linux-libre/0002-e1000e-Fix-e1000_check_for_copper_link_ich8lan-retur.patch b/libre/linux-libre/0002-e1000e-Fix-e1000_check_for_copper_link_ich8lan-retur.patch deleted file mode 100644 index 8c23c9a54..000000000 --- a/libre/linux-libre/0002-e1000e-Fix-e1000_check_for_copper_link_ich8lan-retur.patch +++ /dev/null @@ -1,75 +0,0 @@ -From 8c6956686606b9c3661e74a410c8cb2fc276c5ee Mon Sep 17 00:00:00 2001 -Message-Id: <8c6956686606b9c3661e74a410c8cb2fc276c5ee.1514959852.git.jan.steffens@gmail.com> -In-Reply-To: -References: -From: Benjamin Poirier -Date: Mon, 11 Dec 2017 16:26:40 +0900 -Subject: [PATCH 2/7] e1000e: Fix e1000_check_for_copper_link_ich8lan return - value. - -e1000e_check_for_copper_link() and e1000_check_for_copper_link_ich8lan() -are the two functions that may be assigned to mac.ops.check_for_link when -phy.media_type == e1000_media_type_copper. Commit 19110cfbb34d ("e1000e: -Separate signaling for link check/link up") changed the meaning of the -return value of check_for_link for copper media but only adjusted the first -function. This patch adjusts the second function likewise. - -Reported-by: Christian Hesse -Reported-by: Gabriel C -Link: https://bugzilla.kernel.org/show_bug.cgi?id=198047 -Fixes: 19110cfbb34d ("e1000e: Separate signaling for link check/link up") -Tested-by: Christian Hesse -Signed-off-by: Benjamin Poirier ---- - drivers/net/ethernet/intel/e1000e/ich8lan.c | 11 ++++++++--- - 1 file changed, 8 insertions(+), 3 deletions(-) - -diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c -index d6d4ed7acf031172..31277d3bb7dc1241 100644 ---- a/drivers/net/ethernet/intel/e1000e/ich8lan.c -+++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c -@@ -1367,22 +1367,25 @@ static s32 e1000_disable_ulp_lpt_lp(struct e1000_hw *hw, bool force) - * Checks to see of the link status of the hardware has changed. If a - * change in link status has been detected, then we read the PHY registers - * to get the current speed/duplex if link exists. -+ * -+ * Returns a negative error code (-E1000_ERR_*) or 0 (link down) or 1 (link -+ * up). - **/ - static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw) - { - struct e1000_mac_info *mac = &hw->mac; - s32 ret_val, tipg_reg = 0; - u16 emi_addr, emi_val = 0; - bool link; - u16 phy_reg; - - /* We only want to go out to the PHY registers to see if Auto-Neg - * has completed and/or if our link status has changed. The - * get_link_status flag is set upon receiving a Link Status - * Change or Rx Sequence Error interrupt. - */ - if (!mac->get_link_status) -- return 0; -+ return 1; - - /* First we want to see if the MII Status Register reports - * link. If so, then we want to get the current speed/duplex -@@ -1613,10 +1616,12 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw) - * different link partner. - */ - ret_val = e1000e_config_fc_after_link_up(hw); -- if (ret_val) -+ if (ret_val) { - e_dbg("Error configuring flow control\n"); -+ return ret_val; -+ } - -- return ret_val; -+ return 1; - } - - static s32 e1000_get_variants_ich8lan(struct e1000_adapter *adapter) --- -2.15.1 - diff --git a/libre/linux-libre/0003-dccp-CVE-2017-8824-use-after-free-in-DCCP-code.patch b/libre/linux-libre/0003-dccp-CVE-2017-8824-use-after-free-in-DCCP-code.patch index d7872e2a1..da886c8a5 100644 --- a/libre/linux-libre/0003-dccp-CVE-2017-8824-use-after-free-in-DCCP-code.patch +++ b/libre/linux-libre/0003-dccp-CVE-2017-8824-use-after-free-in-DCCP-code.patch @@ -1,10 +1,10 @@ -From b81e273fb227373a2951c7256ab11a87d5333a9d Mon Sep 17 00:00:00 2001 -Message-Id: -In-Reply-To: -References: +From 8514970bf07bd1cc522f50e882e0159a51a39264 Mon Sep 17 00:00:00 2001 +Message-Id: <8514970bf07bd1cc522f50e882e0159a51a39264.1516188238.git.jan.steffens@gmail.com> +In-Reply-To: <4e54373158caa50df5402fdd3db1794c5394026b.1516188238.git.jan.steffens@gmail.com> +References: <4e54373158caa50df5402fdd3db1794c5394026b.1516188238.git.jan.steffens@gmail.com> From: Mohamed Ghannam Date: Tue, 5 Dec 2017 20:58:35 +0000 -Subject: [PATCH 3/7] dccp: CVE-2017-8824: use-after-free in DCCP code +Subject: [PATCH 2/4] dccp: CVE-2017-8824: use-after-free in DCCP code Whenever the sock object is in DCCP_CLOSED state, dccp_disconnect() must free dccps_hc_tx_ccid and @@ -18,7 +18,7 @@ Signed-off-by: David S. Miller 1 file changed, 5 insertions(+) diff --git a/net/dccp/proto.c b/net/dccp/proto.c -index b68168fcc06aa198..9d43c1f4027408f3 100644 +index b68168fcc06a..9d43c1f40274 100644 --- a/net/dccp/proto.c +++ b/net/dccp/proto.c @@ -259,25 +259,30 @@ int dccp_disconnect(struct sock *sk, int flags) diff --git a/libre/linux-libre/0003-xfrm-Fix-stack-out-of-bounds-read-on-socket-policy-l.patch b/libre/linux-libre/0003-xfrm-Fix-stack-out-of-bounds-read-on-socket-policy-l.patch new file mode 100644 index 000000000..3ccb5289b --- /dev/null +++ b/libre/linux-libre/0003-xfrm-Fix-stack-out-of-bounds-read-on-socket-policy-l.patch @@ -0,0 +1,48 @@ +From c9c8995fc83b476fdf3fc0c4b498feef2949ec75 Mon Sep 17 00:00:00 2001 +Message-Id: +In-Reply-To: <4e54373158caa50df5402fdd3db1794c5394026b.1516188238.git.jan.steffens@gmail.com> +References: <4e54373158caa50df5402fdd3db1794c5394026b.1516188238.git.jan.steffens@gmail.com> +From: Steffen Klassert +Date: Fri, 22 Dec 2017 10:44:57 +0100 +Subject: [PATCH 3/4] xfrm: Fix stack-out-of-bounds read on socket policy + lookup. + +When we do tunnel or beet mode, we pass saddr and daddr from the +template to xfrm_state_find(), this is ok. On transport mode, +we pass the addresses from the flowi, assuming that the IP +addresses (and address family) don't change during transformation. +This assumption is wrong in the IPv4 mapped IPv6 case, packet +is IPv4 and template is IPv6. + +Fix this by catching address family missmatches of the policy +and the flow already before we do the lookup. + +Reported-by: syzbot +Signed-off-by: Steffen Klassert +--- + net/xfrm/xfrm_policy.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c +index 6bc16bb61b55..50c5f46b5cca 100644 +--- a/net/xfrm/xfrm_policy.c ++++ b/net/xfrm/xfrm_policy.c +@@ -1169,9 +1169,15 @@ static struct xfrm_policy *xfrm_sk_policy_lookup(const struct sock *sk, int dir, + again: + pol = rcu_dereference(sk->sk_policy[dir]); + if (pol != NULL) { +- bool match = xfrm_selector_match(&pol->selector, fl, family); ++ bool match; + int err = 0; + ++ if (pol->family != family) { ++ pol = NULL; ++ goto out; ++ } ++ ++ match = xfrm_selector_match(&pol->selector, fl, family); + if (match) { + if ((sk->sk_mark & pol->mark.m) != pol->mark.v) { + pol = NULL; +-- +2.15.1 diff --git a/libre/linux-libre/0004-drm-i915-edp-Only-use-the-alternate-fixed-mode-if-it.patch b/libre/linux-libre/0004-drm-i915-edp-Only-use-the-alternate-fixed-mode-if-it.patch new file mode 100644 index 000000000..49fbe626e --- /dev/null +++ b/libre/linux-libre/0004-drm-i915-edp-Only-use-the-alternate-fixed-mode-if-it.patch @@ -0,0 +1,41 @@ +From e722c8d112f0aa9621d7d4da5223cfc7aeb45e88 Mon Sep 17 00:00:00 2001 +Message-Id: +In-Reply-To: <4e54373158caa50df5402fdd3db1794c5394026b.1516188238.git.jan.steffens@gmail.com> +References: <4e54373158caa50df5402fdd3db1794c5394026b.1516188238.git.jan.steffens@gmail.com> +From: Jim Bride +Date: Mon, 6 Nov 2017 13:38:57 -0800 +Subject: [PATCH 4/4] drm/i915/edp: Only use the alternate fixed mode if it's + asked for + +In commit dc911f5bd8aa ("drm/i915/edp: Allow alternate fixed mode for +eDP if available."), the patch allows for the use of an alternate fixed +mode if it is available, but the patch was not ensuring that the only +time the alternate mode is used is when it is specifically requested. +This patch adds an additional comparison to intel_edp_compare_alt_mode +to ensure that we only use the alternate mode if it is directly +requested. + +Fixes: dc911f5bd8aac ("Allow alternate fixed mode for eDP if available.") +Cc: David Weinehall +Cc: Rodrigo Vivi +Signed-off-by: Jim Bride +--- + drivers/gpu/drm/i915/intel_dp.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c +index 09f274419eea..838cee312e8e 100644 +--- a/drivers/gpu/drm/i915/intel_dp.c ++++ b/drivers/gpu/drm/i915/intel_dp.c +@@ -1632,7 +1632,8 @@ static bool intel_edp_compare_alt_mode(struct drm_display_mode *m1, + m1->vdisplay == m2->vdisplay && + m1->vsync_start == m2->vsync_start && + m1->vsync_end == m2->vsync_end && +- m1->vtotal == m2->vtotal); ++ m1->vtotal == m2->vtotal && ++ m1->vrefresh == m2->vrefresh); + return bres; + } + +-- +2.15.1 diff --git a/libre/linux-libre/0004-xfrm-Fix-stack-out-of-bounds-read-on-socket-policy-l.patch b/libre/linux-libre/0004-xfrm-Fix-stack-out-of-bounds-read-on-socket-policy-l.patch index edd7b24a3..8a3ea3008 100644 --- a/libre/linux-libre/0004-xfrm-Fix-stack-out-of-bounds-read-on-socket-policy-l.patch +++ b/libre/linux-libre/0004-xfrm-Fix-stack-out-of-bounds-read-on-socket-policy-l.patch @@ -1,10 +1,10 @@ -From 3721d64246982f91a5bf863fc17ac60ff722e0c4 Mon Sep 17 00:00:00 2001 -Message-Id: <3721d64246982f91a5bf863fc17ac60ff722e0c4.1514959852.git.jan.steffens@gmail.com> -In-Reply-To: -References: +From c9c8995fc83b476fdf3fc0c4b498feef2949ec75 Mon Sep 17 00:00:00 2001 +Message-Id: +In-Reply-To: <4e54373158caa50df5402fdd3db1794c5394026b.1516188238.git.jan.steffens@gmail.com> +References: <4e54373158caa50df5402fdd3db1794c5394026b.1516188238.git.jan.steffens@gmail.com> From: Steffen Klassert Date: Fri, 22 Dec 2017 10:44:57 +0100 -Subject: [PATCH 5/7] xfrm: Fix stack-out-of-bounds read on socket policy +Subject: [PATCH 3/4] xfrm: Fix stack-out-of-bounds read on socket policy lookup. When we do tunnel or beet mode, we pass saddr and daddr from the @@ -24,7 +24,7 @@ Signed-off-by: Steffen Klassert 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c -index 6bc16bb61b5533ef..50c5f46b5cca942e 100644 +index 6bc16bb61b55..50c5f46b5cca 100644 --- a/net/xfrm/xfrm_policy.c +++ b/net/xfrm/xfrm_policy.c @@ -1169,9 +1169,15 @@ static struct xfrm_policy *xfrm_sk_policy_lookup(const struct sock *sk, int dir, diff --git a/libre/linux-libre/0005-cgroup-fix-css_task_iter-crash-on-CSS_TASK_ITER_PROC.patch b/libre/linux-libre/0005-cgroup-fix-css_task_iter-crash-on-CSS_TASK_ITER_PROC.patch deleted file mode 100644 index 0a54ce129..000000000 --- a/libre/linux-libre/0005-cgroup-fix-css_task_iter-crash-on-CSS_TASK_ITER_PROC.patch +++ /dev/null @@ -1,114 +0,0 @@ -From a79cb4d4e540c72a601ca0494e914565c16e2893 Mon Sep 17 00:00:00 2001 -Message-Id: -In-Reply-To: -References: -From: Tejun Heo -Date: Wed, 20 Dec 2017 07:09:19 -0800 -Subject: [PATCH 6/7] cgroup: fix css_task_iter crash on CSS_TASK_ITER_PROC - -While teaching css_task_iter to handle skipping over tasks which -aren't group leaders, bc2fb7ed089f ("cgroup: add @flags to -css_task_iter_start() and implement CSS_TASK_ITER_PROCS") introduced a -silly bug. - -CSS_TASK_ITER_PROCS is implemented by repeating -css_task_iter_advance() while the advanced cursor is pointing to a -non-leader thread. However, the cursor variable, @l, wasn't updated -when the iteration has to advance to the next css_set and the -following repetition would operate on the terminal @l from the -previous iteration which isn't pointing to a valid task leading to -oopses like the following or infinite looping. - - BUG: unable to handle kernel NULL pointer dereference at 0000000000000254 - IP: __task_pid_nr_ns+0xc7/0xf0 - PGD 0 P4D 0 - Oops: 0000 [#1] SMP - ... - CPU: 2 PID: 1 Comm: systemd Not tainted 4.14.4-200.fc26.x86_64 #1 - Hardware name: System manufacturer System Product Name/PRIME B350M-A, BIOS 3203 11/09/2017 - task: ffff88c4baee8000 task.stack: ffff96d5c3158000 - RIP: 0010:__task_pid_nr_ns+0xc7/0xf0 - RSP: 0018:ffff96d5c315bd50 EFLAGS: 00010206 - RAX: 0000000000000000 RBX: ffff88c4b68c6000 RCX: 0000000000000250 - RDX: ffffffffa5e47960 RSI: 0000000000000000 RDI: ffff88c490f6ab00 - RBP: ffff96d5c315bd50 R08: 0000000000001000 R09: 0000000000000005 - R10: ffff88c4be006b80 R11: ffff88c42f1b8004 R12: ffff96d5c315bf18 - R13: ffff88c42d7dd200 R14: ffff88c490f6a510 R15: ffff88c4b68c6000 - FS: 00007f9446f8ea00(0000) GS:ffff88c4be680000(0000) knlGS:0000000000000000 - CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 - CR2: 0000000000000254 CR3: 00000007f956f000 CR4: 00000000003406e0 - Call Trace: - cgroup_procs_show+0x19/0x30 - cgroup_seqfile_show+0x4c/0xb0 - kernfs_seq_show+0x21/0x30 - seq_read+0x2ec/0x3f0 - kernfs_fop_read+0x134/0x180 - __vfs_read+0x37/0x160 - ? security_file_permission+0x9b/0xc0 - vfs_read+0x8e/0x130 - SyS_read+0x55/0xc0 - entry_SYSCALL_64_fastpath+0x1a/0xa5 - RIP: 0033:0x7f94455f942d - RSP: 002b:00007ffe81ba2d00 EFLAGS: 00000293 ORIG_RAX: 0000000000000000 - RAX: ffffffffffffffda RBX: 00005574e2233f00 RCX: 00007f94455f942d - RDX: 0000000000001000 RSI: 00005574e2321a90 RDI: 000000000000002b - RBP: 0000000000000000 R08: 00005574e2321a90 R09: 00005574e231de60 - R10: 00007f94458c8b38 R11: 0000000000000293 R12: 00007f94458c8ae0 - R13: 00007ffe81ba3800 R14: 0000000000000000 R15: 00005574e2116560 - Code: 04 74 0e 89 f6 48 8d 04 76 48 8d 04 c5 f0 05 00 00 48 8b bf b8 05 00 00 48 01 c7 31 c0 48 8b 0f 48 85 c9 74 18 8b b2 30 08 00 00 <3b> 71 04 77 0d 48 c1 e6 05 48 01 f1 48 3b 51 38 74 09 5d c3 8b - RIP: __task_pid_nr_ns+0xc7/0xf0 RSP: ffff96d5c315bd50 - -Fix it by moving the initialization of the cursor below the repeat -label. While at it, rename it to @next for readability. - -Signed-off-by: Tejun Heo -Fixes: bc2fb7ed089f ("cgroup: add @flags to css_task_iter_start() and implement CSS_TASK_ITER_PROCS") -Cc: stable@vger.kernel.org # v4.14+ -Reported-by: Laura Abbott -Reported-by: Bronek Kozicki -Reported-by: George Amanakis -Signed-off-by: Tejun Heo ---- - kernel/cgroup/cgroup.c | 14 ++++++-------- - 1 file changed, 6 insertions(+), 8 deletions(-) - -diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c -index 44857278eb8aa6a2..030e4286f14c715e 100644 ---- a/kernel/cgroup/cgroup.c -+++ b/kernel/cgroup/cgroup.c -@@ -4059,26 +4059,24 @@ static void css_task_iter_advance_css_set(struct css_task_iter *it) - - static void css_task_iter_advance(struct css_task_iter *it) - { -- struct list_head *l = it->task_pos; -+ struct list_head *next; - - lockdep_assert_held(&css_set_lock); -- WARN_ON_ONCE(!l); -- - repeat: - /* - * Advance iterator to find next entry. cset->tasks is consumed - * first and then ->mg_tasks. After ->mg_tasks, we move onto the - * next cset. - */ -- l = l->next; -+ next = it->task_pos->next; - -- if (l == it->tasks_head) -- l = it->mg_tasks_head->next; -+ if (next == it->tasks_head) -+ next = it->mg_tasks_head->next; - -- if (l == it->mg_tasks_head) -+ if (next == it->mg_tasks_head) - css_task_iter_advance_css_set(it); - else -- it->task_pos = l; -+ it->task_pos = next; - - /* if PROCS, skip over tasks which aren't group leaders */ - if ((it->flags & CSS_TASK_ITER_PROCS) && it->task_pos && --- -2.15.1 - diff --git a/libre/linux-libre/0006-drm-i915-edp-Only-use-the-alternate-fixed-mode-if-it.patch b/libre/linux-libre/0006-drm-i915-edp-Only-use-the-alternate-fixed-mode-if-it.patch index 5d36d15ac..f77c9b5c1 100644 --- a/libre/linux-libre/0006-drm-i915-edp-Only-use-the-alternate-fixed-mode-if-it.patch +++ b/libre/linux-libre/0006-drm-i915-edp-Only-use-the-alternate-fixed-mode-if-it.patch @@ -1,10 +1,10 @@ -From cf45be4971bdd769c09e2a11db483510cd0bcc5f Mon Sep 17 00:00:00 2001 -Message-Id: -In-Reply-To: <0b716bdb952b678d9bb5eb32198dbc82ec492df2.1515173964.git.jan.steffens@gmail.com> -References: <0b716bdb952b678d9bb5eb32198dbc82ec492df2.1515173964.git.jan.steffens@gmail.com> +From e722c8d112f0aa9621d7d4da5223cfc7aeb45e88 Mon Sep 17 00:00:00 2001 +Message-Id: +In-Reply-To: <4e54373158caa50df5402fdd3db1794c5394026b.1516188238.git.jan.steffens@gmail.com> +References: <4e54373158caa50df5402fdd3db1794c5394026b.1516188238.git.jan.steffens@gmail.com> From: Jim Bride Date: Mon, 6 Nov 2017 13:38:57 -0800 -Subject: [PATCH 6/6] drm/i915/edp: Only use the alternate fixed mode if it's +Subject: [PATCH 4/4] drm/i915/edp: Only use the alternate fixed mode if it's asked for In commit dc911f5bd8aa ("drm/i915/edp: Allow alternate fixed mode for @@ -24,7 +24,7 @@ Signed-off-by: Jim Bride 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c -index 09f274419eea1c74..838cee312e8e6978 100644 +index 09f274419eea..838cee312e8e 100644 --- a/drivers/gpu/drm/i915/intel_dp.c +++ b/drivers/gpu/drm/i915/intel_dp.c @@ -1632,7 +1632,8 @@ static bool intel_edp_compare_alt_mode(struct drm_display_mode *m1, diff --git a/libre/linux-libre/PKGBUILD b/libre/linux-libre/PKGBUILD index 65f997a8a..f3dcab207 100644 --- a/libre/linux-libre/PKGBUILD +++ b/libre/linux-libre/PKGBUILD @@ -13,7 +13,7 @@ pkgbase=linux-libre # Build stock kernel #pkgbase=linux-libre-custom # Build kernel with a different name _pkgbasever=4.14-gnu -_pkgver=4.14.12-gnu +_pkgver=4.14.15-gnu _replacesarchkernel=('linux%') # '%' gets replaced with _kernelname _replacesoldkernels=() # '%' gets replaced with _kernelname @@ -57,15 +57,13 @@ source=( '0001-usb-serial-gadget-no-TTY-hangup-on-USB-disconnect-WI.patch' '0002-fix-Atmel-maXTouch-touchscreen-support.patch' '0001-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch' - '0002-e1000e-Fix-e1000_check_for_copper_link_ich8lan-retur.patch' - '0003-dccp-CVE-2017-8824-use-after-free-in-DCCP-code.patch' - '0004-xfrm-Fix-stack-out-of-bounds-read-on-socket-policy-l.patch' - '0005-cgroup-fix-css_task_iter-crash-on-CSS_TASK_ITER_PROC.patch' - '0006-drm-i915-edp-Only-use-the-alternate-fixed-mode-if-it.patch' + 0002-dccp-CVE-2017-8824-use-after-free-in-DCCP-code.patch + 0003-xfrm-Fix-stack-out-of-bounds-read-on-socket-policy-l.patch + 0004-drm-i915-edp-Only-use-the-alternate-fixed-mode-if-it.patch ) sha512sums=('0d4b0b8ec1ffc39c59295adf56f6a2cccf77cad56d8a8bf8072624bbb52ba3e684147ebed91d1528d2685423dd784c5fca0f3650f874f2b93cfc6b7689b9a87f' 'SKIP' - '2e8abb699328db2b156890b6ab966ba0c8cefbf64c909d13290c92ca99419b5fb06a53d3d93ed83ed6bd28edb6eeba73bd996f3cb2bc150c3b8709b2e2bbea17' + '1d60b4b6abb48c757c772b5c6bbefc32d525757b3841bafc277f57d7814a54468e67d7a3932fd520b89b25cfb95e76a644eab38093f151b962132d2a2194b816' 'SKIP' '13cb5bc42542e7b8bb104d5f68253f6609e463b6799800418af33eb0272cc269aaa36163c3e6f0aacbdaaa1d05e2827a4a7c4a08a029238439ed08b89c564bb3' 'SKIP' @@ -73,13 +71,13 @@ sha512sums=('0d4b0b8ec1ffc39c59295adf56f6a2cccf77cad56d8a8bf8072624bbb52ba3e6841 'SKIP' '7a3716bfe3b9f546da309c7492f3e08f8f506813afeb1c737a474c83313d5c313cf4582b65215c2cfce3b74d9d1021c96e8badafe8f6e5b01fe28d2b5c61ae78' 'SKIP' - '702101a78169ad81532f416b44b74bf7723055169027489a1e95eea9909ed693f20fe3a595152f284cc0837ff09202231a82285c55c25db35447d15492f21aed' - 'c0cad633c02bfb3ac0dd3c3daaa044b808bf6f3cfbd1035c31d95dfca338d3ad0eae50f6d9c264f6e8eaa3b590d8b500401509f55f8198406c726f6727ce0b05' - '7ff4babbe27585e0576d0a66f03cf41bd7556f8047db36f5e1f8391f1c624466fb714a7cfd0d91ae608eb5a123dfb7ad315ee900d8a81c9a2b1b769f4eb356a4' + '4784b6edca29f6a23c1e90f268125e8e43a4c5559ab7cfb638fa642596b17e0b5190680ee026bfd16c69bb28a982d210a9e85ed385b4d06261bcef9dc8b9ad74' + '38836173e1558f7a649cbd3d69b711b45f59b0db0b885743091bab16215c76387a3af6096836960d5260ab9c08ef0631f7c9f2c13a5843e8a962e0ffe631f73e' + 'ad197b2cfd3221c4663bc5bfe4123e6f0a268fa4f7f8b236c0cb8383f82724a3fcda483406cbf6a6b30051a1188a720ede7cd6dc0fab808734b8be05a67af521' '7ad5be75ee422dda3b80edd2eb614d8a9181e2c8228cd68b3881e2fb95953bf2dea6cbe7900ce1013c9de89b2802574b7b24869fc5d7a95d3cc3112c4d27063a' '4a8b324aee4cccf3a512ad04ce1a272d14e5b05c8de90feb82075f55ea3845948d817e1b0c6f298f5816834ddd3e5ce0a0e2619866289f3c1ab8fd2f35f04f44' '2dc6b0ba8f7dbf19d2446c5c5f1823587de89f4e28e9595937dd51a87755099656f2acec50e3e2546ea633ad1bfd1c722e0c2b91eef1d609103d8abdc0a7cbaf' - '6a9a290f0fa71973f40a0335017b65bac0486fe719fa79d5cab9358d03c43613f796f5cfcf68bd89964fcb71e05dcead40516b28f78cd25ab9a841c05cbd5874' + '02ca6d0bb935ae6f9049ba363f5f0157b4dfd0e4181c65bedb7c0009a0accb6e8d4bb663cb61dd8b095cdd6684e5cbad5966ee6bffd65f0c3d4524b3faee225e' 'SKIP' '29c709ee6892a668c77945142ed9749cb8a3135575a4316f4a3cc85fbda41c09fdd65e32507b654c96aa438bd2aed08c09919bb162daee969643aafd053321c4' '5b35ef2c675aed00ddf82b8a96a486230fad78f05b5a69c95a57632d6c7f428f026439f3ced72cf54156ffd4fd563e68d4285ba6f42428c00b966257951039c3' @@ -92,12 +90,10 @@ sha512sums=('0d4b0b8ec1ffc39c59295adf56f6a2cccf77cad56d8a8bf8072624bbb52ba3e6841 'f813d51834cedc23fabbb6060709a24f29969fea5aeb963fdeddb79723014ffc0c6d34be45eea8419d5087a5a9c561a42a113d667f03625283f2f2fc68196545' '02af4dd2a007e41db0c63822c8ab3b80b5d25646af1906dc85d0ad9bb8bbf5236f8e381d7f91cf99ed4b0978c50aee37cb9567cdeef65b7ec3d91b882852b1af' 'b8fe56e14006ab866970ddbd501c054ae37186ddc065bb869cf7d18db8c0d455118d5bda3255fb66a0dde38b544655cfe9040ffe46e41d19830b47959b2fb168' - '05f2c577450cfeae4b66a7d022a9dd0dab0dbf36e9738423efa8f45aaf0755b48a89f1f88b042946205e681458f76c5c5177c16869094839b7b234e0e2b27511' - 'fd9bdc818326fa36c9f1813d0d1821de5e325b646e1c307c197ad38bada7f298d35b4bc1bbf1c2854689f3ba71144879e799a1123037caccd6e3f64edfc22d54' - '814517d08c35cc886fe3382619d41107d6139a703c27186d0ce58e187eaf4e84891572e58246750ac8602555794ed6f74d946565b98860787a0aa617fb946dda' - 'e6605e923c967b5f8db619868b15ea5b0d4254c62cf12bb920f38659933d6ca25a643d3e044c4915a8309071461f5f14c55d0aa0329c113bce4780d4fa3afbb7' - '0dec1482efe6e5d762a3061f365e43191484f055b738112452b8ca39e162b935d99cf16b25c0b253d6b532fabc54bde2f5c09be91887156ed6ae06d1558f94b9' - 'fcc40dc86dd432be76854e3c51889db488de0f1029ecc227b92c4f58c62ba928f7dc3b9515ac3ca0a08d6a0a72ca4a1a754d47c4fb274fe89f09a2a336088e7a') + '485f37aca7793cee2361e126bc619e5bfd1737bff484b06bbba76cd326f3845c4d96c17bb9a56623a653b7b7062a698975d6a7f019f5c1a3eb9faf9b352d73f2' + 'bfdeecfc8caaca6b53a396564ba2d9684b0364ccd90843804f64c37503f3070b29afde76dc011a2c801fdfb6dd6cbfffb5fe804d52a1406b0c4f4f7450f66140' + 'd8014f72d8e73477b2fedafccaa527761584a92bfaea4c419d95a7a5a9e15093645dc43df7da5fc0074b02d2458eac1f57cb5b85caa5b1eb1f645e88b23009eb' + '19c79def1992c461b2ddce668099a0fbcecd443dbc3fd7ba21dfcdf9ae14ab497ca3085cdd15bcbc8f4b2bbd2385fe4014ac225fcd365cea651851a9f21d572f') validpgpkeys=( '474402C8C582DAFBE389C427BCB7CF877E7D47A7' # Alexandre Oliva '6DB9C4B4F0D8C0DC432CF6E4227CA7C556B2BA78' # David P. @@ -153,20 +149,14 @@ prepare() { # disable USER_NS for non-root users by default patch -Np1 -i ../0001-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch - # https://bugs.archlinux.org/task/56575 - patch -Np1 -i ../0002-e1000e-Fix-e1000_check_for_copper_link_ich8lan-retur.patch - # https://nvd.nist.gov/vuln/detail/CVE-2017-8824 - patch -Np1 -i ../0003-dccp-CVE-2017-8824-use-after-free-in-DCCP-code.patch + patch -Np1 -i ../0002-dccp-CVE-2017-8824-use-after-free-in-DCCP-code.patch # https://bugs.archlinux.org/task/56605 - patch -Np1 -i ../0004-xfrm-Fix-stack-out-of-bounds-read-on-socket-policy-l.patch - - # https://bugs.archlinux.org/task/56846 - patch -Np1 -i ../0005-cgroup-fix-css_task_iter-crash-on-CSS_TASK_ITER_PROC.patch - + patch -Np1 -i ../0003-xfrm-Fix-stack-out-of-bounds-read-on-socket-policy-l.patch + # https://bugs.archlinux.org/task/56711 - patch -Np1 -i ../0006-drm-i915-edp-Only-use-the-alternate-fixed-mode-if-it.patch + patch -Np1 -i ../0004-drm-i915-edp-Only-use-the-alternate-fixed-mode-if-it.patch # maintain the TTY over USB disconnects # http://www.coreboot.org/EHCI_Gadget_Debug @@ -353,6 +343,9 @@ _package-headers() { # remove files already in linux-docs package rm -r "${_builddir}/Documentation" + # remove now broken symlinks + find -L "${_builddir}" -type l -printf 'Removing %P\n' -delete + # parabola changes # # since we don't want to diverge too much from arch's pkgbuild, we'll diff --git a/libre/linux-libre/config.armv7h b/libre/linux-libre/config.armv7h index 7c369dcac..ea99b73df 100644 --- a/libre/linux-libre/config.armv7h +++ b/libre/linux-libre/config.armv7h @@ -7130,6 +7130,7 @@ CONFIG_VIDEO_BCM2835=m # CONFIG_TYPEC_TCPM is not set # CONFIG_PI433 is not set # CONFIG_GOLDFISH is not set +CONFIG_RETPOLINE=y CONFIG_CHROME_PLATFORMS=y CONFIG_CROS_EC_CHARDEV=y CONFIG_CROS_EC_PROTO=y diff --git a/libre/linux-libre/config.i686 b/libre/linux-libre/config.i686 index 207de9398..814c779b9 100644 --- a/libre/linux-libre/config.i686 +++ b/libre/linux-libre/config.i686 @@ -425,6 +425,7 @@ CONFIG_X86_FAST_FEATURE_TESTS=y CONFIG_X86_MPPARSE=y # CONFIG_X86_BIGSMP is not set # CONFIG_GOLDFISH is not set +CONFIG_RETPOLINE=y CONFIG_INTEL_RDT=y # CONFIG_X86_EXTENDED_PLATFORM is not set CONFIG_X86_INTEL_LPSS=y @@ -1811,6 +1812,7 @@ CONFIG_DEV_COREDUMP=y # CONFIG_SYS_HYPERVISOR is not set # CONFIG_GENERIC_CPU_DEVICES is not set CONFIG_GENERIC_CPU_AUTOPROBE=y +CONFIG_GENERIC_CPU_VULNERABILITIES=y CONFIG_REGMAP=y CONFIG_REGMAP_I2C=y CONFIG_REGMAP_SPI=y diff --git a/libre/linux-libre/config.x86_64 b/libre/linux-libre/config.x86_64 index 0cdd17a02..ec60eb8da 100644 --- a/libre/linux-libre/config.x86_64 +++ b/libre/linux-libre/config.x86_64 @@ -446,6 +446,7 @@ CONFIG_X86_FAST_FEATURE_TESTS=y CONFIG_X86_X2APIC=y CONFIG_X86_MPPARSE=y # CONFIG_GOLDFISH is not set +CONFIG_RETPOLINE=y CONFIG_INTEL_RDT=y # CONFIG_X86_EXTENDED_PLATFORM is not set CONFIG_X86_INTEL_LPSS=y @@ -1839,6 +1840,7 @@ CONFIG_DEV_COREDUMP=y CONFIG_SYS_HYPERVISOR=y # CONFIG_GENERIC_CPU_DEVICES is not set CONFIG_GENERIC_CPU_AUTOPROBE=y +CONFIG_GENERIC_CPU_VULNERABILITIES=y CONFIG_REGMAP=y CONFIG_REGMAP_I2C=y CONFIG_REGMAP_SPI=y diff --git a/libre/linux-libre/linux.install.pkg b/libre/linux-libre/linux.install.pkg new file mode 100644 index 000000000..dc4440d29 --- /dev/null +++ b/libre/linux-libre/linux.install.pkg @@ -0,0 +1,12 @@ +post_upgrade() { + if [ "$(uname -m)" = "x86_64" ] || [ "$(uname -m)" = "i686" ]; then + if findmnt --fstab -uno SOURCE /boot &>/dev/null && ! mountpoint -q /boot; then + echo "WARNING: /boot appears to be a separate partition but is not mounted." + fi + fi +} + +post_remove() { + rm -f boot/initramfs-linux-libre.img + rm -f boot/initramfs-linux-libre-fallback.img +} -- cgit v1.2.3