diff --git a/kernel/drivers/module-bbswitch/pspec.xml b/kernel/drivers/module-bbswitch/pspec.xml index 043fda2c..1d4a1dfa 100644 --- a/kernel/drivers/module-bbswitch/pspec.xml +++ b/kernel/drivers/module-bbswitch/pspec.xml @@ -11,7 +11,7 @@ Kernel module allowing to switch dedicated graphics card on Optimus laptops kernel module allowing to switch dedicated graphics card on Optimus laptops - kernel-module-headers + kernel-module-headers https://github.com/Bumblebee-Project/bbswitch/archive/v0.8.tar.gz @@ -20,7 +20,7 @@ module-bbswitch - kernel + kernel /lib/modules @@ -34,6 +34,13 @@ + + 2015-11-11 + 0.8 + Rebuild for kernel-4.2.6. + Ertuğrul Erata + ertugrulerata@gmail.com + 2015-11-30 0.8 diff --git a/kernel/drivers/module-broadcom-wl/pspec.xml b/kernel/drivers/module-broadcom-wl/pspec.xml index bcd5cf54..62cfb19e 100644 --- a/kernel/drivers/module-broadcom-wl/pspec.xml +++ b/kernel/drivers/module-broadcom-wl/pspec.xml @@ -15,7 +15,7 @@ http://www.broadcom.com/docs/linux_sta/hybrid-v35-nodebug-pcoem-6_30_223_248.tar.gz http://www.broadcom.com/docs/linux_sta/hybrid-v35_64-nodebug-pcoem-6_30_223_248.tar.gz - kernel-module-headers + kernel-module-headers patch/linux-40.patch @@ -32,7 +32,7 @@ module-broadcom-wl - kernel + kernel module-broadcom-wl-userspace @@ -64,6 +64,13 @@ + + 2015-11-11 + 6.30.223.248 + Rebuild for kernel 4.2.6. + Ertuğrul Erata + ertugrulerata@gmail.com + 2015-11-30 6.30.223.248 diff --git a/kernel/drivers/module-virtualbox-guest/pspec.xml b/kernel/drivers/module-virtualbox-guest/pspec.xml index c45315d6..338231ba 100644 --- a/kernel/drivers/module-virtualbox-guest/pspec.xml +++ b/kernel/drivers/module-virtualbox-guest/pspec.xml @@ -14,14 +14,14 @@ This package provides the kernel modules needed for mouse integration and shared folder support between VirtualBox host and guest systems. http://sourceforge.net/projects/pisilinux/files/source/module-virtualbox-guest-5.0.4.tar.xz - kernel-module-headers + kernel-module-headers module-virtualbox-guest - kernel + kernel baselayout module-virtualbox-guest-userspace @@ -52,6 +52,13 @@ + + 2015-11-11 + 5.0.4 + Rebuild for kernel-4.2.6. + Ertuğrul Erata + ertugrulerata@gmail.com + 2015-11-30 5.0.4 diff --git a/kernel/drivers/module-virtualbox/pspec.xml b/kernel/drivers/module-virtualbox/pspec.xml index c8bf8bd8..a432fe8e 100644 --- a/kernel/drivers/module-virtualbox/pspec.xml +++ b/kernel/drivers/module-virtualbox/pspec.xml @@ -14,14 +14,14 @@ This package provides the kernel support for VirtualBox. http://sourceforge.net/projects/pisilinux/files/source/module-virtualbox-5.0.4.tar.xz - kernel-module-headers + kernel-module-headers module-virtualbox - kernel + kernel module-virtualbox-userspace @@ -47,6 +47,13 @@ + + 2015-11-11 + 5.0.4 + Rebuild for kernel-4.2.6. + Ertuğrul Erata + ertugrulerata@gmail.com + 2015-11-30 5.0.4 diff --git a/kernel/drivers/ndiswrapper/pspec.xml b/kernel/drivers/ndiswrapper/pspec.xml index 9bc2eacd..e54fd57a 100644 --- a/kernel/drivers/ndiswrapper/pspec.xml +++ b/kernel/drivers/ndiswrapper/pspec.xml @@ -15,7 +15,7 @@ module-ndiswrapper allows you to use Windows XP drivers for WLAN cards without proper Linux drivers. http://download.sourceforge.net/ndiswrapper/ndiswrapper-1.59.tar.gz - kernel-module-headers + kernel-module-headers support_kernel-4.0.patch @@ -29,7 +29,7 @@ ndiswrapper - kernel + kernel /lib/modules @@ -45,6 +45,13 @@ + + 2014-11-11 + 1.59 + Rebuild for kernel-4.2.6. + PisiLinux Community + admins@pisilinux.org + 2014-11-30 1.59 diff --git a/kernel/kernel/files/configs/kernel-x86_64-config b/kernel/kernel/files/configs/kernel-x86_64-config index 116045e8..c2be9da5 100644 --- a/kernel/kernel/files/configs/kernel-x86_64-config +++ b/kernel/kernel/files/configs/kernel-x86_64-config @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/x86_64 4.2.5 Kernel Configuration +# Linux/x86_64 4.2.6 Kernel Configuration # CONFIG_64BIT=y CONFIG_X86_64=y diff --git a/kernel/kernel/files/patches/linux/patch-4.2.6.xz b/kernel/kernel/files/patches/linux/patch-4.2.6.xz new file mode 100644 index 00000000..06d8f455 Binary files /dev/null and b/kernel/kernel/files/patches/linux/patch-4.2.6.xz differ diff --git a/kernel/kernel/files/patches/mageia/fs-btrfs-fix-possible-leak-in-btrfs_ioctl_balance.patch b/kernel/kernel/files/patches/mageia/fs-btrfs-fix-possible-leak-in-btrfs_ioctl_balance.patch deleted file mode 100644 index 790bf196..00000000 --- a/kernel/kernel/files/patches/mageia/fs-btrfs-fix-possible-leak-in-btrfs_ioctl_balance.patch +++ /dev/null @@ -1,53 +0,0 @@ -From 0f89abf56abbd0e1c6e3cef9813e6d9f05383c1e Mon Sep 17 00:00:00 2001 -From: Christian Engelmayer -Date: Wed, 21 Oct 2015 00:50:06 +0200 -Subject: btrfs: fix possible leak in btrfs_ioctl_balance() - -Commit 8eb934591f8b ("btrfs: check unsupported filters in balance -arguments") adds a jump to exit label out_bargs in case the argument -check fails. At this point in addition to the bargs memory, the -memory for struct btrfs_balance_control has already been allocated. -Ownership of bctl is passed to btrfs_balance() in the good case, -thus the memory is not freed due to the introduced jump. Make sure -that the memory gets freed in any case as necessary. Detected by -Coverity CID 1328378. - -Signed-off-by: Christian Engelmayer -Reviewed-by: David Sterba -Signed-off-by: Chris Mason ---- - fs/btrfs/ioctl.c | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - -diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c -index 3e3e613..8d20f3b 100644 ---- a/fs/btrfs/ioctl.c -+++ b/fs/btrfs/ioctl.c -@@ -4641,7 +4641,7 @@ locked: - - if (bctl->flags & ~(BTRFS_BALANCE_ARGS_MASK | BTRFS_BALANCE_TYPE_MASK)) { - ret = -EINVAL; -- goto out_bargs; -+ goto out_bctl; - } - - do_balance: -@@ -4655,12 +4655,15 @@ do_balance: - need_unlock = false; - - ret = btrfs_balance(bctl, bargs); -+ bctl = NULL; - - if (arg) { - if (copy_to_user(arg, bargs, sizeof(*bargs))) - ret = -EFAULT; - } - -+out_bctl: -+ kfree(bctl); - out_bargs: - kfree(bargs); - out_unlock: --- -cgit v0.11.2 - diff --git a/kernel/kernel/files/patches/mageia/input-alps-Only-the-Dell-Latitude-D420_430_620_630-have-separate-stick-button-bits.patch b/kernel/kernel/files/patches/mageia/input-alps-Only-the-Dell-Latitude-D420_430_620_630-have-separate-stick-button-bits.patch deleted file mode 100644 index 90364e15..00000000 --- a/kernel/kernel/files/patches/mageia/input-alps-Only-the-Dell-Latitude-D420_430_620_630-have-separate-stick-button-bits.patch +++ /dev/null @@ -1,115 +0,0 @@ -From: Hans de Goede -Subject: [PATCH] alps: Only the Dell Latitude D420/430/620/630 have separate stick button bits -Date: Wed, 21 Oct 2015 10:16:18 +0200 - -commit 92bac83dd79e ("Input: alps - non interleaved V2 dualpoint has -separate stick button bits") assumes that all alps v2 non-interleaved -dual point setups have the separate stick button bits. - -Later we limited this to Dell laptops only because of reports that this -broke things on non Dell laptops. Now it turns out that this breaks things -on the Dell Latitude D600 too. So it seems that only the Dell Latitude -D420/430/620/630, which all share the same touchpad / stick combo, -have these separate bits. - -This patch limits the checking of the separate bits to only these models -fixing regressions with other models. - -Reported-and-tested-by: Larry Finger -Cc: stable@vger.kernel.org -Tested-by: Hans de Goede -Signed-off-by: Hans de Goede ---- - drivers/input/mouse/alps.c | 48 ++++++++++++++++++++++++++++++++++++++++------ - 1 file changed, 42 insertions(+), 6 deletions(-) - -diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c -index 4d24686..41e6cb5 100644 ---- a/drivers/input/mouse/alps.c -+++ b/drivers/input/mouse/alps.c -@@ -100,7 +100,7 @@ static const struct alps_nibble_commands alps_v6_nibble_commands[] = { - #define ALPS_FOUR_BUTTONS 0x40 /* 4 direction button present */ - #define ALPS_PS2_INTERLEAVED 0x80 /* 3-byte PS/2 packet interleaved with - 6-byte ALPS packet */ --#define ALPS_DELL 0x100 /* device is a Dell laptop */ -+#define ALPS_STICK_BITS 0x100 /* separate stick button bits */ - #define ALPS_BUTTONPAD 0x200 /* device is a clickpad */ - - static const struct alps_model_info alps_model_data[] = { -@@ -159,6 +159,43 @@ static const struct alps_protocol_info alps_v8_protocol_data = { - ALPS_PROTO_V8, 0x18, 0x18, 0 - }; - -+/* -+ * Some v2 models report the stick buttons in separate bits -+ */ -+static const struct dmi_system_id alps_dmi_has_separate_stick_buttons[] = { -+#if defined(CONFIG_DMI) && defined(CONFIG_X86) -+ { -+ /* Extrapolated from other entries */ -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), -+ DMI_MATCH(DMI_PRODUCT_NAME, "Latitude D420"), -+ }, -+ }, -+ { -+ /* Reported-by: Hans de Bruin */ -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), -+ DMI_MATCH(DMI_PRODUCT_NAME, "Latitude D430"), -+ }, -+ }, -+ { -+ /* Reported-by: Hans de Goede */ -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), -+ DMI_MATCH(DMI_PRODUCT_NAME, "Latitude D620"), -+ }, -+ }, -+ { -+ /* Extrapolated from other entries */ -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), -+ DMI_MATCH(DMI_PRODUCT_NAME, "Latitude D630"), -+ }, -+ }, -+#endif -+ { } -+}; -+ - static void alps_set_abs_params_st(struct alps_data *priv, - struct input_dev *dev1); - static void alps_set_abs_params_semi_mt(struct alps_data *priv, -@@ -253,9 +290,8 @@ static void alps_process_packet_v1_v2(struct psmouse *psmouse) - return; - } - -- /* Dell non interleaved V2 dualpoint has separate stick button bits */ -- if (priv->proto_version == ALPS_PROTO_V2 && -- priv->flags == (ALPS_DELL | ALPS_PASS | ALPS_DUALPOINT)) { -+ /* Some models have separate stick button bits */ -+ if (priv->flags & ALPS_STICK_BITS) { - left |= packet[0] & 1; - right |= packet[0] & 2; - middle |= packet[0] & 4; -@@ -2552,8 +2588,6 @@ static int alps_set_protocol(struct psmouse *psmouse, - priv->byte0 = protocol->byte0; - priv->mask0 = protocol->mask0; - priv->flags = protocol->flags; -- if (dmi_name_in_vendors("Dell")) -- priv->flags |= ALPS_DELL; - - priv->x_max = 2000; - priv->y_max = 1400; -@@ -2568,6 +2602,8 @@ static int alps_set_protocol(struct psmouse *psmouse, - priv->set_abs_params = alps_set_abs_params_st; - priv->x_max = 1023; - priv->y_max = 767; -+ if (dmi_check_system(alps_dmi_has_separate_stick_buttons)) -+ priv->flags |= ALPS_STICK_BITS; - break; - - case ALPS_PROTO_V3: --- -2.5.0 - diff --git a/kernel/kernel/files/patches/mageia/net-netfilter-Fix-removal-of-GRE-expectation-entries-created-by-PPTP.patch b/kernel/kernel/files/patches/mageia/net-netfilter-Fix-removal-of-GRE-expectation-entries-created-by-PPTP.patch new file mode 100644 index 00000000..8f0b8b28 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/net-netfilter-Fix-removal-of-GRE-expectation-entries-created-by-PPTP.patch @@ -0,0 +1,31 @@ +From c255cb2ed3c7960b2c68f45de1dc0ac2197c8f78 Mon Sep 17 00:00:00 2001 +From: Anthony Lineham +Date: Thu, 22 Oct 2015 11:17:03 +1300 +Subject: netfilter: Fix removal of GRE expectation entries created by PPTP + +The uninitialized tuple structure caused incorrect hash calculation +and the lookup failed. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=106441 +Signed-off-by: Anthony Lineham +Signed-off-by: Pablo Neira Ayuso +--- + net/ipv4/netfilter/nf_nat_pptp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/ipv4/netfilter/nf_nat_pptp.c b/net/ipv4/netfilter/nf_nat_pptp.c +index 657d230..b3ca21b 100644 +--- a/net/ipv4/netfilter/nf_nat_pptp.c ++++ b/net/ipv4/netfilter/nf_nat_pptp.c +@@ -45,7 +45,7 @@ static void pptp_nat_expected(struct nf_conn *ct, + struct net *net = nf_ct_net(ct); + const struct nf_conn *master = ct->master; + struct nf_conntrack_expect *other_exp; +- struct nf_conntrack_tuple t; ++ struct nf_conntrack_tuple t = {}; + const struct nf_ct_pptp_master *ct_pptp_info; + const struct nf_nat_pptp *nat_pptp_info; + struct nf_nat_range range; +-- +cgit v0.11.2 + diff --git a/kernel/kernel/files/patches/mageia/net-netfilter-ipset-Fix-extension-alignment.patch b/kernel/kernel/files/patches/mageia/net-netfilter-ipset-Fix-extension-alignment.patch new file mode 100644 index 00000000..08f0e078 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/net-netfilter-ipset-Fix-extension-alignment.patch @@ -0,0 +1,481 @@ +From 95ad1f4a9358dff1dcf84bf5c9cc84caa9215f7f Mon Sep 17 00:00:00 2001 +From: Jozsef Kadlecsik +Date: Sat, 7 Nov 2015 11:21:47 +0100 +Subject: netfilter: ipset: Fix extension alignment + +The data extensions in ipset lacked the proper memory alignment and +thus could lead to kernel crash on several architectures. Therefore +the structures have been reorganized and alignment attributes added +where needed. The patch was tested on armv7h by Gerhard Wiesinger and +on x86_64, sparc64 by Jozsef Kadlecsik. + +Reported-by: Gerhard Wiesinger +Tested-by: Gerhard Wiesinger +Tested-by: Jozsef Kadlecsik +Signed-off-by: Jozsef Kadlecsik +--- + include/linux/netfilter/ipset/ip_set.h | 2 +- + net/netfilter/ipset/ip_set_bitmap_gen.h | 17 +++----- + net/netfilter/ipset/ip_set_bitmap_ip.c | 14 ++----- + net/netfilter/ipset/ip_set_bitmap_ipmac.c | 64 ++++++++++++++----------------- + net/netfilter/ipset/ip_set_bitmap_port.c | 18 ++++----- + net/netfilter/ipset/ip_set_core.c | 14 ++++--- + net/netfilter/ipset/ip_set_hash_gen.h | 11 ++++-- + net/netfilter/ipset/ip_set_list_set.c | 5 ++- + 8 files changed, 65 insertions(+), 80 deletions(-) + +diff --git a/include/linux/netfilter/ipset/ip_set.h b/include/linux/netfilter/ipset/ip_set.h +index 48bb01e..0e1f433 100644 +--- a/include/linux/netfilter/ipset/ip_set.h ++++ b/include/linux/netfilter/ipset/ip_set.h +@@ -421,7 +421,7 @@ extern void ip_set_free(void *members); + extern int ip_set_get_ipaddr4(struct nlattr *nla, __be32 *ipaddr); + extern int ip_set_get_ipaddr6(struct nlattr *nla, union nf_inet_addr *ipaddr); + extern size_t ip_set_elem_len(struct ip_set *set, struct nlattr *tb[], +- size_t len); ++ size_t len, size_t align); + extern int ip_set_get_extensions(struct ip_set *set, struct nlattr *tb[], + struct ip_set_ext *ext); + +diff --git a/net/netfilter/ipset/ip_set_bitmap_gen.h b/net/netfilter/ipset/ip_set_bitmap_gen.h +index d05e759..b0bc475 100644 +--- a/net/netfilter/ipset/ip_set_bitmap_gen.h ++++ b/net/netfilter/ipset/ip_set_bitmap_gen.h +@@ -33,7 +33,7 @@ + #define mtype_gc IPSET_TOKEN(MTYPE, _gc) + #define mtype MTYPE + +-#define get_ext(set, map, id) ((map)->extensions + (set)->dsize * (id)) ++#define get_ext(set, map, id) ((map)->extensions + ((set)->dsize * (id))) + + static void + mtype_gc_init(struct ip_set *set, void (*gc)(unsigned long ul_set)) +@@ -67,12 +67,9 @@ mtype_destroy(struct ip_set *set) + del_timer_sync(&map->gc); + + ip_set_free(map->members); +- if (set->dsize) { +- if (set->extensions & IPSET_EXT_DESTROY) +- mtype_ext_cleanup(set); +- ip_set_free(map->extensions); +- } +- kfree(map); ++ if (set->dsize && set->extensions & IPSET_EXT_DESTROY) ++ mtype_ext_cleanup(set); ++ ip_set_free(map); + + set->data = NULL; + } +@@ -92,16 +89,14 @@ mtype_head(struct ip_set *set, struct sk_buff *skb) + { + const struct mtype *map = set->data; + struct nlattr *nested; ++ size_t memsize = sizeof(*map) + map->memsize; + + nested = ipset_nest_start(skb, IPSET_ATTR_DATA); + if (!nested) + goto nla_put_failure; + if (mtype_do_head(skb, map) || + nla_put_net32(skb, IPSET_ATTR_REFERENCES, htonl(set->ref - 1)) || +- nla_put_net32(skb, IPSET_ATTR_MEMSIZE, +- htonl(sizeof(*map) + +- map->memsize + +- set->dsize * map->elements))) ++ nla_put_net32(skb, IPSET_ATTR_MEMSIZE, htonl(memsize))) + goto nla_put_failure; + if (unlikely(ip_set_put_flags(skb, set))) + goto nla_put_failure; +diff --git a/net/netfilter/ipset/ip_set_bitmap_ip.c b/net/netfilter/ipset/ip_set_bitmap_ip.c +index 64a5643..4783eff 100644 +--- a/net/netfilter/ipset/ip_set_bitmap_ip.c ++++ b/net/netfilter/ipset/ip_set_bitmap_ip.c +@@ -41,7 +41,6 @@ MODULE_ALIAS("ip_set_bitmap:ip"); + /* Type structure */ + struct bitmap_ip { + void *members; /* the set members */ +- void *extensions; /* data extensions */ + u32 first_ip; /* host byte order, included in range */ + u32 last_ip; /* host byte order, included in range */ + u32 elements; /* number of max elements in the set */ +@@ -49,6 +48,8 @@ struct bitmap_ip { + size_t memsize; /* members size */ + u8 netmask; /* subnet netmask */ + struct timer_list gc; /* garbage collection */ ++ unsigned char extensions[0] /* data extensions */ ++ __aligned(__alignof__(u64)); + }; + + /* ADT structure for generic function args */ +@@ -224,13 +225,6 @@ init_map_ip(struct ip_set *set, struct bitmap_ip *map, + map->members = ip_set_alloc(map->memsize); + if (!map->members) + return false; +- if (set->dsize) { +- map->extensions = ip_set_alloc(set->dsize * elements); +- if (!map->extensions) { +- kfree(map->members); +- return false; +- } +- } + map->first_ip = first_ip; + map->last_ip = last_ip; + map->elements = elements; +@@ -316,13 +310,13 @@ bitmap_ip_create(struct net *net, struct ip_set *set, struct nlattr *tb[], + pr_debug("hosts %u, elements %llu\n", + hosts, (unsigned long long)elements); + +- map = kzalloc(sizeof(*map), GFP_KERNEL); ++ set->dsize = ip_set_elem_len(set, tb, 0, 0); ++ map = ip_set_alloc(sizeof(*map) + elements * set->dsize); + if (!map) + return -ENOMEM; + + map->memsize = bitmap_bytes(0, elements - 1); + set->variant = &bitmap_ip; +- set->dsize = ip_set_elem_len(set, tb, 0); + if (!init_map_ip(set, map, first_ip, last_ip, + elements, hosts, netmask)) { + kfree(map); +diff --git a/net/netfilter/ipset/ip_set_bitmap_ipmac.c b/net/netfilter/ipset/ip_set_bitmap_ipmac.c +index 1430535..29dde20 100644 +--- a/net/netfilter/ipset/ip_set_bitmap_ipmac.c ++++ b/net/netfilter/ipset/ip_set_bitmap_ipmac.c +@@ -47,24 +47,26 @@ enum { + /* Type structure */ + struct bitmap_ipmac { + void *members; /* the set members */ +- void *extensions; /* MAC + data extensions */ + u32 first_ip; /* host byte order, included in range */ + u32 last_ip; /* host byte order, included in range */ + u32 elements; /* number of max elements in the set */ + size_t memsize; /* members size */ + struct timer_list gc; /* garbage collector */ ++ unsigned char extensions[0] /* MAC + data extensions */ ++ __aligned(__alignof__(u64)); + }; + + /* ADT structure for generic function args */ + struct bitmap_ipmac_adt_elem { ++ unsigned char ether[ETH_ALEN] __aligned(2); + u16 id; +- unsigned char *ether; ++ u16 add_mac; + }; + + struct bitmap_ipmac_elem { + unsigned char ether[ETH_ALEN]; + unsigned char filled; +-} __attribute__ ((aligned)); ++} __aligned(__alignof__(u64)); + + static inline u32 + ip_to_id(const struct bitmap_ipmac *m, u32 ip) +@@ -72,11 +74,11 @@ ip_to_id(const struct bitmap_ipmac *m, u32 ip) + return ip - m->first_ip; + } + +-static inline struct bitmap_ipmac_elem * +-get_elem(void *extensions, u16 id, size_t dsize) +-{ +- return (struct bitmap_ipmac_elem *)(extensions + id * dsize); +-} ++#define get_elem(extensions, id, dsize) \ ++ (struct bitmap_ipmac_elem *)(extensions + (id) * (dsize)) ++ ++#define get_const_elem(extensions, id, dsize) \ ++ (const struct bitmap_ipmac_elem *)(extensions + (id) * (dsize)) + + /* Common functions */ + +@@ -88,10 +90,9 @@ bitmap_ipmac_do_test(const struct bitmap_ipmac_adt_elem *e, + + if (!test_bit(e->id, map->members)) + return 0; +- elem = get_elem(map->extensions, e->id, dsize); +- if (elem->filled == MAC_FILLED) +- return !e->ether || +- ether_addr_equal(e->ether, elem->ether); ++ elem = get_const_elem(map->extensions, e->id, dsize); ++ if (e->add_mac && elem->filled == MAC_FILLED) ++ return ether_addr_equal(e->ether, elem->ether); + /* Trigger kernel to fill out the ethernet address */ + return -EAGAIN; + } +@@ -103,7 +104,7 @@ bitmap_ipmac_gc_test(u16 id, const struct bitmap_ipmac *map, size_t dsize) + + if (!test_bit(id, map->members)) + return 0; +- elem = get_elem(map->extensions, id, dsize); ++ elem = get_const_elem(map->extensions, id, dsize); + /* Timer not started for the incomplete elements */ + return elem->filled == MAC_FILLED; + } +@@ -133,7 +134,7 @@ bitmap_ipmac_add_timeout(unsigned long *timeout, + * and we can reuse it later when MAC is filled out, + * possibly by the kernel + */ +- if (e->ether) ++ if (e->add_mac) + ip_set_timeout_set(timeout, t); + else + *timeout = t; +@@ -150,7 +151,7 @@ bitmap_ipmac_do_add(const struct bitmap_ipmac_adt_elem *e, + elem = get_elem(map->extensions, e->id, dsize); + if (test_bit(e->id, map->members)) { + if (elem->filled == MAC_FILLED) { +- if (e->ether && ++ if (e->add_mac && + (flags & IPSET_FLAG_EXIST) && + !ether_addr_equal(e->ether, elem->ether)) { + /* memcpy isn't atomic */ +@@ -159,7 +160,7 @@ bitmap_ipmac_do_add(const struct bitmap_ipmac_adt_elem *e, + ether_addr_copy(elem->ether, e->ether); + } + return IPSET_ADD_FAILED; +- } else if (!e->ether) ++ } else if (!e->add_mac) + /* Already added without ethernet address */ + return IPSET_ADD_FAILED; + /* Fill the MAC address and trigger the timer activation */ +@@ -168,7 +169,7 @@ bitmap_ipmac_do_add(const struct bitmap_ipmac_adt_elem *e, + ether_addr_copy(elem->ether, e->ether); + elem->filled = MAC_FILLED; + return IPSET_ADD_START_STORED_TIMEOUT; +- } else if (e->ether) { ++ } else if (e->add_mac) { + /* We can store MAC too */ + ether_addr_copy(elem->ether, e->ether); + elem->filled = MAC_FILLED; +@@ -191,7 +192,7 @@ bitmap_ipmac_do_list(struct sk_buff *skb, const struct bitmap_ipmac *map, + u32 id, size_t dsize) + { + const struct bitmap_ipmac_elem *elem = +- get_elem(map->extensions, id, dsize); ++ get_const_elem(map->extensions, id, dsize); + + return nla_put_ipaddr4(skb, IPSET_ATTR_IP, + htonl(map->first_ip + id)) || +@@ -213,7 +214,7 @@ bitmap_ipmac_kadt(struct ip_set *set, const struct sk_buff *skb, + { + struct bitmap_ipmac *map = set->data; + ipset_adtfn adtfn = set->variant->adt[adt]; +- struct bitmap_ipmac_adt_elem e = { .id = 0 }; ++ struct bitmap_ipmac_adt_elem e = { .id = 0, .add_mac = 1 }; + struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set); + u32 ip; + +@@ -231,7 +232,7 @@ bitmap_ipmac_kadt(struct ip_set *set, const struct sk_buff *skb, + return -EINVAL; + + e.id = ip_to_id(map, ip); +- e.ether = eth_hdr(skb)->h_source; ++ memcpy(e.ether, eth_hdr(skb)->h_source, ETH_ALEN); + + return adtfn(set, &e, &ext, &opt->ext, opt->cmdflags); + } +@@ -265,11 +266,10 @@ bitmap_ipmac_uadt(struct ip_set *set, struct nlattr *tb[], + return -IPSET_ERR_BITMAP_RANGE; + + e.id = ip_to_id(map, ip); +- if (tb[IPSET_ATTR_ETHER]) +- e.ether = nla_data(tb[IPSET_ATTR_ETHER]); +- else +- e.ether = NULL; +- ++ if (tb[IPSET_ATTR_ETHER]) { ++ memcpy(e.ether, nla_data(tb[IPSET_ATTR_ETHER]), ETH_ALEN); ++ e.add_mac = 1; ++ } + ret = adtfn(set, &e, &ext, &ext, flags); + + return ip_set_eexist(ret, flags) ? 0 : ret; +@@ -300,13 +300,6 @@ init_map_ipmac(struct ip_set *set, struct bitmap_ipmac *map, + map->members = ip_set_alloc(map->memsize); + if (!map->members) + return false; +- if (set->dsize) { +- map->extensions = ip_set_alloc(set->dsize * elements); +- if (!map->extensions) { +- kfree(map->members); +- return false; +- } +- } + map->first_ip = first_ip; + map->last_ip = last_ip; + map->elements = elements; +@@ -361,14 +354,15 @@ bitmap_ipmac_create(struct net *net, struct ip_set *set, struct nlattr *tb[], + if (elements > IPSET_BITMAP_MAX_RANGE + 1) + return -IPSET_ERR_BITMAP_RANGE_SIZE; + +- map = kzalloc(sizeof(*map), GFP_KERNEL); ++ set->dsize = ip_set_elem_len(set, tb, ++ sizeof(struct bitmap_ipmac_elem), ++ __alignof__(struct bitmap_ipmac_elem)); ++ map = ip_set_alloc(sizeof(*map) + elements * set->dsize); + if (!map) + return -ENOMEM; + + map->memsize = bitmap_bytes(0, elements - 1); + set->variant = &bitmap_ipmac; +- set->dsize = ip_set_elem_len(set, tb, +- sizeof(struct bitmap_ipmac_elem)); + if (!init_map_ipmac(set, map, first_ip, last_ip, elements)) { + kfree(map); + return -ENOMEM; +diff --git a/net/netfilter/ipset/ip_set_bitmap_port.c b/net/netfilter/ipset/ip_set_bitmap_port.c +index 5338ccd..7f0c733 100644 +--- a/net/netfilter/ipset/ip_set_bitmap_port.c ++++ b/net/netfilter/ipset/ip_set_bitmap_port.c +@@ -35,12 +35,13 @@ MODULE_ALIAS("ip_set_bitmap:port"); + /* Type structure */ + struct bitmap_port { + void *members; /* the set members */ +- void *extensions; /* data extensions */ + u16 first_port; /* host byte order, included in range */ + u16 last_port; /* host byte order, included in range */ + u32 elements; /* number of max elements in the set */ + size_t memsize; /* members size */ + struct timer_list gc; /* garbage collection */ ++ unsigned char extensions[0] /* data extensions */ ++ __aligned(__alignof__(u64)); + }; + + /* ADT structure for generic function args */ +@@ -209,13 +210,6 @@ init_map_port(struct ip_set *set, struct bitmap_port *map, + map->members = ip_set_alloc(map->memsize); + if (!map->members) + return false; +- if (set->dsize) { +- map->extensions = ip_set_alloc(set->dsize * map->elements); +- if (!map->extensions) { +- kfree(map->members); +- return false; +- } +- } + map->first_port = first_port; + map->last_port = last_port; + set->timeout = IPSET_NO_TIMEOUT; +@@ -232,6 +226,7 @@ bitmap_port_create(struct net *net, struct ip_set *set, struct nlattr *tb[], + { + struct bitmap_port *map; + u16 first_port, last_port; ++ u32 elements; + + if (unlikely(!ip_set_attr_netorder(tb, IPSET_ATTR_PORT) || + !ip_set_attr_netorder(tb, IPSET_ATTR_PORT_TO) || +@@ -248,14 +243,15 @@ bitmap_port_create(struct net *net, struct ip_set *set, struct nlattr *tb[], + last_port = tmp; + } + +- map = kzalloc(sizeof(*map), GFP_KERNEL); ++ elements = last_port - first_port + 1; ++ set->dsize = ip_set_elem_len(set, tb, 0, 0); ++ map = ip_set_alloc(sizeof(*map) + elements * set->dsize); + if (!map) + return -ENOMEM; + +- map->elements = last_port - first_port + 1; ++ map->elements = elements; + map->memsize = bitmap_bytes(0, map->elements); + set->variant = &bitmap_port; +- set->dsize = ip_set_elem_len(set, tb, 0); + if (!init_map_port(set, map, first_port, last_port)) { + kfree(map); + return -ENOMEM; +diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c +index 69ab9c26..54f3d7c 100644 +--- a/net/netfilter/ipset/ip_set_core.c ++++ b/net/netfilter/ipset/ip_set_core.c +@@ -364,25 +364,27 @@ add_extension(enum ip_set_ext_id id, u32 flags, struct nlattr *tb[]) + } + + size_t +-ip_set_elem_len(struct ip_set *set, struct nlattr *tb[], size_t len) ++ip_set_elem_len(struct ip_set *set, struct nlattr *tb[], size_t len, ++ size_t align) + { + enum ip_set_ext_id id; +- size_t offset = len; + u32 cadt_flags = 0; + + if (tb[IPSET_ATTR_CADT_FLAGS]) + cadt_flags = ip_set_get_h32(tb[IPSET_ATTR_CADT_FLAGS]); + if (cadt_flags & IPSET_FLAG_WITH_FORCEADD) + set->flags |= IPSET_CREATE_FLAG_FORCEADD; ++ if (!align) ++ align = 1; + for (id = 0; id < IPSET_EXT_ID_MAX; id++) { + if (!add_extension(id, cadt_flags, tb)) + continue; +- offset = ALIGN(offset, ip_set_extensions[id].align); +- set->offset[id] = offset; ++ len = ALIGN(len, ip_set_extensions[id].align); ++ set->offset[id] = len; + set->extensions |= ip_set_extensions[id].type; +- offset += ip_set_extensions[id].len; ++ len += ip_set_extensions[id].len; + } +- return offset; ++ return ALIGN(len, align); + } + EXPORT_SYMBOL_GPL(ip_set_elem_len); + +diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h +index 691b54f..4ff2219 100644 +--- a/net/netfilter/ipset/ip_set_hash_gen.h ++++ b/net/netfilter/ipset/ip_set_hash_gen.h +@@ -72,8 +72,9 @@ struct hbucket { + DECLARE_BITMAP(used, AHASH_MAX_TUNED); + u8 size; /* size of the array */ + u8 pos; /* position of the first free entry */ +- unsigned char value[0]; /* the array of the values */ +-} __attribute__ ((aligned)); ++ unsigned char value[0] /* the array of the values */ ++ __aligned(__alignof__(u64)); ++}; + + /* The hash table: the table size stored here in order to make resizing easy */ + struct htable { +@@ -1323,12 +1324,14 @@ IPSET_TOKEN(HTYPE, _create)(struct net *net, struct ip_set *set, + #endif + set->variant = &IPSET_TOKEN(HTYPE, 4_variant); + set->dsize = ip_set_elem_len(set, tb, +- sizeof(struct IPSET_TOKEN(HTYPE, 4_elem))); ++ sizeof(struct IPSET_TOKEN(HTYPE, 4_elem)), ++ __alignof__(struct IPSET_TOKEN(HTYPE, 4_elem))); + #ifndef IP_SET_PROTO_UNDEF + } else { + set->variant = &IPSET_TOKEN(HTYPE, 6_variant); + set->dsize = ip_set_elem_len(set, tb, +- sizeof(struct IPSET_TOKEN(HTYPE, 6_elem))); ++ sizeof(struct IPSET_TOKEN(HTYPE, 6_elem)), ++ __alignof__(struct IPSET_TOKEN(HTYPE, 6_elem))); + } + #endif + if (tb[IPSET_ATTR_TIMEOUT]) { +diff --git a/net/netfilter/ipset/ip_set_list_set.c b/net/netfilter/ipset/ip_set_list_set.c +index 5a30ce6..bbede95 100644 +--- a/net/netfilter/ipset/ip_set_list_set.c ++++ b/net/netfilter/ipset/ip_set_list_set.c +@@ -31,7 +31,7 @@ struct set_elem { + struct rcu_head rcu; + struct list_head list; + ip_set_id_t id; +-}; ++} __aligned(__alignof__(u64)); + + struct set_adt_elem { + ip_set_id_t id; +@@ -618,7 +618,8 @@ list_set_create(struct net *net, struct ip_set *set, struct nlattr *tb[], + size = IP_SET_LIST_MIN_SIZE; + + set->variant = &set_variant; +- set->dsize = ip_set_elem_len(set, tb, sizeof(struct set_elem)); ++ set->dsize = ip_set_elem_len(set, tb, sizeof(struct set_elem), ++ __alignof__(struct set_elem)); + if (!init_list_set(net, set, size)) + return -ENOMEM; + if (tb[IPSET_ATTR_TIMEOUT]) { +-- +cgit v0.11.2 + diff --git a/kernel/kernel/files/patches/mageia/net-netfilter-ipset-Fix-hash-type-expiration.patch b/kernel/kernel/files/patches/mageia/net-netfilter-ipset-Fix-hash-type-expiration.patch new file mode 100644 index 00000000..54a1c72d --- /dev/null +++ b/kernel/kernel/files/patches/mageia/net-netfilter-ipset-Fix-hash-type-expiration.patch @@ -0,0 +1,30 @@ +From e9dfdc052d018268926ab769d5b7598226713d5a Mon Sep 17 00:00:00 2001 +From: Jozsef Kadlecsik +Date: Sat, 7 Nov 2015 11:23:34 +0100 +Subject: netfilter: ipset: Fix hash:* type expiration + +Incorrect index was used when the data blob was shrinked at expiration, +which could lead to falsely expired entries and memory leak when +the comment extension was used too. + +Signed-off-by: Jozsef Kadlecsik +--- + net/netfilter/ipset/ip_set_hash_gen.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h +index 4ff2219..fa4f637 100644 +--- a/net/netfilter/ipset/ip_set_hash_gen.h ++++ b/net/netfilter/ipset/ip_set_hash_gen.h +@@ -523,7 +523,7 @@ mtype_expire(struct ip_set *set, struct htype *h, u8 nets_length, size_t dsize) + continue; + data = ahash_data(n, j, dsize); + memcpy(tmp->value + d * dsize, data, dsize); +- set_bit(j, tmp->used); ++ set_bit(d, tmp->used); + d++; + } + tmp->pos = d; +-- +cgit v0.11.2 + diff --git a/kernel/kernel/files/patches/mageia/net-netfilter-ipset-Fix-hash-type-expire-release-empty-hash-bucket-block.patch b/kernel/kernel/files/patches/mageia/net-netfilter-ipset-Fix-hash-type-expire-release-empty-hash-bucket-block.patch new file mode 100644 index 00000000..92a4c27d --- /dev/null +++ b/kernel/kernel/files/patches/mageia/net-netfilter-ipset-Fix-hash-type-expire-release-empty-hash-bucket-block.patch @@ -0,0 +1,47 @@ +From 0aae24eb409fc429f54ca3809f904f1b91e295e0 Mon Sep 17 00:00:00 2001 +From: Jozsef Kadlecsik +Date: Sat, 7 Nov 2015 11:24:51 +0100 +Subject: netfilter: ipset: Fix hash type expire: release empty hash bucket + block + +When all entries are expired/all slots are empty, release the bucket. + +Signed-off-by: Jozsef Kadlecsik +--- + net/netfilter/ipset/ip_set_hash_gen.h | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h +index fa4f637..e5336ab 100644 +--- a/net/netfilter/ipset/ip_set_hash_gen.h ++++ b/net/netfilter/ipset/ip_set_hash_gen.h +@@ -476,7 +476,7 @@ static void + mtype_expire(struct ip_set *set, struct htype *h, u8 nets_length, size_t dsize) + { + struct htable *t; +- struct hbucket *n; ++ struct hbucket *n, *tmp; + struct mtype_elem *data; + u32 i, j, d; + #ifdef IP_SET_HASH_WITH_NETS +@@ -511,9 +511,14 @@ mtype_expire(struct ip_set *set, struct htype *h, u8 nets_length, size_t dsize) + } + } + if (d >= AHASH_INIT_SIZE) { +- struct hbucket *tmp = kzalloc(sizeof(*tmp) + +- (n->size - AHASH_INIT_SIZE) * dsize, +- GFP_ATOMIC); ++ if (d >= n->size) { ++ rcu_assign_pointer(hbucket(t, i), NULL); ++ kfree_rcu(n, rcu); ++ continue; ++ } ++ tmp = kzalloc(sizeof(*tmp) + ++ (n->size - AHASH_INIT_SIZE) * dsize, ++ GFP_ATOMIC); + if (!tmp) + /* Still try to delete expired elements */ + continue; +-- +cgit v0.11.2 + diff --git a/kernel/kernel/files/patches/mageia/net-wireless-iwlwifi-fix-firmware-filename-for-3160.patch b/kernel/kernel/files/patches/mageia/net-wireless-iwlwifi-fix-firmware-filename-for-3160.patch deleted file mode 100644 index fb4624d2..00000000 --- a/kernel/kernel/files/patches/mageia/net-wireless-iwlwifi-fix-firmware-filename-for-3160.patch +++ /dev/null @@ -1,32 +0,0 @@ -From b5a48134f8af08f5243328f8a0b05fc5ae7cf343 Mon Sep 17 00:00:00 2001 -From: Johannes Berg -Date: Tue, 22 Sep 2015 10:47:27 +0200 -Subject: [PATCH] iwlwifi: fix firmware filename for 3160 - -The MODULE_FIRMWARE() for 3160 should be using the 7260 version as -it's done in the device configuration struct instead of referencing -IWL3160_UCODE_API_OK which doesn't even exist. - -Cc: [3.8+] -Reported-by: Hauke Mehrtens -Signed-off-by: Johannes Berg -Signed-off-by: Luca Coelho ---- - drivers/net/wireless/iwlwifi/iwl-7000.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/net/wireless/iwlwifi/iwl-7000.c b/drivers/net/wireless/iwlwifi/iwl-7000.c -index 6951aba..3fb327d 100644 ---- a/drivers/net/wireless/iwlwifi/iwl-7000.c -+++ b/drivers/net/wireless/iwlwifi/iwl-7000.c -@@ -348,6 +348,6 @@ const struct iwl_cfg iwl7265d_n_cfg = { - }; - - MODULE_FIRMWARE(IWL7260_MODULE_FIRMWARE(IWL7260_UCODE_API_OK)); --MODULE_FIRMWARE(IWL3160_MODULE_FIRMWARE(IWL3160_UCODE_API_OK)); -+MODULE_FIRMWARE(IWL3160_MODULE_FIRMWARE(IWL7260_UCODE_API_OK)); - MODULE_FIRMWARE(IWL7265_MODULE_FIRMWARE(IWL7260_UCODE_API_OK)); - MODULE_FIRMWARE(IWL7265D_MODULE_FIRMWARE(IWL7260_UCODE_API_OK)); --- -2.6.2 - diff --git a/kernel/kernel/files/patches/mageia/net-wireless-rtlwifi-rtl8821ae-Fix-lockups-on-boot.patch b/kernel/kernel/files/patches/mageia/net-wireless-rtlwifi-rtl8821ae-Fix-lockups-on-boot.patch new file mode 100644 index 00000000..33490eda --- /dev/null +++ b/kernel/kernel/files/patches/mageia/net-wireless-rtlwifi-rtl8821ae-Fix-lockups-on-boot.patch @@ -0,0 +1,58 @@ +From: Larry Finger +Subject: [PATCH] realtek: rtlwifi: rtl8821ae: Fix lockups on boot +Date: Tue, 10 Nov 2015 10:46:11 -0600 + +In commit 54328e64047a5 ("rtlwifi: rtl8821ae: Fix system lockups on boot"), +an attempt was made to fix a regression introduced in commit 1277fa2ab2f9 +("rtlwifi: Remove the clear interrupt routine from all drivers"). +Unfortunately, there were logic errors in that patch that prevented +affected boxes from booting even after that patch was applied. + +The actual cause of the original problem is unknown as none of the +developers have systems that are affected. + +Signed-off-by: Larry Finger +Cc: Stable [V4.1+] +--- + +Kalle, + +I hope this patch can be applied to 4.4. + +Thanks, + +Larry + + drivers/net/wireless/rtlwifi/rtl8821ae/hw.c | 2 +- + drivers/net/wireless/rtlwifi/rtl8821ae/sw.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c b/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c +index 6e9418e..bbb789f 100644 +--- a/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c ++++ b/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c +@@ -2272,7 +2272,7 @@ void rtl8821ae_enable_interrupt(struct ieee80211_hw *hw) + struct rtl_priv *rtlpriv = rtl_priv(hw); + struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw)); + +- if (!rtlpci->int_clear) ++ if (rtlpci->int_clear) + rtl8821ae_clear_interrupt(hw);/*clear it here first*/ + + rtl_write_dword(rtlpriv, REG_HIMR, rtlpci->irq_mask[0] & 0xFFFFFFFF); +diff --git a/drivers/net/wireless/rtlwifi/rtl8821ae/sw.c b/drivers/net/wireless/rtlwifi/rtl8821ae/sw.c +index 8ee141a..142bdff 100644 +--- a/drivers/net/wireless/rtlwifi/rtl8821ae/sw.c ++++ b/drivers/net/wireless/rtlwifi/rtl8821ae/sw.c +@@ -448,7 +448,7 @@ MODULE_PARM_DESC(fwlps, "Set to 1 to use FW control power save (default 1)\n"); + MODULE_PARM_DESC(msi, "Set to 1 to use MSI interrupts mode (default 1)\n"); + MODULE_PARM_DESC(debug, "Set debug level (0-5) (default 0)"); + MODULE_PARM_DESC(disable_watchdog, "Set to 1 to disable the watchdog (default 0)\n"); +-MODULE_PARM_DESC(int_clear, "Set to 1 to disable interrupt clear before set (default 0)\n"); ++MODULE_PARM_DESC(int_clear, "Set to 0 to disable interrupt clear before set (default 1)\n"); + + static SIMPLE_DEV_PM_OPS(rtlwifi_pm_ops, rtl_pci_suspend, rtl_pci_resume); + +-- +2.1.4 + diff --git a/kernel/kernel/files/patches/mageia/net-wireless-rtlwifi-rtl8821ae-Fix-system-lockups-on-boot.patch b/kernel/kernel/files/patches/mageia/net-wireless-rtlwifi-rtl8821ae-Fix-system-lockups-on-boot.patch deleted file mode 100644 index c296cc2b..00000000 --- a/kernel/kernel/files/patches/mageia/net-wireless-rtlwifi-rtl8821ae-Fix-system-lockups-on-boot.patch +++ /dev/null @@ -1,148 +0,0 @@ -From: Larry Finger -Subject: [PATCH] rtlwifi: rtl8821ae: Fix system lockups on boot -Date: Fri, 2 Oct 2015 11:44:30 -0500 - -In commit 1277fa2ab2f9, the code that cleared all interrupt enable -bits before setting them was removed for all PCI drivers. This fixed an -issue that caused TX to be blocked for 3-5 seconds. On some RTL8821AE units, -this change causes soft lockups to occur on boot. For that reason, the portion -of the earlier commit that applied to rtl8821ae is reverted. Kernels 4.1 and -newer are affected. - -See http://marc.info/?l=linux-wireless&m=144373370103285&w=2 and -https://bugzilla.opensuse.org/show_bug.cgi?id=944978 for two cases where -this regression affected user systems. Note that this bug does not appear on -any of the developer's setups. For those users whose systems are affected -by the TX blockage, but do not lock up on boot, a module parameter is added -to disable the interrupt clear - -Signed-off-by: Larry Finger -Cc: Stable [V4.1+] ---- - -Kalle, - -If possible, please send this patch upstream for inclusion in kernel 4.3. -As noted, the bug affects kernels 4.1 and newer. - -This patch applies to wireless-drivers-next, and assumes that the patch that -moved all the Realtek drivers into drivers/net/wireless/realtek has NOT been -applied. - -Thanks, - -Larry ---- - drivers/net/wireless/rtlwifi/pci.h | 2 ++ - drivers/net/wireless/rtlwifi/rtl8821ae/hw.c | 17 +++++++++++++++++ - drivers/net/wireless/rtlwifi/rtl8821ae/sw.c | 5 +++++ - drivers/net/wireless/rtlwifi/wifi.h | 3 +++ - 4 files changed, 27 insertions(+) - -diff --git a/drivers/net/wireless/rtlwifi/pci.h b/drivers/net/wireless/rtlwifi/pci.h -index d4567d1..5da6703 100644 ---- a/drivers/net/wireless/rtlwifi/pci.h -+++ b/drivers/net/wireless/rtlwifi/pci.h -@@ -247,6 +247,8 @@ struct rtl_pci { - /* MSI support */ - bool msi_support; - bool using_msi; -+ /* interrupt clear before set */ -+ bool int_clear; - }; - - struct mp_adapter { -diff --git a/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c b/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c -index b7f18e21..6e9418e 100644 ---- a/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c -+++ b/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c -@@ -2253,11 +2253,28 @@ void rtl8821ae_set_qos(struct ieee80211_hw *hw, int aci) - } - } - -+static void rtl8821ae_clear_interrupt(struct ieee80211_hw *hw) -+{ -+ struct rtl_priv *rtlpriv = rtl_priv(hw); -+ u32 tmp = rtl_read_dword(rtlpriv, REG_HISR); -+ -+ rtl_write_dword(rtlpriv, REG_HISR, tmp); -+ -+ tmp = rtl_read_dword(rtlpriv, REG_HISRE); -+ rtl_write_dword(rtlpriv, REG_HISRE, tmp); -+ -+ tmp = rtl_read_dword(rtlpriv, REG_HSISR); -+ rtl_write_dword(rtlpriv, REG_HSISR, tmp); -+} -+ - void rtl8821ae_enable_interrupt(struct ieee80211_hw *hw) - { - struct rtl_priv *rtlpriv = rtl_priv(hw); - struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw)); - -+ if (!rtlpci->int_clear) -+ rtl8821ae_clear_interrupt(hw);/*clear it here first*/ -+ - rtl_write_dword(rtlpriv, REG_HIMR, rtlpci->irq_mask[0] & 0xFFFFFFFF); - rtl_write_dword(rtlpriv, REG_HIMRE, rtlpci->irq_mask[1] & 0xFFFFFFFF); - rtlpci->irq_enabled = true; -diff --git a/drivers/net/wireless/rtlwifi/rtl8821ae/sw.c b/drivers/net/wireless/rtlwifi/rtl8821ae/sw.c -index a4988121..8ee141a 100644 ---- a/drivers/net/wireless/rtlwifi/rtl8821ae/sw.c -+++ b/drivers/net/wireless/rtlwifi/rtl8821ae/sw.c -@@ -96,6 +96,7 @@ int rtl8821ae_init_sw_vars(struct ieee80211_hw *hw) - - rtl8821ae_bt_reg_init(hw); - rtlpci->msi_support = rtlpriv->cfg->mod_params->msi_support; -+ rtlpci->int_clear = rtlpriv->cfg->mod_params->int_clear; - rtlpriv->btcoexist.btc_ops = rtl_btc_get_ops_pointer(); - - rtlpriv->dm.dm_initialgain_enable = 1; -@@ -167,6 +168,7 @@ int rtl8821ae_init_sw_vars(struct ieee80211_hw *hw) - rtlpriv->psc.swctrl_lps = rtlpriv->cfg->mod_params->swctrl_lps; - rtlpriv->psc.fwctrl_lps = rtlpriv->cfg->mod_params->fwctrl_lps; - rtlpci->msi_support = rtlpriv->cfg->mod_params->msi_support; -+ rtlpci->msi_support = rtlpriv->cfg->mod_params->int_clear; - if (rtlpriv->cfg->mod_params->disable_watchdog) - pr_info("watchdog disabled\n"); - rtlpriv->psc.reg_fwctrl_lps = 3; -@@ -308,6 +310,7 @@ static struct rtl_mod_params rtl8821ae_mod_params = { - .swctrl_lps = false, - .fwctrl_lps = true, - .msi_support = true, -+ .int_clear = true, - .debug = DBG_EMERG, - .disable_watchdog = 0, - }; -@@ -437,6 +440,7 @@ module_param_named(fwlps, rtl8821ae_mod_params.fwctrl_lps, bool, 0444); - module_param_named(msi, rtl8821ae_mod_params.msi_support, bool, 0444); - module_param_named(disable_watchdog, rtl8821ae_mod_params.disable_watchdog, - bool, 0444); -+module_param_named(int_clear, rtl8821ae_mod_params.int_clear, bool, 0444); - MODULE_PARM_DESC(swenc, "Set to 1 for software crypto (default 0)\n"); - MODULE_PARM_DESC(ips, "Set to 0 to not use link power save (default 1)\n"); - MODULE_PARM_DESC(swlps, "Set to 1 to use SW control power save (default 0)\n"); -@@ -444,6 +448,7 @@ MODULE_PARM_DESC(fwlps, "Set to 1 to use FW control power save (default 1)\n"); - MODULE_PARM_DESC(msi, "Set to 1 to use MSI interrupts mode (default 1)\n"); - MODULE_PARM_DESC(debug, "Set debug level (0-5) (default 0)"); - MODULE_PARM_DESC(disable_watchdog, "Set to 1 to disable the watchdog (default 0)\n"); -+MODULE_PARM_DESC(int_clear, "Set to 1 to disable interrupt clear before set (default 0)\n"); - - static SIMPLE_DEV_PM_OPS(rtlwifi_pm_ops, rtl_pci_suspend, rtl_pci_resume); - -diff --git a/drivers/net/wireless/rtlwifi/wifi.h b/drivers/net/wireless/rtlwifi/wifi.h -index b90ca61..4544752 100644 ---- a/drivers/net/wireless/rtlwifi/wifi.h -+++ b/drivers/net/wireless/rtlwifi/wifi.h -@@ -2249,6 +2249,9 @@ struct rtl_mod_params { - - /* default 0: 1 means disable */ - bool disable_watchdog; -+ -+ /* default 0: 1 means do not disable interrupts */ -+ bool int_clear; - }; - - struct rtl_hal_usbint_cfg { --- -2.1.4 - diff --git a/kernel/kernel/files/patches/mageia/series b/kernel/kernel/files/patches/mageia/series index db9cc488..361ade23 100644 --- a/kernel/kernel/files/patches/mageia/series +++ b/kernel/kernel/files/patches/mageia/series @@ -14,9 +14,6 @@ ### ### Stable Queue ### -stable-mac80211-fix-hwflags-debugfs-file-format.patch -stable-ath9k-declare-required-extra-tx-headroom.patch -stable-mmc-core-fix-init_card-in-52mhz.patch ### ### Arch x86 @@ -41,8 +38,11 @@ x86-increase-default-minimum-vmalloc-area-by-64MB-to-192MB.patch # slows down boot Revert-cpufreq-pcc-Enable-autoload-of-pcc-cpufreq-fo.patch -# EFI -x86-efi-Fix-multiple-GOP-device-support.patch +# (CVE-2015-5307) +x86-KVM-x86-work-around-infinite-loop-in-microcode-when-AC-is-delivered.patch + +# (CVE-2015-8104) +x86-KVM-svm-unconditionally-intercept-DB.patch ### ### Core @@ -131,9 +131,6 @@ scsi-Fix-NULL-pointer-dereference-in-RTPM-of-block-layer.patch fs-aufs4.patch fs-aufs4-modular.patch -# btrfs memleak -fs-btrfs-fix-possible-leak-in-btrfs_ioctl_balance.patch - ### ### FireWire ### @@ -177,9 +174,6 @@ gpu-drm-mach64-3.18-buildfix.patch input-i8042-quirks-for-Fujitsu-Lifebook-A544-and-Lif.patch -# fix alps breakage -input-alps-Only-the-Dell-Latitude-D420_430_620_630-have-separate-stick-button-bits.patch - ### ### idle ### @@ -220,11 +214,14 @@ net-netfilter-psd.patch net-netfilter-psd-mdv.patch net-netfilter-psd-2.6.35-buildfix.patch -# wireless lockup -net-wireless-rtlwifi-rtl8821ae-Fix-system-lockups-on-boot.patch +# netfilter fixes +net-netfilter-ipset-Fix-extension-alignment.patch +net-netfilter-ipset-Fix-hash-type-expiration.patch +net-netfilter-ipset-Fix-hash-type-expire-release-empty-hash-bucket-block.patch +net-netfilter-Fix-removal-of-GRE-expectation-entries-created-by-PPTP.patch -# iwlwifi borked fw reference -net-wireless-iwlwifi-fix-firmware-filename-for-3160.patch +# rtlwifi hang fix +net-wireless-rtlwifi-rtl8821ae-Fix-lockups-on-boot.patch ### ### Platform drivers diff --git a/kernel/kernel/files/patches/mageia/stable-ath9k-declare-required-extra-tx-headroom.patch b/kernel/kernel/files/patches/mageia/stable-ath9k-declare-required-extra-tx-headroom.patch deleted file mode 100644 index 16272ae0..00000000 --- a/kernel/kernel/files/patches/mageia/stable-ath9k-declare-required-extra-tx-headroom.patch +++ /dev/null @@ -1,31 +0,0 @@ -From 029cd0370241641eb70235d205aa0b90c84dce44 Mon Sep 17 00:00:00 2001 -From: Felix Fietkau -Date: Thu, 24 Sep 2015 16:59:46 +0200 -Subject: ath9k: declare required extra tx headroom - -From: Felix Fietkau - -commit 029cd0370241641eb70235d205aa0b90c84dce44 upstream. - -ath9k inserts padding between the 802.11 header and the data area (to -align it). Since it didn't declare this extra required headroom, this -led to some nasty issues like randomly dropped packets in some setups. - -Signed-off-by: Felix Fietkau -Signed-off-by: Kalle Valo -Signed-off-by: Greg Kroah-Hartman - ---- - drivers/net/wireless/ath/ath9k/init.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/drivers/net/wireless/ath/ath9k/init.c -+++ b/drivers/net/wireless/ath/ath9k/init.c -@@ -874,6 +874,7 @@ static void ath9k_set_hw_capab(struct at - hw->max_rate_tries = 10; - hw->sta_data_size = sizeof(struct ath_node); - hw->vif_data_size = sizeof(struct ath_vif); -+ hw->extra_tx_headroom = 4; - - hw->wiphy->available_antennas_rx = BIT(ah->caps.max_rxchains) - 1; - hw->wiphy->available_antennas_tx = BIT(ah->caps.max_txchains) - 1; diff --git a/kernel/kernel/files/patches/mageia/stable-mac80211-fix-hwflags-debugfs-file-format.patch b/kernel/kernel/files/patches/mageia/stable-mac80211-fix-hwflags-debugfs-file-format.patch deleted file mode 100644 index 0cba04d1..00000000 --- a/kernel/kernel/files/patches/mageia/stable-mac80211-fix-hwflags-debugfs-file-format.patch +++ /dev/null @@ -1,34 +0,0 @@ -From 4633dfc32c0019bed2996de9bbdbe7f3b518a44e Mon Sep 17 00:00:00 2001 -From: Mohammed Shafi Shajakhan -Date: Thu, 8 Oct 2015 19:20:14 +0530 -Subject: mac80211: Fix hwflags debugfs file format - -From: Mohammed Shafi Shajakhan - -commit 4633dfc32c0019bed2996de9bbdbe7f3b518a44e upstream. - -Commit 30686bf7f5b3 ("mac80211: convert HW flags to unsigned long -bitmap") accidentally removed the newline delimiter from the hwflags -debugfs file. Fix this by adding back the newline between the HW flags. - -Signed-off-by: Mohammed Shafi Shajakhan -[fix commit log] -Signed-off-by: Jouni Malinen -Signed-off-by: Johannes Berg -Signed-off-by: Greg Kroah-Hartman - ---- - net/mac80211/debugfs.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/net/mac80211/debugfs.c -+++ b/net/mac80211/debugfs.c -@@ -148,7 +148,7 @@ static ssize_t hwflags_read(struct file - - for (i = 0; i < NUM_IEEE80211_HW_FLAGS; i++) { - if (test_bit(i, local->hw.flags)) -- pos += scnprintf(pos, end - pos, "%s", -+ pos += scnprintf(pos, end - pos, "%s\n", - hw_flag_names[i]); - } - diff --git a/kernel/kernel/files/patches/mageia/stable-mmc-core-fix-init_card-in-52mhz.patch b/kernel/kernel/files/patches/mageia/stable-mmc-core-fix-init_card-in-52mhz.patch deleted file mode 100644 index 3abec18a..00000000 --- a/kernel/kernel/files/patches/mageia/stable-mmc-core-fix-init_card-in-52mhz.patch +++ /dev/null @@ -1,82 +0,0 @@ -From 08b137d90eec51b0e90c42e123ca8ceb118d233f Mon Sep 17 00:00:00 2001 -From: Chaotian Jing -Date: Mon, 12 Oct 2015 17:22:23 +0800 -Subject: mmc: core: Fix init_card in 52Mhz - -From: Chaotian Jing - -commit 08b137d90eec51b0e90c42e123ca8ceb118d233f upstream. - -Suppose that we got a data crc error, and it triggers the mmc_reset. -mmc_reset will call mmc_send_status to see if HW reset was supported. -before issue CMD13, it will do retune, and if EMMC was in HS400 mode, -it will reduce frequency to 52Mhz firstly, then results in card init -was doing at 52Mhz. -The mmc_send_status was originally only done for mmc_test, should drop -it. And, rename the "eMMC hardware reset" to "Reset test", as we would -also be able to use the test for SD-cards. - -Signed-off-by: Chaotian Jing -Suggested-by: Adrian Hunter -Fixes: bd11e8bd03ca ("mmc: core: Flag re-tuning is needed on CRC errors") -Signed-off-by: Ulf Hansson -Signed-off-by: Greg Kroah-Hartman - ---- - drivers/mmc/card/mmc_test.c | 9 +++------ - drivers/mmc/core/mmc.c | 7 ------- - 2 files changed, 3 insertions(+), 13 deletions(-) - ---- a/drivers/mmc/card/mmc_test.c -+++ b/drivers/mmc/card/mmc_test.c -@@ -2263,15 +2263,12 @@ static int mmc_test_profile_sglen_r_nonb - /* - * eMMC hardware reset. - */ --static int mmc_test_hw_reset(struct mmc_test_card *test) -+static int mmc_test_reset(struct mmc_test_card *test) - { - struct mmc_card *card = test->card; - struct mmc_host *host = card->host; - int err; - -- if (!mmc_card_mmc(card) || !mmc_can_reset(card)) -- return RESULT_UNSUP_CARD; -- - err = mmc_hw_reset(host); - if (!err) - return RESULT_OK; -@@ -2605,8 +2602,8 @@ static const struct mmc_test_case mmc_te - }, - - { -- .name = "eMMC hardware reset", -- .run = mmc_test_hw_reset, -+ .name = "Reset test", -+ .run = mmc_test_reset, - }, - }; - ---- a/drivers/mmc/core/mmc.c -+++ b/drivers/mmc/core/mmc.c -@@ -1924,7 +1924,6 @@ EXPORT_SYMBOL(mmc_can_reset); - static int mmc_reset(struct mmc_host *host) - { - struct mmc_card *card = host->card; -- u32 status; - - if (!(host->caps & MMC_CAP_HW_RESET) || !host->ops->hw_reset) - return -EOPNOTSUPP; -@@ -1937,12 +1936,6 @@ static int mmc_reset(struct mmc_host *ho - - host->ops->hw_reset(host); - -- /* If the reset has happened, then a status command will fail */ -- if (!mmc_send_status(card, &status)) { -- mmc_host_clk_release(host); -- return -ENOSYS; -- } -- - /* Set initial state and call mmc_set_ios */ - mmc_set_initial_state(host); - mmc_host_clk_release(host); diff --git a/kernel/kernel/files/patches/mageia/x86-KVM-svm-unconditionally-intercept-DB.patch b/kernel/kernel/files/patches/mageia/x86-KVM-svm-unconditionally-intercept-DB.patch new file mode 100644 index 00000000..ca67ef99 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/x86-KVM-svm-unconditionally-intercept-DB.patch @@ -0,0 +1,80 @@ +From: Paolo Bonzini +Subject: [PATCH 2/3] KVM: svm: unconditionally intercept #DB +Date: Tue, 10 Nov 2015 13:22:53 +0100 + +This is needed to avoid the possibility that the guest triggers +an infinite stream of #DB exceptions (CVE-2015-8104). + +VMX is not affected: because it does not save DR6 in the VMCS, +it already intercepts #DB unconditionally. + +Reported-by: Jan Beulich +Cc: stable@vger.kernel.org +Signed-off-by: Paolo Bonzini +--- + arch/x86/kvm/svm.c | 14 +++----------- + 1 file changed, 3 insertions(+), 11 deletions(-) + +diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c +index 183926483c3a..1cc1ffca0d8c 100644 +--- a/arch/x86/kvm/svm.c ++++ b/arch/x86/kvm/svm.c +@@ -1020,6 +1020,7 @@ static void init_vmcb(struct vcpu_svm *svm) + set_exception_intercept(svm, UD_VECTOR); + set_exception_intercept(svm, MC_VECTOR); + set_exception_intercept(svm, AC_VECTOR); ++ set_exception_intercept(svm, DB_VECTOR); + + set_intercept(svm, INTERCEPT_INTR); + set_intercept(svm, INTERCEPT_NMI); +@@ -1554,20 +1555,13 @@ static void svm_set_segment(struct kvm_vcpu *vcpu, + mark_dirty(svm->vmcb, VMCB_SEG); + } + +-static void update_db_bp_intercept(struct kvm_vcpu *vcpu) ++static void update_bp_intercept(struct kvm_vcpu *vcpu) + { + struct vcpu_svm *svm = to_svm(vcpu); + +- clr_exception_intercept(svm, DB_VECTOR); + clr_exception_intercept(svm, BP_VECTOR); + +- if (svm->nmi_singlestep) +- set_exception_intercept(svm, DB_VECTOR); +- + if (vcpu->guest_debug & KVM_GUESTDBG_ENABLE) { +- if (vcpu->guest_debug & +- (KVM_GUESTDBG_SINGLESTEP | KVM_GUESTDBG_USE_HW_BP)) +- set_exception_intercept(svm, DB_VECTOR); + if (vcpu->guest_debug & KVM_GUESTDBG_USE_SW_BP) + set_exception_intercept(svm, BP_VECTOR); + } else +@@ -1673,7 +1667,6 @@ static int db_interception(struct vcpu_svm *svm) + if (!(svm->vcpu.guest_debug & KVM_GUESTDBG_SINGLESTEP)) + svm->vmcb->save.rflags &= + ~(X86_EFLAGS_TF | X86_EFLAGS_RF); +- update_db_bp_intercept(&svm->vcpu); + } + + if (svm->vcpu.guest_debug & +@@ -3661,7 +3654,6 @@ static void enable_nmi_window(struct kvm_vcpu *vcpu) + */ + svm->nmi_singlestep = true; + svm->vmcb->save.rflags |= (X86_EFLAGS_TF | X86_EFLAGS_RF); +- update_db_bp_intercept(vcpu); + } + + static int svm_set_tss_addr(struct kvm *kvm, unsigned int addr) +@@ -4287,7 +4279,7 @@ static struct kvm_x86_ops svm_x86_ops = { + .vcpu_load = svm_vcpu_load, + .vcpu_put = svm_vcpu_put, + +- .update_db_bp_intercept = update_db_bp_intercept, ++ .update_db_bp_intercept = update_bp_intercept, + .get_msr = svm_get_msr, + .set_msr = svm_set_msr, + .get_segment_base = svm_get_segment_base, +-- +1.8.3.1 + + diff --git a/kernel/kernel/files/patches/mageia/x86-KVM-x86-work-around-infinite-loop-in-microcode-when-AC-is-delivered.patch b/kernel/kernel/files/patches/mageia/x86-KVM-x86-work-around-infinite-loop-in-microcode-when-AC-is-delivered.patch new file mode 100644 index 00000000..3476a4bf --- /dev/null +++ b/kernel/kernel/files/patches/mageia/x86-KVM-x86-work-around-infinite-loop-in-microcode-when-AC-is-delivered.patch @@ -0,0 +1,93 @@ +From: Paolo Bonzini +Subject: [PATCH 1/3] KVM: x86: work around infinite loop in microcode when #AC is delivered +Date: Tue, 10 Nov 2015 13:22:52 +0100 + +From: Eric Northup + +It was found that a guest can DoS a host by triggering an infinite +stream of "alignment check" (#AC) exceptions. This causes the +microcode to enter an infinite loop where the core never receives +another interrupt. The host kernel panics pretty quickly due to the +effects (CVE-2015-5307). + +Signed-off-by: Eric Northup +Cc: stable@vger.kernel.org +Signed-off-by: Paolo Bonzini +--- + arch/x86/include/uapi/asm/svm.h | 1 + + arch/x86/kvm/svm.c | 8 ++++++++ + arch/x86/kvm/vmx.c | 5 ++++- + 3 files changed, 13 insertions(+), 1 deletion(-) + +diff --git a/arch/x86/include/uapi/asm/svm.h b/arch/x86/include/uapi/asm/svm.h +index b5d7640abc5d..8a4add8e4639 100644 +--- a/arch/x86/include/uapi/asm/svm.h ++++ b/arch/x86/include/uapi/asm/svm.h +@@ -100,6 +100,7 @@ + { SVM_EXIT_EXCP_BASE + UD_VECTOR, "UD excp" }, \ + { SVM_EXIT_EXCP_BASE + PF_VECTOR, "PF excp" }, \ + { SVM_EXIT_EXCP_BASE + NM_VECTOR, "NM excp" }, \ ++ { SVM_EXIT_EXCP_BASE + AC_VECTOR, "AC excp" }, \ + { SVM_EXIT_EXCP_BASE + MC_VECTOR, "MC excp" }, \ + { SVM_EXIT_INTR, "interrupt" }, \ + { SVM_EXIT_NMI, "nmi" }, \ +diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c +index f2ba91990b4e..183926483c3a 100644 +--- a/arch/x86/kvm/svm.c ++++ b/arch/x86/kvm/svm.c +@@ -1019,6 +1019,7 @@ static void init_vmcb(struct vcpu_svm *svm) + set_exception_intercept(svm, PF_VECTOR); + set_exception_intercept(svm, UD_VECTOR); + set_exception_intercept(svm, MC_VECTOR); ++ set_exception_intercept(svm, AC_VECTOR); + + set_intercept(svm, INTERCEPT_INTR); + set_intercept(svm, INTERCEPT_NMI); +@@ -1707,6 +1708,12 @@ static int ud_interception(struct vcpu_svm *svm) + return 1; + } + ++static int ac_interception(struct vcpu_svm *svm) ++{ ++ kvm_queue_exception_e(&svm->vcpu, AC_VECTOR, 0); ++ return 1; ++} ++ + static void svm_fpu_activate(struct kvm_vcpu *vcpu) + { + struct vcpu_svm *svm = to_svm(vcpu); +@@ -3270,6 +3277,7 @@ static int (*const svm_exit_handlers[])(struct vcpu_svm *svm) = { + [SVM_EXIT_EXCP_BASE + PF_VECTOR] = pf_interception, + [SVM_EXIT_EXCP_BASE + NM_VECTOR] = nm_interception, + [SVM_EXIT_EXCP_BASE + MC_VECTOR] = mc_interception, ++ [SVM_EXIT_EXCP_BASE + AC_VECTOR] = ac_interception, + [SVM_EXIT_INTR] = intr_interception, + [SVM_EXIT_NMI] = nmi_interception, + [SVM_EXIT_SMI] = nop_on_interception, +diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c +index b765b036a048..89aaedd2a91d 100644 +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -1639,7 +1639,7 @@ static void update_exception_bitmap(struct kvm_vcpu *vcpu) + u32 eb; + + eb = (1u << PF_VECTOR) | (1u << UD_VECTOR) | (1u << MC_VECTOR) | +- (1u << NM_VECTOR) | (1u << DB_VECTOR); ++ (1u << NM_VECTOR) | (1u << DB_VECTOR) | (1u << AC_VECTOR); + if ((vcpu->guest_debug & + (KVM_GUESTDBG_ENABLE | KVM_GUESTDBG_USE_SW_BP)) == + (KVM_GUESTDBG_ENABLE | KVM_GUESTDBG_USE_SW_BP)) +@@ -5261,6 +5261,9 @@ static int handle_exception(struct kvm_vcpu *vcpu) + return handle_rmode_exception(vcpu, ex_no, error_code); + + switch (ex_no) { ++ case AC_VECTOR: ++ kvm_queue_exception_e(vcpu, AC_VECTOR, error_code); ++ return 1; + case DB_VECTOR: + dr6 = vmcs_readl(EXIT_QUALIFICATION); + if (!(vcpu->guest_debug & +-- +1.8.3.1 + + diff --git a/kernel/kernel/files/patches/mageia/x86-efi-Fix-multiple-GOP-device-support.patch b/kernel/kernel/files/patches/mageia/x86-efi-Fix-multiple-GOP-device-support.patch deleted file mode 100644 index 496144c3..00000000 --- a/kernel/kernel/files/patches/mageia/x86-efi-Fix-multiple-GOP-device-support.patch +++ /dev/null @@ -1,92 +0,0 @@ -From 8a53554e12e98d1759205afd7b8e9e2ea0936f48 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?K=C5=91v=C3=A1g=C3=B3=2C=20Zolt=C3=A1n?= - -Date: Mon, 12 Oct 2015 15:13:56 +0100 -Subject: [PATCH] x86/efi: Fix multiple GOP device support -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -When multiple GOP devices exists, but none of them implements -ConOut, the code should just choose the first GOP (according to -the comments). But currently 'fb_base' will refer to the last GOP, -while other parameters to the first GOP, which will likely -result in a garbled display. - -I can reliably reproduce this bug using my ASRock Z87M Extreme4 -motherboard with CSM and integrated GPU disabled, and two PCIe -video cards (NVidia GT640 and GTX980), booting from efi-stub -(booting from grub works fine). On the primary display the -ASRock logo remains and on the secondary screen it is garbled -up completely. - -Signed-off-by: Kővágó, Zoltán -Signed-off-by: Matt Fleming -Cc: -Cc: Linus Torvalds -Cc: Matthew Garrett -Cc: Peter Zijlstra -Cc: Thomas Gleixner -Link: http://lkml.kernel.org/r/1444659236-24837-2-git-send-email-matt@codeblueprint.co.uk -Signed-off-by: Ingo Molnar ---- - arch/x86/boot/compressed/eboot.c | 8 ++++++-- - 1 file changed, 6 insertions(+), 2 deletions(-) - -diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c -index ee1b6d3..db51c1f 100644 ---- a/arch/x86/boot/compressed/eboot.c -+++ b/arch/x86/boot/compressed/eboot.c -@@ -667,6 +667,7 @@ setup_gop32(struct screen_info *si, efi_guid_t *proto, - bool conout_found = false; - void *dummy = NULL; - u32 h = handles[i]; -+ u32 current_fb_base; - - status = efi_call_early(handle_protocol, h, - proto, (void **)&gop32); -@@ -678,7 +679,7 @@ setup_gop32(struct screen_info *si, efi_guid_t *proto, - if (status == EFI_SUCCESS) - conout_found = true; - -- status = __gop_query32(gop32, &info, &size, &fb_base); -+ status = __gop_query32(gop32, &info, &size, ¤t_fb_base); - if (status == EFI_SUCCESS && (!first_gop || conout_found)) { - /* - * Systems that use the UEFI Console Splitter may -@@ -692,6 +693,7 @@ setup_gop32(struct screen_info *si, efi_guid_t *proto, - pixel_format = info->pixel_format; - pixel_info = info->pixel_information; - pixels_per_scan_line = info->pixels_per_scan_line; -+ fb_base = current_fb_base; - - /* - * Once we've found a GOP supporting ConOut, -@@ -770,6 +772,7 @@ setup_gop64(struct screen_info *si, efi_guid_t *proto, - bool conout_found = false; - void *dummy = NULL; - u64 h = handles[i]; -+ u32 current_fb_base; - - status = efi_call_early(handle_protocol, h, - proto, (void **)&gop64); -@@ -781,7 +784,7 @@ setup_gop64(struct screen_info *si, efi_guid_t *proto, - if (status == EFI_SUCCESS) - conout_found = true; - -- status = __gop_query64(gop64, &info, &size, &fb_base); -+ status = __gop_query64(gop64, &info, &size, ¤t_fb_base); - if (status == EFI_SUCCESS && (!first_gop || conout_found)) { - /* - * Systems that use the UEFI Console Splitter may -@@ -795,6 +798,7 @@ setup_gop64(struct screen_info *si, efi_guid_t *proto, - pixel_format = info->pixel_format; - pixel_info = info->pixel_information; - pixels_per_scan_line = info->pixels_per_scan_line; -+ fb_base = current_fb_base; - - /* - * Once we've found a GOP supporting ConOut, --- -2.6.2 - diff --git a/kernel/kernel/pspec.xml b/kernel/kernel/pspec.xml index 822e4215..746a24fb 100644 --- a/kernel/kernel/pspec.xml +++ b/kernel/kernel/pspec.xml @@ -28,19 +28,18 @@ - patches/linux/patch-4.2.5.xz - + patches/linux/patch-4.2.6.xz + - patches/mageia/stable-mac80211-fix-hwflags-debugfs-file-format.patch - patches/mageia/stable-ath9k-declare-required-extra-tx-headroom.patch - patches/mageia/stable-mmc-core-fix-init_card-in-52mhz.patch + patches/mageia/x86-pci-toshiba-equium-a60-assign-busses.patch patches/mageia/x86-boot-video-80x25-if-break.patch patches/mageia/x86-default_poweroff_up_machines.patch patches/mageia/x86-increase-default-minimum-vmalloc-area-by-64MB-to-192MB.patch patches/mageia/Revert-cpufreq-pcc-Enable-autoload-of-pcc-cpufreq-fo.patch - patches/mageia/x86-efi-Fix-multiple-GOP-device-support.patch + patches/mageia/x86-KVM-x86-work-around-infinite-loop-in-microcode-when-AC-is-delivered.patch + patches/mageia/x86-KVM-svm-unconditionally-intercept-DB.patch patches/mageia/base-cacheinfo-silence-DT-warnings.patch patches/mageia/pci-add-ALI-M5229-ide-compatibility-mode-quirk.patch patches/mageia/pci-quirks-drop-devinit-exit.patch @@ -61,7 +60,6 @@ patches/mageia/block-Make-CFQ-default-to-IOPS-mode-on-SSDs.patch patches/mageia/fs-aufs4.patch patches/mageia/fs-aufs4-modular.patch - patches/mageia/fs-btrfs-fix-possible-leak-in-btrfs_ioctl_balance.patch patches/mageia/firewire-ieee1394-module-aliases.patch patches/mageia/char-agp-intel-new-Q57-id.patch patches/mageia/gpu-drm-mach64.patch @@ -82,7 +80,6 @@ patches/mageia/gpu-drm-mach64-3.17-buildfix.patch patches/mageia/gpu-drm-mach64-3.18-buildfix.patch patches/mageia/input-i8042-quirks-for-Fujitsu-Lifebook-A544-and-Lif.patch - patches/mageia/input-alps-Only-the-Dell-Latitude-D420_430_620_630-have-separate-stick-button-bits.patch patches/mageia/net-sis190-fix-list-usage.patch patches/mageia/net-netfilter-IFWLOG.patch patches/mageia/net-netfilter-IFWLOG-mdv.patch @@ -92,9 +89,12 @@ patches/mageia/net-netfilter-IFWLOG-3.7-buildfix.patch patches/mageia/net-netfilter-psd.patch patches/mageia/net-netfilter-psd-mdv.patch - patches/mageia/net-netfilter-psd-2.6.35-buildfix.patch - patches/mageia/net-wireless-rtlwifi-rtl8821ae-Fix-system-lockups-on-boot.patch - patches/mageia/net-wireless-iwlwifi-fix-firmware-filename-for-3160.patch + patches/mageia/net-netfilter-psd-2.6.35-buildfix.patch + patches/mageia/net-netfilter-ipset-Fix-extension-alignment.patch + patches/mageia/net-netfilter-ipset-Fix-hash-type-expiration.patch + patches/mageia/net-netfilter-ipset-Fix-hash-type-expire-release-empty-hash-bucket-block.patch + patches/mageia/net-netfilter-Fix-removal-of-GRE-expectation-entries-created-by-PPTP.patch + patches/mageia/net-wireless-rtlwifi-rtl8821ae-Fix-lockups-on-boot.patch patches/mageia/platform-x86-add-shuttle-wmi-driver.patch patches/mageia/platform-x86-shuttle-wmi-drop-devinit-exit.patch patches/mageia/platform-x86-shuttle-wmi-4.2-buildfix.patch @@ -113,9 +113,9 @@ patches/mageia/3rd-acerhk-fix-build-with-function-tracer.patch patches/mageia/3rd-acerhk-2.6.36-buildfix.patch patches/mageia/3rd-acerhk-fix-include.patch - + patches/mageia/3rd-aes2501-rmmod-oops-fix.patch patches/mageia/3rd-ndiswrapper-1.59.patch patches/mageia/3rd-ndiswrapper-Kconfig.patch patches/mageia/3rd-ndiswrapper-Makefile-build-fix.patch @@ -190,6 +190,14 @@ + + 2015-11-11 + 4.2.6 + Version bump to 4.2.5 https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.2.5 + security + Ertuğrul Erata + ertugrulerata@gmail.com + 2015-11-30 4.2.5 diff --git a/kernel/tools/cpupowertools/files/patches/linux/patch-4.2.6.xz b/kernel/tools/cpupowertools/files/patches/linux/patch-4.2.6.xz new file mode 100644 index 00000000..06d8f455 Binary files /dev/null and b/kernel/tools/cpupowertools/files/patches/linux/patch-4.2.6.xz differ diff --git a/kernel/tools/cpupowertools/pspec.xml b/kernel/tools/cpupowertools/pspec.xml index 56609a6d..1ff07d7b 100644 --- a/kernel/tools/cpupowertools/pspec.xml +++ b/kernel/tools/cpupowertools/pspec.xml @@ -18,7 +18,7 @@ - patches/linux/patch-4.2.5.xz + patches/linux/patch-4.2.6.xz @@ -44,6 +44,13 @@ --> + + 2015-11-11 + 4.2.6 + Version bump. + Ertuğrul Erata + ertugrulerata@gmail.com + 2015-11-30 4.2.5