diff --git a/find-packages-not-compiled-in-farm b/find-packages-not-compiled-in-farm index 6dbc292b..728cdcff 100755 --- a/find-packages-not-compiled-in-farm +++ b/find-packages-not-compiled-in-farm @@ -16,7 +16,7 @@ import lzma import piksemel pisirepouri = "http://ciftlik.pisilinux.org/pisi-2.0/pisi-index.xml.xz" -svnrepouri = "https://github.com/pisilinux/core/raw/master/pisi-index.xml.xz" +svnrepouri = "https://github.com/ertugerata/core/raw/master/pisi-index.xml.xz" def getIndex(uri): try: diff --git a/kernel/drivers/module-bbswitch/pspec.xml b/kernel/drivers/module-bbswitch/pspec.xml index 33b0ff75..18d4dcff 100644 --- a/kernel/drivers/module-bbswitch/pspec.xml +++ b/kernel/drivers/module-bbswitch/pspec.xml @@ -11,7 +11,7 @@ Kernel module allowing to switch dedicated graphics card on Optimus laptops kernel module allowing to switch dedicated graphics card on Optimus laptops - kernel-module-headers + kernel-module-headers https://github.com/Bumblebee-Project/bbswitch/archive/v0.8.tar.gz @@ -20,7 +20,7 @@ module-bbswitch - kernel + kernel /lib/modules @@ -34,6 +34,13 @@ + + 2015-11-26 + 0.8 + Rebuild for kernel-4.2.4. + Ertuğrul Erata + ertugrulerata@gmail.com + 2015-10-05 0.8 diff --git a/kernel/drivers/module-broadcom-wl/pspec.xml b/kernel/drivers/module-broadcom-wl/pspec.xml index d5094752..a640fece 100644 --- a/kernel/drivers/module-broadcom-wl/pspec.xml +++ b/kernel/drivers/module-broadcom-wl/pspec.xml @@ -15,7 +15,7 @@ http://www.broadcom.com/docs/linux_sta/hybrid-v35-nodebug-pcoem-6_30_223_248.tar.gz http://www.broadcom.com/docs/linux_sta/hybrid-v35_64-nodebug-pcoem-6_30_223_248.tar.gz - kernel-module-headers + kernel-module-headers patch/linux-40.patch @@ -32,7 +32,7 @@ module-broadcom-wl - kernel + kernel module-broadcom-wl-userspace @@ -64,6 +64,13 @@ + + 2015-11-26 + 6.30.223.248 + Rebuild for kernel 4.2.4. + Ertuğrul Erata + ertugrulerata@gmail.com + 2015-10-05 6.30.223.248 diff --git a/kernel/drivers/module-virtualbox-guest/pspec.xml b/kernel/drivers/module-virtualbox-guest/pspec.xml index 951cec26..03636c05 100644 --- a/kernel/drivers/module-virtualbox-guest/pspec.xml +++ b/kernel/drivers/module-virtualbox-guest/pspec.xml @@ -12,16 +12,16 @@ driver Kernel modules for VirtualBox guest machines This package provides the kernel modules needed for mouse integration and shared folder support between VirtualBox host and guest systems. - http://source.pisilinux.org/1.0/module-virtualbox-guest-4.3.28.tar.xz + http://sourceforge.net/projects/pisilinux/files/source/module-virtualbox-guest-5.0.4.tar.xz - kernel-module-headers + kernel-module-headers module-virtualbox-guest - kernel + kernel baselayout module-virtualbox-guest-userspace @@ -52,6 +52,13 @@ + + 2015-11-26 + 5.0.4 + Version bump. + Ertuğrul Erata + ertugrulerata@gmail.com + 2015-10-05 4.3.28 diff --git a/kernel/drivers/module-virtualbox/pspec.xml b/kernel/drivers/module-virtualbox/pspec.xml index 8bb6a74e..250923cc 100644 --- a/kernel/drivers/module-virtualbox/pspec.xml +++ b/kernel/drivers/module-virtualbox/pspec.xml @@ -12,16 +12,16 @@ driver Kernel modules for VirtualBox This package provides the kernel support for VirtualBox. - http://source.pisilinux.org/1.0/module-virtualbox-4.3.28.tar.xz + http://sourceforge.net/projects/pisilinux/files/source/module-virtualbox-5.0.4.tar.xz - kernel-module-headers + kernel-module-headers module-virtualbox - kernel + kernel module-virtualbox-userspace @@ -47,6 +47,13 @@ + + 2015-11-26 + 5.0.4 + Version bump. + Ertuğrul Erata + ertugrulerata@gmail.com + 2015-10-05 4.3.28 diff --git a/kernel/drivers/ndiswrapper/pspec.xml b/kernel/drivers/ndiswrapper/pspec.xml index f9bb6dce..be94d4d3 100644 --- a/kernel/drivers/ndiswrapper/pspec.xml +++ b/kernel/drivers/ndiswrapper/pspec.xml @@ -15,7 +15,7 @@ module-ndiswrapper allows you to use Windows XP drivers for WLAN cards without proper Linux drivers. http://download.sourceforge.net/ndiswrapper/ndiswrapper-1.59.tar.gz - kernel-module-headers + kernel-module-headers support_kernel-4.0.patch @@ -29,7 +29,7 @@ ndiswrapper - kernel + kernel /lib/modules @@ -45,13 +45,20 @@ + + 2014-11-26 + 1.59 + Rebuild for kernel-4.2.4. + PisiLinux Community + admins@pisilinux.org + 2014-10-05 1.59 Rebuild for kernel-4.2.3. PisiLinux Community admins@pisilinux.org - + 2014-10-01 1.59 diff --git a/kernel/kernel/files/configs/kernel-x86_64-config b/kernel/kernel/files/configs/kernel-x86_64-config index 7ddb7b0d..73b96220 100644 --- a/kernel/kernel/files/configs/kernel-x86_64-config +++ b/kernel/kernel/files/configs/kernel-x86_64-config @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/x86_64 4.2.3 Kernel Configuration +# Linux/x86_64 4.2.4 Kernel Configuration # CONFIG_64BIT=y CONFIG_X86_64=y diff --git a/kernel/kernel/files/patches/linux/patch-4.2.4.xz b/kernel/kernel/files/patches/linux/patch-4.2.4.xz new file mode 100644 index 00000000..03a7b891 Binary files /dev/null and b/kernel/kernel/files/patches/linux/patch-4.2.4.xz differ diff --git a/kernel/kernel/files/patches/mageia/cpu-cacheinfo-Fix-teardown-path.patch b/kernel/kernel/files/patches/mageia/cpu-cacheinfo-Fix-teardown-path.patch deleted file mode 100644 index 750fba8d..00000000 --- a/kernel/kernel/files/patches/mageia/cpu-cacheinfo-Fix-teardown-path.patch +++ /dev/null @@ -1,81 +0,0 @@ -From 2110d70c5e58326a10e93cfefdc0b3686e2ada12 Mon Sep 17 00:00:00 2001 -From: Borislav Petkov -Date: Sat, 8 Aug 2015 10:46:02 +0200 -Subject: cpu/cacheinfo: Fix teardown path -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Philip Müller reported a hang when booting 32-bit 4.1 kernel on an AMD -box. A fragment of the splat was enough to pinpoint the issue: - - task: f58e0000 ti: f58e8000 task.ti: f58e800 - EIP: 0060:[] EFLAGS: 00010206 CPU: 0 - EIP is at free_cache_attributes+0x83/0xd0 - EAX: 00000001 EBX: f589d46c ECX: 00000090 EDX: 360c2000 - ESI: 00000000 EDI: c1724a80 EBP: f58e9ec0 ESP: f58e9ea0 - DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068 - CR0: 8005003b CR2: 000000ac CR3: 01731000 CR4: 000006d0 - -cache_shared_cpu_map_setup() did check sibling CPUs cacheinfo descriptor -while the respective teardown path cache_shared_cpu_map_remove() didn't. -Fix that. - ->From tglx's version: to be on the safe side, move the cacheinfo -descriptor check to free_cache_attributes(), thus cleaning up the -hotplug path a little and making this even more robust. - -Reported-and-tested-by: Philip Müller -Reviewed-by: Thomas Gleixner -Acked-by: Sudeep Holla -Cc: # 4.1 -Cc: Andre Przywara -Cc: Guenter Roeck -Cc: "H. Peter Anvin" -Cc: Ingo Molnar -Cc: linux-kernel@vger.kernel.org -Cc: manjaro-dev@manjaro.org -Cc: Philip Müller -Link: https://lkml.kernel.org/r/55B47BB8.6080202@manjaro.org -Signed-off-by: Borislav Petkov -Signed-off-by: Greg Kroah-Hartman - -diff --git a/drivers/base/cacheinfo.c b/drivers/base/cacheinfo.c -index 764280a..e9fd32e 100644 ---- a/drivers/base/cacheinfo.c -+++ b/drivers/base/cacheinfo.c -@@ -148,7 +148,11 @@ static void cache_shared_cpu_map_remove(unsigned int cpu) - - if (sibling == cpu) /* skip itself */ - continue; -+ - sib_cpu_ci = get_cpu_cacheinfo(sibling); -+ if (!sib_cpu_ci->info_list) -+ continue; -+ - sib_leaf = sib_cpu_ci->info_list + index; - cpumask_clear_cpu(cpu, &sib_leaf->shared_cpu_map); - cpumask_clear_cpu(sibling, &this_leaf->shared_cpu_map); -@@ -159,6 +163,9 @@ static void cache_shared_cpu_map_remove(unsigned int cpu) - - static void free_cache_attributes(unsigned int cpu) - { -+ if (!per_cpu_cacheinfo(cpu)) -+ return; -+ - cache_shared_cpu_map_remove(cpu); - - kfree(per_cpu_cacheinfo(cpu)); -@@ -514,8 +521,7 @@ static int cacheinfo_cpu_callback(struct notifier_block *nfb, - break; - case CPU_DEAD: - cache_remove_dev(cpu); -- if (per_cpu_cacheinfo(cpu)) -- free_cache_attributes(cpu); -+ free_cache_attributes(cpu); - break; - } - return notifier_from_errno(rc); --- -cgit v0.10.2 - diff --git a/kernel/kernel/files/patches/mageia/fs-btrfs-fix-possible-leak-in-btrfs_ioctl_balance.patch b/kernel/kernel/files/patches/mageia/fs-btrfs-fix-possible-leak-in-btrfs_ioctl_balance.patch new file mode 100644 index 00000000..790bf196 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/fs-btrfs-fix-possible-leak-in-btrfs_ioctl_balance.patch @@ -0,0 +1,53 @@ +From 0f89abf56abbd0e1c6e3cef9813e6d9f05383c1e Mon Sep 17 00:00:00 2001 +From: Christian Engelmayer +Date: Wed, 21 Oct 2015 00:50:06 +0200 +Subject: btrfs: fix possible leak in btrfs_ioctl_balance() + +Commit 8eb934591f8b ("btrfs: check unsupported filters in balance +arguments") adds a jump to exit label out_bargs in case the argument +check fails. At this point in addition to the bargs memory, the +memory for struct btrfs_balance_control has already been allocated. +Ownership of bctl is passed to btrfs_balance() in the good case, +thus the memory is not freed due to the introduced jump. Make sure +that the memory gets freed in any case as necessary. Detected by +Coverity CID 1328378. + +Signed-off-by: Christian Engelmayer +Reviewed-by: David Sterba +Signed-off-by: Chris Mason +--- + fs/btrfs/ioctl.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c +index 3e3e613..8d20f3b 100644 +--- a/fs/btrfs/ioctl.c ++++ b/fs/btrfs/ioctl.c +@@ -4641,7 +4641,7 @@ locked: + + if (bctl->flags & ~(BTRFS_BALANCE_ARGS_MASK | BTRFS_BALANCE_TYPE_MASK)) { + ret = -EINVAL; +- goto out_bargs; ++ goto out_bctl; + } + + do_balance: +@@ -4655,12 +4655,15 @@ do_balance: + need_unlock = false; + + ret = btrfs_balance(bctl, bargs); ++ bctl = NULL; + + if (arg) { + if (copy_to_user(arg, bargs, sizeof(*bargs))) + ret = -EFAULT; + } + ++out_bctl: ++ kfree(bctl); + out_bargs: + kfree(bargs); + out_unlock: +-- +cgit v0.11.2 + diff --git a/kernel/kernel/files/patches/mageia/fs-dcache-Handle-escaped-paths-in-prepend_path.patch b/kernel/kernel/files/patches/mageia/fs-dcache-Handle-escaped-paths-in-prepend_path.patch deleted file mode 100644 index d5bce46a..00000000 --- a/kernel/kernel/files/patches/mageia/fs-dcache-Handle-escaped-paths-in-prepend_path.patch +++ /dev/null @@ -1,64 +0,0 @@ -From 143081a13f31bcf05cb5685f628b6fda65d05237 Mon Sep 17 00:00:00 2001 -From: "Eric W. Biederman" -Date: Sat, 15 Aug 2015 13:36:12 -0500 -Subject: [PATCH 1/2] dcache: Handle escaped paths in prepend_path - -commit cde93be45a8a90d8c264c776fab63487b5038a65 upstream. - -A rename can result in a dentry that by walking up d_parent -will never reach it's mnt_root. For lack of a better term -I call this an escaped path. - -prepend_path is called by four different functions __d_path, -d_absolute_path, d_path, and getcwd. - -__d_path only wants to see paths are connected to the root it passes -in. So __d_path needs prepend_path to return an error. - -d_absolute_path similarly wants to see paths that are connected to -some root. Escaped paths are not connected to any mnt_root so -d_absolute_path needs prepend_path to return an error greater -than 1. So escaped paths will be treated like paths on lazily -unmounted mounts. - -getcwd needs to prepend "(unreachable)" so getcwd also needs -prepend_path to return an error. - -d_path is the interesting hold out. d_path just wants to print -something, and does not care about the weird cases. Which raises -the question what should be printed? - -Given that / should result in -ENOENT I -believe it is desirable for escaped paths to be printed as empty -paths. As there are not really any meaninful path components when -considered from the perspective of a mount tree. - -So tweak prepend_path to return an empty path with an new error -code of 3 when it encounters an escaped path. - -Signed-off-by: "Eric W. Biederman" -Signed-off-by: Al Viro ---- - fs/dcache.c | 7 +++++++ - 1 file changed, 7 insertions(+) - -diff --git a/fs/dcache.c b/fs/dcache.c -index 9b5fe503f6cb..e3b44ca75a1b 100644 ---- a/fs/dcache.c -+++ b/fs/dcache.c -@@ -2926,6 +2926,13 @@ restart: - - if (dentry == vfsmnt->mnt_root || IS_ROOT(dentry)) { - struct mount *parent = ACCESS_ONCE(mnt->mnt_parent); -+ /* Escaped? */ -+ if (dentry != vfsmnt->mnt_root) { -+ bptr = *buffer; -+ blen = *buflen; -+ error = 3; -+ break; -+ } - /* Global root? */ - if (mnt != parent) { - dentry = ACCESS_ONCE(mnt->mnt_mountpoint); --- -2.2.1 diff --git a/kernel/kernel/files/patches/mageia/fs-vfs-Test-for-and-handle-paths-that-are-unreachable-from-their-mnt_root.patch b/kernel/kernel/files/patches/mageia/fs-vfs-Test-for-and-handle-paths-that-are-unreachable-from-their-mnt_root.patch deleted file mode 100644 index ee6045af..00000000 --- a/kernel/kernel/files/patches/mageia/fs-vfs-Test-for-and-handle-paths-that-are-unreachable-from-their-mnt_root.patch +++ /dev/null @@ -1,110 +0,0 @@ -From 701cf206d76af24fc948b3a798c4ee6b7f149910 Mon Sep 17 00:00:00 2001 -From: "Eric W. Biederman" -Date: Sat, 15 Aug 2015 20:27:13 -0500 -Subject: [PATCH 2/2] vfs: Test for and handle paths that are unreachable from - their mnt_root - -commit 397d425dc26da728396e66d392d5dcb8dac30c37 upstream. - -In rare cases a directory can be renamed out from under a bind mount. -In those cases without special handling it becomes possible to walk up -the directory tree to the root dentry of the filesystem and down -from the root dentry to every other file or directory on the filesystem. - -Like division by zero .. from an unconnected path can not be given -a useful semantic as there is no predicting at which path component -the code will realize it is unconnected. We certainly can not match -the current behavior as the current behavior is a security hole. - -Therefore when encounting .. when following an unconnected path -return -ENOENT. - -- Add a function path_connected to verify path->dentry is reachable - from path->mnt.mnt_root. AKA to validate that rename did not do - something nasty to the bind mount. - - To avoid races path_connected must be called after following a path - component to it's next path component. - -Signed-off-by: "Eric W. Biederman" -Signed-off-by: Al Viro ---- - fs/namei.c | 27 +++++++++++++++++++++++++-- - 1 file changed, 25 insertions(+), 2 deletions(-) - -diff --git a/fs/namei.c b/fs/namei.c -index 1c2105ed20c5..29b927938b8c 100644 ---- a/fs/namei.c -+++ b/fs/namei.c -@@ -560,6 +560,24 @@ static int __nd_alloc_stack(struct nameidata *nd) - return 0; - } - -+/** -+ * path_connected - Verify that a path->dentry is below path->mnt.mnt_root -+ * @path: nameidate to verify -+ * -+ * Rename can sometimes move a file or directory outside of a bind -+ * mount, path_connected allows those cases to be detected. -+ */ -+static bool path_connected(const struct path *path) -+{ -+ struct vfsmount *mnt = path->mnt; -+ -+ /* Only bind mounts can have disconnected paths */ -+ if (mnt->mnt_root == mnt->mnt_sb->s_root) -+ return true; -+ -+ return is_subdir(path->dentry, mnt->mnt_root); -+} -+ - static inline int nd_alloc_stack(struct nameidata *nd) - { - if (likely(nd->depth != EMBEDDED_LEVELS)) -@@ -1296,6 +1314,8 @@ static int follow_dotdot_rcu(struct nameidata *nd) - return -ECHILD; - nd->path.dentry = parent; - nd->seq = seq; -+ if (unlikely(!path_connected(&nd->path))) -+ return -ENOENT; - break; - } else { - struct mount *mnt = real_mount(nd->path.mnt); -@@ -1396,7 +1416,7 @@ static void follow_mount(struct path *path) - } - } - --static void follow_dotdot(struct nameidata *nd) -+static int follow_dotdot(struct nameidata *nd) - { - if (!nd->root.mnt) - set_root(nd); -@@ -1412,6 +1432,8 @@ static void follow_dotdot(struct nameidata *nd) - /* rare case of legitimate dget_parent()... */ - nd->path.dentry = dget_parent(nd->path.dentry); - dput(old); -+ if (unlikely(!path_connected(&nd->path))) -+ return -ENOENT; - break; - } - if (!follow_up(&nd->path)) -@@ -1419,6 +1441,7 @@ static void follow_dotdot(struct nameidata *nd) - } - follow_mount(&nd->path); - nd->inode = nd->path.dentry->d_inode; -+ return 0; - } - - /* -@@ -1634,7 +1657,7 @@ static inline int handle_dots(struct nameidata *nd, int type) - if (nd->flags & LOOKUP_RCU) { - return follow_dotdot_rcu(nd); - } else -- follow_dotdot(nd); -+ return follow_dotdot(nd); - } - return 0; - } --- -2.2.1 - diff --git a/kernel/kernel/files/patches/mageia/input-alps-Only-the-Dell-Latitude-D420_430_620_630-have-separate-stick-button-bits.patch b/kernel/kernel/files/patches/mageia/input-alps-Only-the-Dell-Latitude-D420_430_620_630-have-separate-stick-button-bits.patch new file mode 100644 index 00000000..90364e15 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/input-alps-Only-the-Dell-Latitude-D420_430_620_630-have-separate-stick-button-bits.patch @@ -0,0 +1,115 @@ +From: Hans de Goede +Subject: [PATCH] alps: Only the Dell Latitude D420/430/620/630 have separate stick button bits +Date: Wed, 21 Oct 2015 10:16:18 +0200 + +commit 92bac83dd79e ("Input: alps - non interleaved V2 dualpoint has +separate stick button bits") assumes that all alps v2 non-interleaved +dual point setups have the separate stick button bits. + +Later we limited this to Dell laptops only because of reports that this +broke things on non Dell laptops. Now it turns out that this breaks things +on the Dell Latitude D600 too. So it seems that only the Dell Latitude +D420/430/620/630, which all share the same touchpad / stick combo, +have these separate bits. + +This patch limits the checking of the separate bits to only these models +fixing regressions with other models. + +Reported-and-tested-by: Larry Finger +Cc: stable@vger.kernel.org +Tested-by: Hans de Goede +Signed-off-by: Hans de Goede +--- + drivers/input/mouse/alps.c | 48 ++++++++++++++++++++++++++++++++++++++++------ + 1 file changed, 42 insertions(+), 6 deletions(-) + +diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c +index 4d24686..41e6cb5 100644 +--- a/drivers/input/mouse/alps.c ++++ b/drivers/input/mouse/alps.c +@@ -100,7 +100,7 @@ static const struct alps_nibble_commands alps_v6_nibble_commands[] = { + #define ALPS_FOUR_BUTTONS 0x40 /* 4 direction button present */ + #define ALPS_PS2_INTERLEAVED 0x80 /* 3-byte PS/2 packet interleaved with + 6-byte ALPS packet */ +-#define ALPS_DELL 0x100 /* device is a Dell laptop */ ++#define ALPS_STICK_BITS 0x100 /* separate stick button bits */ + #define ALPS_BUTTONPAD 0x200 /* device is a clickpad */ + + static const struct alps_model_info alps_model_data[] = { +@@ -159,6 +159,43 @@ static const struct alps_protocol_info alps_v8_protocol_data = { + ALPS_PROTO_V8, 0x18, 0x18, 0 + }; + ++/* ++ * Some v2 models report the stick buttons in separate bits ++ */ ++static const struct dmi_system_id alps_dmi_has_separate_stick_buttons[] = { ++#if defined(CONFIG_DMI) && defined(CONFIG_X86) ++ { ++ /* Extrapolated from other entries */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Latitude D420"), ++ }, ++ }, ++ { ++ /* Reported-by: Hans de Bruin */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Latitude D430"), ++ }, ++ }, ++ { ++ /* Reported-by: Hans de Goede */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Latitude D620"), ++ }, ++ }, ++ { ++ /* Extrapolated from other entries */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Latitude D630"), ++ }, ++ }, ++#endif ++ { } ++}; ++ + static void alps_set_abs_params_st(struct alps_data *priv, + struct input_dev *dev1); + static void alps_set_abs_params_semi_mt(struct alps_data *priv, +@@ -253,9 +290,8 @@ static void alps_process_packet_v1_v2(struct psmouse *psmouse) + return; + } + +- /* Dell non interleaved V2 dualpoint has separate stick button bits */ +- if (priv->proto_version == ALPS_PROTO_V2 && +- priv->flags == (ALPS_DELL | ALPS_PASS | ALPS_DUALPOINT)) { ++ /* Some models have separate stick button bits */ ++ if (priv->flags & ALPS_STICK_BITS) { + left |= packet[0] & 1; + right |= packet[0] & 2; + middle |= packet[0] & 4; +@@ -2552,8 +2588,6 @@ static int alps_set_protocol(struct psmouse *psmouse, + priv->byte0 = protocol->byte0; + priv->mask0 = protocol->mask0; + priv->flags = protocol->flags; +- if (dmi_name_in_vendors("Dell")) +- priv->flags |= ALPS_DELL; + + priv->x_max = 2000; + priv->y_max = 1400; +@@ -2568,6 +2602,8 @@ static int alps_set_protocol(struct psmouse *psmouse, + priv->set_abs_params = alps_set_abs_params_st; + priv->x_max = 1023; + priv->y_max = 767; ++ if (dmi_check_system(alps_dmi_has_separate_stick_buttons)) ++ priv->flags |= ALPS_STICK_BITS; + break; + + case ALPS_PROTO_V3: +-- +2.5.0 + diff --git a/kernel/kernel/files/patches/mageia/net-netfilter-bridge-fix-IPv6-packets-not-being-bridged-.patch b/kernel/kernel/files/patches/mageia/net-netfilter-bridge-fix-IPv6-packets-not-being-bridged-.patch deleted file mode 100644 index bf89c51a..00000000 --- a/kernel/kernel/files/patches/mageia/net-netfilter-bridge-fix-IPv6-packets-not-being-bridged-.patch +++ /dev/null @@ -1,42 +0,0 @@ -From 18e1db67e93ed75d9dc0d34c8d783ccf10547c2b Mon Sep 17 00:00:00 2001 -From: Bernhard Thaler -Date: Thu, 13 Aug 2015 08:58:15 +0200 -Subject: [PATCH] netfilter: bridge: fix IPv6 packets not being bridged with - CONFIG_IPV6=n - -230ac490f7fba introduced a dependency to CONFIG_IPV6 which breaks bridging -of IPv6 packets on a bridge with CONFIG_IPV6=n. - -Sysctl entry /proc/sys/net/bridge/bridge-nf-call-ip6tables defaults to 1, -for this reason packets are handled by br_nf_pre_routing_ipv6(). When compiled -with CONFIG_IPV6=n this function returns NF_DROP but should return NF_ACCEPT -to let packets through. - -Change CONFIG_IPV6=n br_nf_pre_routing_ipv6() return value to NF_ACCEPT. - -Tested with a simple bridge with two interfaces and IPv6 packets trying -to pass from host on left side to host on right side of the bridge. - -Fixes: 230ac490f7fba ("netfilter: bridge: split ipv6 code into separated file") -Signed-off-by: Bernhard Thaler -Signed-off-by: Pablo Neira Ayuso ---- - include/net/netfilter/br_netfilter.h | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/include/net/netfilter/br_netfilter.h b/include/net/netfilter/br_netfilter.h -index bab824b..d4c6b5f 100644 ---- a/include/net/netfilter/br_netfilter.h -+++ b/include/net/netfilter/br_netfilter.h -@@ -59,7 +59,7 @@ static inline unsigned int - br_nf_pre_routing_ipv6(const struct nf_hook_ops *ops, struct sk_buff *skb, - const struct nf_hook_state *state) - { -- return NF_DROP; -+ return NF_ACCEPT; - } - #endif - --- -2.6.0 - diff --git a/kernel/kernel/files/patches/mageia/net-netfilter-conntrack-use-nf_ct_tmpl_free-in-CT-synpro.patch b/kernel/kernel/files/patches/mageia/net-netfilter-conntrack-use-nf_ct_tmpl_free-in-CT-synpro.patch deleted file mode 100644 index efd42653..00000000 --- a/kernel/kernel/files/patches/mageia/net-netfilter-conntrack-use-nf_ct_tmpl_free-in-CT-synpro.patch +++ /dev/null @@ -1,103 +0,0 @@ -From 9cf94eab8b309e8bcc78b41dd1561c75b537dd0b Mon Sep 17 00:00:00 2001 -From: Daniel Borkmann -Date: Mon, 31 Aug 2015 19:11:02 +0200 -Subject: [PATCH] netfilter: conntrack: use nf_ct_tmpl_free in CT/synproxy - error paths - -Commit 0838aa7fcfcd ("netfilter: fix netns dependencies with conntrack -templates") migrated templates to the new allocator api, but forgot to -update error paths for them in CT and synproxy to use nf_ct_tmpl_free() -instead of nf_conntrack_free(). - -Due to that, memory is being freed into the wrong kmemcache, but also -we drop the per net reference count of ct objects causing an imbalance. - -In Brad's case, this leads to a wrap-around of net->ct.count and thus -lets __nf_conntrack_alloc() refuse to create a new ct object: - - [ 10.340913] xt_addrtype: ipv6 does not support BROADCAST matching - [ 10.810168] nf_conntrack: table full, dropping packet - [ 11.917416] r8169 0000:07:00.0 eth0: link up - [ 11.917438] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready - [ 12.815902] nf_conntrack: table full, dropping packet - [ 15.688561] nf_conntrack: table full, dropping packet - [ 15.689365] nf_conntrack: table full, dropping packet - [ 15.690169] nf_conntrack: table full, dropping packet - [ 15.690967] nf_conntrack: table full, dropping packet - [...] - -With slab debugging, it also reports the wrong kmemcache (kmalloc-512 vs. -nf_conntrack_ffffffff81ce75c0) and reports poison overwrites, etc. Thus, -to fix the problem, export and use nf_ct_tmpl_free() instead. - -Fixes: 0838aa7fcfcd ("netfilter: fix netns dependencies with conntrack templates") -Reported-by: Brad Jackson -Signed-off-by: Daniel Borkmann -Signed-off-by: Pablo Neira Ayuso ---- - include/net/netfilter/nf_conntrack.h | 1 + - net/netfilter/nf_conntrack_core.c | 3 ++- - net/netfilter/nf_synproxy_core.c | 2 +- - net/netfilter/xt_CT.c | 2 +- - 4 files changed, 5 insertions(+), 3 deletions(-) - -diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h -index 37cd391..4023c4c 100644 ---- a/include/net/netfilter/nf_conntrack.h -+++ b/include/net/netfilter/nf_conntrack.h -@@ -292,6 +292,7 @@ extern unsigned int nf_conntrack_hash_rnd; - void init_nf_conntrack_hash_rnd(void); - - struct nf_conn *nf_ct_tmpl_alloc(struct net *net, u16 zone, gfp_t flags); -+void nf_ct_tmpl_free(struct nf_conn *tmpl); - - #define NF_CT_STAT_INC(net, count) __this_cpu_inc((net)->ct.stat->count) - #define NF_CT_STAT_INC_ATOMIC(net, count) this_cpu_inc((net)->ct.stat->count) -diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c -index 3c20d02..0625a42 100644 ---- a/net/netfilter/nf_conntrack_core.c -+++ b/net/netfilter/nf_conntrack_core.c -@@ -320,12 +320,13 @@ out_free: - } - EXPORT_SYMBOL_GPL(nf_ct_tmpl_alloc); - --static void nf_ct_tmpl_free(struct nf_conn *tmpl) -+void nf_ct_tmpl_free(struct nf_conn *tmpl) - { - nf_ct_ext_destroy(tmpl); - nf_ct_ext_free(tmpl); - kfree(tmpl); - } -+EXPORT_SYMBOL_GPL(nf_ct_tmpl_free); - - static void - destroy_conntrack(struct nf_conntrack *nfct) -diff --git a/net/netfilter/nf_synproxy_core.c b/net/netfilter/nf_synproxy_core.c -index d7f1685..d6ee8f8 100644 ---- a/net/netfilter/nf_synproxy_core.c -+++ b/net/netfilter/nf_synproxy_core.c -@@ -378,7 +378,7 @@ static int __net_init synproxy_net_init(struct net *net) - err3: - free_percpu(snet->stats); - err2: -- nf_conntrack_free(ct); -+ nf_ct_tmpl_free(ct); - err1: - return err; - } -diff --git a/net/netfilter/xt_CT.c b/net/netfilter/xt_CT.c -index 43ddeee..f3377ce 100644 ---- a/net/netfilter/xt_CT.c -+++ b/net/netfilter/xt_CT.c -@@ -233,7 +233,7 @@ out: - return 0; - - err3: -- nf_conntrack_free(ct); -+ nf_ct_tmpl_free(ct); - err2: - nf_ct_l3proto_module_put(par->family); - err1: --- -2.6.0 - diff --git a/kernel/kernel/files/patches/mageia/net-netfilter-ipset-Fixing-unnamed-union-init.patch b/kernel/kernel/files/patches/mageia/net-netfilter-ipset-Fixing-unnamed-union-init.patch deleted file mode 100644 index 9d697cf1..00000000 --- a/kernel/kernel/files/patches/mageia/net-netfilter-ipset-Fixing-unnamed-union-init.patch +++ /dev/null @@ -1,155 +0,0 @@ -From 96be5f2806cd65a2ebced3bfcdf7df0116e6c4a6 Mon Sep 17 00:00:00 2001 -From: Elad Raz -Date: Sat, 22 Aug 2015 08:44:11 +0300 -Subject: [PATCH] netfilter: ipset: Fixing unnamed union init - -In continue to proposed Vinson Lee's post [1], this patch fixes compilation -issues founded at gcc 4.4.7. The initialization of .cidr field of unnamed -unions causes compilation error in gcc 4.4.x. - -References - -Visible links -[1] https://lkml.org/lkml/2015/7/5/74 - -Signed-off-by: Elad Raz -Signed-off-by: Pablo Neira Ayuso ---- - net/netfilter/ipset/ip_set_hash_netnet.c | 20 ++++++++++++++++++-- - net/netfilter/ipset/ip_set_hash_netportnet.c | 20 ++++++++++++++++++-- - 2 files changed, 36 insertions(+), 4 deletions(-) - -diff --git a/net/netfilter/ipset/ip_set_hash_netnet.c b/net/netfilter/ipset/ip_set_hash_netnet.c -index 3c862c0..a93dfeb 100644 ---- a/net/netfilter/ipset/ip_set_hash_netnet.c -+++ b/net/netfilter/ipset/ip_set_hash_netnet.c -@@ -131,6 +131,13 @@ hash_netnet4_data_next(struct hash_netnet4_elem *next, - #define HOST_MASK 32 - #include "ip_set_hash_gen.h" - -+static void -+hash_netnet4_init(struct hash_netnet4_elem *e) -+{ -+ e->cidr[0] = HOST_MASK; -+ e->cidr[1] = HOST_MASK; -+} -+ - static int - hash_netnet4_kadt(struct ip_set *set, const struct sk_buff *skb, - const struct xt_action_param *par, -@@ -160,7 +167,7 @@ hash_netnet4_uadt(struct ip_set *set, struct nlattr *tb[], - { - const struct hash_netnet *h = set->data; - ipset_adtfn adtfn = set->variant->adt[adt]; -- struct hash_netnet4_elem e = { .cidr = { HOST_MASK, HOST_MASK, }, }; -+ struct hash_netnet4_elem e = { }; - struct ip_set_ext ext = IP_SET_INIT_UEXT(set); - u32 ip = 0, ip_to = 0, last; - u32 ip2 = 0, ip2_from = 0, ip2_to = 0, last2; -@@ -169,6 +176,7 @@ hash_netnet4_uadt(struct ip_set *set, struct nlattr *tb[], - if (tb[IPSET_ATTR_LINENO]) - *lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]); - -+ hash_netnet4_init(&e); - if (unlikely(!tb[IPSET_ATTR_IP] || !tb[IPSET_ATTR_IP2] || - !ip_set_optattr_netorder(tb, IPSET_ATTR_CADT_FLAGS))) - return -IPSET_ERR_PROTOCOL; -@@ -357,6 +365,13 @@ hash_netnet6_data_next(struct hash_netnet4_elem *next, - #define IP_SET_EMIT_CREATE - #include "ip_set_hash_gen.h" - -+static void -+hash_netnet6_init(struct hash_netnet6_elem *e) -+{ -+ e->cidr[0] = HOST_MASK; -+ e->cidr[1] = HOST_MASK; -+} -+ - static int - hash_netnet6_kadt(struct ip_set *set, const struct sk_buff *skb, - const struct xt_action_param *par, -@@ -385,13 +400,14 @@ hash_netnet6_uadt(struct ip_set *set, struct nlattr *tb[], - enum ipset_adt adt, u32 *lineno, u32 flags, bool retried) - { - ipset_adtfn adtfn = set->variant->adt[adt]; -- struct hash_netnet6_elem e = { .cidr = { HOST_MASK, HOST_MASK, }, }; -+ struct hash_netnet6_elem e = { }; - struct ip_set_ext ext = IP_SET_INIT_UEXT(set); - int ret; - - if (tb[IPSET_ATTR_LINENO]) - *lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]); - -+ hash_netnet6_init(&e); - if (unlikely(!tb[IPSET_ATTR_IP] || !tb[IPSET_ATTR_IP2] || - !ip_set_optattr_netorder(tb, IPSET_ATTR_CADT_FLAGS))) - return -IPSET_ERR_PROTOCOL; -diff --git a/net/netfilter/ipset/ip_set_hash_netportnet.c b/net/netfilter/ipset/ip_set_hash_netportnet.c -index 0c68734..9a14c23 100644 ---- a/net/netfilter/ipset/ip_set_hash_netportnet.c -+++ b/net/netfilter/ipset/ip_set_hash_netportnet.c -@@ -142,6 +142,13 @@ hash_netportnet4_data_next(struct hash_netportnet4_elem *next, - #define HOST_MASK 32 - #include "ip_set_hash_gen.h" - -+static void -+hash_netportnet4_init(struct hash_netportnet4_elem *e) -+{ -+ e->cidr[0] = HOST_MASK; -+ e->cidr[1] = HOST_MASK; -+} -+ - static int - hash_netportnet4_kadt(struct ip_set *set, const struct sk_buff *skb, - const struct xt_action_param *par, -@@ -175,7 +182,7 @@ hash_netportnet4_uadt(struct ip_set *set, struct nlattr *tb[], - { - const struct hash_netportnet *h = set->data; - ipset_adtfn adtfn = set->variant->adt[adt]; -- struct hash_netportnet4_elem e = { .cidr = { HOST_MASK, HOST_MASK, }, }; -+ struct hash_netportnet4_elem e = { }; - struct ip_set_ext ext = IP_SET_INIT_UEXT(set); - u32 ip = 0, ip_to = 0, ip_last, p = 0, port, port_to; - u32 ip2_from = 0, ip2_to = 0, ip2_last, ip2; -@@ -185,6 +192,7 @@ hash_netportnet4_uadt(struct ip_set *set, struct nlattr *tb[], - if (tb[IPSET_ATTR_LINENO]) - *lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]); - -+ hash_netportnet4_init(&e); - if (unlikely(!tb[IPSET_ATTR_IP] || !tb[IPSET_ATTR_IP2] || - !ip_set_attr_netorder(tb, IPSET_ATTR_PORT) || - !ip_set_optattr_netorder(tb, IPSET_ATTR_PORT_TO) || -@@ -412,6 +420,13 @@ hash_netportnet6_data_next(struct hash_netportnet4_elem *next, - #define IP_SET_EMIT_CREATE - #include "ip_set_hash_gen.h" - -+static void -+hash_netportnet6_init(struct hash_netportnet6_elem *e) -+{ -+ e->cidr[0] = HOST_MASK; -+ e->cidr[1] = HOST_MASK; -+} -+ - static int - hash_netportnet6_kadt(struct ip_set *set, const struct sk_buff *skb, - const struct xt_action_param *par, -@@ -445,7 +460,7 @@ hash_netportnet6_uadt(struct ip_set *set, struct nlattr *tb[], - { - const struct hash_netportnet *h = set->data; - ipset_adtfn adtfn = set->variant->adt[adt]; -- struct hash_netportnet6_elem e = { .cidr = { HOST_MASK, HOST_MASK, }, }; -+ struct hash_netportnet6_elem e = { }; - struct ip_set_ext ext = IP_SET_INIT_UEXT(set); - u32 port, port_to; - bool with_ports = false; -@@ -454,6 +469,7 @@ hash_netportnet6_uadt(struct ip_set *set, struct nlattr *tb[], - if (tb[IPSET_ATTR_LINENO]) - *lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]); - -+ hash_netportnet6_init(&e); - if (unlikely(!tb[IPSET_ATTR_IP] || !tb[IPSET_ATTR_IP2] || - !ip_set_attr_netorder(tb, IPSET_ATTR_PORT) || - !ip_set_optattr_netorder(tb, IPSET_ATTR_PORT_TO) || --- -2.6.0 - diff --git a/kernel/kernel/files/patches/mageia/net-netfilter-ipset-Out-of-bound-access-in-hash-net-type.patch b/kernel/kernel/files/patches/mageia/net-netfilter-ipset-Out-of-bound-access-in-hash-net-type.patch deleted file mode 100644 index 002628fd..00000000 --- a/kernel/kernel/files/patches/mageia/net-netfilter-ipset-Out-of-bound-access-in-hash-net-type.patch +++ /dev/null @@ -1,87 +0,0 @@ -From 6fe7ccfd77415a6ba250c10c580eb3f9acf79753 Mon Sep 17 00:00:00 2001 -From: Jozsef Kadlecsik -Date: Tue, 25 Aug 2015 11:17:51 +0200 -Subject: [PATCH] netfilter: ipset: Out of bound access in hash:net* types - fixed - -Dave Jones reported that KASan detected out of bounds access in hash:net* -types: - -[ 23.139532] ================================================================== -[ 23.146130] BUG: KASan: out of bounds access in hash_net4_add_cidr+0x1db/0x220 at addr ffff8800d4844b58 -[ 23.152937] Write of size 4 by task ipset/457 -[ 23.159742] ============================================================================= -[ 23.166672] BUG kmalloc-512 (Not tainted): kasan: bad access detected -[ 23.173641] ----------------------------------------------------------------------------- -[ 23.194668] INFO: Allocated in hash_net_create+0x16a/0x470 age=7 cpu=1 pid=456 -[ 23.201836] __slab_alloc.constprop.66+0x554/0x620 -[ 23.208994] __kmalloc+0x2f2/0x360 -[ 23.216105] hash_net_create+0x16a/0x470 -[ 23.223238] ip_set_create+0x3e6/0x740 -[ 23.230343] nfnetlink_rcv_msg+0x599/0x640 -[ 23.237454] netlink_rcv_skb+0x14f/0x190 -[ 23.244533] nfnetlink_rcv+0x3f6/0x790 -[ 23.251579] netlink_unicast+0x272/0x390 -[ 23.258573] netlink_sendmsg+0x5a1/0xa50 -[ 23.265485] SYSC_sendto+0x1da/0x2c0 -[ 23.272364] SyS_sendto+0xe/0x10 -[ 23.279168] entry_SYSCALL_64_fastpath+0x12/0x6f - -The bug is fixed in the patch and the testsuite is extended in ipset -to check cidr handling more thoroughly. - -Signed-off-by: Jozsef Kadlecsik ---- - net/netfilter/ipset/ip_set_hash_gen.h | 12 ++++++++---- - 1 file changed, 8 insertions(+), 4 deletions(-) - -diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h -index afe905c..691b54f 100644 ---- a/net/netfilter/ipset/ip_set_hash_gen.h -+++ b/net/netfilter/ipset/ip_set_hash_gen.h -@@ -152,9 +152,13 @@ htable_bits(u32 hashsize) - #define SET_HOST_MASK(family) (family == AF_INET ? 32 : 128) - - #ifdef IP_SET_HASH_WITH_NET0 -+/* cidr from 0 to SET_HOST_MASK() value and c = cidr + 1 */ - #define NLEN(family) (SET_HOST_MASK(family) + 1) -+#define CIDR_POS(c) ((c) - 1) - #else -+/* cidr from 1 to SET_HOST_MASK() value and c = cidr + 1 */ - #define NLEN(family) SET_HOST_MASK(family) -+#define CIDR_POS(c) ((c) - 2) - #endif - - #else -@@ -305,7 +309,7 @@ mtype_add_cidr(struct htype *h, u8 cidr, u8 nets_length, u8 n) - } else if (h->nets[i].cidr[n] < cidr) { - j = i; - } else if (h->nets[i].cidr[n] == cidr) { -- h->nets[cidr - 1].nets[n]++; -+ h->nets[CIDR_POS(cidr)].nets[n]++; - return; - } - } -@@ -314,7 +318,7 @@ mtype_add_cidr(struct htype *h, u8 cidr, u8 nets_length, u8 n) - h->nets[i].cidr[n] = h->nets[i - 1].cidr[n]; - } - h->nets[i].cidr[n] = cidr; -- h->nets[cidr - 1].nets[n] = 1; -+ h->nets[CIDR_POS(cidr)].nets[n] = 1; - } - - static void -@@ -325,8 +329,8 @@ mtype_del_cidr(struct htype *h, u8 cidr, u8 nets_length, u8 n) - for (i = 0; i < nets_length; i++) { - if (h->nets[i].cidr[n] != cidr) - continue; -- h->nets[cidr - 1].nets[n]--; -- if (h->nets[cidr - 1].nets[n] > 0) -+ h->nets[CIDR_POS(cidr)].nets[n]--; -+ if (h->nets[CIDR_POS(cidr)].nets[n] > 0) - return; - for (j = i; j < net_end && h->nets[j].cidr[n]; j++) - h->nets[j].cidr[n] = h->nets[j + 1].cidr[n]; --- -2.6.0 - diff --git a/kernel/kernel/files/patches/mageia/net-netfilter-nf_tables-Use-32-bit-addressing-register-f.patch b/kernel/kernel/files/patches/mageia/net-netfilter-nf_tables-Use-32-bit-addressing-register-f.patch deleted file mode 100644 index c3c88d05..00000000 --- a/kernel/kernel/files/patches/mageia/net-netfilter-nf_tables-Use-32-bit-addressing-register-f.patch +++ /dev/null @@ -1,32 +0,0 @@ -From bf798657eb5ba57552096843c315f096fdf9b715 Mon Sep 17 00:00:00 2001 -From: Pablo Neira Ayuso -Date: Wed, 12 Aug 2015 17:41:00 +0200 -Subject: [PATCH] netfilter: nf_tables: Use 32 bit addressing register from - nft_type_to_reg() - -nft_type_to_reg() needs to return the register in the new 32 bit addressing, -otherwise we hit EINVAL when using mappings. - -Fixes: 49499c3 ("netfilter: nf_tables: switch registers to 32 bit addressing") -Reported-by: Andreas Schultz -Signed-off-by: Pablo Neira Ayuso ---- - include/net/netfilter/nf_tables.h | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h -index 2a24668..aa8bee7 100644 ---- a/include/net/netfilter/nf_tables.h -+++ b/include/net/netfilter/nf_tables.h -@@ -125,7 +125,7 @@ static inline enum nft_data_types nft_dreg_to_type(enum nft_registers reg) - - static inline enum nft_registers nft_type_to_reg(enum nft_data_types type) - { -- return type == NFT_DATA_VERDICT ? NFT_REG_VERDICT : NFT_REG_1; -+ return type == NFT_DATA_VERDICT ? NFT_REG_VERDICT : NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE; - } - - unsigned int nft_parse_register(const struct nlattr *attr); --- -2.6.0 - diff --git a/kernel/kernel/files/patches/mageia/net-netfilter-nfnetlink-work-around-wrong-endianess-in-r.patch b/kernel/kernel/files/patches/mageia/net-netfilter-nfnetlink-work-around-wrong-endianess-in-r.patch deleted file mode 100644 index f5b695c9..00000000 --- a/kernel/kernel/files/patches/mageia/net-netfilter-nfnetlink-work-around-wrong-endianess-in-r.patch +++ /dev/null @@ -1,54 +0,0 @@ -From a9de9777d613500b089a7416f936bf3ae5f070d2 Mon Sep 17 00:00:00 2001 -From: Pablo Neira Ayuso -Date: Fri, 28 Aug 2015 21:01:43 +0200 -Subject: [PATCH] netfilter: nfnetlink: work around wrong endianess in res_id - field - -The convention in nfnetlink is to use network byte order in every header field -as well as in the attribute payload. The initial version of the batching -infrastructure assumes that res_id comes in host byte order though. - -The only client of the batching infrastructure is nf_tables, so let's add a -workaround to address this inconsistency. We currently have 11 nfnetlink -subsystems according to NFNL_SUBSYS_COUNT, so we can assume that the subsystem -2560, ie. htons(10), will not be allocated anytime soon, so it can be an alias -of nf_tables from the nfnetlink batching path when interpreting the res_id -field. - -Based on original patch from Florian Westphal. - -Reported-by: Florian Westphal -Signed-off-by: Pablo Neira Ayuso ---- - net/netfilter/nfnetlink.c | 8 +++++++- - 1 file changed, 7 insertions(+), 1 deletion(-) - -diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c -index 0c0e8ec..70277b1 100644 ---- a/net/netfilter/nfnetlink.c -+++ b/net/netfilter/nfnetlink.c -@@ -444,6 +444,7 @@ done: - static void nfnetlink_rcv(struct sk_buff *skb) - { - struct nlmsghdr *nlh = nlmsg_hdr(skb); -+ u_int16_t res_id; - int msglen; - - if (nlh->nlmsg_len < NLMSG_HDRLEN || -@@ -468,7 +469,12 @@ static void nfnetlink_rcv(struct sk_buff *skb) - - nfgenmsg = nlmsg_data(nlh); - skb_pull(skb, msglen); -- nfnetlink_rcv_batch(skb, nlh, nfgenmsg->res_id); -+ /* Work around old nft using host byte order */ -+ if (nfgenmsg->res_id == NFNL_SUBSYS_NFTABLES) -+ res_id = NFNL_SUBSYS_NFTABLES; -+ else -+ res_id = ntohs(nfgenmsg->res_id); -+ nfnetlink_rcv_batch(skb, nlh, res_id); - } else { - netlink_rcv_skb(skb, &nfnetlink_rcv_msg); - } --- -2.6.0 - diff --git a/kernel/kernel/files/patches/mageia/net-wireless-iwlwifi-fix-firmware-filename-for-3160.patch b/kernel/kernel/files/patches/mageia/net-wireless-iwlwifi-fix-firmware-filename-for-3160.patch new file mode 100644 index 00000000..fb4624d2 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/net-wireless-iwlwifi-fix-firmware-filename-for-3160.patch @@ -0,0 +1,32 @@ +From b5a48134f8af08f5243328f8a0b05fc5ae7cf343 Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Tue, 22 Sep 2015 10:47:27 +0200 +Subject: [PATCH] iwlwifi: fix firmware filename for 3160 + +The MODULE_FIRMWARE() for 3160 should be using the 7260 version as +it's done in the device configuration struct instead of referencing +IWL3160_UCODE_API_OK which doesn't even exist. + +Cc: [3.8+] +Reported-by: Hauke Mehrtens +Signed-off-by: Johannes Berg +Signed-off-by: Luca Coelho +--- + drivers/net/wireless/iwlwifi/iwl-7000.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/iwlwifi/iwl-7000.c b/drivers/net/wireless/iwlwifi/iwl-7000.c +index 6951aba..3fb327d 100644 +--- a/drivers/net/wireless/iwlwifi/iwl-7000.c ++++ b/drivers/net/wireless/iwlwifi/iwl-7000.c +@@ -348,6 +348,6 @@ const struct iwl_cfg iwl7265d_n_cfg = { + }; + + MODULE_FIRMWARE(IWL7260_MODULE_FIRMWARE(IWL7260_UCODE_API_OK)); +-MODULE_FIRMWARE(IWL3160_MODULE_FIRMWARE(IWL3160_UCODE_API_OK)); ++MODULE_FIRMWARE(IWL3160_MODULE_FIRMWARE(IWL7260_UCODE_API_OK)); + MODULE_FIRMWARE(IWL7265_MODULE_FIRMWARE(IWL7260_UCODE_API_OK)); + MODULE_FIRMWARE(IWL7265D_MODULE_FIRMWARE(IWL7260_UCODE_API_OK)); +-- +2.6.2 + diff --git a/kernel/kernel/files/patches/mageia/series b/kernel/kernel/files/patches/mageia/series index 7099472e..99f6d3c8 100644 --- a/kernel/kernel/files/patches/mageia/series +++ b/kernel/kernel/files/patches/mageia/series @@ -14,6 +14,47 @@ ### ### Stable Queue ### +stable-net-ibm-emac-bump-version-numbers-for-correct-work-with-ethtool.patch +stable-l2tp-protect-tunnel-del_work-by-ref_count.patch +stable-af_unix-convert-the-unix_sk-macro-to-an-inline-function-for-type-safety.patch +stable-af_unix-return-data-from-multiple-skbs-on-recv-with-msg_peek-flag.patch +stable-net-unix-fix-logic-about-sk_peek_offset.patch +stable-skbuff-fix-skb-checksum-flag-on-skb-pull.patch +stable-skbuff-fix-skb-checksum-partial-check.patch +stable-net-dsa-fix-preparation-of-a-port-stp-update.patch +stable-inet-fix-races-in-reqsk_queue_hash_req.patch +stable-net-add-pfmemalloc-check-in-sk_add_backlog.patch +stable-ppp-don-t-override-sk-sk_state-in-pppoe_flush_dev.patch +stable-inet-fix-race-in-reqsk_queue_unlink.patch +stable-bpf-fix-panic-in-so_get_filter-with-native-ebpf-programs.patch +stable-ovs-do-not-allocate-memory-from-offline-numa-node.patch +stable-act_mirred-clear-sender-cpu-before-sending-to-tx.patch +stable-bpf-clear-sender_cpu-before-xmit.patch +stable-ipv6-don-t-call-with-rt6_uncached_list_flush_dev.patch +stable-ethtool-use-kcalloc-instead-of-kmalloc-for-ethtool_get_strings.patch +stable-tipc-move-fragment-importance-field-to-new-header-position.patch +stable-netlink-trim-skb-to-alloc-size-to-avoid-msg_trunc.patch +stable-drm-fix-locking-for-sysfs-dpms-file.patch +stable-crypto-sparc-initialize-blkcipher.ivsize.patch +stable-crypto-camellia_aesni_avx-fix-cpu-feature-checks.patch +stable-crypto-ahash-ensure-statesize-is-non-zero.patch +stable-memcg-convert-threshold-to-bytes.patch +stable-btrfs-check-unsupported-filters-in-balance-arguments.patch +stable-btrfs-fix-use-after-free-iterating-extrefs.patch +stable-arm64-errata-use-kbuild_cflags_module-for-erratum-843419.patch +stable-arm-ux500-simplify-secondary-cpu-boot.patch +stable-nfsd-blocklayout-accept-any-minlength.patch +stable-mfd-max77843-fix-max77843_chg_init-return-on-error.patch +stable-i2c-rcar-enable-runtimepm-before-registering-to-the-core.patch +stable-i2c-s3c2410-enable-runtimepm-before-registering-to-the-core.patch +stable-i2c-designware-do-not-use-parameters-from-acpi-on-dell-inspiron-7348.patch +stable-i2c-designware-platdrv-enable-runtimepm-before-registering-to-the-core.patch +stable-workqueue-make-sure-delayed-work-run-in-local-cpu.patch +stable-kvm-x86-clean-up-kvm_arch_vcpu_runnable.patch +stable-kvm-x86-fix-smi-to-halted-vcpu.patch +stable-kvm-x86-fix-rsm-into-64-bit-protected-mode.patch +stable-drm-qxl-fix-framebuffer-dirty-rectangle-tracking.patch +stable-drm-nouveau-fbcon-take-runpm-reference-when-userspace-has-an-open-fd.patch ### ### Arch x86 @@ -38,16 +79,13 @@ x86-increase-default-minimum-vmalloc-area-by-64MB-to-192MB.patch # slows down boot Revert-cpufreq-pcc-Enable-autoload-of-pcc-cpufreq-fo.patch -# efi bootfix -x86-efi-Fix-boot-crash-by-mapping-EFI-memmap-entries.patch +# EFI +x86-efi-Fix-multiple-GOP-device-support.patch ### ### Core ### -# amd cpu boot crash (mga#16527) -cpu-cacheinfo-Fix-teardown-path.patch - ### ### i2c ### @@ -130,9 +168,8 @@ scsi-Fix-NULL-pointer-dereference-in-RTPM-of-block-layer.patch fs-aufs4.patch fs-aufs4-modular.patch -# Bind mount escape fixes (CVE-2015-2925) -fs-dcache-Handle-escaped-paths-in-prepend_path.patch -fs-vfs-Test-for-and-handle-paths-that-are-unreachable-from-their-mnt_root.patch +# btrfs memleak +fs-btrfs-fix-possible-leak-in-btrfs_ioctl_balance.patch ### ### FireWire @@ -177,6 +214,9 @@ gpu-drm-mach64-3.18-buildfix.patch input-i8042-quirks-for-Fujitsu-Lifebook-A544-and-Lif.patch +# fix alps breakage +input-alps-Only-the-Dell-Latitude-D420_430_620_630-have-separate-stick-button-bits.patch + ### ### idle ### @@ -217,17 +257,12 @@ net-netfilter-psd.patch net-netfilter-psd-mdv.patch net-netfilter-psd-2.6.35-buildfix.patch -# netfilter fixes -net-netfilter-conntrack-use-nf_ct_tmpl_free-in-CT-synpro.patch -net-netfilter-nfnetlink-work-around-wrong-endianess-in-r.patch -net-netfilter-bridge-fix-IPv6-packets-not-being-bridged-.patch -net-netfilter-nf_tables-Use-32-bit-addressing-register-f.patch -net-netfilter-ipset-Out-of-bound-access-in-hash-net-type.patch -net-netfilter-ipset-Fixing-unnamed-union-init.patch - # wireless lockup net-wireless-rtlwifi-rtl8821ae-Fix-system-lockups-on-boot.patch +# iwlwifi borked fw reference +net-wireless-iwlwifi-fix-firmware-filename-for-3160.patch + ### ### Platform drivers ### @@ -275,12 +310,6 @@ hid-usbhid-IBM-BladeCenterHS20-quirk.patch usb-storage-unusual_devs-add-id.patch usb-storage-unusual_devs-add-id-2.6.37-buildfix.patch -# boot hang fix -usb-phy-phy-generic-Fix-reset-behaviour-on-legacy-bo.patch - -# xhci 1.1 support -usb-xhci-change-xhci-1.0-only-restrictions-to-support-xh.patch - ### ### V4L ### diff --git a/kernel/kernel/files/patches/mageia/stable-act_mirred-clear-sender-cpu-before-sending-to-tx.patch b/kernel/kernel/files/patches/mageia/stable-act_mirred-clear-sender-cpu-before-sending-to-tx.patch new file mode 100644 index 00000000..e2763086 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-act_mirred-clear-sender-cpu-before-sending-to-tx.patch @@ -0,0 +1,35 @@ +From foo@baz Thu Oct 22 17:25:24 PDT 2015 +From: WANG Cong +Date: Tue, 6 Oct 2015 17:23:47 -0700 +Subject: act_mirred: clear sender cpu before sending to tx + +From: WANG Cong + +[ Upstream commit d40496a56430eac0d330378816954619899fe303 ] + +Similar to commit c29390c6dfee ("xps: must clear sender_cpu before forwarding") +the skb->sender_cpu needs to be cleared when moving from Rx +Tx, otherwise kernel could crash. + +Fixes: 2bd82484bb4c ("xps: fix xps for stacked devices") +Cc: Eric Dumazet +Cc: Jamal Hadi Salim +Signed-off-by: Cong Wang +Signed-off-by: Cong Wang +Acked-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/sched/act_mirred.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/sched/act_mirred.c ++++ b/net/sched/act_mirred.c +@@ -168,6 +168,7 @@ static int tcf_mirred(struct sk_buff *sk + + skb2->skb_iif = skb->dev->ifindex; + skb2->dev = dev; ++ skb_sender_cpu_clear(skb2); + err = dev_queue_xmit(skb2); + + out: diff --git a/kernel/kernel/files/patches/mageia/stable-af_unix-convert-the-unix_sk-macro-to-an-inline-function-for-type-safety.patch b/kernel/kernel/files/patches/mageia/stable-af_unix-convert-the-unix_sk-macro-to-an-inline-function-for-type-safety.patch new file mode 100644 index 00000000..943f5cd6 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-af_unix-convert-the-unix_sk-macro-to-an-inline-function-for-type-safety.patch @@ -0,0 +1,35 @@ +From foo@baz Thu Oct 22 17:25:24 PDT 2015 +From: Aaron Conole +Date: Sat, 26 Sep 2015 18:50:42 -0400 +Subject: af_unix: Convert the unix_sk macro to an inline function for type safety + +From: Aaron Conole + +[ Upstream commit 4613012db1d911f80897f9446a49de817b2c4c47 ] + +As suggested by Eric Dumazet this change replaces the +#define with a static inline function to enjoy +complaints by the compiler when misusing the API. + +Signed-off-by: Aaron Conole +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + include/net/af_unix.h | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/include/net/af_unix.h ++++ b/include/net/af_unix.h +@@ -63,7 +63,11 @@ struct unix_sock { + #define UNIX_GC_MAYBE_CYCLE 1 + struct socket_wq peer_wq; + }; +-#define unix_sk(__sk) ((struct unix_sock *)__sk) ++ ++static inline struct unix_sock *unix_sk(struct sock *sk) ++{ ++ return (struct unix_sock *)sk; ++} + + #define peer_wait peer_wq.wait + diff --git a/kernel/kernel/files/patches/mageia/stable-af_unix-return-data-from-multiple-skbs-on-recv-with-msg_peek-flag.patch b/kernel/kernel/files/patches/mageia/stable-af_unix-return-data-from-multiple-skbs-on-recv-with-msg_peek-flag.patch new file mode 100644 index 00000000..c7ed0119 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-af_unix-return-data-from-multiple-skbs-on-recv-with-msg_peek-flag.patch @@ -0,0 +1,60 @@ +From foo@baz Thu Oct 22 17:25:24 PDT 2015 +From: Aaron Conole +Date: Sat, 26 Sep 2015 18:50:43 -0400 +Subject: af_unix: return data from multiple SKBs on recv() with MSG_PEEK flag + +From: Aaron Conole + +[ Upstream commit 9f389e35674f5b086edd70ed524ca0f287259725 ] + +AF_UNIX sockets now return multiple skbs from recv() when MSG_PEEK flag +is set. + +This is referenced in kernel bugzilla #12323 @ +https://bugzilla.kernel.org/show_bug.cgi?id=12323 + +As described both in the BZ and lkml thread @ +http://lkml.org/lkml/2008/1/8/444 calling recv() with MSG_PEEK on an +AF_UNIX socket only reads a single skb, where the desired effect is +to return as much skb data has been queued, until hitting the recv +buffer size (whichever comes first). + +The modified MSG_PEEK path will now move to the next skb in the tree +and jump to the again: label, rather than following the natural loop +structure. This requires duplicating some of the loop head actions. + +This was tested using the python socketpair python code attached to +the bugzilla issue. + +Signed-off-by: Aaron Conole +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/unix/af_unix.c | 15 ++++++++++++++- + 1 file changed, 14 insertions(+), 1 deletion(-) + +--- a/net/unix/af_unix.c ++++ b/net/unix/af_unix.c +@@ -2179,8 +2179,21 @@ unlock: + if (UNIXCB(skb).fp) + scm.fp = scm_fp_dup(UNIXCB(skb).fp); + +- sk_peek_offset_fwd(sk, chunk); ++ if (skip) { ++ sk_peek_offset_fwd(sk, chunk); ++ skip -= chunk; ++ } + ++ if (UNIXCB(skb).fp) ++ break; ++ ++ last = skb; ++ last_len = skb->len; ++ unix_state_lock(sk); ++ skb = skb_peek_next(skb, &sk->sk_receive_queue); ++ if (skb) ++ goto again; ++ unix_state_unlock(sk); + break; + } + } while (size); diff --git a/kernel/kernel/files/patches/mageia/stable-arm-ux500-simplify-secondary-cpu-boot.patch b/kernel/kernel/files/patches/mageia/stable-arm-ux500-simplify-secondary-cpu-boot.patch new file mode 100644 index 00000000..3cdebeec --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-arm-ux500-simplify-secondary-cpu-boot.patch @@ -0,0 +1,280 @@ +From c00def71efd919e8ae835a25f4f4c80a4b2d36d3 Mon Sep 17 00:00:00 2001 +From: Linus Walleij +Date: Mon, 3 Aug 2015 09:26:52 +0200 +Subject: ARM: ux500: simplify secondary CPU boot + +From: Linus Walleij + +commit c00def71efd919e8ae835a25f4f4c80a4b2d36d3 upstream. + +This removes a lot of ancient cruft from the Ux500 SMP boot. +Instead of the pen grab/release, just point the ROM to +secondary_boot() and start the second CPU there, then send +the IPI. + +Use our own SMP enable method. This enables us to remove the +last static mapping and get both CPUs booting properly. + +Tested this and it just works. + +Signed-off-by: Linus Walleij +Signed-off-by: Olof Johansson +Signed-off-by: Kevin Hilman +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-ux500/Makefile | 2 + arch/arm/mach-ux500/cpu-db8500.c | 1 + arch/arm/mach-ux500/headsmp.S | 37 ---------- + arch/arm/mach-ux500/platsmp.c | 132 +++++++++++---------------------------- + arch/arm/mach-ux500/setup.h | 1 + 5 files changed, 40 insertions(+), 133 deletions(-) + +--- a/arch/arm/mach-ux500/Makefile ++++ b/arch/arm/mach-ux500/Makefile +@@ -7,7 +7,7 @@ obj-$(CONFIG_CACHE_L2X0) += cache-l2x0.o + obj-$(CONFIG_UX500_SOC_DB8500) += cpu-db8500.o + obj-$(CONFIG_MACH_MOP500) += board-mop500-regulators.o \ + board-mop500-audio.o +-obj-$(CONFIG_SMP) += platsmp.o headsmp.o ++obj-$(CONFIG_SMP) += platsmp.o + obj-$(CONFIG_HOTPLUG_CPU) += hotplug.o + obj-$(CONFIG_PM_GENERIC_DOMAINS) += pm_domains.o + +--- a/arch/arm/mach-ux500/cpu-db8500.c ++++ b/arch/arm/mach-ux500/cpu-db8500.c +@@ -154,7 +154,6 @@ static const char * stericsson_dt_platfo + }; + + DT_MACHINE_START(U8500_DT, "ST-Ericsson Ux5x0 platform (Device Tree Support)") +- .smp = smp_ops(ux500_smp_ops), + .map_io = u8500_map_io, + .init_irq = ux500_init_irq, + /* we re-use nomadik timer here */ +--- a/arch/arm/mach-ux500/headsmp.S ++++ /dev/null +@@ -1,37 +0,0 @@ +-/* +- * Copyright (c) 2009 ST-Ericsson +- * This file is based ARM Realview platform +- * Copyright (c) 2003 ARM Limited +- * All Rights Reserved +- * +- * This program is free software; you can redistribute it and/or modify +- * it under the terms of the GNU General Public License version 2 as +- * published by the Free Software Foundation. +- */ +-#include +-#include +- +-/* +- * U8500 specific entry point for secondary CPUs. +- */ +-ENTRY(u8500_secondary_startup) +- mrc p15, 0, r0, c0, c0, 5 +- and r0, r0, #15 +- adr r4, 1f +- ldmia r4, {r5, r6} +- sub r4, r4, r5 +- add r6, r6, r4 +-pen: ldr r7, [r6] +- cmp r7, r0 +- bne pen +- +- /* +- * we've been released from the holding pen: secondary_stack +- * should now contain the SVC stack for this core +- */ +- b secondary_startup +-ENDPROC(u8500_secondary_startup) +- +- .align 2 +-1: .long . +- .long pen_release +--- a/arch/arm/mach-ux500/platsmp.c ++++ b/arch/arm/mach-ux500/platsmp.c +@@ -28,135 +28,81 @@ + #include "db8500-regs.h" + #include "id.h" + +-static void __iomem *scu_base; +-static void __iomem *backupram; +- +-/* This is called from headsmp.S to wakeup the secondary core */ +-extern void u8500_secondary_startup(void); +- +-/* +- * Write pen_release in a way that is guaranteed to be visible to all +- * observers, irrespective of whether they're taking part in coherency +- * or not. This is necessary for the hotplug code to work reliably. +- */ +-static void write_pen_release(int val) +-{ +- pen_release = val; +- smp_wmb(); +- sync_cache_w(&pen_release); +-} +- +-static DEFINE_SPINLOCK(boot_lock); +- +-static void ux500_secondary_init(unsigned int cpu) +-{ +- /* +- * let the primary processor know we're out of the +- * pen, then head off into the C entry point +- */ +- write_pen_release(-1); +- +- /* +- * Synchronise with the boot thread. +- */ +- spin_lock(&boot_lock); +- spin_unlock(&boot_lock); +-} ++/* Magic triggers in backup RAM */ ++#define UX500_CPU1_JUMPADDR_OFFSET 0x1FF4 ++#define UX500_CPU1_WAKEMAGIC_OFFSET 0x1FF0 + +-static int ux500_boot_secondary(unsigned int cpu, struct task_struct *idle) ++static void wakeup_secondary(void) + { +- unsigned long timeout; +- +- /* +- * set synchronisation state between this boot processor +- * and the secondary one +- */ +- spin_lock(&boot_lock); +- +- /* +- * The secondary processor is waiting to be released from +- * the holding pen - release it, then wait for it to flag +- * that it has been released by resetting pen_release. +- */ +- write_pen_release(cpu_logical_map(cpu)); +- +- arch_send_wakeup_ipi_mask(cpumask_of(cpu)); ++ struct device_node *np; ++ static void __iomem *backupram; + +- timeout = jiffies + (1 * HZ); +- while (time_before(jiffies, timeout)) { +- if (pen_release == -1) +- break; ++ np = of_find_compatible_node(NULL, NULL, "ste,dbx500-backupram"); ++ if (!np) { ++ pr_err("No backupram base address\n"); ++ return; ++ } ++ backupram = of_iomap(np, 0); ++ of_node_put(np); ++ if (!backupram) { ++ pr_err("No backupram remap\n"); ++ return; + } + + /* +- * now the secondary core is starting up let it run its +- * calibrations, then wait for it to finish +- */ +- spin_unlock(&boot_lock); +- +- return pen_release != -1 ? -ENOSYS : 0; +-} +- +-static void __init wakeup_secondary(void) +-{ +- /* + * write the address of secondary startup into the backup ram register + * at offset 0x1FF4, then write the magic number 0xA1FEED01 to the + * backup ram register at offset 0x1FF0, which is what boot rom code +- * is waiting for. This would wake up the secondary core from WFE ++ * is waiting for. This will wake up the secondary core from WFE. + */ +-#define UX500_CPU1_JUMPADDR_OFFSET 0x1FF4 +- __raw_writel(virt_to_phys(u8500_secondary_startup), +- backupram + UX500_CPU1_JUMPADDR_OFFSET); +- +-#define UX500_CPU1_WAKEMAGIC_OFFSET 0x1FF0 +- __raw_writel(0xA1FEED01, +- backupram + UX500_CPU1_WAKEMAGIC_OFFSET); ++ writel(virt_to_phys(secondary_startup), ++ backupram + UX500_CPU1_JUMPADDR_OFFSET); ++ writel(0xA1FEED01, ++ backupram + UX500_CPU1_WAKEMAGIC_OFFSET); + + /* make sure write buffer is drained */ + mb(); ++ iounmap(backupram); + } + +-/* +- * Initialise the CPU possible map early - this describes the CPUs +- * which may be present or become present in the system. +- */ +-static void __init ux500_smp_init_cpus(void) ++static void __init ux500_smp_prepare_cpus(unsigned int max_cpus) + { +- unsigned int i, ncores; + struct device_node *np; ++ static void __iomem *scu_base; ++ unsigned int ncores; ++ int i; + + np = of_find_compatible_node(NULL, NULL, "arm,cortex-a9-scu"); ++ if (!np) { ++ pr_err("No SCU base address\n"); ++ return; ++ } + scu_base = of_iomap(np, 0); + of_node_put(np); +- if (!scu_base) ++ if (!scu_base) { ++ pr_err("No SCU remap\n"); + return; +- backupram = ioremap(U8500_BACKUPRAM0_BASE, SZ_8K); +- ncores = scu_get_core_count(scu_base); +- +- /* sanity check */ +- if (ncores > nr_cpu_ids) { +- pr_warn("SMP: %u cores greater than maximum (%u), clipping\n", +- ncores, nr_cpu_ids); +- ncores = nr_cpu_ids; + } + ++ scu_enable(scu_base); ++ ncores = scu_get_core_count(scu_base); + for (i = 0; i < ncores; i++) + set_cpu_possible(i, true); ++ iounmap(scu_base); + } + +-static void __init ux500_smp_prepare_cpus(unsigned int max_cpus) ++static int ux500_boot_secondary(unsigned int cpu, struct task_struct *idle) + { +- scu_enable(scu_base); + wakeup_secondary(); ++ arch_send_wakeup_ipi_mask(cpumask_of(cpu)); ++ return 0; + } + + struct smp_operations ux500_smp_ops __initdata = { +- .smp_init_cpus = ux500_smp_init_cpus, + .smp_prepare_cpus = ux500_smp_prepare_cpus, +- .smp_secondary_init = ux500_secondary_init, + .smp_boot_secondary = ux500_boot_secondary, + #ifdef CONFIG_HOTPLUG_CPU + .cpu_die = ux500_cpu_die, + #endif + }; ++CPU_METHOD_OF_DECLARE(ux500_smp, "ste,dbx500-smp", &ux500_smp_ops); +--- a/arch/arm/mach-ux500/setup.h ++++ b/arch/arm/mach-ux500/setup.h +@@ -26,7 +26,6 @@ extern struct device *ux500_soc_device_i + + extern void ux500_timer_init(void); + +-extern struct smp_operations ux500_smp_ops; + extern void ux500_cpu_die(unsigned int cpu); + + #endif /* __ASM_ARCH_SETUP_H */ diff --git a/kernel/kernel/files/patches/mageia/stable-arm64-errata-use-kbuild_cflags_module-for-erratum-843419.patch b/kernel/kernel/files/patches/mageia/stable-arm64-errata-use-kbuild_cflags_module-for-erratum-843419.patch new file mode 100644 index 00000000..b25ef08a --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-arm64-errata-use-kbuild_cflags_module-for-erratum-843419.patch @@ -0,0 +1,39 @@ +From b6dd8e0719c0d2d01429639a11b7bc2677de240c Mon Sep 17 00:00:00 2001 +From: Will Deacon +Date: Thu, 8 Oct 2015 11:11:17 +0100 +Subject: arm64: errata: use KBUILD_CFLAGS_MODULE for erratum #843419 + +From: Will Deacon + +commit b6dd8e0719c0d2d01429639a11b7bc2677de240c upstream. + +Commit df057cc7b4fa ("arm64: errata: add module build workaround for +erratum #843419") sets CFLAGS_MODULE to ensure that the large memory +model is used by the compiler when building kernel modules. + +However, CFLAGS_MODULE is an environment variable and intended to be +overridden on the command line, which appears to be the case with the +Ubuntu kernel packaging system, so use KBUILD_CFLAGS_MODULE instead. + +Cc: Ard Biesheuvel +Fixes: df057cc7b4fa ("arm64: errata: add module build workaround for erratum #843419") +Reported-by: Dann Frazier +Tested-by: Dann Frazier +Signed-off-by: Will Deacon +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm64/Makefile ++++ b/arch/arm64/Makefile +@@ -31,7 +31,7 @@ endif + CHECKFLAGS += -D__aarch64__ + + ifeq ($(CONFIG_ARM64_ERRATUM_843419), y) +-CFLAGS_MODULE += -mcmodel=large ++KBUILD_CFLAGS_MODULE += -mcmodel=large + endif + + # Default value diff --git a/kernel/kernel/files/patches/mageia/stable-bpf-clear-sender_cpu-before-xmit.patch b/kernel/kernel/files/patches/mageia/stable-bpf-clear-sender_cpu-before-xmit.patch new file mode 100644 index 00000000..1981b7c0 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-bpf-clear-sender_cpu-before-xmit.patch @@ -0,0 +1,31 @@ +From foo@baz Thu Oct 22 17:25:24 PDT 2015 +From: Alexei Starovoitov +Date: Tue, 6 Oct 2015 20:46:07 -0700 +Subject: bpf: clear sender_cpu before xmit + +From: Alexei Starovoitov + +[ Upstream commit 6bf0577374cfb6c2301dbf4934a4f23ad3d72763 ] + +Similar to commit c29390c6dfee ("xps: must clear sender_cpu before forwarding") +the skb->sender_cpu needs to be cleared before xmit. + +Fixes: 3896d655f4d4 ("bpf: introduce bpf_clone_redirect() helper") +Signed-off-by: Alexei Starovoitov +Acked-by: Daniel Borkmann +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/core/filter.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -1412,6 +1412,7 @@ static u64 bpf_clone_redirect(u64 r1, u6 + return dev_forward_skb(dev, skb2); + + skb2->dev = dev; ++ skb_sender_cpu_clear(skb2); + return dev_queue_xmit(skb2); + } + diff --git a/kernel/kernel/files/patches/mageia/stable-bpf-fix-panic-in-so_get_filter-with-native-ebpf-programs.patch b/kernel/kernel/files/patches/mageia/stable-bpf-fix-panic-in-so_get_filter-with-native-ebpf-programs.patch new file mode 100644 index 00000000..0a66e3b1 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-bpf-fix-panic-in-so_get_filter-with-native-ebpf-programs.patch @@ -0,0 +1,65 @@ +From foo@baz Thu Oct 22 17:25:24 PDT 2015 +From: Daniel Borkmann +Date: Fri, 2 Oct 2015 12:06:03 +0200 +Subject: bpf: fix panic in SO_GET_FILTER with native ebpf programs + +From: Daniel Borkmann + +[ Upstream commit 93d08b6966cf730ea669d4d98f43627597077153 ] + +When sockets have a native eBPF program attached through +setsockopt(sk, SOL_SOCKET, SO_ATTACH_BPF, ...), and then try to +dump these over getsockopt(sk, SOL_SOCKET, SO_GET_FILTER, ...), +the following panic appears: + + [49904.178642] BUG: unable to handle kernel NULL pointer dereference at (null) + [49904.178762] IP: [] sk_get_filter+0x39/0x90 + [49904.182000] PGD 86fc9067 PUD 531a1067 PMD 0 + [49904.185196] Oops: 0000 [#1] SMP + [...] + [49904.224677] Call Trace: + [49904.226090] [] sock_getsockopt+0x319/0x740 + [49904.227535] [] ? sock_has_perm+0x63/0x70 + [49904.228953] [] ? release_sock+0x108/0x150 + [49904.230380] [] ? selinux_socket_getsockopt+0x23/0x30 + [49904.231788] [] SyS_getsockopt+0xa6/0xc0 + [49904.233267] [] entry_SYSCALL_64_fastpath+0x12/0x71 + +The underlying issue is the very same as in commit b382c0865600 +("sock, diag: fix panic in sock_diag_put_filterinfo"), that is, +native eBPF programs don't store an original program since this +is only needed in cBPF ones. + +However, sk_get_filter() wasn't updated to test for this at the +time when eBPF could be attached. Just throw an error to the user +to indicate that eBPF cannot be dumped over this interface. +That way, it can also be known that a program _is_ attached (as +opposed to just return 0), and a different (future) method needs +to be consulted for a dump. + +Fixes: 89aa075832b0 ("net: sock: allow eBPF programs to be attached to sockets") +Signed-off-by: Daniel Borkmann +Acked-by: Alexei Starovoitov +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/core/filter.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -1701,9 +1701,13 @@ int sk_get_filter(struct sock *sk, struc + goto out; + + /* We're copying the filter that has been originally attached, +- * so no conversion/decode needed anymore. ++ * so no conversion/decode needed anymore. eBPF programs that ++ * have no original program cannot be dumped through this. + */ ++ ret = -EACCES; + fprog = filter->prog->orig_prog; ++ if (!fprog) ++ goto out; + + ret = fprog->len; + if (!len) diff --git a/kernel/kernel/files/patches/mageia/stable-btrfs-check-unsupported-filters-in-balance-arguments.patch b/kernel/kernel/files/patches/mageia/stable-btrfs-check-unsupported-filters-in-balance-arguments.patch new file mode 100644 index 00000000..44800a6d --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-btrfs-check-unsupported-filters-in-balance-arguments.patch @@ -0,0 +1,57 @@ +From 8eb934591f8bf584969454a658f629cd06e59f3a Mon Sep 17 00:00:00 2001 +From: David Sterba +Date: Mon, 12 Oct 2015 16:55:54 +0200 +Subject: btrfs: check unsupported filters in balance arguments + +From: David Sterba + +commit 8eb934591f8bf584969454a658f629cd06e59f3a upstream. + +We don't verify that all the balance filter arguments supplemented by +the flags are actually known to the kernel. Thus we let it silently pass +and do nothing. + +At the moment this means only the 'limit' filter, but we're going to add +a few more soon so it's better to have that fixed. Also in older stable +kernels so that it works with newer userspace tools. + +Signed-off-by: David Sterba +Signed-off-by: Chris Mason +Signed-off-by: Greg Kroah-Hartman + +--- + fs/btrfs/ioctl.c | 5 +++++ + fs/btrfs/volumes.h | 8 ++++++++ + 2 files changed, 13 insertions(+) + +--- a/fs/btrfs/ioctl.c ++++ b/fs/btrfs/ioctl.c +@@ -4647,6 +4647,11 @@ locked: + bctl->flags |= BTRFS_BALANCE_TYPE_MASK; + } + ++ if (bctl->flags & ~(BTRFS_BALANCE_ARGS_MASK | BTRFS_BALANCE_TYPE_MASK)) { ++ ret = -EINVAL; ++ goto out_bargs; ++ } ++ + do_balance: + /* + * Ownership of bctl and mutually_exclusive_operation_running +--- a/fs/btrfs/volumes.h ++++ b/fs/btrfs/volumes.h +@@ -376,6 +376,14 @@ struct map_lookup { + #define BTRFS_BALANCE_ARGS_VRANGE (1ULL << 4) + #define BTRFS_BALANCE_ARGS_LIMIT (1ULL << 5) + ++#define BTRFS_BALANCE_ARGS_MASK \ ++ (BTRFS_BALANCE_ARGS_PROFILES | \ ++ BTRFS_BALANCE_ARGS_USAGE | \ ++ BTRFS_BALANCE_ARGS_DEVID | \ ++ BTRFS_BALANCE_ARGS_DRANGE | \ ++ BTRFS_BALANCE_ARGS_VRANGE | \ ++ BTRFS_BALANCE_ARGS_LIMIT) ++ + /* + * Profile changing flags. When SOFT is set we won't relocate chunk if + * it already has the target profile (even though it may be diff --git a/kernel/kernel/files/patches/mageia/stable-btrfs-fix-use-after-free-iterating-extrefs.patch b/kernel/kernel/files/patches/mageia/stable-btrfs-fix-use-after-free-iterating-extrefs.patch new file mode 100644 index 00000000..27bec066 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-btrfs-fix-use-after-free-iterating-extrefs.patch @@ -0,0 +1,61 @@ +From dc6c5fb3b514221f2e9d21ee626a9d95d3418dff Mon Sep 17 00:00:00 2001 +From: Chris Mason +Date: Tue, 13 Oct 2015 14:06:48 -0400 +Subject: btrfs: fix use after free iterating extrefs + +From: Chris Mason + +commit dc6c5fb3b514221f2e9d21ee626a9d95d3418dff upstream. + +The code for btrfs inode-resolve has never worked properly for +files with enough hard links to trigger extrefs. It was trying to +get the leaf out of a path after freeing the path: + + btrfs_release_path(path); + leaf = path->nodes[0]; + item_size = btrfs_item_size_nr(leaf, slot); + +The fix here is to use the extent buffer we cloned just a little higher +up to avoid deadlocks caused by using the leaf in the path. + +Signed-off-by: Chris Mason +cc: Mark Fasheh +Reviewed-by: Filipe Manana +Reviewed-by: Mark Fasheh +Signed-off-by: Greg Kroah-Hartman + +--- + fs/btrfs/backref.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +--- a/fs/btrfs/backref.c ++++ b/fs/btrfs/backref.c +@@ -1809,7 +1809,6 @@ static int iterate_inode_extrefs(u64 inu + int found = 0; + struct extent_buffer *eb; + struct btrfs_inode_extref *extref; +- struct extent_buffer *leaf; + u32 item_size; + u32 cur_offset; + unsigned long ptr; +@@ -1837,9 +1836,8 @@ static int iterate_inode_extrefs(u64 inu + btrfs_set_lock_blocking_rw(eb, BTRFS_READ_LOCK); + btrfs_release_path(path); + +- leaf = path->nodes[0]; +- item_size = btrfs_item_size_nr(leaf, slot); +- ptr = btrfs_item_ptr_offset(leaf, slot); ++ item_size = btrfs_item_size_nr(eb, slot); ++ ptr = btrfs_item_ptr_offset(eb, slot); + cur_offset = 0; + + while (cur_offset < item_size) { +@@ -1853,7 +1851,7 @@ static int iterate_inode_extrefs(u64 inu + if (ret) + break; + +- cur_offset += btrfs_inode_extref_name_len(leaf, extref); ++ cur_offset += btrfs_inode_extref_name_len(eb, extref); + cur_offset += sizeof(*extref); + } + btrfs_tree_read_unlock_blocking(eb); diff --git a/kernel/kernel/files/patches/mageia/stable-crypto-ahash-ensure-statesize-is-non-zero.patch b/kernel/kernel/files/patches/mageia/stable-crypto-ahash-ensure-statesize-is-non-zero.patch new file mode 100644 index 00000000..a869f8d8 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-crypto-ahash-ensure-statesize-is-non-zero.patch @@ -0,0 +1,37 @@ +From 8996eafdcbad149ac0f772fb1649fbb75c482a6a Mon Sep 17 00:00:00 2001 +From: Russell King +Date: Fri, 9 Oct 2015 20:43:33 +0100 +Subject: crypto: ahash - ensure statesize is non-zero + +From: Russell King + +commit 8996eafdcbad149ac0f772fb1649fbb75c482a6a upstream. + +Unlike shash algorithms, ahash drivers must implement export +and import as their descriptors may contain hardware state and +cannot be exported as is. Unfortunately some ahash drivers did +not provide them and end up causing crashes with algif_hash. + +This patch adds a check to prevent these drivers from registering +ahash algorithms until they are fixed. + +Signed-off-by: Russell King +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + crypto/ahash.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/crypto/ahash.c ++++ b/crypto/ahash.c +@@ -544,7 +544,8 @@ static int ahash_prepare_alg(struct ahas + struct crypto_alg *base = &alg->halg.base; + + if (alg->halg.digestsize > PAGE_SIZE / 8 || +- alg->halg.statesize > PAGE_SIZE / 8) ++ alg->halg.statesize > PAGE_SIZE / 8 || ++ alg->halg.statesize == 0) + return -EINVAL; + + base->cra_type = &crypto_ahash_type; diff --git a/kernel/kernel/files/patches/mageia/stable-crypto-camellia_aesni_avx-fix-cpu-feature-checks.patch b/kernel/kernel/files/patches/mageia/stable-crypto-camellia_aesni_avx-fix-cpu-feature-checks.patch new file mode 100644 index 00000000..62fd0a5b --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-crypto-camellia_aesni_avx-fix-cpu-feature-checks.patch @@ -0,0 +1,42 @@ +From 92b279070dd6c94265db32748bbeb5b583588de9 Mon Sep 17 00:00:00 2001 +From: Ben Hutchings +Date: Tue, 6 Oct 2015 12:31:33 +0100 +Subject: crypto: camellia_aesni_avx - Fix CPU feature checks +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ben Hutchings + +commit 92b279070dd6c94265db32748bbeb5b583588de9 upstream. + +We need to explicitly check the AVX and AES CPU features, as we can't +infer them from the related XSAVE feature flags. For example, the +Core i3 2310M passes the XSAVE feature test but does not implement +AES-NI. + +Reported-and-tested-by: Stéphane Glondu +References: https://bugs.debian.org/800934 +Fixes: ce4f5f9b65ae ("x86/fpu, crypto x86/camellia_aesni_avx: Simplify...") +Signed-off-by: Ben Hutchings +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/crypto/camellia_aesni_avx_glue.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/arch/x86/crypto/camellia_aesni_avx_glue.c ++++ b/arch/x86/crypto/camellia_aesni_avx_glue.c +@@ -554,6 +554,11 @@ static int __init camellia_aesni_init(vo + { + const char *feature_name; + ++ if (!cpu_has_avx || !cpu_has_aes || !cpu_has_osxsave) { ++ pr_info("AVX or AES-NI instructions are not detected.\n"); ++ return -ENODEV; ++ } ++ + if (!cpu_has_xfeatures(XSTATE_SSE | XSTATE_YMM, &feature_name)) { + pr_info("CPU feature '%s' is not supported.\n", feature_name); + return -ENODEV; diff --git a/kernel/kernel/files/patches/mageia/stable-crypto-sparc-initialize-blkcipher.ivsize.patch b/kernel/kernel/files/patches/mageia/stable-crypto-sparc-initialize-blkcipher.ivsize.patch new file mode 100644 index 00000000..da4afaa8 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-crypto-sparc-initialize-blkcipher.ivsize.patch @@ -0,0 +1,68 @@ +From a66d7f724a96d6fd279bfbd2ee488def6b081bea Mon Sep 17 00:00:00 2001 +From: Dave Kleikamp +Date: Mon, 5 Oct 2015 10:08:51 -0500 +Subject: crypto: sparc - initialize blkcipher.ivsize + +From: Dave Kleikamp + +commit a66d7f724a96d6fd279bfbd2ee488def6b081bea upstream. + +Some of the crypto algorithms write to the initialization vector, +but no space has been allocated for it. This clobbers adjacent memory. + +Signed-off-by: Dave Kleikamp +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + arch/sparc/crypto/aes_glue.c | 2 ++ + arch/sparc/crypto/camellia_glue.c | 1 + + arch/sparc/crypto/des_glue.c | 2 ++ + 3 files changed, 5 insertions(+) + +--- a/arch/sparc/crypto/aes_glue.c ++++ b/arch/sparc/crypto/aes_glue.c +@@ -433,6 +433,7 @@ static struct crypto_alg algs[] = { { + .blkcipher = { + .min_keysize = AES_MIN_KEY_SIZE, + .max_keysize = AES_MAX_KEY_SIZE, ++ .ivsize = AES_BLOCK_SIZE, + .setkey = aes_set_key, + .encrypt = cbc_encrypt, + .decrypt = cbc_decrypt, +@@ -452,6 +453,7 @@ static struct crypto_alg algs[] = { { + .blkcipher = { + .min_keysize = AES_MIN_KEY_SIZE, + .max_keysize = AES_MAX_KEY_SIZE, ++ .ivsize = AES_BLOCK_SIZE, + .setkey = aes_set_key, + .encrypt = ctr_crypt, + .decrypt = ctr_crypt, +--- a/arch/sparc/crypto/camellia_glue.c ++++ b/arch/sparc/crypto/camellia_glue.c +@@ -274,6 +274,7 @@ static struct crypto_alg algs[] = { { + .blkcipher = { + .min_keysize = CAMELLIA_MIN_KEY_SIZE, + .max_keysize = CAMELLIA_MAX_KEY_SIZE, ++ .ivsize = CAMELLIA_BLOCK_SIZE, + .setkey = camellia_set_key, + .encrypt = cbc_encrypt, + .decrypt = cbc_decrypt, +--- a/arch/sparc/crypto/des_glue.c ++++ b/arch/sparc/crypto/des_glue.c +@@ -429,6 +429,7 @@ static struct crypto_alg algs[] = { { + .blkcipher = { + .min_keysize = DES_KEY_SIZE, + .max_keysize = DES_KEY_SIZE, ++ .ivsize = DES_BLOCK_SIZE, + .setkey = des_set_key, + .encrypt = cbc_encrypt, + .decrypt = cbc_decrypt, +@@ -485,6 +486,7 @@ static struct crypto_alg algs[] = { { + .blkcipher = { + .min_keysize = DES3_EDE_KEY_SIZE, + .max_keysize = DES3_EDE_KEY_SIZE, ++ .ivsize = DES3_EDE_BLOCK_SIZE, + .setkey = des3_ede_set_key, + .encrypt = cbc3_encrypt, + .decrypt = cbc3_decrypt, diff --git a/kernel/kernel/files/patches/mageia/stable-drm-fix-locking-for-sysfs-dpms-file.patch b/kernel/kernel/files/patches/mageia/stable-drm-fix-locking-for-sysfs-dpms-file.patch new file mode 100644 index 00000000..fd96ce12 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-drm-fix-locking-for-sysfs-dpms-file.patch @@ -0,0 +1,72 @@ +From 621bd0f6982badd6483acb191eb7b6226a578328 Mon Sep 17 00:00:00 2001 +From: Daniel Vetter +Date: Tue, 29 Sep 2015 09:56:53 +0200 +Subject: drm: Fix locking for sysfs dpms file + +From: Daniel Vetter + +commit 621bd0f6982badd6483acb191eb7b6226a578328 upstream. + +With atomic drivers we need to make sure that (at least in general) +property reads hold the right locks. But the legacy dpms property is +special and can be read locklessly. Since userspace loves to just +randomly look at that all the time (like with "status") do that. + +To make it clear that we play tricks use the READ_ONCE compiler +barrier (and also for paranoia). + +Note that there's not really anything bad going on since even with the +new atomic paths we eventually end up not chasing any pointers (and +hence possibly freed memory and other fun stuff). The locking WARNING +has been added in + +commit 88a48e297b3a3bac6022c03babfb038f1a886cea +Author: Rob Clark +Date: Thu Dec 18 16:01:50 2014 -0500 + + drm: add atomic properties + +but since drivers are converting not everyone will have seen this from +the start. + +Jens reported this and submitted a patch to just grab the +mode_config.connection_mutex, but we can do a bit better. + +v2: Remove unused variables I failed to git add for real. + +Reference: http://mid.gmane.org/20150928194822.GA3930@kernel.dk +Reported-by: Jens Axboe +Tested-by: Jens Axboe +Cc: Rob Clark +Signed-off-by: Daniel Vetter +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/drm_sysfs.c | 12 +++--------- + 1 file changed, 3 insertions(+), 9 deletions(-) + +--- a/drivers/gpu/drm/drm_sysfs.c ++++ b/drivers/gpu/drm/drm_sysfs.c +@@ -235,18 +235,12 @@ static ssize_t dpms_show(struct device * + char *buf) + { + struct drm_connector *connector = to_drm_connector(device); +- struct drm_device *dev = connector->dev; +- uint64_t dpms_status; +- int ret; ++ int dpms; + +- ret = drm_object_property_get_value(&connector->base, +- dev->mode_config.dpms_property, +- &dpms_status); +- if (ret) +- return 0; ++ dpms = READ_ONCE(connector->dpms); + + return snprintf(buf, PAGE_SIZE, "%s\n", +- drm_get_dpms_name((int)dpms_status)); ++ drm_get_dpms_name(dpms)); + } + + static ssize_t enabled_show(struct device *device, diff --git a/kernel/kernel/files/patches/mageia/stable-drm-nouveau-fbcon-take-runpm-reference-when-userspace-has-an-open-fd.patch b/kernel/kernel/files/patches/mageia/stable-drm-nouveau-fbcon-take-runpm-reference-when-userspace-has-an-open-fd.patch new file mode 100644 index 00000000..b718470d --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-drm-nouveau-fbcon-take-runpm-reference-when-userspace-has-an-open-fd.patch @@ -0,0 +1,65 @@ +From f231976c2e8964ceaa9250e57d27c35ff03825c2 Mon Sep 17 00:00:00 2001 +From: Ben Skeggs +Date: Fri, 2 Oct 2015 14:03:19 +1000 +Subject: drm/nouveau/fbcon: take runpm reference when userspace has an open fd + +From: Ben Skeggs + +commit f231976c2e8964ceaa9250e57d27c35ff03825c2 upstream. + +We need to do this in order to prevent accesses to the device while it's +powered down. Userspace may have an mmap of the fb, and there's no good +way (that I know of) to prevent it from touching the device otherwise. + +This fixes some nasty races between runpm and plymouth on some systems, +which result in the GPU getting very upset and hanging the boot. + +Signed-off-by: Ben Skeggs +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/nouveau/nouveau_fbcon.c | 24 ++++++++++++++++++++++++ + 1 file changed, 24 insertions(+) + +--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c ++++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c +@@ -178,8 +178,30 @@ nouveau_fbcon_sync(struct fb_info *info) + return 0; + } + ++static int ++nouveau_fbcon_open(struct fb_info *info, int user) ++{ ++ struct nouveau_fbdev *fbcon = info->par; ++ struct nouveau_drm *drm = nouveau_drm(fbcon->dev); ++ int ret = pm_runtime_get_sync(drm->dev->dev); ++ if (ret < 0 && ret != -EACCES) ++ return ret; ++ return 0; ++} ++ ++static int ++nouveau_fbcon_release(struct fb_info *info, int user) ++{ ++ struct nouveau_fbdev *fbcon = info->par; ++ struct nouveau_drm *drm = nouveau_drm(fbcon->dev); ++ pm_runtime_put(drm->dev->dev); ++ return 0; ++} ++ + static struct fb_ops nouveau_fbcon_ops = { + .owner = THIS_MODULE, ++ .fb_open = nouveau_fbcon_open, ++ .fb_release = nouveau_fbcon_release, + .fb_check_var = drm_fb_helper_check_var, + .fb_set_par = drm_fb_helper_set_par, + .fb_fillrect = nouveau_fbcon_fillrect, +@@ -195,6 +217,8 @@ static struct fb_ops nouveau_fbcon_ops = + + static struct fb_ops nouveau_fbcon_sw_ops = { + .owner = THIS_MODULE, ++ .fb_open = nouveau_fbcon_open, ++ .fb_release = nouveau_fbcon_release, + .fb_check_var = drm_fb_helper_check_var, + .fb_set_par = drm_fb_helper_set_par, + .fb_fillrect = cfb_fillrect, diff --git a/kernel/kernel/files/patches/mageia/stable-drm-qxl-fix-framebuffer-dirty-rectangle-tracking.patch b/kernel/kernel/files/patches/mageia/stable-drm-qxl-fix-framebuffer-dirty-rectangle-tracking.patch new file mode 100644 index 00000000..35aaa4a7 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-drm-qxl-fix-framebuffer-dirty-rectangle-tracking.patch @@ -0,0 +1,50 @@ +From 60906529bec506a4bde93f04eb5e7a9dd9c42a3b Mon Sep 17 00:00:00 2001 +From: Gerd Hoffmann +Date: Mon, 5 Oct 2015 12:20:26 +0200 +Subject: drm/qxl: fix framebuffer dirty rectangle tracking. + +From: Gerd Hoffmann + +commit 60906529bec506a4bde93f04eb5e7a9dd9c42a3b upstream. + +Commit "c0fe07a drm/qxl: rewrite framebuffer support" has a bug in the +dirty rectangle tracking: Instead of ignoring an empty dirty rectangle +when adding a new dirty region the dirty region gets extended to the +upper left corner. Fix it. + +Signed-off-by: Gerd Hoffmann +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/qxl/qxl_fb.c | 19 +++++++++++-------- + 1 file changed, 11 insertions(+), 8 deletions(-) + +--- a/drivers/gpu/drm/qxl/qxl_fb.c ++++ b/drivers/gpu/drm/qxl/qxl_fb.c +@@ -144,14 +144,17 @@ static void qxl_dirty_update(struct qxl_ + + spin_lock_irqsave(&qfbdev->dirty.lock, flags); + +- if (qfbdev->dirty.y1 < y) +- y = qfbdev->dirty.y1; +- if (qfbdev->dirty.y2 > y2) +- y2 = qfbdev->dirty.y2; +- if (qfbdev->dirty.x1 < x) +- x = qfbdev->dirty.x1; +- if (qfbdev->dirty.x2 > x2) +- x2 = qfbdev->dirty.x2; ++ if ((qfbdev->dirty.y2 - qfbdev->dirty.y1) && ++ (qfbdev->dirty.x2 - qfbdev->dirty.x1)) { ++ if (qfbdev->dirty.y1 < y) ++ y = qfbdev->dirty.y1; ++ if (qfbdev->dirty.y2 > y2) ++ y2 = qfbdev->dirty.y2; ++ if (qfbdev->dirty.x1 < x) ++ x = qfbdev->dirty.x1; ++ if (qfbdev->dirty.x2 > x2) ++ x2 = qfbdev->dirty.x2; ++ } + + qfbdev->dirty.x1 = x; + qfbdev->dirty.x2 = x2; diff --git a/kernel/kernel/files/patches/mageia/stable-ethtool-use-kcalloc-instead-of-kmalloc-for-ethtool_get_strings.patch b/kernel/kernel/files/patches/mageia/stable-ethtool-use-kcalloc-instead-of-kmalloc-for-ethtool_get_strings.patch new file mode 100644 index 00000000..766c3c9a --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-ethtool-use-kcalloc-instead-of-kmalloc-for-ethtool_get_strings.patch @@ -0,0 +1,33 @@ +From foo@baz Thu Oct 22 17:25:24 PDT 2015 +From: Joe Perches +Date: Wed, 14 Oct 2015 01:09:40 -0700 +Subject: ethtool: Use kcalloc instead of kmalloc for ethtool_get_strings + +From: Joe Perches + +[ Upstream commit 077cb37fcf6f00a45f375161200b5ee0cd4e937b ] + +It seems that kernel memory can leak into userspace by a +kmalloc, ethtool_get_strings, then copy_to_user sequence. + +Avoid this by using kcalloc to zero fill the copied buffer. + +Signed-off-by: Joe Perches +Acked-by: Ben Hutchings +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/core/ethtool.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/core/ethtool.c ++++ b/net/core/ethtool.c +@@ -1284,7 +1284,7 @@ static int ethtool_get_strings(struct ne + + gstrings.len = ret; + +- data = kmalloc(gstrings.len * ETH_GSTRING_LEN, GFP_USER); ++ data = kcalloc(gstrings.len, ETH_GSTRING_LEN, GFP_USER); + if (!data) + return -ENOMEM; + diff --git a/kernel/kernel/files/patches/mageia/stable-i2c-designware-do-not-use-parameters-from-acpi-on-dell-inspiron-7348.patch b/kernel/kernel/files/patches/mageia/stable-i2c-designware-do-not-use-parameters-from-acpi-on-dell-inspiron-7348.patch new file mode 100644 index 00000000..04b514ff --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-i2c-designware-do-not-use-parameters-from-acpi-on-dell-inspiron-7348.patch @@ -0,0 +1,108 @@ +From 56d4b8a24cef5d66f0d10ac778a520d3c2c68a48 Mon Sep 17 00:00:00 2001 +From: Mika Westerberg +Date: Thu, 24 Sep 2015 12:06:54 +0300 +Subject: i2c: designware: Do not use parameters from ACPI on Dell Inspiron 7348 + +From: Mika Westerberg + +commit 56d4b8a24cef5d66f0d10ac778a520d3c2c68a48 upstream. + +ACPI SSCN/FMCN methods were originally added because then the platform can +provide the most accurate HCNT/LCNT values to the driver. However, this +seems not to be true for Dell Inspiron 7348 where using these causes the +touchpad to fail in boot: + + i2c_hid i2c-DLL0675:00: failed to retrieve report from device. + i2c_designware INT3433:00: i2c_dw_handle_tx_abort: lost arbitration + i2c_hid i2c-DLL0675:00: failed to retrieve report from device. + i2c_designware INT3433:00: controller timed out + +The values received from ACPI are (in fast mode): + + HCNT: 72 + LCNT: 160 + +this translates to following timings (input clock is 100MHz on Broadwell): + + tHIGH: 720 ns (spec min 600 ns) + tLOW: 1600 ns (spec min 1300 ns) + Bus period: 2920 ns (assuming 300 ns tf and tr) + Bus speed: 342.5 kHz + +Both tHIGH and tLOW are within the I2C specification. + +The calculated values when ACPI parameters are not used are (in fast mode): + + HCNT: 87 + LCNT: 159 + +which translates to: + + tHIGH: 870 ns (spec min 600 ns) + tLOW: 1590 ns (spec min 1300 ns) + Bus period 3060 ns (assuming 300 ns tf and tr) + Bus speed 326.8 kHz + +These values are also within the I2C specification. + +Since both ACPI and calculated values meet the I2C specification timing +requirements it is hard to say why the touchpad does not function properly +with the ACPI values except that the bus speed is higher in this case (but +still well below the max 400kHz). + +Solve this by adding DMI quirk to the driver that disables using ACPI +parameters on this particulare machine. + +Reported-by: Pavel Roskin +Signed-off-by: Mika Westerberg +Tested-by: Pavel Roskin +Signed-off-by: Wolfram Sang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/i2c/busses/i2c-designware-platdrv.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +--- a/drivers/i2c/busses/i2c-designware-platdrv.c ++++ b/drivers/i2c/busses/i2c-designware-platdrv.c +@@ -24,6 +24,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -51,6 +52,22 @@ static u32 i2c_dw_get_clk_rate_khz(struc + } + + #ifdef CONFIG_ACPI ++/* ++ * The HCNT/LCNT information coming from ACPI should be the most accurate ++ * for given platform. However, some systems get it wrong. On such systems ++ * we get better results by calculating those based on the input clock. ++ */ ++static const struct dmi_system_id dw_i2c_no_acpi_params[] = { ++ { ++ .ident = "Dell Inspiron 7348", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 7348"), ++ }, ++ }, ++ { } ++}; ++ + static void dw_i2c_acpi_params(struct platform_device *pdev, char method[], + u16 *hcnt, u16 *lcnt, u32 *sda_hold) + { +@@ -58,6 +75,9 @@ static void dw_i2c_acpi_params(struct pl + acpi_handle handle = ACPI_HANDLE(&pdev->dev); + union acpi_object *obj; + ++ if (dmi_check_system(dw_i2c_no_acpi_params)) ++ return; ++ + if (ACPI_FAILURE(acpi_evaluate_object(handle, method, NULL, &buf))) + return; + diff --git a/kernel/kernel/files/patches/mageia/stable-i2c-designware-platdrv-enable-runtimepm-before-registering-to-the-core.patch b/kernel/kernel/files/patches/mageia/stable-i2c-designware-platdrv-enable-runtimepm-before-registering-to-the-core.patch new file mode 100644 index 00000000..2e6bb173 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-i2c-designware-platdrv-enable-runtimepm-before-registering-to-the-core.patch @@ -0,0 +1,51 @@ +From 36d48fb5766aee9717e429f772046696b215282d Mon Sep 17 00:00:00 2001 +From: Wolfram Sang +Date: Fri, 9 Oct 2015 10:39:24 +0100 +Subject: i2c: designware-platdrv: enable RuntimePM before registering to the core + +From: Wolfram Sang + +commit 36d48fb5766aee9717e429f772046696b215282d upstream. + +The core may register clients attached to this master which may use +funtionality from the master. So, RuntimePM must be enabled before, otherwise +this will fail. + +Signed-off-by: Wolfram Sang +Signed-off-by: Wolfram Sang +Acked-by: Mika Westerberg +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/i2c/busses/i2c-designware-platdrv.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +--- a/drivers/i2c/busses/i2c-designware-platdrv.c ++++ b/drivers/i2c/busses/i2c-designware-platdrv.c +@@ -273,12 +273,6 @@ static int dw_i2c_probe(struct platform_ + adap->dev.parent = &pdev->dev; + adap->dev.of_node = pdev->dev.of_node; + +- r = i2c_add_numbered_adapter(adap); +- if (r) { +- dev_err(&pdev->dev, "failure adding adapter\n"); +- return r; +- } +- + if (dev->pm_runtime_disabled) { + pm_runtime_forbid(&pdev->dev); + } else { +@@ -288,6 +282,13 @@ static int dw_i2c_probe(struct platform_ + pm_runtime_enable(&pdev->dev); + } + ++ r = i2c_add_numbered_adapter(adap); ++ if (r) { ++ dev_err(&pdev->dev, "failure adding adapter\n"); ++ pm_runtime_disable(&pdev->dev); ++ return r; ++ } ++ + return 0; + } + diff --git a/kernel/kernel/files/patches/mageia/stable-i2c-rcar-enable-runtimepm-before-registering-to-the-core.patch b/kernel/kernel/files/patches/mageia/stable-i2c-rcar-enable-runtimepm-before-registering-to-the-core.patch new file mode 100644 index 00000000..ef2da749 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-i2c-rcar-enable-runtimepm-before-registering-to-the-core.patch @@ -0,0 +1,44 @@ +From 4f7effddf4549d57114289f273710f077c4c330a Mon Sep 17 00:00:00 2001 +From: Wolfram Sang +Date: Fri, 9 Oct 2015 10:39:25 +0100 +Subject: i2c: rcar: enable RuntimePM before registering to the core + +From: Wolfram Sang + +commit 4f7effddf4549d57114289f273710f077c4c330a upstream. + +The core may register clients attached to this master which may use +funtionality from the master. So, RuntimePM must be enabled before, otherwise +this will fail. While here, move drvdata, too. + +Reported-by: Geert Uytterhoeven +Signed-off-by: Wolfram Sang +Signed-off-by: Wolfram Sang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/i2c/busses/i2c-rcar.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/i2c/busses/i2c-rcar.c ++++ b/drivers/i2c/busses/i2c-rcar.c +@@ -690,15 +690,16 @@ static int rcar_i2c_probe(struct platfor + return ret; + } + ++ pm_runtime_enable(dev); ++ platform_set_drvdata(pdev, priv); ++ + ret = i2c_add_numbered_adapter(adap); + if (ret < 0) { + dev_err(dev, "reg adap failed: %d\n", ret); ++ pm_runtime_disable(dev); + return ret; + } + +- pm_runtime_enable(dev); +- platform_set_drvdata(pdev, priv); +- + dev_info(dev, "probed\n"); + + return 0; diff --git a/kernel/kernel/files/patches/mageia/stable-i2c-s3c2410-enable-runtimepm-before-registering-to-the-core.patch b/kernel/kernel/files/patches/mageia/stable-i2c-s3c2410-enable-runtimepm-before-registering-to-the-core.patch new file mode 100644 index 00000000..dcd4dfab --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-i2c-s3c2410-enable-runtimepm-before-registering-to-the-core.patch @@ -0,0 +1,48 @@ +From eadd709f5d2e8aebb1b7bf49460e97a68d81a9b0 Mon Sep 17 00:00:00 2001 +From: Wolfram Sang +Date: Sat, 10 Oct 2015 08:24:23 +0100 +Subject: i2c: s3c2410: enable RuntimePM before registering to the core + +From: Wolfram Sang + +commit eadd709f5d2e8aebb1b7bf49460e97a68d81a9b0 upstream. + +The core may register clients attached to this master which may use +funtionality from the master. So, RuntimePM must be enabled before, otherwise +this will fail. While here, move drvdata, too. + +Signed-off-by: Wolfram Sang +Tested-by: Krzysztof Kozlowski +Acked-by: Kukjin Kim +Signed-off-by: Wolfram Sang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/i2c/busses/i2c-s3c2410.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/i2c/busses/i2c-s3c2410.c ++++ b/drivers/i2c/busses/i2c-s3c2410.c +@@ -1243,17 +1243,19 @@ static int s3c24xx_i2c_probe(struct plat + i2c->adap.nr = i2c->pdata->bus_num; + i2c->adap.dev.of_node = pdev->dev.of_node; + ++ platform_set_drvdata(pdev, i2c); ++ ++ pm_runtime_enable(&pdev->dev); ++ + ret = i2c_add_numbered_adapter(&i2c->adap); + if (ret < 0) { + dev_err(&pdev->dev, "failed to add bus to i2c core\n"); ++ pm_runtime_disable(&pdev->dev); + s3c24xx_i2c_deregister_cpufreq(i2c); + clk_unprepare(i2c->clk); + return ret; + } + +- platform_set_drvdata(pdev, i2c); +- +- pm_runtime_enable(&pdev->dev); + pm_runtime_enable(&i2c->adap.dev); + + dev_info(&pdev->dev, "%s: S3C I2C adapter\n", dev_name(&i2c->adap.dev)); diff --git a/kernel/kernel/files/patches/mageia/stable-inet-fix-race-in-reqsk_queue_unlink.patch b/kernel/kernel/files/patches/mageia/stable-inet-fix-race-in-reqsk_queue_unlink.patch new file mode 100644 index 00000000..7c98de1b --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-inet-fix-race-in-reqsk_queue_unlink.patch @@ -0,0 +1,64 @@ +From foo@baz Thu Oct 22 17:25:24 PDT 2015 +From: Eric Dumazet +Date: Thu, 1 Oct 2015 05:39:26 -0700 +Subject: inet: fix race in reqsk_queue_unlink() + +From: Eric Dumazet + +[ Upstream commit 2306c704ce280c97a60d1f45333b822b40281dea ] + +reqsk_timer_handler() tests if icsk_accept_queue.listen_opt +is NULL at its beginning. + +By the time it calls inet_csk_reqsk_queue_drop() and +reqsk_queue_unlink(), listener might have been closed and +inet_csk_listen_stop() had called reqsk_queue_yank_acceptq() +which sets icsk_accept_queue.listen_opt to NULL + +We therefore need to correctly check listen_opt being NULL +after holding syn_wait_lock for proper synchronization. + +Fixes: fa76ce7328b2 ("inet: get rid of central tcp/dccp listener timer") +Fixes: b357a364c57c ("inet: fix possible panic in reqsk_queue_unlink()") +Signed-off-by: Eric Dumazet +Cc: Yuchung Cheng +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/inet_connection_sock.c | 19 ++++++++++--------- + 1 file changed, 10 insertions(+), 9 deletions(-) + +--- a/net/ipv4/inet_connection_sock.c ++++ b/net/ipv4/inet_connection_sock.c +@@ -577,21 +577,22 @@ EXPORT_SYMBOL(inet_rtx_syn_ack); + static bool reqsk_queue_unlink(struct request_sock_queue *queue, + struct request_sock *req) + { +- struct listen_sock *lopt = queue->listen_opt; + struct request_sock **prev; ++ struct listen_sock *lopt; + bool found = false; + + spin_lock(&queue->syn_wait_lock); +- +- for (prev = &lopt->syn_table[req->rsk_hash]; *prev != NULL; +- prev = &(*prev)->dl_next) { +- if (*prev == req) { +- *prev = req->dl_next; +- found = true; +- break; ++ lopt = queue->listen_opt; ++ if (lopt) { ++ for (prev = &lopt->syn_table[req->rsk_hash]; *prev != NULL; ++ prev = &(*prev)->dl_next) { ++ if (*prev == req) { ++ *prev = req->dl_next; ++ found = true; ++ break; ++ } + } + } +- + spin_unlock(&queue->syn_wait_lock); + if (timer_pending(&req->rsk_timer) && del_timer_sync(&req->rsk_timer)) + reqsk_put(req); diff --git a/kernel/kernel/files/patches/mageia/stable-inet-fix-races-in-reqsk_queue_hash_req.patch b/kernel/kernel/files/patches/mageia/stable-inet-fix-races-in-reqsk_queue_hash_req.patch new file mode 100644 index 00000000..840bdaf1 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-inet-fix-races-in-reqsk_queue_hash_req.patch @@ -0,0 +1,52 @@ +From foo@baz Thu Oct 22 17:25:24 PDT 2015 +From: Eric Dumazet +Date: Sat, 19 Sep 2015 09:48:04 -0700 +Subject: inet: fix races in reqsk_queue_hash_req() + +From: Eric Dumazet + +[ Upstream commit 29c6852602e259d2c1882f320b29d5c3fec0de04 ] + +Before allowing lockless LISTEN processing, we need to make +sure to arm the SYN_RECV timer before the req socket is visible +in hash tables. + +Also, req->rsk_hash should be written before we set rsk_refcnt +to a non zero value. + +Fixes: fa76ce7328b2 ("inet: get rid of central tcp/dccp listener timer") +Signed-off-by: Eric Dumazet +Cc: Ying Cai +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/inet_connection_sock.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/net/ipv4/inet_connection_sock.c ++++ b/net/ipv4/inet_connection_sock.c +@@ -685,20 +685,20 @@ void reqsk_queue_hash_req(struct request + req->num_timeout = 0; + req->sk = NULL; + ++ setup_timer(&req->rsk_timer, reqsk_timer_handler, (unsigned long)req); ++ mod_timer_pinned(&req->rsk_timer, jiffies + timeout); ++ req->rsk_hash = hash; ++ + /* before letting lookups find us, make sure all req fields + * are committed to memory and refcnt initialized. + */ + smp_wmb(); + atomic_set(&req->rsk_refcnt, 2); +- setup_timer(&req->rsk_timer, reqsk_timer_handler, (unsigned long)req); +- req->rsk_hash = hash; + + spin_lock(&queue->syn_wait_lock); + req->dl_next = lopt->syn_table[hash]; + lopt->syn_table[hash] = req; + spin_unlock(&queue->syn_wait_lock); +- +- mod_timer_pinned(&req->rsk_timer, jiffies + timeout); + } + EXPORT_SYMBOL(reqsk_queue_hash_req); + diff --git a/kernel/kernel/files/patches/mageia/stable-ipv6-don-t-call-with-rt6_uncached_list_flush_dev.patch b/kernel/kernel/files/patches/mageia/stable-ipv6-don-t-call-with-rt6_uncached_list_flush_dev.patch new file mode 100644 index 00000000..675967a5 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-ipv6-don-t-call-with-rt6_uncached_list_flush_dev.patch @@ -0,0 +1,72 @@ +From foo@baz Thu Oct 22 17:25:24 PDT 2015 +From: "Eric W. Biederman" +Date: Mon, 12 Oct 2015 11:02:08 -0500 +Subject: ipv6: Don't call with rt6_uncached_list_flush_dev + +From: "Eric W. Biederman" + +[ Upstream commit e332bc67cf5e5e5b71a1aec9750d0791aac65183 ] + +As originally written rt6_uncached_list_flush_dev makes no sense when +called with dev == NULL as it attempts to flush all uncached routes +regardless of network namespace when dev == NULL. Which is simply +incorrect behavior. + +Furthermore at the point rt6_ifdown is called with dev == NULL no more +network devices exist in the network namespace so even if the code in +rt6_uncached_list_flush_dev were to attempt something sensible it +would be meaningless. + +Therefore remove support in rt6_uncached_list_flush_dev for handling +network devices where dev == NULL, and only call rt6_uncached_list_flush_dev + when rt6_ifdown is called with a network device. + +Fixes: 8d0b94afdca8 ("ipv6: Keep track of DST_NOCACHE routes in case of iface down/unregister") +Signed-off-by: "Eric W. Biederman" +Reviewed-by: Martin KaFai Lau +Tested-by: Martin KaFai Lau +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/route.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -139,6 +139,9 @@ static void rt6_uncached_list_flush_dev( + struct net_device *loopback_dev = net->loopback_dev; + int cpu; + ++ if (dev == loopback_dev) ++ return; ++ + for_each_possible_cpu(cpu) { + struct uncached_list *ul = per_cpu_ptr(&rt6_uncached_list, cpu); + struct rt6_info *rt; +@@ -148,14 +151,12 @@ static void rt6_uncached_list_flush_dev( + struct inet6_dev *rt_idev = rt->rt6i_idev; + struct net_device *rt_dev = rt->dst.dev; + +- if (rt_idev && (rt_idev->dev == dev || !dev) && +- rt_idev->dev != loopback_dev) { ++ if (rt_idev->dev == dev) { + rt->rt6i_idev = in6_dev_get(loopback_dev); + in6_dev_put(rt_idev); + } + +- if (rt_dev && (rt_dev == dev || !dev) && +- rt_dev != loopback_dev) { ++ if (rt_dev == dev) { + rt->dst.dev = loopback_dev; + dev_hold(rt->dst.dev); + dev_put(rt_dev); +@@ -2577,7 +2578,8 @@ void rt6_ifdown(struct net *net, struct + + fib6_clean_all(net, fib6_ifdown, &adn); + icmp6_clean_all(fib6_ifdown, &adn); +- rt6_uncached_list_flush_dev(net, dev); ++ if (dev) ++ rt6_uncached_list_flush_dev(net, dev); + } + + struct rt6_mtu_change_arg { diff --git a/kernel/kernel/files/patches/mageia/stable-kvm-x86-clean-up-kvm_arch_vcpu_runnable.patch b/kernel/kernel/files/patches/mageia/stable-kvm-x86-clean-up-kvm_arch_vcpu_runnable.patch new file mode 100644 index 00000000..a9a7be41 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-kvm-x86-clean-up-kvm_arch_vcpu_runnable.patch @@ -0,0 +1,90 @@ +From 5d9bc648b94dd719022343b8675e6c4381f0c45f Mon Sep 17 00:00:00 2001 +From: Paolo Bonzini +Date: Tue, 13 Oct 2015 10:18:53 +0200 +Subject: KVM: x86: clean up kvm_arch_vcpu_runnable +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Paolo Bonzini + +commit 5d9bc648b94dd719022343b8675e6c4381f0c45f upstream. + +Split the huge conditional in two functions. + +Fixes: 64d6067057d9658acb8675afcfba549abdb7fc16 +Reviewed-by: Radim Krčmář +Signed-off-by: Paolo Bonzini +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kvm/x86.c | 39 +++++++++++++++++++++++++++++---------- + 1 file changed, 29 insertions(+), 10 deletions(-) + +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -6706,6 +6706,12 @@ static inline int vcpu_block(struct kvm + return 1; + } + ++static inline bool kvm_vcpu_running(struct kvm_vcpu *vcpu) ++{ ++ return (vcpu->arch.mp_state == KVM_MP_STATE_RUNNABLE && ++ !vcpu->arch.apf.halted); ++} ++ + static int vcpu_run(struct kvm_vcpu *vcpu) + { + int r; +@@ -6714,8 +6720,7 @@ static int vcpu_run(struct kvm_vcpu *vcp + vcpu->srcu_idx = srcu_read_lock(&kvm->srcu); + + for (;;) { +- if (vcpu->arch.mp_state == KVM_MP_STATE_RUNNABLE && +- !vcpu->arch.apf.halted) ++ if (kvm_vcpu_running(vcpu)) + r = vcpu_enter_guest(vcpu); + else + r = vcpu_block(kvm, vcpu); +@@ -8011,19 +8016,33 @@ void kvm_arch_flush_shadow_memslot(struc + kvm_mmu_invalidate_zap_all_pages(kvm); + } + ++static inline bool kvm_vcpu_has_events(struct kvm_vcpu *vcpu) ++{ ++ if (!list_empty_careful(&vcpu->async_pf.done)) ++ return true; ++ ++ if (kvm_apic_has_events(vcpu)) ++ return true; ++ ++ if (vcpu->arch.pv.pv_unhalted) ++ return true; ++ ++ if (atomic_read(&vcpu->arch.nmi_queued)) ++ return true; ++ ++ if (kvm_arch_interrupt_allowed(vcpu) && ++ kvm_cpu_has_interrupt(vcpu)) ++ return true; ++ ++ return false; ++} ++ + int kvm_arch_vcpu_runnable(struct kvm_vcpu *vcpu) + { + if (is_guest_mode(vcpu) && kvm_x86_ops->check_nested_events) + kvm_x86_ops->check_nested_events(vcpu, false); + +- return (vcpu->arch.mp_state == KVM_MP_STATE_RUNNABLE && +- !vcpu->arch.apf.halted) +- || !list_empty_careful(&vcpu->async_pf.done) +- || kvm_apic_has_events(vcpu) +- || vcpu->arch.pv.pv_unhalted +- || atomic_read(&vcpu->arch.nmi_queued) || +- (kvm_arch_interrupt_allowed(vcpu) && +- kvm_cpu_has_interrupt(vcpu)); ++ return kvm_vcpu_running(vcpu) || kvm_vcpu_has_events(vcpu); + } + + int kvm_arch_vcpu_should_kick(struct kvm_vcpu *vcpu) diff --git a/kernel/kernel/files/patches/mageia/stable-kvm-x86-fix-rsm-into-64-bit-protected-mode.patch b/kernel/kernel/files/patches/mageia/stable-kvm-x86-fix-rsm-into-64-bit-protected-mode.patch new file mode 100644 index 00000000..ea07d9de --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-kvm-x86-fix-rsm-into-64-bit-protected-mode.patch @@ -0,0 +1,58 @@ +From b10d92a54dac25a6152f1aa1ffc95c12908035ce Mon Sep 17 00:00:00 2001 +From: Paolo Bonzini +Date: Wed, 14 Oct 2015 15:25:52 +0200 +Subject: KVM: x86: fix RSM into 64-bit protected mode + +From: Paolo Bonzini + +commit b10d92a54dac25a6152f1aa1ffc95c12908035ce upstream. + +In order to get into 64-bit protected mode, you need to enable +paging while EFER.LMA=1. For this to work, CS.L must be 0. +Currently, we load the segments before CR0 and CR4, which means +that if RSM returns into 64-bit protected mode CS.L is already 1 +and everything breaks. + +Luckily, CS.L=0 is always the case when executing RSM, because it +is forbidden to execute RSM from 64-bit protected mode. Hence it +is enough to load CR0 and CR4 first, and only then the segments. + +Fixes: 660a5d517aaab9187f93854425c4c63f4a09195c +Signed-off-by: Paolo Bonzini +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kvm/emulate.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +--- a/arch/x86/kvm/emulate.c ++++ b/arch/x86/kvm/emulate.c +@@ -2418,7 +2418,7 @@ static int rsm_load_state_64(struct x86_ + u64 val, cr0, cr4; + u32 base3; + u16 selector; +- int i; ++ int i, r; + + for (i = 0; i < 16; i++) + *reg_write(ctxt, i) = GET_SMSTATE(u64, smbase, 0x7ff8 - i * 8); +@@ -2460,13 +2460,17 @@ static int rsm_load_state_64(struct x86_ + dt.address = GET_SMSTATE(u64, smbase, 0x7e68); + ctxt->ops->set_gdt(ctxt, &dt); + ++ r = rsm_enter_protected_mode(ctxt, cr0, cr4); ++ if (r != X86EMUL_CONTINUE) ++ return r; ++ + for (i = 0; i < 6; i++) { +- int r = rsm_load_seg_64(ctxt, smbase, i); ++ r = rsm_load_seg_64(ctxt, smbase, i); + if (r != X86EMUL_CONTINUE) + return r; + } + +- return rsm_enter_protected_mode(ctxt, cr0, cr4); ++ return X86EMUL_CONTINUE; + } + + static int em_rsm(struct x86_emulate_ctxt *ctxt) diff --git a/kernel/kernel/files/patches/mageia/stable-kvm-x86-fix-smi-to-halted-vcpu.patch b/kernel/kernel/files/patches/mageia/stable-kvm-x86-fix-smi-to-halted-vcpu.patch new file mode 100644 index 00000000..6f9893bd --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-kvm-x86-fix-smi-to-halted-vcpu.patch @@ -0,0 +1,32 @@ +From 73917739334c6509833b0403b81d4a04a8784bdf Mon Sep 17 00:00:00 2001 +From: Paolo Bonzini +Date: Tue, 13 Oct 2015 10:19:35 +0200 +Subject: KVM: x86: fix SMI to halted VCPU + +From: Paolo Bonzini + +commit 73917739334c6509833b0403b81d4a04a8784bdf upstream. + +An SMI to a halted VCPU must wake it up, hence a VCPU with a pending +SMI must be considered runnable. + +Fixes: 64d6067057d9658acb8675afcfba549abdb7fc16 +Signed-off-by: Paolo Bonzini +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kvm/x86.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -8030,6 +8030,9 @@ static inline bool kvm_vcpu_has_events(s + if (atomic_read(&vcpu->arch.nmi_queued)) + return true; + ++ if (test_bit(KVM_REQ_SMI, &vcpu->requests)) ++ return true; ++ + if (kvm_arch_interrupt_allowed(vcpu) && + kvm_cpu_has_interrupt(vcpu)) + return true; diff --git a/kernel/kernel/files/patches/mageia/stable-l2tp-protect-tunnel-del_work-by-ref_count.patch b/kernel/kernel/files/patches/mageia/stable-l2tp-protect-tunnel-del_work-by-ref_count.patch new file mode 100644 index 00000000..78d75c2a --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-l2tp-protect-tunnel-del_work-by-ref_count.patch @@ -0,0 +1,55 @@ +From foo@baz Thu Oct 22 17:25:24 PDT 2015 +From: Alexander Couzens +Date: Mon, 28 Sep 2015 11:32:42 +0200 +Subject: l2tp: protect tunnel->del_work by ref_count + +From: Alexander Couzens + +[ Upstream commit 06a15f51cf3618e32a73871ee6a547ef7fd902b5 ] + +There is a small chance that tunnel_free() is called before tunnel->del_work scheduled +resulting in a zero pointer dereference. + +Signed-off-by: Alexander Couzens +Acked-by: James Chapman +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/l2tp/l2tp_core.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +--- a/net/l2tp/l2tp_core.c ++++ b/net/l2tp/l2tp_core.c +@@ -1319,7 +1319,7 @@ static void l2tp_tunnel_del_work(struct + tunnel = container_of(work, struct l2tp_tunnel, del_work); + sk = l2tp_tunnel_sock_lookup(tunnel); + if (!sk) +- return; ++ goto out; + + sock = sk->sk_socket; + +@@ -1341,6 +1341,8 @@ static void l2tp_tunnel_del_work(struct + } + + l2tp_tunnel_sock_put(sk); ++out: ++ l2tp_tunnel_dec_refcount(tunnel); + } + + /* Create a socket for the tunnel, if one isn't set up by +@@ -1636,8 +1638,13 @@ EXPORT_SYMBOL_GPL(l2tp_tunnel_create); + */ + int l2tp_tunnel_delete(struct l2tp_tunnel *tunnel) + { ++ l2tp_tunnel_inc_refcount(tunnel); + l2tp_tunnel_closeall(tunnel); +- return (false == queue_work(l2tp_wq, &tunnel->del_work)); ++ if (false == queue_work(l2tp_wq, &tunnel->del_work)) { ++ l2tp_tunnel_dec_refcount(tunnel); ++ return 1; ++ } ++ return 0; + } + EXPORT_SYMBOL_GPL(l2tp_tunnel_delete); + diff --git a/kernel/kernel/files/patches/mageia/stable-memcg-convert-threshold-to-bytes.patch b/kernel/kernel/files/patches/mageia/stable-memcg-convert-threshold-to-bytes.patch new file mode 100644 index 00000000..59f1b712 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-memcg-convert-threshold-to-bytes.patch @@ -0,0 +1,35 @@ +From 424cdc14138088ada1b0e407a2195b2783c6e5ef Mon Sep 17 00:00:00 2001 +From: Shaohua Li +Date: Thu, 15 Oct 2015 15:28:29 -0700 +Subject: memcg: convert threshold to bytes + +From: Shaohua Li + +commit 424cdc14138088ada1b0e407a2195b2783c6e5ef upstream. + +page_counter_memparse() returns pages for the threshold, while +mem_cgroup_usage() returns bytes for memory usage. Convert the +threshold to bytes. + +Fixes: 3e32cb2e0a12b6915 ("memcg: rename cgroup_event to mem_cgroup_event"). +Signed-off-by: Shaohua Li +Cc: Johannes Weiner +Acked-by: Michal Hocko +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/memcontrol.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/mm/memcontrol.c ++++ b/mm/memcontrol.c +@@ -3687,6 +3687,7 @@ static int __mem_cgroup_usage_register_e + ret = page_counter_memparse(args, "-1", &threshold); + if (ret) + return ret; ++ threshold <<= PAGE_SHIFT; + + mutex_lock(&memcg->thresholds_lock); + diff --git a/kernel/kernel/files/patches/mageia/stable-mfd-max77843-fix-max77843_chg_init-return-on-error.patch b/kernel/kernel/files/patches/mageia/stable-mfd-max77843-fix-max77843_chg_init-return-on-error.patch new file mode 100644 index 00000000..0798f6b0 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-mfd-max77843-fix-max77843_chg_init-return-on-error.patch @@ -0,0 +1,34 @@ +From 1b52e50f2a402a266f1ba2281f0a57e87637a047 Mon Sep 17 00:00:00 2001 +From: Javier Martinez Canillas +Date: Mon, 21 Sep 2015 14:26:54 +0200 +Subject: mfd: max77843: Fix max77843_chg_init() return on error + +From: Javier Martinez Canillas + +commit 1b52e50f2a402a266f1ba2281f0a57e87637a047 upstream. + +If i2c_new_dummy() fails in max77843_chg_init(), an PTR_ERR(NULL) is +returned which is 0. So the function was wrongly returning a success +value instead of an error code. + +Fixes: c7f585fe46d8 ("mfd: max77843: Add max77843 MFD driver core driver") +Signed-off-by: Javier Martinez Canillas +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Lee Jones +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mfd/max77843.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/mfd/max77843.c ++++ b/drivers/mfd/max77843.c +@@ -79,7 +79,7 @@ static int max77843_chg_init(struct max7 + if (!max77843->i2c_chg) { + dev_err(&max77843->i2c->dev, + "Cannot allocate I2C device for Charger\n"); +- return PTR_ERR(max77843->i2c_chg); ++ return -ENODEV; + } + i2c_set_clientdata(max77843->i2c_chg, max77843); + diff --git a/kernel/kernel/files/patches/mageia/stable-net-add-pfmemalloc-check-in-sk_add_backlog.patch b/kernel/kernel/files/patches/mageia/stable-net-add-pfmemalloc-check-in-sk_add_backlog.patch new file mode 100644 index 00000000..2dfdab75 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-net-add-pfmemalloc-check-in-sk_add_backlog.patch @@ -0,0 +1,49 @@ +From foo@baz Thu Oct 22 17:25:24 PDT 2015 +From: Eric Dumazet +Date: Tue, 29 Sep 2015 18:52:25 -0700 +Subject: net: add pfmemalloc check in sk_add_backlog() + +From: Eric Dumazet + +[ Upstream commit c7c49b8fde26b74277188bdc6c9dca38db6fa35b ] + +Greg reported crashes hitting the following check in __sk_backlog_rcv() + + BUG_ON(!sock_flag(sk, SOCK_MEMALLOC)); + +The pfmemalloc bit is currently checked in sk_filter(). + +This works correctly for TCP, because sk_filter() is ran in +tcp_v[46]_rcv() before hitting the prequeue or backlog checks. + +For UDP or other protocols, this does not work, because the sk_filter() +is ran from sock_queue_rcv_skb(), which might be called _after_ backlog +queuing if socket is owned by user by the time packet is processed by +softirq handler. + +Fixes: b4b9e35585089 ("netvm: set PF_MEMALLOC as appropriate during SKB processing") +Signed-off-by: Eric Dumazet +Reported-by: Greg Thelen +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + include/net/sock.h | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/include/net/sock.h ++++ b/include/net/sock.h +@@ -826,6 +826,14 @@ static inline __must_check int sk_add_ba + if (sk_rcvqueues_full(sk, limit)) + return -ENOBUFS; + ++ /* ++ * If the skb was allocated from pfmemalloc reserves, only ++ * allow SOCK_MEMALLOC sockets to use it as this socket is ++ * helping free memory ++ */ ++ if (skb_pfmemalloc(skb) && !sock_flag(sk, SOCK_MEMALLOC)) ++ return -ENOMEM; ++ + __sk_add_backlog(sk, skb); + sk->sk_backlog.len += skb->truesize; + return 0; diff --git a/kernel/kernel/files/patches/mageia/stable-net-dsa-fix-preparation-of-a-port-stp-update.patch b/kernel/kernel/files/patches/mageia/stable-net-dsa-fix-preparation-of-a-port-stp-update.patch new file mode 100644 index 00000000..5e0635c3 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-net-dsa-fix-preparation-of-a-port-stp-update.patch @@ -0,0 +1,47 @@ +From foo@baz Thu Oct 22 17:25:24 PDT 2015 +From: Vivien Didelot +Date: Tue, 29 Sep 2015 14:17:54 -0400 +Subject: net: dsa: fix preparation of a port STP update + +From: Vivien Didelot + +[ Upstream commit 57a47532c4312159935c98b7f1cf0e62296b9171 ] + +Because of the default 0 value of ret in dsa_slave_port_attr_set, a +driver may return -EOPNOTSUPP from the commit phase of a STP state, +which triggers a WARN() from switchdev. + +This happened on a 6185 switch which does not support hardware bridging. + +Fixes: 3563606258cf ("switchdev: convert STP update to switchdev attr set") +Reported-by: Andrew Lunn +Signed-off-by: Vivien Didelot +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/dsa/slave.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +--- a/net/dsa/slave.c ++++ b/net/dsa/slave.c +@@ -348,12 +348,17 @@ static int dsa_slave_stp_update(struct n + static int dsa_slave_port_attr_set(struct net_device *dev, + struct switchdev_attr *attr) + { +- int ret = 0; ++ struct dsa_slave_priv *p = netdev_priv(dev); ++ struct dsa_switch *ds = p->parent; ++ int ret; + + switch (attr->id) { + case SWITCHDEV_ATTR_PORT_STP_STATE: +- if (attr->trans == SWITCHDEV_TRANS_COMMIT) +- ret = dsa_slave_stp_update(dev, attr->u.stp_state); ++ if (attr->trans == SWITCHDEV_TRANS_PREPARE) ++ ret = ds->drv->port_stp_update ? 0 : -EOPNOTSUPP; ++ else ++ ret = ds->drv->port_stp_update(ds, p->port, ++ attr->u.stp_state); + break; + default: + ret = -EOPNOTSUPP; diff --git a/kernel/kernel/files/patches/mageia/stable-net-ibm-emac-bump-version-numbers-for-correct-work-with-ethtool.patch b/kernel/kernel/files/patches/mageia/stable-net-ibm-emac-bump-version-numbers-for-correct-work-with-ethtool.patch new file mode 100644 index 00000000..17d64561 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-net-ibm-emac-bump-version-numbers-for-correct-work-with-ethtool.patch @@ -0,0 +1,40 @@ +From foo@baz Thu Oct 22 17:25:24 PDT 2015 +From: Ivan Mikhaylov +Date: Fri, 25 Sep 2015 11:52:27 +0400 +Subject: net/ibm/emac: bump version numbers for correct work with ethtool + +From: Ivan Mikhaylov + +[ Upstream commit 661dfc65f7981481ba2e31aaa702371e82336e56 ] + +The size of the MAC register dump used to be the size specified by the +reg property in the device tree. Userland has no good way of finding +out that size, and it was not specified consistently for each MAC type, +so ethtool would end up printing junk at the end of the register dump +if the device tree didn't match the size it assumed. + +Using the new version numbers indicates unambiguously that the size of +the MAC register dump is dependent only on the MAC type. + +Fixes: 5369c71f7ca2 ("net/ibm/emac: fix size of emac dump memory areas") +Signed-off-by: Ivan Mikhaylov +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/ibm/emac/core.h | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/net/ethernet/ibm/emac/core.h ++++ b/drivers/net/ethernet/ibm/emac/core.h +@@ -460,8 +460,8 @@ struct emac_ethtool_regs_subhdr { + u32 index; + }; + +-#define EMAC_ETHTOOL_REGS_VER 0 +-#define EMAC4_ETHTOOL_REGS_VER 1 +-#define EMAC4SYNC_ETHTOOL_REGS_VER 2 ++#define EMAC_ETHTOOL_REGS_VER 3 ++#define EMAC4_ETHTOOL_REGS_VER 4 ++#define EMAC4SYNC_ETHTOOL_REGS_VER 5 + + #endif /* __IBM_NEWEMAC_CORE_H */ diff --git a/kernel/kernel/files/patches/mageia/stable-net-unix-fix-logic-about-sk_peek_offset.patch b/kernel/kernel/files/patches/mageia/stable-net-unix-fix-logic-about-sk_peek_offset.patch new file mode 100644 index 00000000..caf341d6 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-net-unix-fix-logic-about-sk_peek_offset.patch @@ -0,0 +1,67 @@ +From foo@baz Thu Oct 22 17:25:24 PDT 2015 +From: Andrey Vagin +Date: Fri, 2 Oct 2015 00:05:36 +0300 +Subject: net/unix: fix logic about sk_peek_offset + +From: Andrey Vagin + +[ Upstream commit e9193d60d363e4dff75ff6d43a48f22be26d59c7 ] + +Now send with MSG_PEEK can return data from multiple SKBs. + +Unfortunately we take into account the peek offset for each skb, +that is wrong. We need to apply the peek offset only once. + +In addition, the peek offset should be used only if MSG_PEEK is set. + +Cc: "David S. Miller" (maintainer:NETWORKING +Cc: Eric Dumazet (commit_signer:1/14=7%) +Cc: Aaron Conole +Fixes: 9f389e35674f ("af_unix: return data from multiple SKBs on recv() with MSG_PEEK flag") +Signed-off-by: Andrey Vagin +Tested-by: Aaron Conole +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/unix/af_unix.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +--- a/net/unix/af_unix.c ++++ b/net/unix/af_unix.c +@@ -2064,6 +2064,11 @@ static int unix_stream_read_generic(stru + goto out; + } + ++ if (flags & MSG_PEEK) ++ skip = sk_peek_offset(sk, flags); ++ else ++ skip = 0; ++ + do { + int chunk; + struct sk_buff *skb, *last; +@@ -2112,7 +2117,6 @@ unlock: + break; + } + +- skip = sk_peek_offset(sk, flags); + while (skip >= unix_skb_len(skb)) { + skip -= unix_skb_len(skb); + last = skb; +@@ -2179,14 +2183,12 @@ unlock: + if (UNIXCB(skb).fp) + scm.fp = scm_fp_dup(UNIXCB(skb).fp); + +- if (skip) { +- sk_peek_offset_fwd(sk, chunk); +- skip -= chunk; +- } ++ sk_peek_offset_fwd(sk, chunk); + + if (UNIXCB(skb).fp) + break; + ++ skip = 0; + last = skb; + last_len = skb->len; + unix_state_lock(sk); diff --git a/kernel/kernel/files/patches/mageia/stable-netlink-trim-skb-to-alloc-size-to-avoid-msg_trunc.patch b/kernel/kernel/files/patches/mageia/stable-netlink-trim-skb-to-alloc-size-to-avoid-msg_trunc.patch new file mode 100644 index 00000000..dc17779e --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-netlink-trim-skb-to-alloc-size-to-avoid-msg_trunc.patch @@ -0,0 +1,107 @@ +From foo@baz Thu Oct 22 17:25:24 PDT 2015 +From: "Arad, Ronen" +Date: Thu, 15 Oct 2015 01:55:17 -0700 +Subject: netlink: Trim skb to alloc size to avoid MSG_TRUNC + +From: "Arad, Ronen" + +[ Upstream commit db65a3aaf29ecce2e34271d52e8d2336b97bd9fe ] + +netlink_dump() allocates skb based on the calculated min_dump_alloc or +a per socket max_recvmsg_len. +min_alloc_size is maximum space required for any single netdev +attributes as calculated by rtnl_calcit(). +max_recvmsg_len tracks the user provided buffer to netlink_recvmsg. +It is capped at 16KiB. +The intention is to avoid small allocations and to minimize the number +of calls required to obtain dump information for all net devices. + +netlink_dump packs as many small messages as could fit within an skb +that was sized for the largest single netdev information. The actual +space available within an skb is larger than what is requested. It could +be much larger and up to near 2x with align to next power of 2 approach. + +Allowing netlink_dump to use all the space available within the +allocated skb increases the buffer size a user has to provide to avoid +truncaion (i.e. MSG_TRUNG flag set). + +It was observed that with many VLANs configured on at least one netdev, +a larger buffer of near 64KiB was necessary to avoid "Message truncated" +error in "ip link" or "bridge [-c[ompressvlans]] vlan show" when +min_alloc_size was only little over 32KiB. + +This patch trims skb to allocated size in order to allow the user to +avoid truncation with more reasonable buffer size. + +Signed-off-by: Ronen Arad +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/netlink/af_netlink.c | 34 ++++++++++++++++++++++------------ + 1 file changed, 22 insertions(+), 12 deletions(-) + +--- a/net/netlink/af_netlink.c ++++ b/net/netlink/af_netlink.c +@@ -2750,6 +2750,7 @@ static int netlink_dump(struct sock *sk) + struct sk_buff *skb = NULL; + struct nlmsghdr *nlh; + int len, err = -ENOBUFS; ++ int alloc_min_size; + int alloc_size; + + mutex_lock(nlk->cb_mutex); +@@ -2758,9 +2759,6 @@ static int netlink_dump(struct sock *sk) + goto errout_skb; + } + +- cb = &nlk->cb; +- alloc_size = max_t(int, cb->min_dump_alloc, NLMSG_GOODSIZE); +- + if (!netlink_rx_is_mmaped(sk) && + atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf) + goto errout_skb; +@@ -2770,23 +2768,35 @@ static int netlink_dump(struct sock *sk) + * to reduce number of system calls on dump operations, if user + * ever provided a big enough buffer. + */ +- if (alloc_size < nlk->max_recvmsg_len) { +- skb = netlink_alloc_skb(sk, +- nlk->max_recvmsg_len, +- nlk->portid, ++ cb = &nlk->cb; ++ alloc_min_size = max_t(int, cb->min_dump_alloc, NLMSG_GOODSIZE); ++ ++ if (alloc_min_size < nlk->max_recvmsg_len) { ++ alloc_size = nlk->max_recvmsg_len; ++ skb = netlink_alloc_skb(sk, alloc_size, nlk->portid, + GFP_KERNEL | + __GFP_NOWARN | + __GFP_NORETRY); +- /* available room should be exact amount to avoid MSG_TRUNC */ +- if (skb) +- skb_reserve(skb, skb_tailroom(skb) - +- nlk->max_recvmsg_len); + } +- if (!skb) ++ if (!skb) { ++ alloc_size = alloc_min_size; + skb = netlink_alloc_skb(sk, alloc_size, nlk->portid, + GFP_KERNEL); ++ } + if (!skb) + goto errout_skb; ++ ++ /* Trim skb to allocated size. User is expected to provide buffer as ++ * large as max(min_dump_alloc, 16KiB (mac_recvmsg_len capped at ++ * netlink_recvmsg())). dump will pack as many smaller messages as ++ * could fit within the allocated skb. skb is typically allocated ++ * with larger space than required (could be as much as near 2x the ++ * requested size with align to next power of 2 approach). Allowing ++ * dump to use the excess space makes it difficult for a user to have a ++ * reasonable static buffer based on the expected largest dump of a ++ * single netdev. The outcome is MSG_TRUNC error. ++ */ ++ skb_reserve(skb, skb_tailroom(skb) - alloc_size); + netlink_skb_set_owner_r(skb, sk); + + len = cb->dump(skb, cb); diff --git a/kernel/kernel/files/patches/mageia/stable-nfsd-blocklayout-accept-any-minlength.patch b/kernel/kernel/files/patches/mageia/stable-nfsd-blocklayout-accept-any-minlength.patch new file mode 100644 index 00000000..93a47304 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-nfsd-blocklayout-accept-any-minlength.patch @@ -0,0 +1,43 @@ +From 8c3ad9cb7343dc5f61b8cf3cdbe1016c5e7c2c8b Mon Sep 17 00:00:00 2001 +From: Christoph Hellwig +Date: Fri, 9 Oct 2015 15:03:26 +0200 +Subject: nfsd/blocklayout: accept any minlength + +From: Christoph Hellwig + +commit 8c3ad9cb7343dc5f61b8cf3cdbe1016c5e7c2c8b upstream. + +Recent Linux clients have started to send GETLAYOUT requests with +minlength less than blocksize. + +Servers aren't really allowed to impose this kind of restriction on +layouts; see RFC 5661 section 18.43.3 for details. + +This has been observed to cause indefinite hangs on fsx runs on some +clients. + +Signed-off-by: Christoph Hellwig +Signed-off-by: J. Bruce Fields +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfsd/blocklayout.c | 8 -------- + 1 file changed, 8 deletions(-) + +--- a/fs/nfsd/blocklayout.c ++++ b/fs/nfsd/blocklayout.c +@@ -56,14 +56,6 @@ nfsd4_block_proc_layoutget(struct inode + u32 device_generation = 0; + int error; + +- /* +- * We do not attempt to support I/O smaller than the fs block size, +- * or not aligned to it. +- */ +- if (args->lg_minlength < block_size) { +- dprintk("pnfsd: I/O too small\n"); +- goto out_layoutunavailable; +- } + if (seg->offset & (block_size - 1)) { + dprintk("pnfsd: I/O misaligned\n"); + goto out_layoutunavailable; diff --git a/kernel/kernel/files/patches/mageia/stable-ovs-do-not-allocate-memory-from-offline-numa-node.patch b/kernel/kernel/files/patches/mageia/stable-ovs-do-not-allocate-memory-from-offline-numa-node.patch new file mode 100644 index 00000000..d6354343 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-ovs-do-not-allocate-memory-from-offline-numa-node.patch @@ -0,0 +1,35 @@ +From foo@baz Thu Oct 22 17:25:24 PDT 2015 +From: Konstantin Khlebnikov +Date: Fri, 2 Oct 2015 13:18:22 +0300 +Subject: ovs: do not allocate memory from offline numa node + +From: Konstantin Khlebnikov + +[ Upstream commit 598c12d0ba6de9060f04999746eb1e015774044b ] + +When openvswitch tries allocate memory from offline numa node 0: +stats = kmem_cache_alloc_node(flow_stats_cache, GFP_KERNEL | __GFP_ZERO, 0) +It catches VM_BUG_ON(nid < 0 || nid >= MAX_NUMNODES || !node_online(nid)) +[ replaced with VM_WARN_ON(!node_online(nid)) recently ] in linux/gfp.h +This patch disables numa affinity in this case. + +Signed-off-by: Konstantin Khlebnikov +Acked-by: Pravin B Shelar +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/openvswitch/flow_table.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/net/openvswitch/flow_table.c ++++ b/net/openvswitch/flow_table.c +@@ -92,7 +92,8 @@ struct sw_flow *ovs_flow_alloc(void) + + /* Initialize the default stat node. */ + stats = kmem_cache_alloc_node(flow_stats_cache, +- GFP_KERNEL | __GFP_ZERO, 0); ++ GFP_KERNEL | __GFP_ZERO, ++ node_online(0) ? 0 : NUMA_NO_NODE); + if (!stats) + goto err; + diff --git a/kernel/kernel/files/patches/mageia/stable-ppp-don-t-override-sk-sk_state-in-pppoe_flush_dev.patch b/kernel/kernel/files/patches/mageia/stable-ppp-don-t-override-sk-sk_state-in-pppoe_flush_dev.patch new file mode 100644 index 00000000..0234e75f --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-ppp-don-t-override-sk-sk_state-in-pppoe_flush_dev.patch @@ -0,0 +1,76 @@ +From foo@baz Thu Oct 22 17:25:24 PDT 2015 +From: Guillaume Nault +Date: Wed, 30 Sep 2015 11:45:33 +0200 +Subject: ppp: don't override sk->sk_state in pppoe_flush_dev() + +From: Guillaume Nault + +[ Upstream commit e6740165b8f7f06d8caee0fceab3fb9d790a6fed ] + +Since commit 2b018d57ff18 ("pppoe: drop PPPOX_ZOMBIEs in pppoe_release"), +pppoe_release() calls dev_put(po->pppoe_dev) if sk is in the +PPPOX_ZOMBIE state. But pppoe_flush_dev() can set sk->sk_state to +PPPOX_ZOMBIE _and_ reset po->pppoe_dev to NULL. This leads to the +following oops: + +[ 570.140800] BUG: unable to handle kernel NULL pointer dereference at 00000000000004e0 +[ 570.142931] IP: [] pppoe_release+0x50/0x101 [pppoe] +[ 570.144601] PGD 3d119067 PUD 3dbc1067 PMD 0 +[ 570.144601] Oops: 0000 [#1] SMP +[ 570.144601] Modules linked in: l2tp_ppp l2tp_netlink l2tp_core ip6_udp_tunnel udp_tunnel pppoe pppox ppp_generic slhc loop crc32c_intel ghash_clmulni_intel jitterentropy_rng sha256_generic hmac drbg ansi_cprng aesni_intel aes_x86_64 ablk_helper cryptd lrw gf128mul glue_helper acpi_cpufreq evdev serio_raw processor button ext4 crc16 mbcache jbd2 virtio_net virtio_blk virtio_pci virtio_ring virtio +[ 570.144601] CPU: 1 PID: 15738 Comm: ppp-apitest Not tainted 4.2.0 #1 +[ 570.144601] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Debian-1.8.2-1 04/01/2014 +[ 570.144601] task: ffff88003d30d600 ti: ffff880036b60000 task.ti: ffff880036b60000 +[ 570.144601] RIP: 0010:[] [] pppoe_release+0x50/0x101 [pppoe] +[ 570.144601] RSP: 0018:ffff880036b63e08 EFLAGS: 00010202 +[ 570.144601] RAX: 0000000000000000 RBX: ffff880034340000 RCX: 0000000000000206 +[ 570.144601] RDX: 0000000000000006 RSI: ffff88003d30dd20 RDI: ffff88003d30dd20 +[ 570.144601] RBP: ffff880036b63e28 R08: 0000000000000001 R09: 0000000000000000 +[ 570.144601] R10: 00007ffee9b50420 R11: ffff880034340078 R12: ffff8800387ec780 +[ 570.144601] R13: ffff8800387ec7b0 R14: ffff88003e222aa0 R15: ffff8800387ec7b0 +[ 570.144601] FS: 00007f5672f48700(0000) GS:ffff88003fc80000(0000) knlGS:0000000000000000 +[ 570.144601] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 570.144601] CR2: 00000000000004e0 CR3: 0000000037f7e000 CR4: 00000000000406a0 +[ 570.144601] Stack: +[ 570.144601] ffffffffa018f240 ffff8800387ec780 ffffffffa018f240 ffff8800387ec7b0 +[ 570.144601] ffff880036b63e48 ffffffff812caabe ffff880039e4e000 0000000000000008 +[ 570.144601] ffff880036b63e58 ffffffff812cabad ffff880036b63ea8 ffffffff811347f5 +[ 570.144601] Call Trace: +[ 570.144601] [] sock_release+0x1a/0x75 +[ 570.144601] [] sock_close+0xd/0x11 +[ 570.144601] [] __fput+0xff/0x1a5 +[ 570.144601] [] ____fput+0x9/0xb +[ 570.144601] [] task_work_run+0x66/0x90 +[ 570.144601] [] prepare_exit_to_usermode+0x8c/0xa7 +[ 570.144601] [] syscall_return_slowpath+0x16d/0x19b +[ 570.144601] [] int_ret_from_sys_call+0x25/0x9f +[ 570.144601] Code: 48 8b 83 c8 01 00 00 a8 01 74 12 48 89 df e8 8b 27 14 e1 b8 f7 ff ff ff e9 b7 00 00 00 8a 43 12 a8 0b 74 1c 48 8b 83 a8 04 00 00 <48> 8b 80 e0 04 00 00 65 ff 08 48 c7 83 a8 04 00 00 00 00 00 00 +[ 570.144601] RIP [] pppoe_release+0x50/0x101 [pppoe] +[ 570.144601] RSP +[ 570.144601] CR2: 00000000000004e0 +[ 570.200518] ---[ end trace 46956baf17349563 ]--- + +pppoe_flush_dev() has no reason to override sk->sk_state with +PPPOX_ZOMBIE. pppox_unbind_sock() already sets sk->sk_state to +PPPOX_DEAD, which is the correct state given that sk is unbound and +po->pppoe_dev is NULL. + +Fixes: 2b018d57ff18 ("pppoe: drop PPPOX_ZOMBIEs in pppoe_release") +Tested-by: Oleksii Berezhniak +Signed-off-by: Guillaume Nault +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ppp/pppoe.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/net/ppp/pppoe.c ++++ b/drivers/net/ppp/pppoe.c +@@ -313,7 +313,6 @@ static void pppoe_flush_dev(struct net_d + if (po->pppoe_dev == dev && + sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND | PPPOX_ZOMBIE)) { + pppox_unbind_sock(sk); +- sk->sk_state = PPPOX_ZOMBIE; + sk->sk_state_change(sk); + po->pppoe_dev = NULL; + dev_put(dev); diff --git a/kernel/kernel/files/patches/mageia/stable-skbuff-fix-skb-checksum-flag-on-skb-pull.patch b/kernel/kernel/files/patches/mageia/stable-skbuff-fix-skb-checksum-flag-on-skb-pull.patch new file mode 100644 index 00000000..40758742 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-skbuff-fix-skb-checksum-flag-on-skb-pull.patch @@ -0,0 +1,68 @@ +From foo@baz Thu Oct 22 17:25:24 PDT 2015 +From: Pravin B Shelar +Date: Tue, 22 Sep 2015 12:57:53 -0700 +Subject: skbuff: Fix skb checksum flag on skb pull + +From: Pravin B Shelar + +[ Upstream commit 6ae459bdaaeebc632b16e54dcbabb490c6931d61 ] + +VXLAN device can receive skb with checksum partial. But the checksum +offset could be in outer header which is pulled on receive. This results +in negative checksum offset for the skb. Such skb can cause the assert +failure in skb_checksum_help(). Following patch fixes the bug by setting +checksum-none while pulling outer header. + +Following is the kernel panic msg from old kernel hitting the bug. + +------------[ cut here ]------------ +kernel BUG at net/core/dev.c:1906! +RIP: 0010:[] skb_checksum_help+0x144/0x150 +Call Trace: + +[] queue_userspace_packet+0x408/0x470 [openvswitch] +[] ovs_dp_upcall+0x5d/0x60 [openvswitch] +[] ovs_dp_process_packet_with_key+0xe6/0x100 [openvswitch] +[] ovs_dp_process_received_packet+0x4b/0x80 [openvswitch] +[] ovs_vport_receive+0x2a/0x30 [openvswitch] +[] vxlan_rcv+0x53/0x60 [openvswitch] +[] vxlan_udp_encap_recv+0x8b/0xf0 [openvswitch] +[] udp_queue_rcv_skb+0x2dc/0x3b0 +[] __udp4_lib_rcv+0x1cf/0x6c0 +[] udp_rcv+0x1a/0x20 +[] ip_local_deliver_finish+0xdd/0x280 +[] ip_local_deliver+0x88/0x90 +[] ip_rcv_finish+0x10d/0x370 +[] ip_rcv+0x235/0x300 +[] __netif_receive_skb+0x55d/0x620 +[] netif_receive_skb+0x80/0x90 +[] virtnet_poll+0x555/0x6f0 +[] net_rx_action+0x134/0x290 +[] __do_softirq+0xa8/0x210 +[] call_softirq+0x1c/0x30 +[] do_softirq+0x65/0xa0 +[] irq_exit+0x8e/0xb0 +[] do_IRQ+0x63/0xe0 +[] common_interrupt+0x6e/0x6e + +Reported-by: Anupam Chanda +Signed-off-by: Pravin B Shelar +Acked-by: Tom Herbert +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/skbuff.h | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/include/linux/skbuff.h ++++ b/include/linux/skbuff.h +@@ -2601,6 +2601,9 @@ static inline void skb_postpull_rcsum(st + { + if (skb->ip_summed == CHECKSUM_COMPLETE) + skb->csum = csum_sub(skb->csum, csum_partial(start, len, 0)); ++ else if (skb->ip_summed == CHECKSUM_PARTIAL && ++ skb_checksum_start_offset(skb) <= len) ++ skb->ip_summed = CHECKSUM_NONE; + } + + unsigned char *skb_pull_rcsum(struct sk_buff *skb, unsigned int len); diff --git a/kernel/kernel/files/patches/mageia/stable-skbuff-fix-skb-checksum-partial-check.patch b/kernel/kernel/files/patches/mageia/stable-skbuff-fix-skb-checksum-partial-check.patch new file mode 100644 index 00000000..4d3fed25 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-skbuff-fix-skb-checksum-partial-check.patch @@ -0,0 +1,58 @@ +From foo@baz Thu Oct 22 17:25:24 PDT 2015 +From: Pravin B Shelar +Date: Mon, 28 Sep 2015 17:24:25 -0700 +Subject: skbuff: Fix skb checksum partial check. + +From: Pravin B Shelar + +[ Upstream commit 31b33dfb0a144469dd805514c9e63f4993729a48 ] + +Earlier patch 6ae459bda tried to detect void ckecksum partial +skb by comparing pull length to checksum offset. But it does +not work for all cases since checksum-offset depends on +updates to skb->data. + +Following patch fixes it by validating checksum start offset +after skb-data pointer is updated. Negative value of checksum +offset start means there is no need to checksum. + +Fixes: 6ae459bda ("skbuff: Fix skb checksum flag on skb pull") +Reported-by: Andrew Vagin +Signed-off-by: Pravin B Shelar +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/skbuff.h | 2 +- + net/core/skbuff.c | 9 +++++---- + 2 files changed, 6 insertions(+), 5 deletions(-) + +--- a/include/linux/skbuff.h ++++ b/include/linux/skbuff.h +@@ -2602,7 +2602,7 @@ static inline void skb_postpull_rcsum(st + if (skb->ip_summed == CHECKSUM_COMPLETE) + skb->csum = csum_sub(skb->csum, csum_partial(start, len, 0)); + else if (skb->ip_summed == CHECKSUM_PARTIAL && +- skb_checksum_start_offset(skb) <= len) ++ skb_checksum_start_offset(skb) < 0) + skb->ip_summed = CHECKSUM_NONE; + } + +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -2958,11 +2958,12 @@ EXPORT_SYMBOL_GPL(skb_append_pagefrags); + */ + unsigned char *skb_pull_rcsum(struct sk_buff *skb, unsigned int len) + { ++ unsigned char *data = skb->data; ++ + BUG_ON(len > skb->len); +- skb->len -= len; +- BUG_ON(skb->len < skb->data_len); +- skb_postpull_rcsum(skb, skb->data, len); +- return skb->data += len; ++ __skb_pull(skb, len); ++ skb_postpull_rcsum(skb, data, len); ++ return skb->data; + } + EXPORT_SYMBOL_GPL(skb_pull_rcsum); + diff --git a/kernel/kernel/files/patches/mageia/stable-tipc-move-fragment-importance-field-to-new-header-position.patch b/kernel/kernel/files/patches/mageia/stable-tipc-move-fragment-importance-field-to-new-header-position.patch new file mode 100644 index 00000000..866de2e9 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-tipc-move-fragment-importance-field-to-new-header-position.patch @@ -0,0 +1,57 @@ +From foo@baz Thu Oct 22 17:25:24 PDT 2015 +From: Jon Paul Maloy +Date: Wed, 14 Oct 2015 09:23:18 -0400 +Subject: tipc: move fragment importance field to new header position + +From: Jon Paul Maloy + +[ Upstream commit dde4b5ae65de659b9ec64bafdde0430459fcb495 ] + +In commit e3eea1eb47a ("tipc: clean up handling of message priorities") +we introduced a field in the packet header for keeping track of the +priority of fragments, since this value is not present in the specified +protocol header. Since the value so far only is used at the transmitting +end of the link, we have not yet officially defined it as part of the +protocol. + +Unfortunately, the field we use for keeping this value, bits 13-15 in +in word 5, has turned out to be a poor choice; it is already used by the +broadcast protocol for carrying the 'network id' field of the sending +node. Since packet fragments also need to be transported across the +broadcast protocol, the risk of conflict is obvious, and we see this +happen when we use network identities larger than 2^13-1. This has +escaped our testing because we have so far only been using small network +id values. + +We now move this field to bits 0-2 in word 9, a field that is guaranteed +to be unused by all involved protocols. + +Fixes: e3eea1eb47a ("tipc: clean up handling of message priorities") +Signed-off-by: Jon Maloy +Acked-by: Ying Xue +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/tipc/msg.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/tipc/msg.h ++++ b/net/tipc/msg.h +@@ -357,7 +357,7 @@ static inline u32 msg_importance(struct + if (likely((usr <= TIPC_CRITICAL_IMPORTANCE) && !msg_errcode(m))) + return usr; + if ((usr == MSG_FRAGMENTER) || (usr == MSG_BUNDLER)) +- return msg_bits(m, 5, 13, 0x7); ++ return msg_bits(m, 9, 0, 0x7); + return TIPC_SYSTEM_IMPORTANCE; + } + +@@ -366,7 +366,7 @@ static inline void msg_set_importance(st + int usr = msg_user(m); + + if (likely((usr == MSG_FRAGMENTER) || (usr == MSG_BUNDLER))) +- msg_set_bits(m, 5, 13, 0x7, i); ++ msg_set_bits(m, 9, 0, 0x7, i); + else if (i < TIPC_SYSTEM_IMPORTANCE) + msg_set_user(m, i); + else diff --git a/kernel/kernel/files/patches/mageia/stable-workqueue-make-sure-delayed-work-run-in-local-cpu.patch b/kernel/kernel/files/patches/mageia/stable-workqueue-make-sure-delayed-work-run-in-local-cpu.patch new file mode 100644 index 00000000..c8324073 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-workqueue-make-sure-delayed-work-run-in-local-cpu.patch @@ -0,0 +1,78 @@ +From 874bbfe600a660cba9c776b3957b1ce393151b76 Mon Sep 17 00:00:00 2001 +From: Shaohua Li +Date: Wed, 30 Sep 2015 09:05:30 -0700 +Subject: workqueue: make sure delayed work run in local cpu + +From: Shaohua Li + +commit 874bbfe600a660cba9c776b3957b1ce393151b76 upstream. + +My system keeps crashing with below message. vmstat_update() schedules a delayed +work in current cpu and expects the work runs in the cpu. +schedule_delayed_work() is expected to make delayed work run in local cpu. The +problem is timer can be migrated with NO_HZ. __queue_work() queues work in +timer handler, which could run in a different cpu other than where the delayed +work is scheduled. The end result is the delayed work runs in different cpu. +The patch makes __queue_delayed_work records local cpu earlier. Where the timer +runs doesn't change where the work runs with the change. + +[ 28.010131] ------------[ cut here ]------------ +[ 28.010609] kernel BUG at ../mm/vmstat.c:1392! +[ 28.011099] invalid opcode: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC KASAN +[ 28.011860] Modules linked in: +[ 28.012245] CPU: 0 PID: 289 Comm: kworker/0:3 Tainted: G W4.3.0-rc3+ #634 +[ 28.013065] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140709_153802- 04/01/2014 +[ 28.014160] Workqueue: events vmstat_update +[ 28.014571] task: ffff880117682580 ti: ffff8800ba428000 task.ti: ffff8800ba428000 +[ 28.015445] RIP: 0010:[] []vmstat_update+0x31/0x80 +[ 28.016282] RSP: 0018:ffff8800ba42fd80 EFLAGS: 00010297 +[ 28.016812] RAX: 0000000000000000 RBX: ffff88011a858dc0 RCX:0000000000000000 +[ 28.017585] RDX: ffff880117682580 RSI: ffffffff81f14d8c RDI:ffffffff81f4df8d +[ 28.018366] RBP: ffff8800ba42fd90 R08: 0000000000000001 R09:0000000000000000 +[ 28.019169] R10: 0000000000000000 R11: 0000000000000121 R12:ffff8800baa9f640 +[ 28.019947] R13: ffff88011a81e340 R14: ffff88011a823700 R15:0000000000000000 +[ 28.020071] FS: 0000000000000000(0000) GS:ffff88011a800000(0000)knlGS:0000000000000000 +[ 28.020071] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b +[ 28.020071] CR2: 00007ff6144b01d0 CR3: 00000000b8e93000 CR4:00000000000006f0 +[ 28.020071] Stack: +[ 28.020071] ffff88011a858dc0 ffff8800baa9f640 ffff8800ba42fe00ffffffff8106bd88 +[ 28.020071] ffffffff8106bd0b 0000000000000096 0000000000000000ffffffff82f9b1e8 +[ 28.020071] ffffffff829f0b10 0000000000000000 ffffffff81f18460ffff88011a81e340 +[ 28.020071] Call Trace: +[ 28.020071] [] process_one_work+0x1c8/0x540 +[ 28.020071] [] ? process_one_work+0x14b/0x540 +[ 28.020071] [] worker_thread+0x114/0x460 +[ 28.020071] [] ? process_one_work+0x540/0x540 +[ 28.020071] [] kthread+0xf8/0x110 +[ 28.020071] [] ?kthread_create_on_node+0x200/0x200 +[ 28.020071] [] ret_from_fork+0x3f/0x70 +[ 28.020071] [] ?kthread_create_on_node+0x200/0x200 + +Signed-off-by: Shaohua Li +Signed-off-by: Tejun Heo +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/workqueue.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/kernel/workqueue.c ++++ b/kernel/workqueue.c +@@ -1458,13 +1458,13 @@ static void __queue_delayed_work(int cpu + timer_stats_timer_set_start_info(&dwork->timer); + + dwork->wq = wq; ++ /* timer isn't guaranteed to run in this cpu, record earlier */ ++ if (cpu == WORK_CPU_UNBOUND) ++ cpu = raw_smp_processor_id(); + dwork->cpu = cpu; + timer->expires = jiffies + delay; + +- if (unlikely(cpu != WORK_CPU_UNBOUND)) +- add_timer_on(timer, cpu); +- else +- add_timer(timer); ++ add_timer_on(timer, cpu); + } + + /** diff --git a/kernel/kernel/files/patches/mageia/usb-phy-phy-generic-Fix-reset-behaviour-on-legacy-bo.patch b/kernel/kernel/files/patches/mageia/usb-phy-phy-generic-Fix-reset-behaviour-on-legacy-bo.patch deleted file mode 100644 index dd02c4a4..00000000 --- a/kernel/kernel/files/patches/mageia/usb-phy-phy-generic-Fix-reset-behaviour-on-legacy-bo.patch +++ /dev/null @@ -1,38 +0,0 @@ -From 762982db33b23029e98c844611e2e8beeb75bc0d Mon Sep 17 00:00:00 2001 -From: Roger Quadros -Date: Thu, 13 Aug 2015 13:28:42 +0300 -Subject: [PATCH] usb: phy: phy-generic: Fix reset behaviour on legacy boot - -The gpio-desc migration done in v4.0 caused a regression -with legacy boots due to reversed reset logic. -e.g. omap3-beagle USB host breaks on legacy boot. - -Request the reset GPIO with GPIOF_ACTIVE_LOW flag so that -it matches the driver logic and pin behaviour. - -Fixes: e9f2cefb0cdc ("usb: phy: generic: migrate to gpio_desc") -Cc: # 4.0+ -Tested-by: Fabio Estevam -Signed-off-by: Roger Quadros -Signed-off-by: Felipe Balbi ---- - drivers/usb/phy/phy-generic.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/drivers/usb/phy/phy-generic.c b/drivers/usb/phy/phy-generic.c -index ec6ecd0..5320cb8 100644 ---- a/drivers/usb/phy/phy-generic.c -+++ b/drivers/usb/phy/phy-generic.c -@@ -232,7 +232,8 @@ int usb_phy_gen_create_phy(struct device *dev, struct usb_phy_generic *nop, - clk_rate = pdata->clk_rate; - needs_vcc = pdata->needs_vcc; - if (gpio_is_valid(pdata->gpio_reset)) { -- err = devm_gpio_request_one(dev, pdata->gpio_reset, 0, -+ err = devm_gpio_request_one(dev, pdata->gpio_reset, -+ GPIOF_ACTIVE_LOW, - dev_name(dev)); - if (!err) - nop->gpiod_reset = --- -2.6.0 - diff --git a/kernel/kernel/files/patches/mageia/usb-xhci-change-xhci-1.0-only-restrictions-to-support-xh.patch b/kernel/kernel/files/patches/mageia/usb-xhci-change-xhci-1.0-only-restrictions-to-support-xh.patch deleted file mode 100644 index 796b4dae..00000000 --- a/kernel/kernel/files/patches/mageia/usb-xhci-change-xhci-1.0-only-restrictions-to-support-xh.patch +++ /dev/null @@ -1,56 +0,0 @@ -From dca7794539eff04b786fb6907186989e5eaaa9c2 Mon Sep 17 00:00:00 2001 -From: Mathias Nyman -Date: Mon, 21 Sep 2015 17:46:16 +0300 -Subject: [PATCH] xhci: change xhci 1.0 only restrictions to support xhci 1.1 - -Some changes between xhci 0.96 and xhci 1.0 specifications forced us to -check the hci version in code, some of these checks were implemented as -hci_version == 1.0, which will not work with new xhci 1.1 controllers. - -xhci 1.1 behaves similar to xhci 1.0 in these cases, so change these -checks to hci_version >= 1.0 - -Cc: -Signed-off-by: Mathias Nyman -Signed-off-by: Greg Kroah-Hartman ---- - drivers/usb/host/xhci-mem.c | 6 +++--- - drivers/usb/host/xhci-ring.c | 4 ++-- - 2 files changed, 5 insertions(+), 5 deletions(-) - -diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c -index 9a8c936..8497fb8 100644 ---- a/drivers/usb/host/xhci-mem.c -+++ b/drivers/usb/host/xhci-mem.c -@@ -1498,10 +1498,10 @@ int xhci_endpoint_init(struct xhci_hcd *xhci, - * use Event Data TRBs, and we don't chain in a link TRB on short - * transfers, we're basically dividing by 1. - * -- * xHCI 1.0 specification indicates that the Average TRB Length should -- * be set to 8 for control endpoints. -+ * xHCI 1.0 and 1.1 specification indicates that the Average TRB Length -+ * should be set to 8 for control endpoints. - */ -- if (usb_endpoint_xfer_control(&ep->desc) && xhci->hci_version == 0x100) -+ if (usb_endpoint_xfer_control(&ep->desc) && xhci->hci_version >= 0x100) - ep_ctx->tx_info |= cpu_to_le32(AVG_TRB_LENGTH_FOR_EP(8)); - else - ep_ctx->tx_info |= -diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c -index 1c61e5e..43291f9 100644 ---- a/drivers/usb/host/xhci-ring.c -+++ b/drivers/usb/host/xhci-ring.c -@@ -3470,8 +3470,8 @@ int xhci_queue_ctrl_tx(struct xhci_hcd *xhci, gfp_t mem_flags, - if (start_cycle == 0) - field |= 0x1; - -- /* xHCI 1.0 6.4.1.2.1: Transfer Type field */ -- if (xhci->hci_version == 0x100) { -+ /* xHCI 1.0/1.1 6.4.1.2.1: Transfer Type field */ -+ if (xhci->hci_version >= 0x100) { - if (urb->transfer_buffer_length > 0) { - if (setup->bRequestType & USB_DIR_IN) - field |= TRB_TX_TYPE(TRB_DATA_IN); --- -2.6.0 - diff --git a/kernel/kernel/files/patches/mageia/x86-efi-Fix-boot-crash-by-mapping-EFI-memmap-entries.patch b/kernel/kernel/files/patches/mageia/x86-efi-Fix-boot-crash-by-mapping-EFI-memmap-entries.patch deleted file mode 100644 index a79001a1..00000000 --- a/kernel/kernel/files/patches/mageia/x86-efi-Fix-boot-crash-by-mapping-EFI-memmap-entries.patch +++ /dev/null @@ -1,174 +0,0 @@ -From a5caa209ba9c29c6421292e7879d2387a2ef39c9 Mon Sep 17 00:00:00 2001 -From: Matt Fleming -Date: Fri, 25 Sep 2015 23:02:18 +0100 -Subject: [PATCH] x86/efi: Fix boot crash by mapping EFI memmap entries - bottom-up at runtime, instead of top-down - -Beginning with UEFI v2.5 EFI_PROPERTIES_TABLE was introduced -that signals that the firmware PE/COFF loader supports splitting -code and data sections of PE/COFF images into separate EFI -memory map entries. This allows the kernel to map those regions -with strict memory protections, e.g. EFI_MEMORY_RO for code, -EFI_MEMORY_XP for data, etc. - -Unfortunately, an unwritten requirement of this new feature is -that the regions need to be mapped with the same offsets -relative to each other as observed in the EFI memory map. If -this is not done crashes like this may occur, - - BUG: unable to handle kernel paging request at fffffffefe6086dd - IP: [] 0xfffffffefe6086dd - Call Trace: - [] efi_call+0x7e/0x100 - [] ? virt_efi_set_variable+0x61/0x90 - [] efi_delete_dummy_variable+0x63/0x70 - [] efi_enter_virtual_mode+0x383/0x392 - [] start_kernel+0x38a/0x417 - [] x86_64_start_reservations+0x2a/0x2c - [] x86_64_start_kernel+0xeb/0xef - -Here 0xfffffffefe6086dd refers to an address the firmware -expects to be mapped but which the OS never claimed was mapped. -The issue is that included in these regions are relative -addresses to other regions which were emitted by the firmware -toolchain before the "splitting" of sections occurred at -runtime. - -Needless to say, we don't satisfy this unwritten requirement on -x86_64 and instead map the EFI memory map entries in reverse -order. The above crash is almost certainly triggerable with any -kernel newer than v3.13 because that's when we rewrote the EFI -runtime region mapping code, in commit d2f7cbe7b26a ("x86/efi: -Runtime services virtual mapping"). For kernel versions before -v3.13 things may work by pure luck depending on the -fragmentation of the kernel virtual address space at the time we -map the EFI regions. - -Instead of mapping the EFI memory map entries in reverse order, -where entry N has a higher virtual address than entry N+1, map -them in the same order as they appear in the EFI memory map to -preserve this relative offset between regions. - -This patch has been kept as small as possible with the intention -that it should be applied aggressively to stable and -distribution kernels. It is very much a bugfix rather than -support for a new feature, since when EFI_PROPERTIES_TABLE is -enabled we must map things as outlined above to even boot - we -have no way of asking the firmware not to split the code/data -regions. - -In fact, this patch doesn't even make use of the more strict -memory protections available in UEFI v2.5. That will come later. - -Suggested-by: Ard Biesheuvel -Reported-by: Ard Biesheuvel -Signed-off-by: Matt Fleming -Cc: -Cc: Borislav Petkov -Cc: Chun-Yi -Cc: Dave Young -Cc: H. Peter Anvin -Cc: James Bottomley -Cc: Lee, Chun-Yi -Cc: Leif Lindholm -Cc: Linus Torvalds -Cc: Matthew Garrett -Cc: Mike Galbraith -Cc: Peter Jones -Cc: Peter Zijlstra -Cc: Thomas Gleixner -Cc: linux-kernel@vger.kernel.org -Link: http://lkml.kernel.org/r/1443218539-7610-2-git-send-email-matt@codeblueprint.co.uk -Signed-off-by: Ingo Molnar ---- - arch/x86/platform/efi/efi.c | 67 ++++++++++++++++++++++++++++++++++++++++++++- - 1 file changed, 66 insertions(+), 1 deletion(-) - -diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c -index 1db84c0..6a28ded 100644 ---- a/arch/x86/platform/efi/efi.c -+++ b/arch/x86/platform/efi/efi.c -@@ -705,6 +705,70 @@ out: - } - - /* -+ * Iterate the EFI memory map in reverse order because the regions -+ * will be mapped top-down. The end result is the same as if we had -+ * mapped things forward, but doesn't require us to change the -+ * existing implementation of efi_map_region(). -+ */ -+static inline void *efi_map_next_entry_reverse(void *entry) -+{ -+ /* Initial call */ -+ if (!entry) -+ return memmap.map_end - memmap.desc_size; -+ -+ entry -= memmap.desc_size; -+ if (entry < memmap.map) -+ return NULL; -+ -+ return entry; -+} -+ -+/* -+ * efi_map_next_entry - Return the next EFI memory map descriptor -+ * @entry: Previous EFI memory map descriptor -+ * -+ * This is a helper function to iterate over the EFI memory map, which -+ * we do in different orders depending on the current configuration. -+ * -+ * To begin traversing the memory map @entry must be %NULL. -+ * -+ * Returns %NULL when we reach the end of the memory map. -+ */ -+static void *efi_map_next_entry(void *entry) -+{ -+ if (!efi_enabled(EFI_OLD_MEMMAP) && efi_enabled(EFI_64BIT)) { -+ /* -+ * Starting in UEFI v2.5 the EFI_PROPERTIES_TABLE -+ * config table feature requires us to map all entries -+ * in the same order as they appear in the EFI memory -+ * map. That is to say, entry N must have a lower -+ * virtual address than entry N+1. This is because the -+ * firmware toolchain leaves relative references in -+ * the code/data sections, which are split and become -+ * separate EFI memory regions. Mapping things -+ * out-of-order leads to the firmware accessing -+ * unmapped addresses. -+ * -+ * Since we need to map things this way whether or not -+ * the kernel actually makes use of -+ * EFI_PROPERTIES_TABLE, let's just switch to this -+ * scheme by default for 64-bit. -+ */ -+ return efi_map_next_entry_reverse(entry); -+ } -+ -+ /* Initial call */ -+ if (!entry) -+ return memmap.map; -+ -+ entry += memmap.desc_size; -+ if (entry >= memmap.map_end) -+ return NULL; -+ -+ return entry; -+} -+ -+/* - * Map the efi memory ranges of the runtime services and update new_mmap with - * virtual addresses. - */ -@@ -714,7 +778,8 @@ static void * __init efi_map_regions(int *count, int *pg_shift) - unsigned long left = 0; - efi_memory_desc_t *md; - -- for (p = memmap.map; p < memmap.map_end; p += memmap.desc_size) { -+ p = NULL; -+ while ((p = efi_map_next_entry(p))) { - md = p; - if (!(md->attribute & EFI_MEMORY_RUNTIME)) { - #ifdef CONFIG_X86_64 --- -2.6.0 - diff --git a/kernel/kernel/files/patches/mageia/x86-efi-Fix-multiple-GOP-device-support.patch b/kernel/kernel/files/patches/mageia/x86-efi-Fix-multiple-GOP-device-support.patch new file mode 100644 index 00000000..496144c3 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/x86-efi-Fix-multiple-GOP-device-support.patch @@ -0,0 +1,92 @@ +From 8a53554e12e98d1759205afd7b8e9e2ea0936f48 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?K=C5=91v=C3=A1g=C3=B3=2C=20Zolt=C3=A1n?= + +Date: Mon, 12 Oct 2015 15:13:56 +0100 +Subject: [PATCH] x86/efi: Fix multiple GOP device support +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +When multiple GOP devices exists, but none of them implements +ConOut, the code should just choose the first GOP (according to +the comments). But currently 'fb_base' will refer to the last GOP, +while other parameters to the first GOP, which will likely +result in a garbled display. + +I can reliably reproduce this bug using my ASRock Z87M Extreme4 +motherboard with CSM and integrated GPU disabled, and two PCIe +video cards (NVidia GT640 and GTX980), booting from efi-stub +(booting from grub works fine). On the primary display the +ASRock logo remains and on the secondary screen it is garbled +up completely. + +Signed-off-by: Kővágó, Zoltán +Signed-off-by: Matt Fleming +Cc: +Cc: Linus Torvalds +Cc: Matthew Garrett +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Link: http://lkml.kernel.org/r/1444659236-24837-2-git-send-email-matt@codeblueprint.co.uk +Signed-off-by: Ingo Molnar +--- + arch/x86/boot/compressed/eboot.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c +index ee1b6d3..db51c1f 100644 +--- a/arch/x86/boot/compressed/eboot.c ++++ b/arch/x86/boot/compressed/eboot.c +@@ -667,6 +667,7 @@ setup_gop32(struct screen_info *si, efi_guid_t *proto, + bool conout_found = false; + void *dummy = NULL; + u32 h = handles[i]; ++ u32 current_fb_base; + + status = efi_call_early(handle_protocol, h, + proto, (void **)&gop32); +@@ -678,7 +679,7 @@ setup_gop32(struct screen_info *si, efi_guid_t *proto, + if (status == EFI_SUCCESS) + conout_found = true; + +- status = __gop_query32(gop32, &info, &size, &fb_base); ++ status = __gop_query32(gop32, &info, &size, ¤t_fb_base); + if (status == EFI_SUCCESS && (!first_gop || conout_found)) { + /* + * Systems that use the UEFI Console Splitter may +@@ -692,6 +693,7 @@ setup_gop32(struct screen_info *si, efi_guid_t *proto, + pixel_format = info->pixel_format; + pixel_info = info->pixel_information; + pixels_per_scan_line = info->pixels_per_scan_line; ++ fb_base = current_fb_base; + + /* + * Once we've found a GOP supporting ConOut, +@@ -770,6 +772,7 @@ setup_gop64(struct screen_info *si, efi_guid_t *proto, + bool conout_found = false; + void *dummy = NULL; + u64 h = handles[i]; ++ u32 current_fb_base; + + status = efi_call_early(handle_protocol, h, + proto, (void **)&gop64); +@@ -781,7 +784,7 @@ setup_gop64(struct screen_info *si, efi_guid_t *proto, + if (status == EFI_SUCCESS) + conout_found = true; + +- status = __gop_query64(gop64, &info, &size, &fb_base); ++ status = __gop_query64(gop64, &info, &size, ¤t_fb_base); + if (status == EFI_SUCCESS && (!first_gop || conout_found)) { + /* + * Systems that use the UEFI Console Splitter may +@@ -795,6 +798,7 @@ setup_gop64(struct screen_info *si, efi_guid_t *proto, + pixel_format = info->pixel_format; + pixel_info = info->pixel_information; + pixels_per_scan_line = info->pixels_per_scan_line; ++ fb_base = current_fb_base; + + /* + * Once we've found a GOP supporting ConOut, +-- +2.6.2 + diff --git a/kernel/kernel/pspec.xml b/kernel/kernel/pspec.xml index 05db5206..074c18b0 100644 --- a/kernel/kernel/pspec.xml +++ b/kernel/kernel/pspec.xml @@ -28,15 +28,14 @@ - patches/linux/patch-4.2.3.xz - + patches/linux/patch-4.2.4.xz + patches/mageia/x86-pci-toshiba-equium-a60-assign-busses.patch patches/mageia/x86-boot-video-80x25-if-break.patch patches/mageia/x86-default_poweroff_up_machines.patch patches/mageia/x86-increase-default-minimum-vmalloc-area-by-64MB-to-192MB.patch patches/mageia/Revert-cpufreq-pcc-Enable-autoload-of-pcc-cpufreq-fo.patch - patches/mageia/x86-efi-Fix-boot-crash-by-mapping-EFI-memmap-entries.patch - patches/mageia/cpu-cacheinfo-Fix-teardown-path.patch + patches/mageia/x86-efi-Fix-multiple-GOP-device-support.patch patches/mageia/pci-add-ALI-M5229-ide-compatibility-mode-quirk.patch patches/mageia/pci-quirks-drop-devinit-exit.patch patches/mageia/acpi-CLEVO-M360S-disable_acpi_irq.patch @@ -56,8 +55,7 @@ patches/mageia/block-Make-CFQ-default-to-IOPS-mode-on-SSDs.patch patches/mageia/fs-aufs4.patch patches/mageia/fs-aufs4-modular.patch - patches/mageia/fs-dcache-Handle-escaped-paths-in-prepend_path.patch - patches/mageia/fs-vfs-Test-for-and-handle-paths-that-are-unreachable-from-their-mnt_root.patch + patches/mageia/firewire-ieee1394-module-aliases.patch patches/mageia/char-agp-intel-new-Q57-id.patch patches/mageia/gpu-drm-mach64.patch @@ -73,11 +71,12 @@ patches/mageia/gpu-drm-mach64-3.6-buildfix.patch patches/mageia/gpu-drm-mach64-3.7-buildfix.patch patches/mageia/gpu-drm-mach64-3.12-buildfix.patch - patches/mageia/gpu-drm-mach64-restore-mach64_PCI_IDS.patch + patches/mageia/gpu-drm-mach64-restore-mach64_PCI_IDS.patch patches/mageia/gpu-drm-mach64-linux-3.14-buildfix.patch patches/mageia/gpu-drm-mach64-3.17-buildfix.patch patches/mageia/gpu-drm-mach64-3.18-buildfix.patch patches/mageia/input-i8042-quirks-for-Fujitsu-Lifebook-A544-and-Lif.patch + patches/mageia/input-alps-Only-the-Dell-Latitude-D420_430_620_630-have-separate-stick-button-bits.patch patches/mageia/net-sis190-fix-list-usage.patch patches/mageia/net-netfilter-IFWLOG.patch patches/mageia/net-netfilter-IFWLOG-mdv.patch @@ -87,14 +86,9 @@ patches/mageia/net-netfilter-IFWLOG-3.7-buildfix.patch patches/mageia/net-netfilter-psd.patch patches/mageia/net-netfilter-psd-mdv.patch - patches/mageia/net-netfilter-psd-2.6.35-buildfix.patch - patches/mageia/net-netfilter-conntrack-use-nf_ct_tmpl_free-in-CT-synpro.patch - patches/mageia/net-netfilter-nfnetlink-work-around-wrong-endianess-in-r.patch - patches/mageia/net-netfilter-bridge-fix-IPv6-packets-not-being-bridged-.patch - patches/mageia/net-netfilter-nf_tables-Use-32-bit-addressing-register-f.patch - patches/mageia/net-netfilter-ipset-Out-of-bound-access-in-hash-net-type.patch - patches/mageia/net-netfilter-ipset-Fixing-unnamed-union-init.patch - patches/mageia/net-wireless-rtlwifi-rtl8821ae-Fix-system-lockups-on-boot.patch + patches/mageia/net-netfilter-psd-2.6.35-buildfix.patch + patches/mageia/net-wireless-rtlwifi-rtl8821ae-Fix-system-lockups-on-boot.patch + patches/mageia/net-wireless-iwlwifi-fix-firmware-filename-for-3160.patch patches/mageia/platform-x86-add-shuttle-wmi-driver.patch patches/mageia/platform-x86-shuttle-wmi-drop-devinit-exit.patch patches/mageia/platform-x86-shuttle-wmi-4.2-buildfix.patch @@ -103,8 +97,6 @@ patches/mageia/hid-usbhid-IBM-BladeCenterHS20-quirk.patch patches/mageia/usb-storage-unusual_devs-add-id.patch patches/mageia/usb-storage-unusual_devs-add-id-2.6.37-buildfix.patch - patches/mageia/usb-phy-phy-generic-Fix-reset-behaviour-on-legacy-bo.patch - patches/mageia/usb-xhci-change-xhci-1.0-only-restrictions-to-support-xh.patch patches/mageia/media-usb-pwc-lie-in-proc-usb-devices.patch patches/mageia/3rd-3rdparty-1.0-tree.patch patches/mageia/3rd-3rdparty-merge.patch @@ -191,7 +183,15 @@ - + + + 2015-11-26 + 4.2.4 + Version bump to 4.2.4 https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.2.4 + security + Ertuğrul Erata + ertugrulerata@gmail.com + 2015-10-04 4.2.3 diff --git a/kernel/tools/cpupowertools/files/patches/linux/patch-4.2.4.xz b/kernel/tools/cpupowertools/files/patches/linux/patch-4.2.4.xz new file mode 100644 index 00000000..03a7b891 Binary files /dev/null and b/kernel/tools/cpupowertools/files/patches/linux/patch-4.2.4.xz differ diff --git a/kernel/tools/cpupowertools/pspec.xml b/kernel/tools/cpupowertools/pspec.xml index c15ae128..34c7fb8b 100644 --- a/kernel/tools/cpupowertools/pspec.xml +++ b/kernel/tools/cpupowertools/pspec.xml @@ -18,7 +18,7 @@ - patches/linux/patch-4.2.3.xz + patches/linux/patch-4.2.4.xz @@ -44,6 +44,13 @@ --> + + 2015-11-26 + 4.2.4 + Version bump. + Ertuğrul Erata + ertugrulerata@gmail.com + 2015-10-05 4.2.3 diff --git a/pisi-index.xml b/pisi-index.xml index 06ec26a2..6d1ef821 100644 --- a/pisi-index.xml +++ b/pisi-index.xml @@ -567,14 +567,13 @@ xmlto - patches/linux/patch-4.2.3.xz + patches/linux/patch-4.2.4.xz patches/mageia/x86-pci-toshiba-equium-a60-assign-busses.patch patches/mageia/x86-boot-video-80x25-if-break.patch patches/mageia/x86-default_poweroff_up_machines.patch patches/mageia/x86-increase-default-minimum-vmalloc-area-by-64MB-to-192MB.patch patches/mageia/Revert-cpufreq-pcc-Enable-autoload-of-pcc-cpufreq-fo.patch - patches/mageia/x86-efi-Fix-boot-crash-by-mapping-EFI-memmap-entries.patch - patches/mageia/cpu-cacheinfo-Fix-teardown-path.patch + patches/mageia/x86-efi-Fix-multiple-GOP-device-support.patch patches/mageia/pci-add-ALI-M5229-ide-compatibility-mode-quirk.patch patches/mageia/pci-quirks-drop-devinit-exit.patch patches/mageia/acpi-CLEVO-M360S-disable_acpi_irq.patch @@ -588,8 +587,6 @@ patches/mageia/block-Make-CFQ-default-to-IOPS-mode-on-SSDs.patch patches/mageia/fs-aufs4.patch patches/mageia/fs-aufs4-modular.patch - patches/mageia/fs-dcache-Handle-escaped-paths-in-prepend_path.patch - patches/mageia/fs-vfs-Test-for-and-handle-paths-that-are-unreachable-from-their-mnt_root.patch patches/mageia/firewire-ieee1394-module-aliases.patch patches/mageia/char-agp-intel-new-Q57-id.patch patches/mageia/gpu-drm-mach64.patch @@ -610,6 +607,7 @@ patches/mageia/gpu-drm-mach64-3.17-buildfix.patch patches/mageia/gpu-drm-mach64-3.18-buildfix.patch patches/mageia/input-i8042-quirks-for-Fujitsu-Lifebook-A544-and-Lif.patch + patches/mageia/input-alps-Only-the-Dell-Latitude-D420_430_620_630-have-separate-stick-button-bits.patch patches/mageia/net-sis190-fix-list-usage.patch patches/mageia/net-netfilter-IFWLOG.patch patches/mageia/net-netfilter-IFWLOG-mdv.patch @@ -620,13 +618,8 @@ patches/mageia/net-netfilter-psd.patch patches/mageia/net-netfilter-psd-mdv.patch patches/mageia/net-netfilter-psd-2.6.35-buildfix.patch - patches/mageia/net-netfilter-conntrack-use-nf_ct_tmpl_free-in-CT-synpro.patch - patches/mageia/net-netfilter-nfnetlink-work-around-wrong-endianess-in-r.patch - patches/mageia/net-netfilter-bridge-fix-IPv6-packets-not-being-bridged-.patch - patches/mageia/net-netfilter-nf_tables-Use-32-bit-addressing-register-f.patch - patches/mageia/net-netfilter-ipset-Out-of-bound-access-in-hash-net-type.patch - patches/mageia/net-netfilter-ipset-Fixing-unnamed-union-init.patch patches/mageia/net-wireless-rtlwifi-rtl8821ae-Fix-system-lockups-on-boot.patch + patches/mageia/net-wireless-iwlwifi-fix-firmware-filename-for-3160.patch patches/mageia/platform-x86-add-shuttle-wmi-driver.patch patches/mageia/platform-x86-shuttle-wmi-drop-devinit-exit.patch patches/mageia/platform-x86-shuttle-wmi-4.2-buildfix.patch @@ -635,8 +628,6 @@ patches/mageia/hid-usbhid-IBM-BladeCenterHS20-quirk.patch patches/mageia/usb-storage-unusual_devs-add-id.patch patches/mageia/usb-storage-unusual_devs-add-id-2.6.37-buildfix.patch - patches/mageia/usb-phy-phy-generic-Fix-reset-behaviour-on-legacy-bo.patch - patches/mageia/usb-xhci-change-xhci-1.0-only-restrictions-to-support-xh.patch patches/mageia/media-usb-pwc-lie-in-proc-usb-devices.patch patches/mageia/3rd-3rdparty-1.0-tree.patch patches/mageia/3rd-3rdparty-merge.patch @@ -725,6 +716,14 @@ + + security + 2015-11-26 + 4.2.4 + Version bump to 4.2.4 https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.2.4 + Ertuğrul Erata + ertugrulerata@gmail.com + security 2015-10-04 @@ -1498,7 +1497,7 @@ pciutils-devel - patches/linux/patch-4.2.3.xz + patches/linux/patch-4.2.4.xz kernel/tools/cpupowertools/pspec.xml @@ -1521,6 +1520,13 @@ + + 2015-11-26 + 4.2.4 + Version bump. + Ertuğrul Erata + ertugrulerata@gmail.com + 2015-10-05 4.2.3 @@ -2149,9 +2155,9 @@ kernel.drivers Kernel modules for VirtualBox This package provides the kernel support for VirtualBox. - http://source.pisilinux.org/1.0/module-virtualbox-4.3.28.tar.xz + http://sourceforge.net/projects/pisilinux/files/source/module-virtualbox-5.0.4.tar.xz - kernel-module-headers + kernel-module-headers kernel/drivers/module-virtualbox/pspec.xml @@ -2161,8 +2167,8 @@ noDelta - kernel - module-virtualbox-userspace + kernel + module-virtualbox-userspace /lib/modules @@ -2183,6 +2189,13 @@ + + 2015-11-26 + 5.0.4 + Version bump. + Ertuğrul Erata + ertugrulerata@gmail.com + 2015-10-05 4.3.28 @@ -2602,7 +2615,7 @@ kernel-4.2.patch - kernel-module-headers + kernel-module-headers support_kernel-4.0.patch @@ -2615,7 +2628,7 @@ noDelta - kernel + kernel /lib/modules @@ -2627,6 +2640,13 @@ + + 2014-11-26 + 1.59 + Rebuild for kernel-4.2.4. + PisiLinux Community + admins@pisilinux.org + 2014-10-05 1.59 @@ -2681,14 +2701,14 @@ Eski ve yeni optimus teknolojisine sahip dizüstü bilgisyarlarda çalışabilmektedir. https://github.com/Bumblebee-Project/bbswitch/archive/v0.8.tar.gz - kernel-module-headers + kernel-module-headers kernel/drivers/module-bbswitch/pspec.xml module-bbswitch - kernel + kernel /lib/modules @@ -2701,6 +2721,13 @@ + + 2015-11-26 + 0.8 + Rebuild for kernel-4.2.4. + Ertuğrul Erata + ertugrulerata@gmail.com + 2015-10-05 0.8 @@ -2942,9 +2969,9 @@ VirtualBox misafir makineleri için çekirdek modülleri This package provides the kernel modules needed for mouse integration and shared folder support between VirtualBox host and guest systems. Bu paket VirtualBox sunucu makinesi ile misafir sistemler arası fare entegrasyonu ve paylaşımlı dizin desteği için gerekli çekirdek modüllerini içerir. - http://source.pisilinux.org/1.0/module-virtualbox-guest-4.3.28.tar.xz + http://sourceforge.net/projects/pisilinux/files/source/module-virtualbox-guest-5.0.4.tar.xz - kernel-module-headers + kernel-module-headers kernel/drivers/module-virtualbox-guest/pspec.xml @@ -2954,9 +2981,9 @@ noDelta - kernel + kernel baselayout - module-virtualbox-guest-userspace + module-virtualbox-guest-userspace /lib/modules @@ -2981,6 +3008,13 @@ + + 2015-11-26 + 5.0.4 + Version bump. + Ertuğrul Erata + ertugrulerata@gmail.com + 2015-10-05 4.3.28 @@ -3372,7 +3406,7 @@ http://www.broadcom.com/docs/linux_sta/hybrid-v35-nodebug-pcoem-6_30_223_248.tar.gz http://www.broadcom.com/docs/linux_sta/hybrid-v35_64-nodebug-pcoem-6_30_223_248.tar.gz - kernel-module-headers + kernel-module-headers patch/linux-40.patch @@ -3391,8 +3425,8 @@ noDelta - kernel - module-broadcom-wl-userspace + kernel + module-broadcom-wl-userspace /lib/modules @@ -3419,6 +3453,13 @@ + + 2015-11-26 + 6.30.223.248 + Rebuild for kernel 4.2.4. + Ertuğrul Erata + ertugrulerata@gmail.com + 2015-10-05 6.30.223.248 @@ -6416,11 +6457,12 @@ Çeşitli kullanışlı Linux araçları The util-linux package contains a large variety of low-level system utilities that are necessary for a Linux system to function. util-linux paketi, bir Linux sisteminin işlevsel olması için gerekli olan birçok düşük seviye sistem uygulamasını içerir. - https://www.kernel.org/pub/linux/utils/util-linux/v2.26/util-linux-2.26.2.tar.xz + https://www.kernel.org/pub/linux/utils/util-linux/v2.27/util-linux-2.27.tar.xz zlib-devel eudev-devel python-devel + readline-devel shadow ncurses-devel libcap-ng-devel @@ -6434,10 +6476,11 @@ util-linux - libutil-linux + libutil-linux zlib perl ncurses + readline eudev libcap-ng @@ -6514,7 +6557,7 @@ header system.devel - libutil-linux + libutil-linux /usr/include/ @@ -6551,6 +6594,13 @@ + + 2015-10-09 + 2.27 + Version bump. + Ertuğrul Erata + ertugrulerata@gmail.com + 2015-06-05 2.26.2 @@ -17450,7 +17500,7 @@ D-Bus fourni à la fois un daemon système (pour les événements els que l'"ajout d'un nouveau périphérique" ou "file d'impression changée") et un daemon propre à chaque session utilisateur (pour les besoins généraux de communication entre processus utilisateurs). De plus, le bus de message est construit en se basant sur un framework (cadre de développement) de passage de message de un-vers-un pouvant être utilisé par n'importe quelles applications pour communiquer directement (sans passer par le daemon de bus de message). Pour l'instant les applications pouvant communiquer doivent être situées sur le même ordinateur, mais l'option TCP/IP est disponible et le support de processus distant est prévu. D-Bus supplies both a system daemon (for events such as "new hardware device added" or "printer queue changed") and a per-user-login-session daemon (for general IPC needs among user applications). Also, the message bus is built on top of a general one-to-one message passing framework, which can be used by any two apps to communicate directly (without going through the message bus daemon). Currently the communicating applications are on one computer, but TCP/IP option is available and remote support planned. D-Bus, sistem ve kullanıcılar için olmak üzere iki tane artalan süreci (daemon) sunar. Mesaj yolu, bire bir mesaj geçiş araçları üzerine inşa edilmiştir. Bu sayede iki program birbiriyle bir mesaj yolu artalan süreci kullanmadan, direkt olarak haberleşebilir. Şu an için haberleşme araçları aynı bilgisayar üzerinde çalışabilmektedir, fakat TCP/IP ile uzaktan haberleşme de planlanmaktadır. - http://dbus.freedesktop.org/releases/dbus/dbus-1.9.14.tar.gz + http://dbus.freedesktop.org/releases/dbus/dbus-1.10.0.tar.gz expat-devel libX11-devel @@ -17501,7 +17551,7 @@ dbus için geliştirme dosyaları system.devel - dbus + dbus /usr/include @@ -17529,6 +17579,13 @@ + + 2015-10-09 + 1.10.0 + Version bump. + Ertuğrul Erata + ertugrulerata@gmail.com + 2015-05-11 1.9.14 diff --git a/pisi-index.xml.sha1sum b/pisi-index.xml.sha1sum index bf2fa422..cc78f596 100644 --- a/pisi-index.xml.sha1sum +++ b/pisi-index.xml.sha1sum @@ -1 +1 @@ -11aa6ec3d10eb18a9ab827073e06651676546851 \ No newline at end of file +84d6793a988e271467840e2a70243171b55a3415 \ No newline at end of file diff --git a/pisi-index.xml.xz b/pisi-index.xml.xz index bced1e5c..25cdaa7f 100644 Binary files a/pisi-index.xml.xz and b/pisi-index.xml.xz differ diff --git a/pisi-index.xml.xz.sha1sum b/pisi-index.xml.xz.sha1sum index ee356b6c..7684baf1 100644 --- a/pisi-index.xml.xz.sha1sum +++ b/pisi-index.xml.xz.sha1sum @@ -1 +1 @@ -c0ce98694b4bbd60e53bd61ecba0c8edc2d66acb \ No newline at end of file +cab71eae42526a9d76d92fd8662339ebbd23ee80 \ No newline at end of file