This commit is contained in:
Jan Alexander Steffens 2018-05-17 06:33:03 +00:00
parent 1b724be6aa
commit 208c34716c
6 changed files with 90 additions and 22 deletions

View File

@ -1,8 +1,8 @@
From dea1110505c920b0f7e0cdd8840448e48ef420fa Mon Sep 17 00:00:00 2001 From 1d8e17daf031e219d904ef93718081534c9e8cea Mon Sep 17 00:00:00 2001
Message-Id: <dea1110505c920b0f7e0cdd8840448e48ef420fa.1525295228.git.jan.steffens@gmail.com> Message-Id: <1d8e17daf031e219d904ef93718081534c9e8cea.1526520263.git.jan.steffens@gmail.com>
From: Serge Hallyn <serge.hallyn@canonical.com> From: Serge Hallyn <serge.hallyn@canonical.com>
Date: Fri, 31 May 2013 19:12:12 +0100 Date: Fri, 31 May 2013 19:12:12 +0100
Subject: [PATCH 1/3] add sysctl to disallow unprivileged CLONE_NEWUSER by Subject: [PATCH 1/4] add sysctl to disallow unprivileged CLONE_NEWUSER by
default default
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com> Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

View File

@ -1,10 +1,10 @@
From 800a7732e3d89f3dac3b10ca6b82868286562331 Mon Sep 17 00:00:00 2001 From 97ed8f58f1e019eca30233ffc6a14e6eddac1a36 Mon Sep 17 00:00:00 2001
Message-Id: <800a7732e3d89f3dac3b10ca6b82868286562331.1525295228.git.jan.steffens@gmail.com> Message-Id: <97ed8f58f1e019eca30233ffc6a14e6eddac1a36.1526520264.git.jan.steffens@gmail.com>
In-Reply-To: <dea1110505c920b0f7e0cdd8840448e48ef420fa.1525295228.git.jan.steffens@gmail.com> In-Reply-To: <1d8e17daf031e219d904ef93718081534c9e8cea.1526520263.git.jan.steffens@gmail.com>
References: <dea1110505c920b0f7e0cdd8840448e48ef420fa.1525295228.git.jan.steffens@gmail.com> References: <1d8e17daf031e219d904ef93718081534c9e8cea.1526520263.git.jan.steffens@gmail.com>
From: Jim Bride <jim.bride@linux.intel.com> From: Jim Bride <jim.bride@linux.intel.com>
Date: Mon, 6 Nov 2017 13:38:57 -0800 Date: Mon, 6 Nov 2017 13:38:57 -0800
Subject: [PATCH 2/3] drm/i915/edp: Only use the alternate fixed mode if it's Subject: [PATCH 2/4] drm/i915/edp: Only use the alternate fixed mode if it's
asked for asked for
In commit dc911f5bd8aa ("drm/i915/edp: Allow alternate fixed mode for In commit dc911f5bd8aa ("drm/i915/edp: Allow alternate fixed mode for
@ -24,7 +24,7 @@ Signed-off-by: Jim Bride <jim.bride@linux.intel.com>
1 file changed, 2 insertions(+), 1 deletion(-) 1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index a29868cd30c7..b6d07b615b12 100644 index 79521da5d11d..837cbaa55a2b 100644
--- a/drivers/gpu/drm/i915/intel_dp.c --- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c +++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -1597,7 +1597,8 @@ static bool intel_edp_compare_alt_mode(struct drm_display_mode *m1, @@ -1597,7 +1597,8 @@ static bool intel_edp_compare_alt_mode(struct drm_display_mode *m1,

View File

@ -1,10 +1,10 @@
From d39f4cf63fe216321bf105e3062cef3ad5250cd3 Mon Sep 17 00:00:00 2001 From a4a45daaacca4c48f4f3840a42cf1c8f385c0e82 Mon Sep 17 00:00:00 2001
Message-Id: <d39f4cf63fe216321bf105e3062cef3ad5250cd3.1525295228.git.jan.steffens@gmail.com> Message-Id: <a4a45daaacca4c48f4f3840a42cf1c8f385c0e82.1526520264.git.jan.steffens@gmail.com>
In-Reply-To: <dea1110505c920b0f7e0cdd8840448e48ef420fa.1525295228.git.jan.steffens@gmail.com> In-Reply-To: <1d8e17daf031e219d904ef93718081534c9e8cea.1526520263.git.jan.steffens@gmail.com>
References: <dea1110505c920b0f7e0cdd8840448e48ef420fa.1525295228.git.jan.steffens@gmail.com> References: <1d8e17daf031e219d904ef93718081534c9e8cea.1526520263.git.jan.steffens@gmail.com>
From: "Jan Alexander Steffens (heftig)" <jan.steffens@gmail.com> From: "Jan Alexander Steffens (heftig)" <jan.steffens@gmail.com>
Date: Fri, 6 Apr 2018 16:19:38 +0200 Date: Fri, 6 Apr 2018 16:19:38 +0200
Subject: [PATCH 3/3] Partially revert "swiotlb: remove various exports" Subject: [PATCH 3/4] Partially revert "swiotlb: remove various exports"
This partially reverts commit 4bd89ed39b2ab8dc4ac4b6c59b07d420b0213bec. This partially reverts commit 4bd89ed39b2ab8dc4ac4b6c59b07d420b0213bec.
The proprietary NVIDIA driver needs one of the exports. The proprietary NVIDIA driver needs one of the exports.
@ -13,7 +13,7 @@ The proprietary NVIDIA driver needs one of the exports.
1 file changed, 1 insertion(+) 1 file changed, 1 insertion(+)
diff --git a/lib/swiotlb.c b/lib/swiotlb.c diff --git a/lib/swiotlb.c b/lib/swiotlb.c
index 44f7eb408fdb..0bb1bb65ad6b 100644 index dc81f16b9095..1c0a8699f8b9 100644
--- a/lib/swiotlb.c --- a/lib/swiotlb.c
+++ b/lib/swiotlb.c +++ b/lib/swiotlb.c
@@ -1016,6 +1016,7 @@ swiotlb_map_sg_attrs(struct device *hwdev, struct scatterlist *sgl, int nelems, @@ -1016,6 +1016,7 @@ swiotlb_map_sg_attrs(struct device *hwdev, struct scatterlist *sgl, int nelems,

View File

@ -0,0 +1,63 @@
From 005c2f4576d9bab5ff97dac4b3d27aafa2f1f153 Mon Sep 17 00:00:00 2001
Message-Id: <005c2f4576d9bab5ff97dac4b3d27aafa2f1f153.1526520264.git.jan.steffens@gmail.com>
In-Reply-To: <1d8e17daf031e219d904ef93718081534c9e8cea.1526520263.git.jan.steffens@gmail.com>
References: <1d8e17daf031e219d904ef93718081534c9e8cea.1526520263.git.jan.steffens@gmail.com>
From: Mathias Nyman <mathias.nyman@linux.intel.com>
Date: Mon, 14 May 2018 11:57:23 +0300
Subject: [PATCH 4/4] xhci: Fix USB3 NULL pointer dereference at logical
disconnect.
Hub driver will try to disable a USB3 device twice at logical disconnect,
racing with xhci_free_dev() callback from the first port disable.
This can be triggered with "udisksctl power-off --block-device <disk>"
or by writing "1" to the "remove" sysfs file for a USB3 device
in 4.17-rc4.
USB3 devices don't have a similar disabled link state as USB2 devices,
and use a U3 suspended link state instead. In this state the port
is still enabled and connected.
hub_port_connect() first disconnects the device, then later it notices
that device is still enabled (due to U3 states) it will try to disable
the port again (set to U3).
The xhci_free_dev() called during device disable is async, so checking
for existing xhci->devs[i] when setting link state to U3 the second time
was successful, even if device was being freed.
The regression was caused by, and whole thing revealed by,
Commit 44a182b9d177 ("xhci: Fix use-after-free in xhci_free_virt_device")
which sets xhci->devs[i]->udev to NULL before xhci_virt_dev() returned.
and causes a NULL pointer dereference the second time we try to set U3.
Fix this by checking xhci->devs[i]->udev exists before setting link state.
The original patch went to stable so this fix needs to be applied there as
well.
Fixes: 44a182b9d177 ("xhci: Fix use-after-free in xhci_free_virt_device")
Cc: <stable@vger.kernel.org>
Reported-by: Jordan Glover <Golden_Miller83@protonmail.ch>
Tested-by: Jordan Glover <Golden_Miller83@protonmail.ch>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
---
drivers/usb/host/xhci-hub.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index 72ebbc908e19..32cd52ca8318 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -354,7 +354,7 @@ int xhci_find_slot_id_by_port(struct usb_hcd *hcd, struct xhci_hcd *xhci,
slot_id = 0;
for (i = 0; i < MAX_HC_SLOTS; i++) {
- if (!xhci->devs[i])
+ if (!xhci->devs[i] || !xhci->devs[i]->udev)
continue;
speed = xhci->devs[i]->udev->speed;
if (((speed >= USB_SPEED_SUPER) == (hcd->speed >= HCD_USB3))
--
2.17.0

View File

@ -4,7 +4,7 @@
pkgbase=linux # Build stock -ARCH kernel pkgbase=linux # Build stock -ARCH kernel
#pkgbase=linux-custom # Build kernel with a different name #pkgbase=linux-custom # Build kernel with a different name
_srcname=linux-4.16 _srcname=linux-4.16
pkgver=4.16.8 pkgver=4.16.9
pkgrel=1 pkgrel=1
arch=('x86_64') arch=('x86_64')
url="https://www.kernel.org/" url="https://www.kernel.org/"
@ -21,6 +21,7 @@ source=(
0001-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch 0001-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch
0002-drm-i915-edp-Only-use-the-alternate-fixed-mode-if-it.patch 0002-drm-i915-edp-Only-use-the-alternate-fixed-mode-if-it.patch
0003-Partially-revert-swiotlb-remove-various-exports.patch 0003-Partially-revert-swiotlb-remove-various-exports.patch
0004-xhci-Fix-USB3-NULL-pointer-dereference-at-logical-di.patch
) )
validpgpkeys=( validpgpkeys=(
'ABAF11C65A2970B130ABE3C479BE3E4300411886' # Linus Torvalds 'ABAF11C65A2970B130ABE3C479BE3E4300411886' # Linus Torvalds
@ -28,15 +29,16 @@ validpgpkeys=(
) )
sha256sums=('63f6dc8e3c9f3a0273d5d6f4dca38a2413ca3a5f689329d05b750e4c87bb21b9' sha256sums=('63f6dc8e3c9f3a0273d5d6f4dca38a2413ca3a5f689329d05b750e4c87bb21b9'
'SKIP' 'SKIP'
'6fb2db1e38f762e6a028dfa5e6d094f0eb4324572667923aca3d64c87117772d' '299b45a4f16f763ecf654e6642c020b6e9e461601d056ef44ecb21b54d736cbf'
'SKIP' 'SKIP'
'8566a49997faf3f8678440c52578a7a0ee901e598d3b67d3bee3799fb92e8f86' '66e44d128ddbc6ca30127d7fca3947f0200146b451bf3d7376fc2ef985a4a89b'
'ae2e95db94ef7176207c690224169594d49445e04249d2499e9d2fbc117a0b21' 'ae2e95db94ef7176207c690224169594d49445e04249d2499e9d2fbc117a0b21'
'75f99f5239e03238f88d1a834c50043ec32b1dc568f2cc291b07d04718483919' '75f99f5239e03238f88d1a834c50043ec32b1dc568f2cc291b07d04718483919'
'ad6344badc91ad0630caacde83f7f9b97276f80d26a20619a87952be65492c65' 'ad6344badc91ad0630caacde83f7f9b97276f80d26a20619a87952be65492c65'
'7fb607fe384dd814e9e45d7fc28f7b5b23a51d80784c54bf9209486ad428be14' '69241df4bd7897eb04db90e4d0a82c6e0b99b806019ba96bb885278ca8da89df'
'ceaa19e0af3842c62eb666a4ac5c79d89b3e6d00593442f18d6508ca6d74bbaa' '10728f672a83a515af540cafafde62346e9ccc2d14bf74e417fd2693865b1293'
'5b397cf9eccdad0c1f2865842c29ba6f4e32ad7dbe4e0c6ef6ca6f07d2963cea') 'a81b612369e78d142ff80ec3adda36b3f94503e5a68d54282c508a112cc8dae0'
'052a39582f84c52b027c261fcec90325493f4d46f15647c274a58e39145deced')
_kernelname=${pkgbase#linux} _kernelname=${pkgbase#linux}
: ${_kernelname:=-ARCH} : ${_kernelname:=-ARCH}
@ -59,6 +61,9 @@ prepare() {
# NVIDIA driver compat # NVIDIA driver compat
patch -Np1 -i ../0003-Partially-revert-swiotlb-remove-various-exports.patch patch -Np1 -i ../0003-Partially-revert-swiotlb-remove-various-exports.patch
# https://bugs.archlinux.org/task/58237
patch -Np1 -i ../0004-xhci-Fix-USB3-NULL-pointer-dereference-at-logical-di.patch
cat ../config - >.config <<END cat ../config - >.config <<END
CONFIG_LOCALVERSION="${_kernelname}" CONFIG_LOCALVERSION="${_kernelname}"
CONFIG_LOCALVERSION_AUTO=n CONFIG_LOCALVERSION_AUTO=n

2
config
View File

@ -1,6 +1,6 @@
# #
# Automatically generated file; DO NOT EDIT. # Automatically generated file; DO NOT EDIT.
# Linux/x86 4.16.7-1 Kernel Configuration # Linux/x86 4.16.9-1 Kernel Configuration
# #
CONFIG_64BIT=y CONFIG_64BIT=y
CONFIG_X86_64=y CONFIG_X86_64=y