diff --git a/bcm2835-hwrng-Handle-deferred-clock-properly.patch b/bcm2835-hwrng-Handle-deferred-clock-properly.patch deleted file mode 100644 index 4b4cdfea0..000000000 --- a/bcm2835-hwrng-Handle-deferred-clock-properly.patch +++ /dev/null @@ -1,42 +0,0 @@ -From patchwork Mon Feb 12 20:11:36 2018 -Content-Type: text/plain; charset="utf-8" -MIME-Version: 1.0 -Content-Transfer-Encoding: 7bit -Subject: hwrng: bcm2835: Handle deferred clock properly -From: Stefan Wahren -X-Patchwork-Id: 10214385 -Message-Id: <1518466296-30161-1-git-send-email-stefan.wahren@i2se.com> -To: Herbert Xu , Matt Mackall -Cc: Stefan Wahren , - Florian Fainelli , Arnd Bergmann , - Scott Branden , Jon Mason , - Greg Kroah-Hartman , - Eric Anholt , - bcm-kernel-feedback-list@broadcom.com, linux-crypto@vger.kernel.org, - Ray Jui , linux-arm-kernel@lists.infradead.org -Date: Mon, 12 Feb 2018 21:11:36 +0100 - -In case the probe of the clock is deferred, we would assume it is -optional. This is wrong, so defer the probe of this driver until -the clock is available. - -Fixes: 791af4f4907a ("hwrng: bcm2835 - Manage an optional clock") -Signed-off-by: Stefan Wahren -Acked-by: Florian Fainelli ---- - drivers/char/hw_random/bcm2835-rng.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/drivers/char/hw_random/bcm2835-rng.c b/drivers/char/hw_random/bcm2835-rng.c -index 7a84cec..6767d96 100644 ---- a/drivers/char/hw_random/bcm2835-rng.c -+++ b/drivers/char/hw_random/bcm2835-rng.c -@@ -163,6 +163,8 @@ static int bcm2835_rng_probe(struct platform_device *pdev) - - /* Clock is optional on most platforms */ - priv->clk = devm_clk_get(dev, NULL); -+ if (IS_ERR(priv->clk) && PTR_ERR(priv->clk) == -EPROBE_DEFER) -+ return -EPROBE_DEFER; - - priv->rng.name = pdev->name; - priv->rng.init = bcm2835_rng_init; diff --git a/bcm2837-lan78xx-fixes.patch b/bcm2837-lan78xx-fixes.patch index 7fa432a5e..e0603c762 100644 --- a/bcm2837-lan78xx-fixes.patch +++ b/bcm2837-lan78xx-fixes.patch @@ -259,179 +259,6 @@ index eb492d47f717..8f9c90379732 100644 -- 2.17.0 -From 7d76fccb22d71c80209eb9ef5b013a630424cb6c Mon Sep 17 00:00:00 2001 -From: Alexander Graf -Date: Wed, 4 Apr 2018 00:19:35 +0200 -Subject: [PATCH 2/9] lan78xx: Connect phy early - -When using wicked with a lan78xx device attached to the system, we -end up with ethtool commands issued on the device before an ifup -got issued. That lead to the following crash: - - Unable to handle kernel NULL pointer dereference at virtual address 0000039c - pgd = ffff800035b30000 - [0000039c] *pgd=0000000000000000 - Internal error: Oops: 96000004 [#1] SMP - Modules linked in: [...] - Supported: Yes - CPU: 3 PID: 638 Comm: wickedd Tainted: G E 4.12.14-0-default #1 - Hardware name: raspberrypi rpi/rpi, BIOS 2018.03-rc2 02/21/2018 - task: ffff800035e74180 task.stack: ffff800036718000 - PC is at phy_ethtool_ksettings_get+0x20/0x98 - LR is at lan78xx_get_link_ksettings+0x44/0x60 [lan78xx] - pc : [] lr : [] pstate: 20000005 - sp : ffff80003671bb20 - x29: ffff80003671bb20 x28: ffff800035e74180 - x27: ffff000008912000 x26: 000000000000001d - x25: 0000000000000124 x24: ffff000008f74d00 - x23: 0000004000114809 x22: 0000000000000000 - x21: ffff80003671bbd0 x20: 0000000000000000 - x19: ffff80003671bbd0 x18: 000000000000040d - x17: 0000000000000001 x16: 0000000000000000 - x15: 0000000000000000 x14: ffffffffffffffff - x13: 0000000000000000 x12: 0000000000000020 - x11: 0101010101010101 x10: fefefefefefefeff - x9 : 7f7f7f7f7f7f7f7f x8 : fefefeff31677364 - x7 : 0000000080808080 x6 : ffff80003671bc9c - x5 : ffff80003671b9f8 x4 : ffff80002c296190 - x3 : 0000000000000000 x2 : 0000000000000000 - x1 : ffff80003671bbd0 x0 : ffff80003671bc00 - Process wickedd (pid: 638, stack limit = 0xffff800036718000) - Call trace: - Exception stack(0xffff80003671b9e0 to 0xffff80003671bb20) - b9e0: ffff80003671bc00 ffff80003671bbd0 0000000000000000 0000000000000000 - ba00: ffff80002c296190 ffff80003671b9f8 ffff80003671bc9c 0000000080808080 - ba20: fefefeff31677364 7f7f7f7f7f7f7f7f fefefefefefefeff 0101010101010101 - ba40: 0000000000000020 0000000000000000 ffffffffffffffff 0000000000000000 - ba60: 0000000000000000 0000000000000001 000000000000040d ffff80003671bbd0 - ba80: 0000000000000000 ffff80003671bbd0 0000000000000000 0000004000114809 - baa0: ffff000008f74d00 0000000000000124 000000000000001d ffff000008912000 - bac0: ffff800035e74180 ffff80003671bb20 ffff000000dcca84 ffff80003671bb20 - bae0: ffff0000086f7f30 0000000020000005 ffff80002c296000 ffff800035223900 - bb00: 0000ffffffffffff 0000000000000000 ffff80003671bb20 ffff0000086f7f30 - [] phy_ethtool_ksettings_get+0x20/0x98 - [] lan78xx_get_link_ksettings+0x44/0x60 [lan78xx] - [] ethtool_get_settings+0x68/0x210 - [] dev_ethtool+0x214/0x2180 - [] dev_ioctl+0x400/0x630 - [] sock_do_ioctl+0x70/0x88 - [] sock_ioctl+0x208/0x368 - [] do_vfs_ioctl+0xb0/0x848 - [] SyS_ioctl+0x8c/0xa8 - Exception stack(0xffff80003671bec0 to 0xffff80003671c000) - bec0: 0000000000000009 0000000000008946 0000fffff4e841d0 0000aa0032687465 - bee0: 0000aaaafa2319d4 0000fffff4e841d4 0000000032687465 0000000032687465 - bf00: 000000000000001d 7f7fff7f7f7f7f7f 72606b622e71ff4c 7f7f7f7f7f7f7f7f - bf20: 0101010101010101 0000000000000020 ffffffffffffffff 0000ffff7f510c68 - bf40: 0000ffff7f6a9d18 0000ffff7f44ce30 000000000000040d 0000ffff7f6f98f0 - bf60: 0000fffff4e842c0 0000000000000001 0000aaaafa2c2e00 0000ffff7f6ab000 - bf80: 0000fffff4e842c0 0000ffff7f62a000 0000aaaafa2b9f20 0000aaaafa2c2e00 - bfa0: 0000fffff4e84818 0000fffff4e841a0 0000ffff7f5ad0cc 0000fffff4e841a0 - bfc0: 0000ffff7f44ce3c 0000000080000000 0000000000000009 000000000000001d - bfe0: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 - -The culprit is quite simple: The driver tries to access the phy left and right, -but only actually has a working reference to it when the device is up. - -The fix thus is quite simple too: Get a reference to the phy on probe already -and keep it even when the device is going down. - -With this patch applied, I can successfully run wicked on my system and bring -the interface up and down as many times as I want, without getting NULL pointer -dereferences in between. - -Signed-off-by: Alexander Graf -Signed-off-by: David S. Miller ---- - drivers/net/usb/lan78xx.c | 34 ++++++++++++++++++---------------- - 1 file changed, 18 insertions(+), 16 deletions(-) - -diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c -index 32cf21716f19..145bb7cbf5b2 100644 ---- a/drivers/net/usb/lan78xx.c -+++ b/drivers/net/usb/lan78xx.c -@@ -2083,10 +2083,6 @@ static int lan78xx_phy_init(struct lan78xx_net *dev) - - dev->fc_autoneg = phydev->autoneg; - -- phy_start(phydev); -- -- netif_dbg(dev, ifup, dev->net, "phy initialised successfully"); -- - return 0; - - error: -@@ -2523,9 +2519,9 @@ static int lan78xx_open(struct net_device *net) - if (ret < 0) - goto done; - -- ret = lan78xx_phy_init(dev); -- if (ret < 0) -- goto done; -+ phy_start(net->phydev); -+ -+ netif_dbg(dev, ifup, dev->net, "phy initialised successfully"); - - /* for Link Check */ - if (dev->urb_intr) { -@@ -2586,13 +2582,8 @@ static int lan78xx_stop(struct net_device *net) - if (timer_pending(&dev->stat_monitor)) - del_timer_sync(&dev->stat_monitor); - -- phy_unregister_fixup_for_uid(PHY_KSZ9031RNX, 0xfffffff0); -- phy_unregister_fixup_for_uid(PHY_LAN8835, 0xfffffff0); -- -- phy_stop(net->phydev); -- phy_disconnect(net->phydev); -- -- net->phydev = NULL; -+ if (net->phydev) -+ phy_stop(net->phydev); - - clear_bit(EVENT_DEV_OPEN, &dev->flags); - netif_stop_queue(net); -@@ -3507,8 +3498,13 @@ static void lan78xx_disconnect(struct usb_interface *intf) - return; - - udev = interface_to_usbdev(intf); -- - net = dev->net; -+ -+ phy_unregister_fixup_for_uid(PHY_KSZ9031RNX, 0xfffffff0); -+ phy_unregister_fixup_for_uid(PHY_LAN8835, 0xfffffff0); -+ -+ phy_disconnect(net->phydev); -+ - unregister_netdev(net); - - cancel_delayed_work_sync(&dev->wq); -@@ -3664,8 +3660,14 @@ static int lan78xx_probe(struct usb_interface *intf, - pm_runtime_set_autosuspend_delay(&udev->dev, - DEFAULT_AUTOSUSPEND_DELAY); - -+ ret = lan78xx_phy_init(dev); -+ if (ret < 0) -+ goto out4; -+ - return 0; - -+out4: -+ unregister_netdev(netdev); - out3: - lan78xx_unbind(dev, intf); - out2: -@@ -4013,7 +4015,7 @@ static int lan78xx_reset_resume(struct usb_interface *intf) - - lan78xx_reset(dev); - -- lan78xx_phy_init(dev); -+ phy_start(dev->net->phydev); - - return lan78xx_resume(intf); - } --- -2.17.0 - From 502356f8db439d77a41958041feec187c42f72bb Mon Sep 17 00:00:00 2001 From: Phil Elwell Date: Wed, 11 Apr 2018 12:02:47 +0100 diff --git a/bcm283x-Fix-probing-of-bcm2835-i2s.patch b/bcm283x-Fix-probing-of-bcm2835-i2s.patch index 911b2d982..0176baf46 100644 --- a/bcm283x-Fix-probing-of-bcm2835-i2s.patch +++ b/bcm283x-Fix-probing-of-bcm2835-i2s.patch @@ -72,47 +72,3 @@ index 65783de..7bb0362 100644 dmas = <&dma 2>, <&dma 3>; -From patchwork Fri Feb 16 10:55:34 2018 -Content-Type: text/plain; charset="utf-8" -MIME-Version: 1.0 -Content-Transfer-Encoding: 7bit -Subject: [V3,2/2,RESEND] ARM: dts: bcm283x: Fix probing of bcm2835-i2s -From: Stefan Wahren -X-Patchwork-Id: 10224427 -Message-Id: <1518778534-3328-3-git-send-email-stefan.wahren@i2se.com> -To: Rob Herring , Mark Rutland , - Eric Anholt -Cc: Stefan Wahren , devicetree@vger.kernel.org, - alsa-devel@alsa-project.org, Liam Girdwood , - Mark Brown , linux-rpi-kernel@lists.infradead.org, - linux-arm-kernel@lists.infradead.org -Date: Fri, 16 Feb 2018 11:55:34 +0100 - -Since 517e7a1537a ("ASoC: bcm2835: move to use the clock framework") -the bcm2835-i2s requires a clock as DT property. Unfortunately -the necessary DT change has never been applied. While we are at it -also fix the first PCM register range to cover the PCM_GRAY register. - -Fixes: 517e7a1537a ("ASoC: bcm2835: move to use the clock framework") -Signed-off-by: Stefan Wahren -Reviewed-by: Eric Anholt -Tested-by: Matthias Reichl ---- - arch/arm/boot/dts/bcm283x.dtsi | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/arch/arm/boot/dts/bcm283x.dtsi b/arch/arm/boot/dts/bcm283x.dtsi -index 013431e..e08203c 100644 ---- a/arch/arm/boot/dts/bcm283x.dtsi -+++ b/arch/arm/boot/dts/bcm283x.dtsi -@@ -396,8 +396,8 @@ - - i2s: i2s@7e203000 { - compatible = "brcm,bcm2835-i2s"; -- reg = <0x7e203000 0x20>, -- <0x7e101098 0x02>; -+ reg = <0x7e203000 0x24>; -+ clocks = <&clocks BCM2835_CLOCK_PCM>; - - dmas = <&dma 2>, - <&dma 3>; diff --git a/kernel.spec b/kernel.spec index a76f58fd4..208ee8fe2 100644 --- a/kernel.spec +++ b/kernel.spec @@ -54,7 +54,7 @@ Summary: The Linux kernel %if 0%{?released_kernel} # Do we have a -stable update to apply? -%define stable_update 12 +%define stable_update 13 # Set rpm version accordingly %if 0%{?stable_update} %define stablerev %{stable_update} @@ -622,9 +622,6 @@ Patch321: bcm283x-Fix-probing-of-bcm2835-i2s.patch # https://www.spinics.net/lists/arm-kernel/msg633942.html Patch322: mmc-sdhci-iproc-Disable-preset-values-for-BCM2835.patch -# https://www.spinics.net/lists/arm-kernel/msg633945.html -Patch323: bcm2835-hwrng-Handle-deferred-clock-properly.patch - Patch324: bcm283x-clk-audio-fixes.patch # Enabling Patches for the RPi3+ @@ -1920,6 +1917,10 @@ fi # # %changelog +* Wed May 30 2018 Jeremy Cline - 4.16.13-300 +- Linux v4.16.13 +- Fixes CVE-2018-11506 (rhbz 1583210 1583213) + * Fri May 25 2018 Jeremy Cline - 4.16.12-300 - Linux v4.16.12 - Fix CVE-2018-10840 (rhbz 1582346 1582348) diff --git a/sources b/sources index 451f4c0b3..34471a85c 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ SHA512 (linux-4.16.tar.xz) = ab47849314b177d0eec9dbf261f33972b0d89fb92fb0650130ffa7abc2f36c0fab2d06317dc1683c51a472a9a631573a9b1e7258d6281a2ee189897827f14662 -SHA512 (patch-4.16.12.xz) = 7bd2b4fa54b69df5558a4a151936fb1787f2faa0f4e73c03db04ef84ac088f764425faf5d6b5a023d4863e190775dcbb251eba1efc3b10eb133330bb6b210b72 +SHA512 (patch-4.16.13.xz) = f136eadbaff335b5c9cd45a9265b4ce4409c141372bc7af378c5a6bbb50330bf16d75ef29294f2b876961292c4c2606980e3d169b98e5b413d6c1b13f5eed37e