[linux] 01/01: Merge tag 'debian/4.2.6-2'
debian-kernel at lists.debian.org
debian-kernel at lists.debian.org
Fri Dec 4 18:04:52 UTC 2015
This is an automated email from the git hooks/post-receive script.
benh pushed a commit to branch master
in repository linux.
commit 12dc87aa9c045875bf17ccd6d37c57e125bd5026
Merge: f499576 cbdd531
Author: Ben Hutchings <ben at decadent.org.uk>
Date: Fri Dec 4 18:03:02 2015 +0000
Merge tag 'debian/4.2.6-2'
Exclude one new patch that's already in 4.3, and the ABI stuff.
Remove items from the open changelog entry that are now redundant.
debian/changelog | 54 +++-
debian/installer/modules/multipath-modules | 1 +
...runcation-of-compressed-and-inlined-exten.patch | 283 ++++++++++++++++++
...d-checks-for-allocation-failure-in-isdn_p.patch | 37 +++
...sion-fix-crash-on-detecting-device-with-i.patch | 44 +++
...lidate-vj-compression-slot-parameters-com.patch | 128 ++++++++
...id-use-after-free-in-ep_remove_wait_queue.patch | 325 +++++++++++++++++++++
...sbvision-fix-overflow-of-interfaces-array.patch | 10 +-
.../x86/kvm-svm-unconditionally-intercept-DB.patch | 75 +++++
...ame-update_db_bp_intercept-to-update_bp_i.patch | 60 ++++
debian/patches/series | 9 +-
11 files changed, 1006 insertions(+), 20 deletions(-)
diff --cc debian/changelog
index a4102dd,b86b5c7..c4fb0e9
--- a/debian/changelog
+++ b/debian/changelog
@@@ -1,98 -1,42 +1,122 @@@
+linux (4.3-1~exp2) UNRELEASED; urgency=medium
+
+ [ Ben Hutchings ]
- * qxl: Enable by default (Closes: #779515)
+ * mv643xx_eth: Re-enable TSO, fixed upstream in 4.3
+ * debian/control: Move patchutils from Build-Depends to Build-Depends-Indep,
+ as we only use filterdiff when building linux-source-<version>
+ * debian/control,debian/rules: Support a 'stage1' build profile which
+ builds only linux-libc-dev (Closes: #695243)
+ * debian/control: Add ':any' to Build-Depends on python3, to support cross-
+ bootstrap
- * [s390*] Update linux-compiler metapackage to gcc-4.9
- * firmware_class: Fix condition in directory search loop (Closes: #804862)
- * [x86] input: Enable MOUSE_ELAN_I2C as module, MOUSE_ELAN_I2C_I2C and
- MOUSE_ELAN_I2C_SMBUS (Closes: #791631)
- * [armhf] hsi: Enable CMT_SPEECH as module (Closes: #791819)
- * [armhf] power: Enable BATTERY_RX51 as module (Closes: #791820)
- * [x86] psmouse: Enable MOUSE_PS2_VMMOUSE (Closes: #802929)
- - linux-image: Add versioned Breaks on xserver-xorg-input-vmmouse to
- avoid driver conflicts
+ * [armhf] Enable new drivers for Allwinner chips (Closes: #804856)
+ - crypto: Enable CRYPTO_DEV_SUN4I_SS as module
+ - musb: Enable USB_MUSB_SUNXI as module
- * [armhf] udeb: Add stmmac platform modules dwmac-generic, dwmac-socfpga
- and dwmac-sunxi to nic-modules (Closes: #805098)
+ * aufs: Update support patches to aufs4.3-20151116
- * wireless: Enable WL_MEDIATEK, MT7601U as module
- * [x86] drm/i915: shut up gen8+ SDE irq dmesg noise (Closes: #806304)
- * [armhf] regulator: Enable REGULATOR_PFUZE100 as module (Closes: #806284)
+ * [armhf] USB: Change USB, USB_GADGET, and various drivers from built-in to
+ modules
+ - musb: Enable USB_MUSB_DUAL_ROLE
+ * [armhf] musb: Disable MUSB_PIO_ONLY and enable USB_INVENTRA_DMA,
+ USB_TI_CPPI41_DMA, USB_TUSB_OMAP_DMA
+
+ [ Ian Campbell ]
+ * [armel/orion5x] Enable Device Tree for orion5x. Patch from Roger Shimizu
+ (Closes: #803159)
+ * [armel/orion5x] Enable CONFIG_DEBUG_LL_UART_8250.
+
+ -- Ben Hutchings <ben at decadent.org.uk> Sat, 07 Nov 2015 14:18:48 +0000
+
+linux (4.3-1~exp1) experimental; urgency=medium
+
+ * New upstream release
+
+ [ Ben Hutchings ]
+ * netfilter: Enable NFT_DUP_IPV4, NFT_DUP_IPV6 as modules (Closes: #803370)
+ * tests: Add autopkgtest support
+ * [x86] Compile with gcc-5
+ * [x86] Enable PINCTRL_BAYTRAIL (Closes: #797949)
+
+ [ Salvatore Bonaccorso ]
+ * Fix typo in image.plain.postinst template.
+ Add missing space in warn message causing typo "dangling linkto".
+ Thanks to Jakub Wilk <jwilk at debian.org> (Closes: #803323)
+
+ -- Ben Hutchings <ben at decadent.org.uk> Wed, 04 Nov 2015 07:45:13 +0000
+
+linux (4.3~rc7-1~exp1) experimental; urgency=medium
+
+ * New upstream release candidate
+ - [x86] smpboot: Fix CPU #1 boot timeout (Closes: #802464)
+
+ -- Ben Hutchings <ben at decadent.org.uk> Wed, 28 Oct 2015 11:04:27 +0900
+
+linux (4.3~rc5-1~exp1) experimental; urgency=medium
+
+ * New upstream release candidate
+
+ -- Ben Hutchings <ben at decadent.org.uk> Wed, 14 Oct 2015 00:48:41 +0100
+
+linux (4.3~rc4-1~exp1) experimental; urgency=medium
+
+ * New upstream release candidate
+
+ [ Ben Hutchings ]
+ * [armhf] dts: Fix Makefile target for sun4i-a10-itead-iteaduino-plus
+ (fixes FTBFS)
+ * [mips*] io: Define ioremap_uc (fixes FTBFS)
+
+ -- Ben Hutchings <ben at decadent.org.uk> Tue, 06 Oct 2015 23:27:45 +0100
+
+linux (4.3~rc3-1~exp1) experimental; urgency=medium
+
+ * New upstream release candidate
+
+ [ Ben Hutchings ]
+ * Disable CRAMFS; it was obsoleted by squashfs and initramfs
+ * [i386] Replace 586 flavour with 686
+ - Enable support for OLPC and other Geode-based systems in the 686 flavour
+ - udeb: Update kernel-versions
+
+ -- Ben Hutchings <ben at decadent.org.uk> Sun, 27 Sep 2015 21:02:54 +0100
+
+ linux (4.2.6-2) unstable; urgency=medium
+
+ [ Salvatore Bonaccorso ]
+ * [x86] KVM: svm: unconditionally intercept #DB (CVE-2015-8104)
+ * [x86] KVM: rename update_db_bp_intercept to update_bp_intercept
+
+ [ Ian Campbell ]
+ * [x86] Xen: expose a more realistic max p2m size in the shared info, fixes
+ migration (Closes: #797205)
+
+ [ Ben Hutchings ]
+ * media: usbvision: fix crash on detecting device with invalid configuration
+ (CVE-2015-7833, partly fixed in 4.2.6-1)
+ * udeb: Add dm-service-time to multipath-modules (Closes: #806131)
+ * unix: avoid use-after-free in ep_remove_wait_queue (CVE-2013-7446)
+ * isdn_ppp: Add checks for allocation failure in isdn_ppp_open()
+ * ppp, slip: Validate VJ compression slot parameters completely
+ (CVE-2015-7799)
+ * Btrfs: fix truncation of compressed and inlined extents (CVE-2015-8374)
+ * netfilter: Enable NFT_DUP_IPV4, NFT_DUP_IPV6 as modules (Closes: #803370)
+ * [x86] Enable PINCTRL_BAYTRAIL (Closes: #797949)
+ * qxl: Enable by default (Closes: #779515)
+ * [s390*] Update linux-compiler metapackage to gcc-4.9
+ * firmware_class: Fix condition in directory search loop (Closes: #804862)
+ * [x86] input: Enable MOUSE_ELAN_I2C as module, MOUSE_ELAN_I2C_I2C and
+ MOUSE_ELAN_I2C_SMBUS (Closes: #791631)
+ * [armhf] hsi: Enable CMT_SPEECH as module (Closes: #791819)
+ * [armhf] power: Enable BATTERY_RX51 as module (Closes: #791820)
+ * [x86] psmouse: Enable MOUSE_PS2_VMMOUSE (Closes: #802929)
+ - linux-image: Add versioned Breaks on xserver-xorg-input-vmmouse to
+ avoid driver conflicts
+ * [armhf] udeb: Add stmmac platform modules dwmac-generic, dwmac-socfpga
+ and dwmac-sunxi to nic-modules (Closes: #805098)
+ * wireless: Enable WL_MEDIATEK, MT7601U as module
+ * [x86] drm/i915: shut up gen8+ SDE irq dmesg noise (Closes: #806304)
+ * [armhf] regulator: Enable REGULATOR_PFUZE100 as module (Closes: #806284)
+
+ -- Ben Hutchings <ben at decadent.org.uk> Fri, 04 Dec 2015 02:26:51 +0000
+
linux (4.2.6-1) unstable; urgency=medium
* New upstream stable update:
diff --cc debian/patches/bugfix/all/unix-avoid-use-after-free-in-ep_remove_wait_queue.patch
index 0000000,6abbb18..6fb47c7
mode 000000,100644..100644
--- a/debian/patches/bugfix/all/unix-avoid-use-after-free-in-ep_remove_wait_queue.patch
+++ b/debian/patches/bugfix/all/unix-avoid-use-after-free-in-ep_remove_wait_queue.patch
@@@ -1,0 -1,325 +1,325 @@@
+ From: Rainer Weikusat <rweikusat at mobileactivedefense.com>
+ Date: Fri, 20 Nov 2015 22:07:23 +0000
+ Subject: unix: avoid use-after-free in ep_remove_wait_queue
+ Origin: https://git.kernel.org/cgit/linux/kernel/git/davem/net.git//commit?id=7d267278a9ece963d77eefec61630223fce08c6c
+
+ Rainer Weikusat <rweikusat at mobileactivedefense.com> writes:
+ An AF_UNIX datagram socket being the client in an n:1 association with
+ some server socket is only allowed to send messages to the server if the
+ receive queue of this socket contains at most sk_max_ack_backlog
+ datagrams. This implies that prospective writers might be forced to go
+ to sleep despite none of the message presently enqueued on the server
+ receive queue were sent by them. In order to ensure that these will be
+ woken up once space becomes again available, the present unix_dgram_poll
+ routine does a second sock_poll_wait call with the peer_wait wait queue
+ of the server socket as queue argument (unix_dgram_recvmsg does a wake
+ up on this queue after a datagram was received). This is inherently
+ problematic because the server socket is only guaranteed to remain alive
+ for as long as the client still holds a reference to it. In case the
+ connection is dissolved via connect or by the dead peer detection logic
+ in unix_dgram_sendmsg, the server socket may be freed despite "the
+ polling mechanism" (in particular, epoll) still has a pointer to the
+ corresponding peer_wait queue. There's no way to forcibly deregister a
+ wait queue with epoll.
+
+ Based on an idea by Jason Baron, the patch below changes the code such
+ that a wait_queue_t belonging to the client socket is enqueued on the
+ peer_wait queue of the server whenever the peer receive queue full
+ condition is detected by either a sendmsg or a poll. A wake up on the
+ peer queue is then relayed to the ordinary wait queue of the client
+ socket via wake function. The connection to the peer wait queue is again
+ dissolved if either a wake up is about to be relayed or the client
+ socket reconnects or a dead peer is detected or the client socket is
+ itself closed. This enables removing the second sock_poll_wait from
+ unix_dgram_poll, thus avoiding the use-after-free, while still ensuring
+ that no blocked writer sleeps forever.
+
+ Signed-off-by: Rainer Weikusat <rweikusat at mobileactivedefense.com>
+ Fixes: ec0d215f9420 ("af_unix: fix 'poll for write'/connected DGRAM sockets")
+ Reviewed-by: Jason Baron <jbaron at akamai.com>
+ Signed-off-by: David S. Miller <davem at davemloft.net>
+ [bwh: Backported to 4.2: adjust context]
+ ---
+ include/net/af_unix.h | 1 +
+ net/unix/af_unix.c | 183 ++++++++++++++++++++++++++++++++++++++++++++------
+ 2 files changed, 165 insertions(+), 19 deletions(-)
+
+ --- a/include/net/af_unix.h
+ +++ b/include/net/af_unix.h
+ @@ -62,6 +62,7 @@ struct unix_sock {
+ #define UNIX_GC_CANDIDATE 0
+ #define UNIX_GC_MAYBE_CYCLE 1
+ struct socket_wq peer_wq;
+ + wait_queue_t peer_wake;
+ };
+
- static inline struct unix_sock *unix_sk(struct sock *sk)
++ static inline struct unix_sock *unix_sk(const struct sock *sk)
+ --- a/net/unix/af_unix.c
+ +++ b/net/unix/af_unix.c
+ @@ -326,6 +326,118 @@ found:
+ return s;
+ }
+
+ +/* Support code for asymmetrically connected dgram sockets
+ + *
+ + * If a datagram socket is connected to a socket not itself connected
+ + * to the first socket (eg, /dev/log), clients may only enqueue more
+ + * messages if the present receive queue of the server socket is not
+ + * "too large". This means there's a second writeability condition
+ + * poll and sendmsg need to test. The dgram recv code will do a wake
+ + * up on the peer_wait wait queue of a socket upon reception of a
+ + * datagram which needs to be propagated to sleeping would-be writers
+ + * since these might not have sent anything so far. This can't be
+ + * accomplished via poll_wait because the lifetime of the server
+ + * socket might be less than that of its clients if these break their
+ + * association with it or if the server socket is closed while clients
+ + * are still connected to it and there's no way to inform "a polling
+ + * implementation" that it should let go of a certain wait queue
+ + *
+ + * In order to propagate a wake up, a wait_queue_t of the client
+ + * socket is enqueued on the peer_wait queue of the server socket
+ + * whose wake function does a wake_up on the ordinary client socket
+ + * wait queue. This connection is established whenever a write (or
+ + * poll for write) hit the flow control condition and broken when the
+ + * association to the server socket is dissolved or after a wake up
+ + * was relayed.
+ + */
+ +
+ +static int unix_dgram_peer_wake_relay(wait_queue_t *q, unsigned mode, int flags,
+ + void *key)
+ +{
+ + struct unix_sock *u;
+ + wait_queue_head_t *u_sleep;
+ +
+ + u = container_of(q, struct unix_sock, peer_wake);
+ +
+ + __remove_wait_queue(&unix_sk(u->peer_wake.private)->peer_wait,
+ + q);
+ + u->peer_wake.private = NULL;
+ +
+ + /* relaying can only happen while the wq still exists */
+ + u_sleep = sk_sleep(&u->sk);
+ + if (u_sleep)
+ + wake_up_interruptible_poll(u_sleep, key);
+ +
+ + return 0;
+ +}
+ +
+ +static int unix_dgram_peer_wake_connect(struct sock *sk, struct sock *other)
+ +{
+ + struct unix_sock *u, *u_other;
+ + int rc;
+ +
+ + u = unix_sk(sk);
+ + u_other = unix_sk(other);
+ + rc = 0;
+ + spin_lock(&u_other->peer_wait.lock);
+ +
+ + if (!u->peer_wake.private) {
+ + u->peer_wake.private = other;
+ + __add_wait_queue(&u_other->peer_wait, &u->peer_wake);
+ +
+ + rc = 1;
+ + }
+ +
+ + spin_unlock(&u_other->peer_wait.lock);
+ + return rc;
+ +}
+ +
+ +static void unix_dgram_peer_wake_disconnect(struct sock *sk,
+ + struct sock *other)
+ +{
+ + struct unix_sock *u, *u_other;
+ +
+ + u = unix_sk(sk);
+ + u_other = unix_sk(other);
+ + spin_lock(&u_other->peer_wait.lock);
+ +
+ + if (u->peer_wake.private == other) {
+ + __remove_wait_queue(&u_other->peer_wait, &u->peer_wake);
+ + u->peer_wake.private = NULL;
+ + }
+ +
+ + spin_unlock(&u_other->peer_wait.lock);
+ +}
+ +
+ +static void unix_dgram_peer_wake_disconnect_wakeup(struct sock *sk,
+ + struct sock *other)
+ +{
+ + unix_dgram_peer_wake_disconnect(sk, other);
+ + wake_up_interruptible_poll(sk_sleep(sk),
+ + POLLOUT |
+ + POLLWRNORM |
+ + POLLWRBAND);
+ +}
+ +
+ +/* preconditions:
+ + * - unix_peer(sk) == other
+ + * - association is stable
+ + */
+ +static int unix_dgram_peer_wake_me(struct sock *sk, struct sock *other)
+ +{
+ + int connected;
+ +
+ + connected = unix_dgram_peer_wake_connect(sk, other);
+ +
+ + if (unix_recvq_full(other))
+ + return 1;
+ +
+ + if (connected)
+ + unix_dgram_peer_wake_disconnect(sk, other);
+ +
+ + return 0;
+ +}
+ +
+ static inline int unix_writable(struct sock *sk)
+ {
+ return (atomic_read(&sk->sk_wmem_alloc) << 2) <= sk->sk_sndbuf;
+ @@ -430,6 +542,8 @@ static void unix_release_sock(struct soc
+ skpair->sk_state_change(skpair);
+ sk_wake_async(skpair, SOCK_WAKE_WAITD, POLL_HUP);
+ }
+ +
+ + unix_dgram_peer_wake_disconnect(sk, skpair);
+ sock_put(skpair); /* It may now die */
+ unix_peer(sk) = NULL;
+ }
+ @@ -664,6 +778,7 @@ static struct sock *unix_create1(struct
+ INIT_LIST_HEAD(&u->link);
+ mutex_init(&u->readlock); /* single task reading lock */
+ init_waitqueue_head(&u->peer_wait);
+ + init_waitqueue_func_entry(&u->peer_wake, unix_dgram_peer_wake_relay);
+ unix_insert_socket(unix_sockets_unbound(sk), sk);
+ out:
+ if (sk == NULL)
+ @@ -1031,6 +1146,8 @@ restart:
+ if (unix_peer(sk)) {
+ struct sock *old_peer = unix_peer(sk);
+ unix_peer(sk) = other;
+ + unix_dgram_peer_wake_disconnect_wakeup(sk, old_peer);
+ +
+ unix_state_double_unlock(sk, other);
+
+ if (other != old_peer)
+ @@ -1470,6 +1587,7 @@ static int unix_dgram_sendmsg(struct soc
+ struct scm_cookie scm;
+ int max_level;
+ int data_len = 0;
+ + int sk_locked;
+
+ wait_for_unix_gc();
+ err = scm_send(sock, msg, &scm, false);
+ @@ -1548,12 +1666,14 @@ restart:
+ goto out_free;
+ }
+
+ + sk_locked = 0;
+ unix_state_lock(other);
+ +restart_locked:
+ err = -EPERM;
+ if (!unix_may_send(sk, other))
+ goto out_unlock;
+
+ - if (sock_flag(other, SOCK_DEAD)) {
+ + if (unlikely(sock_flag(other, SOCK_DEAD))) {
+ /*
+ * Check with 1003.1g - what should
+ * datagram error
+ @@ -1561,10 +1681,14 @@ restart:
+ unix_state_unlock(other);
+ sock_put(other);
+
+ + if (!sk_locked)
+ + unix_state_lock(sk);
+ +
+ err = 0;
+ - unix_state_lock(sk);
+ if (unix_peer(sk) == other) {
+ unix_peer(sk) = NULL;
+ + unix_dgram_peer_wake_disconnect_wakeup(sk, other);
+ +
+ unix_state_unlock(sk);
+
+ unix_dgram_disconnected(sk, other);
+ @@ -1590,21 +1714,38 @@ restart:
+ goto out_unlock;
+ }
+
+ - if (unix_peer(other) != sk && unix_recvq_full(other)) {
+ - if (!timeo) {
+ - err = -EAGAIN;
+ - goto out_unlock;
+ + if (unlikely(unix_peer(other) != sk && unix_recvq_full(other))) {
+ + if (timeo) {
+ + timeo = unix_wait_for_peer(other, timeo);
+ +
+ + err = sock_intr_errno(timeo);
+ + if (signal_pending(current))
+ + goto out_free;
+ +
+ + goto restart;
+ }
+
+ - timeo = unix_wait_for_peer(other, timeo);
+ + if (!sk_locked) {
+ + unix_state_unlock(other);
+ + unix_state_double_lock(sk, other);
+ + }
+
+ - err = sock_intr_errno(timeo);
+ - if (signal_pending(current))
+ - goto out_free;
+ + if (unix_peer(sk) != other ||
+ + unix_dgram_peer_wake_me(sk, other)) {
+ + err = -EAGAIN;
+ + sk_locked = 1;
+ + goto out_unlock;
+ + }
+
+ - goto restart;
+ + if (!sk_locked) {
+ + sk_locked = 1;
+ + goto restart_locked;
+ + }
+ }
+
+ + if (unlikely(sk_locked))
+ + unix_state_unlock(sk);
+ +
+ if (sock_flag(other, SOCK_RCVTSTAMP))
+ __net_timestamp(skb);
+ maybe_add_creds(skb, sock, other);
+ @@ -1618,6 +1759,8 @@ restart:
+ return len;
+
+ out_unlock:
+ + if (sk_locked)
+ + unix_state_unlock(sk);
+ unix_state_unlock(other);
+ out_free:
+ kfree_skb(skb);
+ @@ -2453,14 +2596,16 @@ static unsigned int unix_dgram_poll(stru
+ return mask;
+
+ writable = unix_writable(sk);
+ - other = unix_peer_get(sk);
+ - if (other) {
+ - if (unix_peer(other) != sk) {
+ - sock_poll_wait(file, &unix_sk(other)->peer_wait, wait);
+ - if (unix_recvq_full(other))
+ - writable = 0;
+ - }
+ - sock_put(other);
+ + if (writable) {
+ + unix_state_lock(sk);
+ +
+ + other = unix_peer(sk);
+ + if (other && unix_peer(other) != sk &&
+ + unix_recvq_full(other) &&
+ + unix_dgram_peer_wake_me(sk, other))
+ + writable = 0;
+ +
+ + unix_state_unlock(sk);
+ }
+
+ if (writable)
diff --cc debian/patches/series
index 18281fc,fc9db3b..8c10489
--- a/debian/patches/series
+++ b/debian/patches/series
@@@ -77,17 -85,34 +77,24 @@@ features/all/grsecurity/grsecurity-kcon
#features/all/grsecurity/grsecurity-kbuild.patch
features/all/grsecurity/grkernsec_perf_harden.patch
-bugfix/all/gfs2-make-statistics-unsigned-suitable-for-use-with-.patch
-bugfix/all/dcache-reduce-the-scope-of-i_lock-in-d_splice_alias.patch
-bugfix/all/rds-verify-the-underlying-transport-exists-before-cr.patch
bugfix/all/media-uvcvideo-disable-hardware-timestamps-by-defaul.patch
-bugfix/mips/mips-pgtable-bits.h-correct-_page_global_shift-build.patch
-features/all/ath10k-add-qca6164-support.patch
-debian/block-fix-abi-change-in-4.2.2.patch
-bugfix/all/nbd-fix-timeout-detection.patch
-bugfix/all/nbd-remove-variable-pid.patch
-bugfix/all/nbd-add-locking-for-tasks.patch
-bugfix/all/KEYS-Fix-race-between-key-destruction-and-finding-a-.patch
-bugfix/all/KEYS-Fix-crash-when-attempt-to-garbage-collect-an-un.patch
-bugfix/all/KEYS-Don-t-permit-request_key-to-construct-a-new-key.patch
-
-debian/target-fix-abi-change-in-4.2.4.patch
-debian/signal-fix-abi-change-in-4.2.4.patch
+bugfix/all/selftests-add-missing-include-directives.patch
+bugfix/all/selftests-memfd-stop-unnecessary-rebuilds.patch
+bugfix/all/selftests-kprobe-choose-an-always-defined-function-t.patch
+bugfix/all/selftests-make-scripts-executable.patch
+bugfix/all/selftests-vm-try-harder-to-allocate-huge-pages.patch
+bugfix/all/selftests-breakpoints-actually-build-it.patch
- bugfix/all/usbvision-fix-overflow-of-interfaces-array.patch
bugfix/all/rds-fix-race-condition-when-sending-a-message-on-unbound-socket.patch
bugfix/all/media-media-vivid-osd-fix-info-leak-in-ioctl.patch
bugfix/x86/kvm-x86-vmx-avoid-guest-host-dos-by-intercepting-ac.patch
bugfix/x86/kvm-x86-svm-intercept-ac-to-avoid-guest-host-exploit.patch
+ bugfix/x86/kvm-svm-unconditionally-intercept-DB.patch
+ bugfix/x86/kvm-x86-rename-update_db_bp_intercept-to-update_bp_i.patch
-bugfix/x86/x86-xen-p2m-hint-at-the-last-populated-P2M-entry.patch
+ bugfix/all/usbvision-fix-overflow-of-interfaces-array.patch
+ bugfix/all/media-usbvision-fix-crash-on-detecting-device-with-i.patch
+ bugfix/all/unix-avoid-use-after-free-in-ep_remove_wait_queue.patch
+ bugfix/all/isdn_ppp-add-checks-for-allocation-failure-in-isdn_p.patch
+ bugfix/all/ppp-slip-validate-vj-compression-slot-parameters-com.patch
+ bugfix/all/btrfs-fix-truncation-of-compressed-and-inlined-exten.patch
bugfix/x86/drm-i915-shut-up-gen8-sde-irq-dmesg-noise.patch
--
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/kernel/linux.git
More information about the Kernel-svn-changes
mailing list