[linux] 01/01: Update to 3.16.7-ckt19
debian-kernel at lists.debian.org
debian-kernel at lists.debian.org
Tue Nov 17 18:08:54 UTC 2015
This is an automated email from the git hooks/post-receive script.
benh pushed a commit to branch jessie
in repository linux.
commit 1e84725bdbb211f72bc0d1bc4c95a47efccd0b11
Author: Ben Hutchings <ben at decadent.org.uk>
Date: Tue Nov 17 17:57:21 2015 +0000
Update to 3.16.7-ckt19
Ignore ABI change to skb_copy_and_csum_datagram_iovec, apparently not
used from OOT.
---
debian/changelog | 94 ++++++++++++++++-
debian/config/defines | 2 +
...sg-shm-IPC-objects-before-doing-ipc_addid.patch | 108 -------------------
...permit-request_key-to-construct-a-new-key.patch | 37 -------
...ash-when-attempt-to-garbage-collect-an-un.patch | 79 --------------
...ce-between-key-destruction-and-finding-a-.patch | 52 ----------
...ache-handle-escaped-paths-in-prepend_path.patch | 58 -----------
...ully-initialize-sem_array-before-making-i.patch | 60 -----------
...open-coded-terminate_walk-in-follow_dotdo.patch | 66 ------------
...iteheat-fix-potential-null-deref-at-probe.patch | 79 --------------
...r-and-handle-paths-that-are-unreachable-f.patch | 103 ------------------
...t-release-per-queue-Tx-and-Rx-resource-wh.patch | 19 ++--
...rm-orion5x-fix-legacy-orion5x-irq-numbers.patch | 115 ---------------------
debian/patches/series | 10 --
14 files changed, 100 insertions(+), 782 deletions(-)
diff --git a/debian/changelog b/debian/changelog
index 7c2a070..13afa5c 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,4 +1,4 @@
-linux (3.16.7-ckt18-1) UNRELEASED; urgency=medium
+linux (3.16.7-ckt19-1) UNRELEASED; urgency=medium
* New upstream stable update:
http://kernel.ubuntu.com/stable/ChangeLog-3.16.7-ckt18
@@ -69,6 +69,96 @@ linux (3.16.7-ckt18-1) UNRELEASED; urgency=medium
- netlink, mmap: transform mmap skb into full skb on taps
- openvswitch: Zero flows on allocation.
- fib_rules: fix fib rule dumps across multiple skbs
+ http://kernel.ubuntu.com/stable/ChangeLog-3.16.7-ckt19
+ - [armel,armhf] 8429/1: disable GCC SRA optimization
+ - CIFS: fix type confusion in copy offload ioctl
+ - hwmon: (nct6775) Swap STEP_UP_TIME and STEP_DOWN_TIME registers for most
+ chips
+ - [x86] apic: Serialize LVTT and TSC_DEADLINE writes
+ - [arm64] head.S: initialise mdcr_el2 in el2_setup
+ - kvm: don't try to register to KVM_FAST_MMIO_BUS for non mmio eventfd
+ - kvm: factor out core eventfd assign/deassign logic
+ - kvm: fix double free for fast mmio eventfd
+ - kvm: fix zero length mmio searching
+ - [powerpc*] mm: Recompute hash value after a failed update
+ - [x86] platform: Fix Geode LX timekeeping in the generic x86 build
+ - [arm64] errata: add module build workaround for erratum #843419
+ - [arm64] KVM: Disable virtual timer even if the guest is not using it
+ - [armhf] KVM: Disable virtual timer even if the guest is not using it
+ - [x86] hp-wmi: Add missing __init annotations to initialization code
+ - [x86] hp-wmi: limit hotkey enable
+ - zram: fix possible use after free in zcomp_create()
+ - [x86] drm/vmwgfx: Fix up user_dmabuf refcounting
+ - [armhf] dts: omap3-beagle: make i2c3, ddc and tfp410 gpio work again
+ - Btrfs: fix read corruption of compressed and shared extents
+ - btrfs: skip waiting on ordered range for special files
+ - usb: chipidea: udc: using the correct stall implementation
+ - [armhf] net: mvneta: fix DMA buffer unmapping in mvneta_rx()
+ - iser-target: remove command with state ISTATE_REMOVE
+ - [x86] KVM: trap AMD MSRs for the TSeg base and mask
+ - usb: Use the USB_SS_MULT() macro to get the burst multiplier.
+ - xhci: give command abortion one more chance before killing xhci
+ - usb: xhci: Clear XHCI_STATE_DYING on start
+ - usb: xhci: Allow usb_add/remove_hcd() to be called repeatedly
+ - xhci: change xhci 1.0 only restrictions to support xhci 1.1
+ - xhci-mem: Use setup_timer
+ - xhci: init command timeout timer earlier to avoid deleting it
+ uninitialized
+ - cifs: disabling oplocks/leases via module parm enable_oplocks broken for
+ SMB3
+ - cifs: use server timestamp for ntlmv2 authentication
+ - [x86] paravirt: Replace the paravirt nop with a bona fide empty function
+ - [amd64] nmi: Fix a paravirt stack-clobbering bug in the NMI code
+ - ocfs2/dlm: fix deadlock when dispatch assert master
+ - [x86] drm/i915/bios: handle MIPI Sequence Block v3+ gracefully
+ - drm/qxl: only report first monitor as connected if we have no state
+ - PCI: Fix devfn for VPD access through function 0
+ - PCI: Use function 0 VPD for identical functions, regular VPD for others
+ - netfilter: nft_compat: skip family comparison in case of NFPROTO_UNSPEC
+ - [armhf] dts: omap5-uevm.dts: fix i2c5 pinctrl offsets
+ - vxlan: set needed headroom correctly
+ - jbd2: avoid infinite loop when destroying aborted journal
+ - asix: Don't reset PHY on if_up for ASIX 88772
+ - asix: Do full reset during ax88772_bind
+ - fib_rules: Fix dump_rules() not to exit early
+ - net/xen-netfront: only napi_synchronize() if running
+ - [x86] intel_pstate: Fix overflow in busy_scaled due to long delay
+ - UBI: Validate data_size
+ - UBI: return ENOSPC if no enough space available
+ - [mips*] dma-default: Fix 32-bit fall back to GFP_DMA
+ - [mips*] CPS: Stop dangling delay slot from has_mt.
+ - [mips*] CPS: Don't include MT code in non-MT kernels.
+ - [mips*] CPS: #ifdef on CONFIG_MIPS_MT_SMP rather than CONFIG_MIPS_MT
+ - drm/qxl: recreate the primary surface when the bo is not primary
+ - genirq: Fix race in register_irq_proc()
+ - [x86] efi: Fix boot crash by mapping EFI memmap entries bottom-up at
+ runtime, instead of top-down
+ - [x86] Use WARN_ON_ONCE for missing X86_FEATURE_NRIPS
+ - mm: hugetlbfs: skip shared VMAs when unmapping private pages to satisfy a
+ fault
+ - [x86] mm: Set NX on gap between __ex_table and rodata
+ - clocksource: Fix abs() usage w/ 64bit values
+ - dmaengine: dw: properly read DWC_PARAMS register
+ - mm/slab: fix unexpected index mapping result of kmalloc_size(INDEX_NODE+1)
+ - drm/vmwgfx: Fix kernel NULL pointer dereference on older hardware
+ - fs: if a coredump already exists, unlink and recreate with O_EXCL
+ - sctp: donot reset the overall_error_count in SHUTDOWN_RECEIVE state
+ - drivers: usb :fsl: Implement Workaround for USB Erratum A007792
+ - drivers: usb: fsl: Workaround for USB erratum-A005275
+ - l2tp: protect tunnel->del_work by ref_count
+ - af_unix: Convert the unix_sk macro to an inline function for type safety
+ - af_unix: return data from multiple SKBs on recv() with MSG_PEEK flag
+ - net/unix: fix logic about sk_peek_offset
+ - skbuff: Fix skb checksum flag on skb pull
+ - skbuff: Fix skb checksum partial check.
+ - net: add pfmemalloc check in sk_add_backlog()
+ - ppp: don't override sk->sk_state in pppoe_flush_dev()
+ - ethtool: Use kcalloc instead of kmalloc for ethtool_get_strings
+ - ovs: do not allocate memory from offline numa node
+ - netlink: Trim skb to alloc size to avoid MSG_TRUNC
+ - net: add length argument to skb_copy_and_csum_datagram_iovec
+ (regression in 3.16.7-ckt17) (CVE-2015-8019)
+ - Btrfs: update fix for read corruption of compressed and shared extents
[ Aurelien Jarno ]
* [mips*/octeon] Enable CAVIUM_CN63XXP1 (Closes: #800595)
@@ -76,8 +166,6 @@ linux (3.16.7-ckt18-1) UNRELEASED; urgency=medium
[ Ben Hutchings ]
* nbd: Restore request timeout detection (Closes: #770479)
* netlink: Fix ABI change in 3.16.7-ckt18
- * Revert "ARM: orion5x: fix legacy orion5x IRQ numbers", mistakenly
- included in 3.16.7-ckt18
* [x86] Enable PINCTRL_BAYTRAIL (Closes: #797949)
* firmware_class: Fix condition in directory search loop (Closes: #804862)
diff --git a/debian/config/defines b/debian/config/defines
index 2d6f738..f56a8f6 100644
--- a/debian/config/defines
+++ b/debian/config/defines
@@ -32,6 +32,8 @@ ignore-changes:
clk_divider_ro_ops
tick_nohz_idle_enter
tick_nohz_idle_exit
+# Apparently not used from OOT
+ skb_copy_and_csum_datagram_iovec
[base]
arches:
diff --git a/debian/patches/bugfix/all/Initialize-msg-shm-IPC-objects-before-doing-ipc_addid.patch b/debian/patches/bugfix/all/Initialize-msg-shm-IPC-objects-before-doing-ipc_addid.patch
deleted file mode 100644
index aed863b..0000000
--- a/debian/patches/bugfix/all/Initialize-msg-shm-IPC-objects-before-doing-ipc_addid.patch
+++ /dev/null
@@ -1,108 +0,0 @@
-From: Linus Torvalds <torvalds at linux-foundation.org>
-Date: Wed, 30 Sep 2015 12:48:40 -0400
-Subject: Initialize msg/shm IPC objects before doing ipc_addid()
-Origin: https://git.kernel.org/linus/b9a532277938798b53178d5a66af6e2915cb27cf
-
-As reported by Dmitry Vyukov, we really shouldn't do ipc_addid() before
-having initialized the IPC object state. Yes, we initialize the IPC
-object in a locked state, but with all the lockless RCU lookup work,
-that IPC object lock no longer means that the state cannot be seen.
-
-We already did this for the IPC semaphore code (see commit e8577d1f0329:
-"ipc/sem.c: fully initialize sem_array before making it visible") but we
-clearly forgot about msg and shm.
-
-Reported-by: Dmitry Vyukov <dvyukov at google.com>
-Cc: Manfred Spraul <manfred at colorfullife.com>
-Cc: Davidlohr Bueso <dbueso at suse.de>
-Cc: stable at vger.kernel.org
-Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
-[carnil: Backported to 3.16: adjust context]
----
- ipc/msg.c | 14 +++++++-------
- ipc/shm.c | 13 +++++++------
- ipc/util.c | 8 ++++----
- 3 files changed, 18 insertions(+), 17 deletions(-)
-
---- a/ipc/msg.c
-+++ b/ipc/msg.c
-@@ -137,13 +137,6 @@ static int newque(struct ipc_namespace *
- return retval;
- }
-
-- /* ipc_addid() locks msq upon success. */
-- id = ipc_addid(&msg_ids(ns), &msq->q_perm, ns->msg_ctlmni);
-- if (id < 0) {
-- ipc_rcu_putref(msq, msg_rcu_free);
-- return id;
-- }
--
- msq->q_stime = msq->q_rtime = 0;
- msq->q_ctime = get_seconds();
- msq->q_cbytes = msq->q_qnum = 0;
-@@ -153,6 +146,13 @@ static int newque(struct ipc_namespace *
- INIT_LIST_HEAD(&msq->q_receivers);
- INIT_LIST_HEAD(&msq->q_senders);
-
-+ /* ipc_addid() locks msq upon success. */
-+ id = ipc_addid(&msg_ids(ns), &msq->q_perm, ns->msg_ctlmni);
-+ if (id < 0) {
-+ ipc_rcu_putref(msq, msg_rcu_free);
-+ return id;
-+ }
-+
- ipc_unlock_object(&msq->q_perm);
- rcu_read_unlock();
-
---- a/ipc/shm.c
-+++ b/ipc/shm.c
-@@ -547,12 +547,6 @@ static int newseg(struct ipc_namespace *
- if (IS_ERR(file))
- goto no_file;
-
-- id = ipc_addid(&shm_ids(ns), &shp->shm_perm, ns->shm_ctlmni);
-- if (id < 0) {
-- error = id;
-- goto no_id;
-- }
--
- shp->shm_cprid = task_tgid_vnr(current);
- shp->shm_lprid = 0;
- shp->shm_atim = shp->shm_dtim = 0;
-@@ -562,6 +556,12 @@ static int newseg(struct ipc_namespace *
- shp->shm_file = file;
- shp->shm_creator = current;
-
-+ id = ipc_addid(&shm_ids(ns), &shp->shm_perm, ns->shm_ctlmni);
-+ if (id < 0) {
-+ error = id;
-+ goto no_id;
-+ }
-+
- /*
- * shmid gets reported as "inode#" in /proc/pid/maps.
- * proc-ps tools use this. Changing this will break them.
---- a/ipc/util.c
-+++ b/ipc/util.c
-@@ -277,6 +277,10 @@ int ipc_addid(struct ipc_ids *ids, struc
- rcu_read_lock();
- spin_lock(&new->lock);
-
-+ current_euid_egid(&euid, &egid);
-+ new->cuid = new->uid = euid;
-+ new->gid = new->cgid = egid;
-+
- id = idr_alloc(&ids->ipcs_idr, new,
- (next_id < 0) ? 0 : ipcid_to_idx(next_id), 0,
- GFP_NOWAIT);
-@@ -289,10 +293,6 @@ int ipc_addid(struct ipc_ids *ids, struc
-
- ids->in_use++;
-
-- current_euid_egid(&euid, &egid);
-- new->cuid = new->uid = euid;
-- new->gid = new->cgid = egid;
--
- if (next_id < 0) {
- new->seq = ids->seq++;
- if (ids->seq > IPCID_SEQ_MAX)
diff --git a/debian/patches/bugfix/all/KEYS-Don-t-permit-request_key-to-construct-a-new-key.patch b/debian/patches/bugfix/all/KEYS-Don-t-permit-request_key-to-construct-a-new-key.patch
deleted file mode 100644
index e2859ca..0000000
--- a/debian/patches/bugfix/all/KEYS-Don-t-permit-request_key-to-construct-a-new-key.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From: David Howells <dhowells at redhat.com>
-Date: Mon, 19 Oct 2015 11:20:28 +0100
-Subject: KEYS: Don't permit request_key() to construct a new keyring
-Origin: https://git.kernel.org/linus/911b79cde95c7da0ec02f48105358a36636b7a71
-
-If request_key() is used to find a keyring, only do the search part - don't
-do the construction part if the keyring was not found by the search. We
-don't really want keyrings in the negative instantiated state since the
-rejected/negative instantiation error value in the payload is unioned with
-keyring metadata.
-
-Now the kernel gives an error:
-
- request_key("keyring", "#selinux,bdekeyring", "keyring", KEY_SPEC_USER_SESSION_KEYRING) = -1 EPERM (Operation not permitted)
-
-Signed-off-by: David Howells <dhowells at redhat.com>
----
- security/keys/request_key.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/security/keys/request_key.c b/security/keys/request_key.c
-index 486ef6f..0d62531 100644
---- a/security/keys/request_key.c
-+++ b/security/keys/request_key.c
-@@ -440,6 +440,9 @@ static struct key *construct_key_and_link(struct keyring_search_context *ctx,
-
- kenter("");
-
-+ if (ctx->index_key.type == &key_type_keyring)
-+ return ERR_PTR(-EPERM);
-+
- user = key_user_lookup(current_fsuid());
- if (!user)
- return ERR_PTR(-ENOMEM);
---
-2.6.1
-
diff --git a/debian/patches/bugfix/all/KEYS-Fix-crash-when-attempt-to-garbage-collect-an-un.patch b/debian/patches/bugfix/all/KEYS-Fix-crash-when-attempt-to-garbage-collect-an-un.patch
deleted file mode 100644
index 4369a05..0000000
--- a/debian/patches/bugfix/all/KEYS-Fix-crash-when-attempt-to-garbage-collect-an-un.patch
+++ /dev/null
@@ -1,79 +0,0 @@
-From: David Howells <dhowells at redhat.com>
-Date: Thu, 15 Oct 2015 17:21:37 +0100
-Subject: KEYS: Fix crash when attempt to garbage collect an uninstantiated
- keyring
-Origin: https://git.kernel.org/linus/f05819df10d7b09f6d1eb6f8534a8f68e5a4fe61
-
-The following sequence of commands:
-
- i=`keyctl add user a a @s`
- keyctl request2 keyring foo bar @t
- keyctl unlink $i @s
-
-tries to invoke an upcall to instantiate a keyring if one doesn't already
-exist by that name within the user's keyring set. However, if the upcall
-fails, the code sets keyring->type_data.reject_error to -ENOKEY or some
-other error code. When the key is garbage collected, the key destroy
-function is called unconditionally and keyring_destroy() uses list_empty()
-on keyring->type_data.link - which is in a union with reject_error.
-Subsequently, the kernel tries to unlink the keyring from the keyring names
-list - which oopses like this:
-
- BUG: unable to handle kernel paging request at 00000000ffffff8a
- IP: [<ffffffff8126e051>] keyring_destroy+0x3d/0x88
- ...
- Workqueue: events key_garbage_collector
- ...
- RIP: 0010:[<ffffffff8126e051>] keyring_destroy+0x3d/0x88
- RSP: 0018:ffff88003e2f3d30 EFLAGS: 00010203
- RAX: 00000000ffffff82 RBX: ffff88003bf1a900 RCX: 0000000000000000
- RDX: 0000000000000000 RSI: 000000003bfc6901 RDI: ffffffff81a73a40
- RBP: ffff88003e2f3d38 R08: 0000000000000152 R09: 0000000000000000
- R10: ffff88003e2f3c18 R11: 000000000000865b R12: ffff88003bf1a900
- R13: 0000000000000000 R14: ffff88003bf1a908 R15: ffff88003e2f4000
- ...
- CR2: 00000000ffffff8a CR3: 000000003e3ec000 CR4: 00000000000006f0
- ...
- Call Trace:
- [<ffffffff8126c756>] key_gc_unused_keys.constprop.1+0x5d/0x10f
- [<ffffffff8126ca71>] key_garbage_collector+0x1fa/0x351
- [<ffffffff8105ec9b>] process_one_work+0x28e/0x547
- [<ffffffff8105fd17>] worker_thread+0x26e/0x361
- [<ffffffff8105faa9>] ? rescuer_thread+0x2a8/0x2a8
- [<ffffffff810648ad>] kthread+0xf3/0xfb
- [<ffffffff810647ba>] ? kthread_create_on_node+0x1c2/0x1c2
- [<ffffffff815f2ccf>] ret_from_fork+0x3f/0x70
- [<ffffffff810647ba>] ? kthread_create_on_node+0x1c2/0x1c2
-
-Note the value in RAX. This is a 32-bit representation of -ENOKEY.
-
-The solution is to only call ->destroy() if the key was successfully
-instantiated.
-
-Reported-by: Dmitry Vyukov <dvyukov at google.com>
-Signed-off-by: David Howells <dhowells at redhat.com>
-Tested-by: Dmitry Vyukov <dvyukov at google.com>
----
- security/keys/gc.c | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/security/keys/gc.c b/security/keys/gc.c
-index 39eac1f..addf060 100644
---- a/security/keys/gc.c
-+++ b/security/keys/gc.c
-@@ -134,8 +134,10 @@ static noinline void key_gc_unused_keys(struct list_head *keys)
- kdebug("- %u", key->serial);
- key_check(key);
-
-- /* Throw away the key data */
-- if (key->type->destroy)
-+ /* Throw away the key data if the key is instantiated */
-+ if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags) &&
-+ !test_bit(KEY_FLAG_NEGATIVE, &key->flags) &&
-+ key->type->destroy)
- key->type->destroy(key);
-
- security_key_free(key);
---
-2.6.1
-
diff --git a/debian/patches/bugfix/all/KEYS-Fix-race-between-key-destruction-and-finding-a-.patch b/debian/patches/bugfix/all/KEYS-Fix-race-between-key-destruction-and-finding-a-.patch
deleted file mode 100644
index 3e779c3..0000000
--- a/debian/patches/bugfix/all/KEYS-Fix-race-between-key-destruction-and-finding-a-.patch
+++ /dev/null
@@ -1,52 +0,0 @@
-From: David Howells <dhowells at redhat.com>
-Date: Fri, 25 Sep 2015 16:30:08 +0100
-Subject: KEYS: Fix race between key destruction and finding a keyring by name
-Origin: https://git.kernel.org/linus/94c4554ba07adbdde396748ee7ae01e86cf2d8d7
-
-There appears to be a race between:
-
- (1) key_gc_unused_keys() which frees key->security and then calls
- keyring_destroy() to unlink the name from the name list
-
- (2) find_keyring_by_name() which calls key_permission(), thus accessing
- key->security, on a key before checking to see whether the key usage is 0
- (ie. the key is dead and might be cleaned up).
-
-Fix this by calling ->destroy() before cleaning up the core key data -
-including key->security.
-
-Reported-by: Petr Matousek <pmatouse at redhat.com>
-Signed-off-by: David Howells <dhowells at redhat.com>
----
- security/keys/gc.c | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/security/keys/gc.c b/security/keys/gc.c
-index c795237..39eac1f 100644
---- a/security/keys/gc.c
-+++ b/security/keys/gc.c
-@@ -134,6 +134,10 @@ static noinline void key_gc_unused_keys(struct list_head *keys)
- kdebug("- %u", key->serial);
- key_check(key);
-
-+ /* Throw away the key data */
-+ if (key->type->destroy)
-+ key->type->destroy(key);
-+
- security_key_free(key);
-
- /* deal with the user's key tracking and quota */
-@@ -148,10 +152,6 @@ static noinline void key_gc_unused_keys(struct list_head *keys)
- if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags))
- atomic_dec(&key->user->nikeys);
-
-- /* now throw away the key memory */
-- if (key->type->destroy)
-- key->type->destroy(key);
--
- key_user_put(key->user);
-
- kfree(key->description);
---
-2.6.1
-
diff --git a/debian/patches/bugfix/all/dcache-handle-escaped-paths-in-prepend_path.patch b/debian/patches/bugfix/all/dcache-handle-escaped-paths-in-prepend_path.patch
deleted file mode 100644
index e038e06..0000000
--- a/debian/patches/bugfix/all/dcache-handle-escaped-paths-in-prepend_path.patch
+++ /dev/null
@@ -1,58 +0,0 @@
-From: "Eric W. Biederman" <ebiederm at xmission.com>
-Date: Sat, 15 Aug 2015 13:36:12 -0500
-Subject: dcache: Handle escaped paths in prepend_path
-Origin: https://git.kernel.org/linus/cde93be45a8a90d8c264c776fab63487b5038a65
-
-A rename can result in a dentry that by walking up d_parent
-will never reach it's mnt_root. For lack of a better term
-I call this an escaped path.
-
-prepend_path is called by four different functions __d_path,
-d_absolute_path, d_path, and getcwd.
-
-__d_path only wants to see paths are connected to the root it passes
-in. So __d_path needs prepend_path to return an error.
-
-d_absolute_path similarly wants to see paths that are connected to
-some root. Escaped paths are not connected to any mnt_root so
-d_absolute_path needs prepend_path to return an error greater
-than 1. So escaped paths will be treated like paths on lazily
-unmounted mounts.
-
-getcwd needs to prepend "(unreachable)" so getcwd also needs
-prepend_path to return an error.
-
-d_path is the interesting hold out. d_path just wants to print
-something, and does not care about the weird cases. Which raises
-the question what should be printed?
-
-Given that <escaped_path>/<anything> should result in -ENOENT I
-believe it is desirable for escaped paths to be printed as empty
-paths. As there are not really any meaninful path components when
-considered from the perspective of a mount tree.
-
-So tweak prepend_path to return an empty path with an new error
-code of 3 when it encounters an escaped path.
-
-Signed-off-by: "Eric W. Biederman" <ebiederm at xmission.com>
-Signed-off-by: Al Viro <viro at zeniv.linux.org.uk>
----
- fs/dcache.c | 7 +++++++
- 1 file changed, 7 insertions(+)
-
---- a/fs/dcache.c
-+++ b/fs/dcache.c
-@@ -2909,6 +2909,13 @@ restart:
-
- if (dentry == vfsmnt->mnt_root || IS_ROOT(dentry)) {
- struct mount *parent = ACCESS_ONCE(mnt->mnt_parent);
-+ /* Escaped? */
-+ if (dentry != vfsmnt->mnt_root) {
-+ bptr = *buffer;
-+ blen = *buflen;
-+ error = 3;
-+ break;
-+ }
- /* Global root? */
- if (mnt != parent) {
- dentry = ACCESS_ONCE(mnt->mnt_mountpoint);
diff --git a/debian/patches/bugfix/all/ipc-sem.c-fully-initialize-sem_array-before-making-i.patch b/debian/patches/bugfix/all/ipc-sem.c-fully-initialize-sem_array-before-making-i.patch
deleted file mode 100644
index 4d10d15..0000000
--- a/debian/patches/bugfix/all/ipc-sem.c-fully-initialize-sem_array-before-making-i.patch
+++ /dev/null
@@ -1,60 +0,0 @@
-From: Manfred Spraul <manfred at colorfullife.com>
-Date: Tue, 2 Dec 2014 15:59:34 -0800
-Subject: ipc/sem.c: fully initialize sem_array before making it visible
-Origin: https://git.kernel.org/linus/e8577d1f0329d4842e8302e289fb2c22156abef4
-
-ipc_addid() makes a new ipc identifier visible to everyone. New objects
-start as locked, so that the caller can complete the initialization
-after the call. Within struct sem_array, at least sma->sem_base and
-sma->sem_nsems are accessed without any locks, therefore this approach
-doesn't work.
-
-Thus: Move the ipc_addid() to the end of the initialization.
-
-Signed-off-by: Manfred Spraul <manfred at colorfullife.com>
-Reported-by: Rik van Riel <riel at redhat.com>
-Acked-by: Rik van Riel <riel at redhat.com>
-Acked-by: Davidlohr Bueso <dave at stgolabs.net>
-Acked-by: Rafael Aquini <aquini at redhat.com>
-Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
-Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
----
- ipc/sem.c | 15 ++++++++-------
- 1 file changed, 8 insertions(+), 7 deletions(-)
-
-diff --git a/ipc/sem.c b/ipc/sem.c
-index 454f6c6..53c3310 100644
---- a/ipc/sem.c
-+++ b/ipc/sem.c
-@@ -507,13 +507,6 @@ static int newary(struct ipc_namespace *ns, struct ipc_params *params)
- return retval;
- }
-
-- id = ipc_addid(&sem_ids(ns), &sma->sem_perm, ns->sc_semmni);
-- if (id < 0) {
-- ipc_rcu_putref(sma, sem_rcu_free);
-- return id;
-- }
-- ns->used_sems += nsems;
--
- sma->sem_base = (struct sem *) &sma[1];
-
- for (i = 0; i < nsems; i++) {
-@@ -528,6 +521,14 @@ static int newary(struct ipc_namespace *ns, struct ipc_params *params)
- INIT_LIST_HEAD(&sma->list_id);
- sma->sem_nsems = nsems;
- sma->sem_ctime = get_seconds();
-+
-+ id = ipc_addid(&sem_ids(ns), &sma->sem_perm, ns->sc_semmni);
-+ if (id < 0) {
-+ ipc_rcu_putref(sma, sem_rcu_free);
-+ return id;
-+ }
-+ ns->used_sems += nsems;
-+
- sem_unlock(sma, -1);
- rcu_read_unlock();
-
---
-2.6.0
-
diff --git a/debian/patches/bugfix/all/namei-lift-open-coded-terminate_walk-in-follow_dotdo.patch b/debian/patches/bugfix/all/namei-lift-open-coded-terminate_walk-in-follow_dotdo.patch
deleted file mode 100644
index 82d4dfa..0000000
--- a/debian/patches/bugfix/all/namei-lift-open-coded-terminate_walk-in-follow_dotdo.patch
+++ /dev/null
@@ -1,66 +0,0 @@
-From: Al Viro <viro at zeniv.linux.org.uk>
-Date: Mon, 4 May 2015 07:53:00 -0400
-Subject: namei: lift (open-coded) terminate_walk() in follow_dotdot_rcu() into
- callers
-Origin: https://git.kernel.org/linus/70291aecc6aa228c1b3bb36a5f3efdb0af636042
-
-follow_dotdot_rcu() does an equivalent of terminate_walk() on failure;
-shifting it into callers makes for simpler rules and those callers
-already have terminate_walk() on other failure exits.
-
-Signed-off-by: Al Viro <viro at zeniv.linux.org.uk>
-[bwh: Backported to 3.16: adjust context]
----
- fs/namei.c | 19 ++++++++++---------
- 1 file changed, 10 insertions(+), 9 deletions(-)
-
---- a/fs/namei.c
-+++ b/fs/namei.c
-@@ -1178,10 +1178,6 @@ static int follow_dotdot_rcu(struct name
- return 0;
-
- failed:
-- nd->flags &= ~LOOKUP_RCU;
-- if (!(nd->flags & LOOKUP_ROOT))
-- nd->root.mnt = NULL;
-- rcu_read_unlock();
- return -ECHILD;
- }
-
-@@ -1494,8 +1490,7 @@ static inline int handle_dots(struct nam
- {
- if (type == LAST_DOTDOT) {
- if (nd->flags & LOOKUP_RCU) {
-- if (follow_dotdot_rcu(nd))
-- return -ECHILD;
-+ return follow_dotdot_rcu(nd);
- } else
- follow_dotdot(nd);
- }
-@@ -1535,8 +1530,12 @@ static inline int walk_component(struct
- * to be able to know about the current root directory and
- * parent relationships.
- */
-- if (unlikely(nd->last_type != LAST_NORM))
-- return handle_dots(nd, nd->last_type);
-+ if (unlikely(nd->last_type != LAST_NORM)) {
-+ err = handle_dots(nd, nd->last_type);
-+ if (err)
-+ goto out_err;
-+ return 0;
-+ }
- err = lookup_fast(nd, path, &inode);
- if (unlikely(err)) {
- if (err < 0)
-@@ -2904,8 +2903,10 @@ static int do_last(struct nameidata *nd,
-
- if (nd->last_type != LAST_NORM) {
- error = handle_dots(nd, nd->last_type);
-- if (error)
-+ if (unlikely(error)) {
-+ terminate_walk(nd);
- return error;
-+ }
- goto finish_open;
- }
-
diff --git a/debian/patches/bugfix/all/usb-whiteheat-fix-potential-null-deref-at-probe.patch b/debian/patches/bugfix/all/usb-whiteheat-fix-potential-null-deref-at-probe.patch
deleted file mode 100644
index 4380958..0000000
--- a/debian/patches/bugfix/all/usb-whiteheat-fix-potential-null-deref-at-probe.patch
+++ /dev/null
@@ -1,79 +0,0 @@
-From: Johan Hovold <johan at kernel.org>
-Date: Wed, 23 Sep 2015 11:41:42 -0700
-Subject: USB: whiteheat: fix potential null-deref at probe
-Origin: https://git.kernel.org/cgit/linux/kernel/git/gregkh/usb.git/commit?id=cbb4be652d374f64661137756b8f357a1827d6a4
-
-Fix potential null-pointer dereference at probe by making sure that the
-required endpoints are present.
-
-The whiteheat driver assumes there are at least five pairs of bulk
-endpoints, of which the final pair is used for the "command port". An
-attempt to bind to an interface with fewer bulk endpoints would
-currently lead to an oops.
-
-Fixes CVE-2015-5257.
-
-Reported-by: Moein Ghasemzadeh <moein at istuary.com>
-Cc: stable <stable at vger.kernel.org>
-Signed-off-by: Johan Hovold <johan at kernel.org>
-Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
----
- drivers/usb/serial/whiteheat.c | 31 +++++++++++++++++++++++++++++++
- 1 file changed, 31 insertions(+)
-
-diff --git a/drivers/usb/serial/whiteheat.c b/drivers/usb/serial/whiteheat.c
-index 6c3734d..d3ea90b 100644
---- a/drivers/usb/serial/whiteheat.c
-+++ b/drivers/usb/serial/whiteheat.c
-@@ -80,6 +80,8 @@ static int whiteheat_firmware_download(struct usb_serial *serial,
- static int whiteheat_firmware_attach(struct usb_serial *serial);
-
- /* function prototypes for the Connect Tech WhiteHEAT serial converter */
-+static int whiteheat_probe(struct usb_serial *serial,
-+ const struct usb_device_id *id);
- static int whiteheat_attach(struct usb_serial *serial);
- static void whiteheat_release(struct usb_serial *serial);
- static int whiteheat_port_probe(struct usb_serial_port *port);
-@@ -116,6 +118,7 @@ static struct usb_serial_driver whiteheat_device = {
- .description = "Connect Tech - WhiteHEAT",
- .id_table = id_table_std,
- .num_ports = 4,
-+ .probe = whiteheat_probe,
- .attach = whiteheat_attach,
- .release = whiteheat_release,
- .port_probe = whiteheat_port_probe,
-@@ -217,6 +220,34 @@ static int whiteheat_firmware_attach(struct usb_serial *serial)
- /*****************************************************************************
- * Connect Tech's White Heat serial driver functions
- *****************************************************************************/
-+
-+static int whiteheat_probe(struct usb_serial *serial,
-+ const struct usb_device_id *id)
-+{
-+ struct usb_host_interface *iface_desc;
-+ struct usb_endpoint_descriptor *endpoint;
-+ size_t num_bulk_in = 0;
-+ size_t num_bulk_out = 0;
-+ size_t min_num_bulk;
-+ unsigned int i;
-+
-+ iface_desc = serial->interface->cur_altsetting;
-+
-+ for (i = 0; i < iface_desc->desc.bNumEndpoints; i++) {
-+ endpoint = &iface_desc->endpoint[i].desc;
-+ if (usb_endpoint_is_bulk_in(endpoint))
-+ ++num_bulk_in;
-+ if (usb_endpoint_is_bulk_out(endpoint))
-+ ++num_bulk_out;
-+ }
-+
-+ min_num_bulk = COMMAND_PORT + 1;
-+ if (num_bulk_in < min_num_bulk || num_bulk_out < min_num_bulk)
-+ return -ENODEV;
-+
-+ return 0;
-+}
-+
- static int whiteheat_attach(struct usb_serial *serial)
- {
- struct usb_serial_port *command_port;
diff --git a/debian/patches/bugfix/all/vfs-test-for-and-handle-paths-that-are-unreachable-f.patch b/debian/patches/bugfix/all/vfs-test-for-and-handle-paths-that-are-unreachable-f.patch
deleted file mode 100644
index 751d512..0000000
--- a/debian/patches/bugfix/all/vfs-test-for-and-handle-paths-that-are-unreachable-f.patch
+++ /dev/null
@@ -1,103 +0,0 @@
-From: "Eric W. Biederman" <ebiederm at xmission.com>
-Date: Sat, 15 Aug 2015 20:27:13 -0500
-Subject: vfs: Test for and handle paths that are unreachable from their mnt_root
-Origin: https://git.kernel.org/linus/397d425dc26da728396e66d392d5dcb8dac30c37
-
-In rare cases a directory can be renamed out from under a bind mount.
-In those cases without special handling it becomes possible to walk up
-the directory tree to the root dentry of the filesystem and down
-from the root dentry to every other file or directory on the filesystem.
-
-Like division by zero .. from an unconnected path can not be given
-a useful semantic as there is no predicting at which path component
-the code will realize it is unconnected. We certainly can not match
-the current behavior as the current behavior is a security hole.
-
-Therefore when encounting .. when following an unconnected path
-return -ENOENT.
-
-- Add a function path_connected to verify path->dentry is reachable
- from path->mnt.mnt_root. AKA to validate that rename did not do
- something nasty to the bind mount.
-
- To avoid races path_connected must be called after following a path
- component to it's next path component.
-
-Signed-off-by: "Eric W. Biederman" <ebiederm at xmission.com>
-Signed-off-by: Al Viro <viro at zeniv.linux.org.uk>
-[bwh: Backported to 3.16: adjust context]
----
- fs/namei.c | 27 +++++++++++++++++++++++++--
- 1 file changed, 25 insertions(+), 2 deletions(-)
-
---- a/fs/namei.c
-+++ b/fs/namei.c
-@@ -486,6 +486,24 @@ void path_put(const struct path *path)
- }
- EXPORT_SYMBOL(path_put);
-
-+/**
-+ * path_connected - Verify that a path->dentry is below path->mnt.mnt_root
-+ * @path: nameidate to verify
-+ *
-+ * Rename can sometimes move a file or directory outside of a bind
-+ * mount, path_connected allows those cases to be detected.
-+ */
-+static bool path_connected(const struct path *path)
-+{
-+ struct vfsmount *mnt = path->mnt;
-+
-+ /* Only bind mounts can have disconnected paths */
-+ if (mnt->mnt_root == mnt->mnt_sb->s_root)
-+ return true;
-+
-+ return is_subdir(path->dentry, mnt->mnt_root);
-+}
-+
- /*
- * Path walking has 2 modes, rcu-walk and ref-walk (see
- * Documentation/filesystems/path-lookup.txt). In situations when we can't
-@@ -1155,6 +1173,8 @@ static int follow_dotdot_rcu(struct name
- goto failed;
- nd->path.dentry = parent;
- nd->seq = seq;
-+ if (unlikely(!path_connected(&nd->path)))
-+ return -ENOENT;
- break;
- }
- if (!follow_up_rcu(&nd->path))
-@@ -1247,7 +1267,7 @@ static void follow_mount(struct path *pa
- }
- }
-
--static void follow_dotdot(struct nameidata *nd)
-+static int follow_dotdot(struct nameidata *nd)
- {
- if (!nd->root.mnt)
- set_root(nd);
-@@ -1263,6 +1283,8 @@ static void follow_dotdot(struct nameida
- /* rare case of legitimate dget_parent()... */
- nd->path.dentry = dget_parent(nd->path.dentry);
- dput(old);
-+ if (unlikely(!path_connected(&nd->path)))
-+ return -ENOENT;
- break;
- }
- if (!follow_up(&nd->path))
-@@ -1270,6 +1292,7 @@ static void follow_dotdot(struct nameida
- }
- follow_mount(&nd->path);
- nd->inode = nd->path.dentry->d_inode;
-+ return 0;
- }
-
- /*
-@@ -1492,7 +1515,7 @@ static inline int handle_dots(struct nam
- if (nd->flags & LOOKUP_RCU) {
- return follow_dotdot_rcu(nd);
- } else
-- follow_dotdot(nd);
-+ return follow_dotdot(nd);
- }
- return 0;
- }
diff --git a/debian/patches/bugfix/all/xen-netfront-release-per-queue-Tx-and-Rx-resource-wh.patch b/debian/patches/bugfix/all/xen-netfront-release-per-queue-Tx-and-Rx-resource-wh.patch
index 0ccc5e2..ee65a0e 100644
--- a/debian/patches/bugfix/all/xen-netfront-release-per-queue-Tx-and-Rx-resource-wh.patch
+++ b/debian/patches/bugfix/all/xen-netfront-release-per-queue-Tx-and-Rx-resource-wh.patch
@@ -24,11 +24,9 @@ Signed-off-by: David S. Miller <davem at davemloft.net>
drivers/net/xen-netfront.c | 68 +++++-----------------------------------------
1 file changed, 7 insertions(+), 61 deletions(-)
-diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
-index 1cc46d0..0b133a3 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
-@@ -1196,22 +1196,6 @@ static void xennet_release_rx_bufs(struct netfront_queue *queue)
+@@ -1194,22 +1194,6 @@ static void xennet_release_rx_bufs(struc
spin_unlock_bh(&queue->rx_lock);
}
@@ -51,7 +49,7 @@ index 1cc46d0..0b133a3 100644
static netdev_features_t xennet_fix_features(struct net_device *dev,
netdev_features_t features)
{
-@@ -1313,7 +1297,6 @@ static void xennet_poll_controller(struct net_device *dev)
+@@ -1311,7 +1295,6 @@ static void xennet_poll_controller(struc
static const struct net_device_ops xennet_netdev_ops = {
.ndo_open = xennet_open,
@@ -59,9 +57,9 @@ index 1cc46d0..0b133a3 100644
.ndo_stop = xennet_close,
.ndo_start_xmit = xennet_start_xmit,
.ndo_change_mtu = xennet_change_mtu,
-@@ -1455,6 +1438,11 @@ static void xennet_disconnect_backend(struct netfront_info *info)
-
- napi_synchronize(&queue->napi);
+@@ -1452,6 +1435,11 @@ static void xennet_disconnect_backend(st
+ if (netif_running(info->netdev))
+ napi_synchronize(&queue->napi);
+ xennet_release_tx_bufs(queue);
+ xennet_release_rx_bufs(queue);
@@ -71,7 +69,7 @@ index 1cc46d0..0b133a3 100644
/* End access and free the pages */
xennet_end_access(queue->tx_ring_ref, queue->tx.sring);
xennet_end_access(queue->rx_ring_ref, queue->rx.sring);
-@@ -2010,10 +1998,7 @@ static int xennet_connect(struct net_device *dev)
+@@ -2007,10 +1995,7 @@ static int xennet_connect(struct net_dev
{
struct netfront_info *np = netdev_priv(dev);
unsigned int num_queues = 0;
@@ -83,7 +81,7 @@ index 1cc46d0..0b133a3 100644
unsigned int feature_rx_copy;
unsigned int j = 0;
struct netfront_queue *queue = NULL;
-@@ -2040,47 +2025,8 @@ static int xennet_connect(struct net_device *dev)
+@@ -2037,47 +2022,8 @@ static int xennet_connect(struct net_dev
netdev_update_features(dev);
rtnl_unlock();
@@ -132,6 +130,3 @@ index 1cc46d0..0b133a3 100644
* ready to start sending and receiving packets and give the driver
* domain a kick because we've probably just requeued some
* packets.
---
-2.1.4
-
diff --git a/debian/patches/bugfix/arm/revert-arm-orion5x-fix-legacy-orion5x-irq-numbers.patch b/debian/patches/bugfix/arm/revert-arm-orion5x-fix-legacy-orion5x-irq-numbers.patch
deleted file mode 100644
index 7a56395..0000000
--- a/debian/patches/bugfix/arm/revert-arm-orion5x-fix-legacy-orion5x-irq-numbers.patch
+++ /dev/null
@@ -1,115 +0,0 @@
-From: Ben Hutchings <ben at decadent.org.uk>
-Subject: Revert "ARM: orion5x: fix legacy orion5x IRQ numbers"
-Forwarded: http://mid.gmane.org/1444879386.31451.42.camel@decadent.org.uk
-
-This reverts commit b5614b199b9990b015ae0973db5adf53e7be1651, which was
-commit 5be9fc23cdb42e1d383ecc8eae8a8ff70a752708 upstream. The bug it
-fixes was introduced in 3.18.
-
---- a/arch/arm/Kconfig
-+++ b/arch/arm/Kconfig
-@@ -565,7 +565,6 @@ config ARCH_ORION5X
- select MVEBU_MBUS
- select PCI
- select PLAT_ORION_LEGACY
-- select MULTI_IRQ_HANDLER
- help
- Support for the following Marvell Orion 5x series SoCs:
- Orion-1 (5181), Orion-VoIP (5181L), Orion-NAS (5182),
---- a/arch/arm/mach-orion5x/include/mach/irqs.h
-+++ b/arch/arm/mach-orion5x/include/mach/irqs.h
-@@ -16,42 +16,42 @@
- /*
- * Orion Main Interrupt Controller
- */
--#define IRQ_ORION5X_BRIDGE (1 + 0)
--#define IRQ_ORION5X_DOORBELL_H2C (1 + 1)
--#define IRQ_ORION5X_DOORBELL_C2H (1 + 2)
--#define IRQ_ORION5X_UART0 (1 + 3)
--#define IRQ_ORION5X_UART1 (1 + 4)
--#define IRQ_ORION5X_I2C (1 + 5)
--#define IRQ_ORION5X_GPIO_0_7 (1 + 6)
--#define IRQ_ORION5X_GPIO_8_15 (1 + 7)
--#define IRQ_ORION5X_GPIO_16_23 (1 + 8)
--#define IRQ_ORION5X_GPIO_24_31 (1 + 9)
--#define IRQ_ORION5X_PCIE0_ERR (1 + 10)
--#define IRQ_ORION5X_PCIE0_INT (1 + 11)
--#define IRQ_ORION5X_USB1_CTRL (1 + 12)
--#define IRQ_ORION5X_DEV_BUS_ERR (1 + 14)
--#define IRQ_ORION5X_PCI_ERR (1 + 15)
--#define IRQ_ORION5X_USB_BR_ERR (1 + 16)
--#define IRQ_ORION5X_USB0_CTRL (1 + 17)
--#define IRQ_ORION5X_ETH_RX (1 + 18)
--#define IRQ_ORION5X_ETH_TX (1 + 19)
--#define IRQ_ORION5X_ETH_MISC (1 + 20)
--#define IRQ_ORION5X_ETH_SUM (1 + 21)
--#define IRQ_ORION5X_ETH_ERR (1 + 22)
--#define IRQ_ORION5X_IDMA_ERR (1 + 23)
--#define IRQ_ORION5X_IDMA_0 (1 + 24)
--#define IRQ_ORION5X_IDMA_1 (1 + 25)
--#define IRQ_ORION5X_IDMA_2 (1 + 26)
--#define IRQ_ORION5X_IDMA_3 (1 + 27)
--#define IRQ_ORION5X_CESA (1 + 28)
--#define IRQ_ORION5X_SATA (1 + 29)
--#define IRQ_ORION5X_XOR0 (1 + 30)
--#define IRQ_ORION5X_XOR1 (1 + 31)
-+#define IRQ_ORION5X_BRIDGE 0
-+#define IRQ_ORION5X_DOORBELL_H2C 1
-+#define IRQ_ORION5X_DOORBELL_C2H 2
-+#define IRQ_ORION5X_UART0 3
-+#define IRQ_ORION5X_UART1 4
-+#define IRQ_ORION5X_I2C 5
-+#define IRQ_ORION5X_GPIO_0_7 6
-+#define IRQ_ORION5X_GPIO_8_15 7
-+#define IRQ_ORION5X_GPIO_16_23 8
-+#define IRQ_ORION5X_GPIO_24_31 9
-+#define IRQ_ORION5X_PCIE0_ERR 10
-+#define IRQ_ORION5X_PCIE0_INT 11
-+#define IRQ_ORION5X_USB1_CTRL 12
-+#define IRQ_ORION5X_DEV_BUS_ERR 14
-+#define IRQ_ORION5X_PCI_ERR 15
-+#define IRQ_ORION5X_USB_BR_ERR 16
-+#define IRQ_ORION5X_USB0_CTRL 17
-+#define IRQ_ORION5X_ETH_RX 18
-+#define IRQ_ORION5X_ETH_TX 19
-+#define IRQ_ORION5X_ETH_MISC 20
-+#define IRQ_ORION5X_ETH_SUM 21
-+#define IRQ_ORION5X_ETH_ERR 22
-+#define IRQ_ORION5X_IDMA_ERR 23
-+#define IRQ_ORION5X_IDMA_0 24
-+#define IRQ_ORION5X_IDMA_1 25
-+#define IRQ_ORION5X_IDMA_2 26
-+#define IRQ_ORION5X_IDMA_3 27
-+#define IRQ_ORION5X_CESA 28
-+#define IRQ_ORION5X_SATA 29
-+#define IRQ_ORION5X_XOR0 30
-+#define IRQ_ORION5X_XOR1 31
-
- /*
- * Orion General Purpose Pins
- */
--#define IRQ_ORION5X_GPIO_START 33
-+#define IRQ_ORION5X_GPIO_START 32
- #define NR_GPIO_IRQS 32
-
- #define NR_IRQS (IRQ_ORION5X_GPIO_START + NR_GPIO_IRQS)
---- a/arch/arm/mach-orion5x/irq.c
-+++ b/arch/arm/mach-orion5x/irq.c
-@@ -42,7 +42,7 @@ __exception_irq_entry orion5x_legacy_han
- stat = readl_relaxed(MAIN_IRQ_CAUSE);
- stat &= readl_relaxed(MAIN_IRQ_MASK);
- if (stat) {
-- unsigned int hwirq = 1 + __fls(stat);
-+ unsigned int hwirq = __fls(stat);
- handle_IRQ(hwirq, regs);
- return;
- }
-@@ -51,7 +51,7 @@ __exception_irq_entry orion5x_legacy_han
-
- void __init orion5x_init_irq(void)
- {
-- orion_irq_init(1, MAIN_IRQ_MASK);
-+ orion_irq_init(0, MAIN_IRQ_MASK);
-
- #ifdef CONFIG_MULTI_IRQ_HANDLER
- set_handle_irq(orion5x_legacy_handle_irq);
diff --git a/debian/patches/series b/debian/patches/series
index 5da4c61..e378cc6 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -631,21 +631,11 @@ debian/bh-avoid-abi-change-in-3.16.7-ckt17.patch
debian/net-sched-avoid-abi-change-in-3.16.7-ckt17.patch
debian/netlink-fix-abi-change-in-3.16.7-ckt18.patch
-bugfix/all/namei-lift-open-coded-terminate_walk-in-follow_dotdo.patch
-bugfix/all/dcache-handle-escaped-paths-in-prepend_path.patch
-bugfix/all/vfs-test-for-and-handle-paths-that-are-unreachable-f.patch
-bugfix/all/usb-whiteheat-fix-potential-null-deref-at-probe.patch
-bugfix/all/ipc-sem.c-fully-initialize-sem_array-before-making-i.patch
-bugfix/all/Initialize-msg-shm-IPC-objects-before-doing-ipc_addid.patch
bugfix/x86/i2c-i801-Use-wait_event_timeout-to-wait-for-interrup.patch
bugfix/all/media-uvcvideo-disable-hardware-timestamps-by-defaul.patch
bugfix/all/nbd-fix-timeout-detection.patch
bugfix/all/nbd-remove-variable-pid.patch
bugfix/all/nbd-add-locking-for-tasks.patch
-bugfix/arm/revert-arm-orion5x-fix-legacy-orion5x-irq-numbers.patch
-bugfix/all/KEYS-Fix-race-between-key-destruction-and-finding-a-.patch
-bugfix/all/KEYS-Fix-crash-when-attempt-to-garbage-collect-an-un.patch
-bugfix/all/KEYS-Don-t-permit-request_key-to-construct-a-new-key.patch
bugfix/all/usbvision-fix-overflow-of-interfaces-array.patch
bugfix/all/rds-fix-race-condition-when-sending-a-message-on-unbound-socket.patch
bugfix/x86/kvm-x86-vmx-avoid-guest-host-dos-by-intercepting-ac.patch
--
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/kernel/linux.git
More information about the Kernel-svn-changes
mailing list