[linux] 05/07: Remove patches included in 4.9.82
debian-kernel at lists.debian.org
debian-kernel at lists.debian.org
Sat Feb 17 17:38:39 UTC 2018
This is an automated email from the git hooks/post-receive script.
corsac pushed a commit to branch stretch
in repository linux.
commit 60b8ab9d790adc6eead0d6bc52a5e30e033ab732
Author: Yves-Alexis Perez <corsac at corsac.net>
Date: Sat Feb 17 15:58:30 2018 +0100
Remove patches included in 4.9.82
---
debian/changelog | 1 +
...cve-2017-8824-use-after-free-in-dccp-code.patch | 38 ---------
...sb-v2-lmedm04-Improve-logic-checking-of-w.patch | 83 ------------------
...sb-v2-lmedm04-move-ts2020-attach-to-dm04_.patch | 67 ---------------
...-fix-an-error-handling-path-in-hdpvr_prob.patch | 98 ----------------------
debian/patches/series | 4 -
6 files changed, 1 insertion(+), 290 deletions(-)
diff --git a/debian/changelog b/debian/changelog
index 749b97d..ef3d4f7 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -82,6 +82,7 @@ linux (4.9.82-1) UNRELEASED; urgency=medium
- pipe: actually allow root to exceed the pipe buffer limits
- ACPI: sbshc: remove raw pointer from printk() message (CVE-2018-5750)
- acpi, nfit: fix register dimm error handling
+ * Remove patches included in 4.9.82
-- Yves-Alexis Perez <corsac at debian.org> Tue, 13 Feb 2018 17:44:41 +0100
diff --git a/debian/patches/bugfix/all/dccp-cve-2017-8824-use-after-free-in-dccp-code.patch b/debian/patches/bugfix/all/dccp-cve-2017-8824-use-after-free-in-dccp-code.patch
deleted file mode 100644
index 3772ee8..0000000
--- a/debian/patches/bugfix/all/dccp-cve-2017-8824-use-after-free-in-dccp-code.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From: Mohamed Ghannam <simo.ghannam at gmail.com>
-Date: Tue, 5 Dec 2017 20:58:35 +0000
-Subject: dccp: CVE-2017-8824: use-after-free in DCCP code
-Origin: https://git.kernel.org/linus/69c64866ce072dea1d1e59a0d61e0f66c0dffb76
-Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2017-8824
-
-Whenever the sock object is in DCCP_CLOSED state,
-dccp_disconnect() must free dccps_hc_tx_ccid and
-dccps_hc_rx_ccid and set to NULL.
-
-Signed-off-by: Mohamed Ghannam <simo.ghannam at gmail.com>
-Reviewed-by: Eric Dumazet <edumazet at google.com>
-Signed-off-by: David S. Miller <davem at davemloft.net>
----
- net/dccp/proto.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
---- a/net/dccp/proto.c
-+++ b/net/dccp/proto.c
-@@ -259,6 +259,7 @@ int dccp_disconnect(struct sock *sk, int
- {
- struct inet_connection_sock *icsk = inet_csk(sk);
- struct inet_sock *inet = inet_sk(sk);
-+ struct dccp_sock *dp = dccp_sk(sk);
- int err = 0;
- const int old_state = sk->sk_state;
-
-@@ -278,6 +279,10 @@ int dccp_disconnect(struct sock *sk, int
- sk->sk_err = ECONNRESET;
-
- dccp_clear_xmit_timers(sk);
-+ ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk);
-+ ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk);
-+ dp->dccps_hc_rx_ccid = NULL;
-+ dp->dccps_hc_tx_ccid = NULL;
-
- __skb_queue_purge(&sk->sk_receive_queue);
- __skb_queue_purge(&sk->sk_write_queue);
diff --git a/debian/patches/bugfix/all/media-dvb-usb-v2-lmedm04-Improve-logic-checking-of-w.patch b/debian/patches/bugfix/all/media-dvb-usb-v2-lmedm04-Improve-logic-checking-of-w.patch
deleted file mode 100644
index 6807e62..0000000
--- a/debian/patches/bugfix/all/media-dvb-usb-v2-lmedm04-Improve-logic-checking-of-w.patch
+++ /dev/null
@@ -1,83 +0,0 @@
-From: Malcolm Priestley <tvboxspy at gmail.com>
-Date: Tue, 26 Sep 2017 17:10:20 -0400
-Subject: [1/2] media: dvb-usb-v2: lmedm04: Improve logic checking of warm
- start
-Origin: https://git.linuxtv.org/media_tree.git/commit?id=3d932ee27e852e4904647f15b64dedca51187ad7
-Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2017-16538
-
-Warm start has no check as whether a genuine device has
-connected and proceeds to next execution path.
-
-Check device should read 0x47 at offset of 2 on USB descriptor read
-and it is the amount requested of 6 bytes.
-
-Fix for
-kasan: CONFIG_KASAN_INLINE enabled
-kasan: GPF could be caused by NULL-ptr deref or user memory access as
-
-Reported-by: Andrey Konovalov <andreyknvl at google.com>
-Signed-off-by: Malcolm Priestley <tvboxspy at gmail.com>
-Signed-off-by: Mauro Carvalho Chehab <mchehab at s-opensource.com>
----
- drivers/media/usb/dvb-usb-v2/lmedm04.c | 26 ++++++++++++++++++--------
- 1 file changed, 18 insertions(+), 8 deletions(-)
-
---- a/drivers/media/usb/dvb-usb-v2/lmedm04.c
-+++ b/drivers/media/usb/dvb-usb-v2/lmedm04.c
-@@ -504,18 +504,23 @@ static int lme2510_pid_filter(struct dvb
-
- static int lme2510_return_status(struct dvb_usb_device *d)
- {
-- int ret = 0;
-+ int ret;
- u8 *data;
-
-- data = kzalloc(10, GFP_KERNEL);
-+ data = kzalloc(6, GFP_KERNEL);
- if (!data)
- return -ENOMEM;
-
-- ret |= usb_control_msg(d->udev, usb_rcvctrlpipe(d->udev, 0),
-- 0x06, 0x80, 0x0302, 0x00, data, 0x0006, 200);
-- info("Firmware Status: %x (%x)", ret , data[2]);
-+ ret = usb_control_msg(d->udev, usb_rcvctrlpipe(d->udev, 0),
-+ 0x06, 0x80, 0x0302, 0x00,
-+ data, 0x6, 200);
-+ if (ret != 6)
-+ ret = -EINVAL;
-+ else
-+ ret = data[2];
-+
-+ info("Firmware Status: %6ph", data);
-
-- ret = (ret < 0) ? -ENODEV : data[2];
- kfree(data);
- return ret;
- }
-@@ -1200,6 +1205,7 @@ static int lme2510_get_adapter_count(str
- static int lme2510_identify_state(struct dvb_usb_device *d, const char **name)
- {
- struct lme2510_state *st = d->priv;
-+ int status;
-
- usb_reset_configuration(d->udev);
-
-@@ -1208,12 +1214,16 @@ static int lme2510_identify_state(struct
-
- st->dvb_usb_lme2510_firmware = dvb_usb_lme2510_firmware;
-
-- if (lme2510_return_status(d) == 0x44) {
-+ status = lme2510_return_status(d);
-+ if (status == 0x44) {
- *name = lme_firmware_switch(d, 0);
- return COLD;
- }
-
-- return 0;
-+ if (status != 0x47)
-+ return -EINVAL;
-+
-+ return WARM;
- }
-
- static int lme2510_get_stream_config(struct dvb_frontend *fe, u8 *ts_type,
diff --git a/debian/patches/bugfix/all/media-dvb-usb-v2-lmedm04-move-ts2020-attach-to-dm04_.patch b/debian/patches/bugfix/all/media-dvb-usb-v2-lmedm04-move-ts2020-attach-to-dm04_.patch
deleted file mode 100644
index 176d79d..0000000
--- a/debian/patches/bugfix/all/media-dvb-usb-v2-lmedm04-move-ts2020-attach-to-dm04_.patch
+++ /dev/null
@@ -1,67 +0,0 @@
-From: Malcolm Priestley <tvboxspy at gmail.com>
-Date: Tue, 26 Sep 2017 17:10:21 -0400
-Subject: [2/2] media: dvb-usb-v2: lmedm04: move ts2020 attach to
- dm04_lme2510_tuner
-Origin: https://git.linuxtv.org/media_tree.git/commit?id=7bf7a7116ed313c601307f7e585419369926ab05
-Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2017-16538
-
-When the tuner was split from m88rs2000 the attach function is in wrong
-place.
-
-Move to dm04_lme2510_tuner to trap errors on failure and removing
-a call to lme_coldreset.
-
-Prevents driver starting up without any tuner connected.
-
-Fixes to trap for ts2020 fail.
-LME2510(C): FE Found M88RS2000
-ts2020: probe of 0-0060 failed with error -11
-...
-LME2510(C): TUN Found RS2000 tuner
-kasan: CONFIG_KASAN_INLINE enabled
-kasan: GPF could be caused by NULL-ptr deref or user memory access
-general protection fault: 0000 [#1] PREEMPT SMP KASAN
-
-Reported-by: Andrey Konovalov <andreyknvl at google.com>
-Signed-off-by: Malcolm Priestley <tvboxspy at gmail.com>
-Tested-by: Andrey Konovalov <andreyknvl at google.com>
-Signed-off-by: Mauro Carvalho Chehab <mchehab at s-opensource.com>
----
- drivers/media/usb/dvb-usb-v2/lmedm04.c | 13 ++++++-------
- 1 file changed, 6 insertions(+), 7 deletions(-)
-
---- a/drivers/media/usb/dvb-usb-v2/lmedm04.c
-+++ b/drivers/media/usb/dvb-usb-v2/lmedm04.c
-@@ -1084,8 +1084,6 @@ static int dm04_lme2510_frontend_attach(
-
- if (adap->fe[0]) {
- info("FE Found M88RS2000");
-- dvb_attach(ts2020_attach, adap->fe[0], &ts2020_config,
-- &d->i2c_adap);
- st->i2c_tuner_gate_w = 5;
- st->i2c_tuner_gate_r = 5;
- st->i2c_tuner_addr = 0x60;
-@@ -1151,17 +1149,18 @@ static int dm04_lme2510_tuner(struct dvb
- ret = st->tuner_config;
- break;
- case TUNER_RS2000:
-- ret = st->tuner_config;
-+ if (dvb_attach(ts2020_attach, adap->fe[0],
-+ &ts2020_config, &d->i2c_adap))
-+ ret = st->tuner_config;
- break;
- default:
- break;
- }
-
-- if (ret)
-+ if (ret) {
- info("TUN Found %s tuner", tun_msg[ret]);
-- else {
-- info("TUN No tuner found --- resetting device");
-- lme_coldreset(d);
-+ } else {
-+ info("TUN No tuner found");
- return -ENODEV;
- }
-
diff --git a/debian/patches/bugfix/all/media-hdpvr-fix-an-error-handling-path-in-hdpvr_prob.patch b/debian/patches/bugfix/all/media-hdpvr-fix-an-error-handling-path-in-hdpvr_prob.patch
deleted file mode 100644
index 37dc384..0000000
--- a/debian/patches/bugfix/all/media-hdpvr-fix-an-error-handling-path-in-hdpvr_prob.patch
+++ /dev/null
@@ -1,98 +0,0 @@
-From: Arvind Yadav <arvind.yadav.cs at gmail.com>
-Date: Fri, 22 Sep 2017 09:07:06 -0400
-Subject: media: hdpvr: Fix an error handling path in hdpvr_probe()
-Origin: https://git.linuxtv.org/media_tree.git/commit?id=c0f71bbb810237a38734607ca4599632f7f5d47f
-Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2017-16644
-
-Here, hdpvr_register_videodev() is responsible for setup and
-register a video device. Also defining and initializing a worker.
-hdpvr_register_videodev() is calling by hdpvr_probe at last.
-So no need to flush any work here.
-Unregister v4l2, free buffers and memory. If hdpvr_probe() will fail.
-
-Signed-off-by: Arvind Yadav <arvind.yadav.cs at gmail.com>
-Reported-by: Andrey Konovalov <andreyknvl at google.com>
-Tested-by: Andrey Konovalov <andreyknvl at google.com>
-Signed-off-by: Hans Verkuil <hans.verkuil at cisco.com>
-Signed-off-by: Mauro Carvalho Chehab <mchehab at s-opensource.com>
----
- drivers/media/usb/hdpvr/hdpvr-core.c | 26 +++++++++++++++-----------
- 1 file changed, 15 insertions(+), 11 deletions(-)
-
---- a/drivers/media/usb/hdpvr/hdpvr-core.c
-+++ b/drivers/media/usb/hdpvr/hdpvr-core.c
-@@ -295,7 +295,7 @@ static int hdpvr_probe(struct usb_interf
- /* register v4l2_device early so it can be used for printks */
- if (v4l2_device_register(&interface->dev, &dev->v4l2_dev)) {
- dev_err(&interface->dev, "v4l2_device_register failed\n");
-- goto error;
-+ goto error_free_dev;
- }
-
- mutex_init(&dev->io_mutex);
-@@ -304,7 +304,7 @@ static int hdpvr_probe(struct usb_interf
- dev->usbc_buf = kmalloc(64, GFP_KERNEL);
- if (!dev->usbc_buf) {
- v4l2_err(&dev->v4l2_dev, "Out of memory\n");
-- goto error;
-+ goto error_v4l2_unregister;
- }
-
- init_waitqueue_head(&dev->wait_buffer);
-@@ -342,13 +342,13 @@ static int hdpvr_probe(struct usb_interf
- }
- if (!dev->bulk_in_endpointAddr) {
- v4l2_err(&dev->v4l2_dev, "Could not find bulk-in endpoint\n");
-- goto error;
-+ goto error_put_usb;
- }
-
- /* init the device */
- if (hdpvr_device_init(dev)) {
- v4l2_err(&dev->v4l2_dev, "device init failed\n");
-- goto error;
-+ goto error_put_usb;
- }
-
- mutex_lock(&dev->io_mutex);
-@@ -356,7 +356,7 @@ static int hdpvr_probe(struct usb_interf
- mutex_unlock(&dev->io_mutex);
- v4l2_err(&dev->v4l2_dev,
- "allocating transfer buffers failed\n");
-- goto error;
-+ goto error_put_usb;
- }
- mutex_unlock(&dev->io_mutex);
-
-@@ -364,7 +364,7 @@ static int hdpvr_probe(struct usb_interf
- retval = hdpvr_register_i2c_adapter(dev);
- if (retval < 0) {
- v4l2_err(&dev->v4l2_dev, "i2c adapter register failed\n");
-- goto error;
-+ goto error_free_buffers;
- }
-
- client = hdpvr_register_ir_rx_i2c(dev);
-@@ -397,13 +397,17 @@ static int hdpvr_probe(struct usb_interf
- reg_fail:
- #if IS_ENABLED(CONFIG_I2C)
- i2c_del_adapter(&dev->i2c_adapter);
-+error_free_buffers:
- #endif
-+ hdpvr_free_buffers(dev);
-+error_put_usb:
-+ usb_put_dev(dev->udev);
-+ kfree(dev->usbc_buf);
-+error_v4l2_unregister:
-+ v4l2_device_unregister(&dev->v4l2_dev);
-+error_free_dev:
-+ kfree(dev);
- error:
-- if (dev) {
-- flush_work(&dev->worker);
-- /* this frees allocated memory */
-- hdpvr_delete(dev);
-- }
- return retval;
- }
-
diff --git a/debian/patches/series b/debian/patches/series
index 69afe29..8b579d0 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -135,10 +135,6 @@ features/all/securelevel/arm64-add-kernel-config-option-to-set-securelevel-wh.pa
debian/i386-686-pae-pci-set-pci-nobios-by-default.patch
debian/time-mark-timer_stats-as-broken.patch
bugfix/all/tracing-Use-strlcpy-instead-of-strcpy-in-__trace_fin.patch
-bugfix/all/dccp-cve-2017-8824-use-after-free-in-dccp-code.patch
-bugfix/all/media-dvb-usb-v2-lmedm04-Improve-logic-checking-of-w.patch
-bugfix/all/media-dvb-usb-v2-lmedm04-move-ts2020-attach-to-dm04_.patch
-bugfix/all/media-hdpvr-fix-an-error-handling-path-in-hdpvr_prob.patch
# Fix exported symbol versions
bugfix/ia64/revert-ia64-move-exports-to-definitions.patch
--
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/kernel/linux.git
More information about the Kernel-svn-changes
mailing list