Tue Oct 21 17:02:23 UTC 2008

Author: cebbert

Update of /cvs/pkgs/rpms/kernel/F-9
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv733

Modified Files:
	.cvsignore TODO kernel.spec linux-2.6-upstream-reverts.patch 
	sources upstream 
Added Files:
	patch-2.6.26.7-rc1.bz2.sign 
Removed Files:
	linux-2.6-dont-allow-splice-to-files-opened-with-o_append.patch 
	linux-2.6-libata-always-do-follow-up-SRST-if-requested.patch 
	linux-2.6-libata-fix-EH-action-overwriting-in-ata_eh_reset.patch 
	linux-2.6-libata-lba-28-48-off-by-one-in-ata.h.patch 
	linux-2.6-pci-check-mapped-ranges-on-sysfs-resource-files.patch 
	linux-2.6-pci-disable-aspm-on-pre-1.1-devices.patch 
	linux-2.6-pci-disable-aspm-per-acpi-fadt-setting.patch 
	linux-2.6-uvcvideo-dont-use-stack-based-buffers.patch 
	linux-2.6-uvcvideo-fix-another-buffer-overflow.patch 
	linux-2.6-uvcvideo-return-sensible-min-max-values.patch 
	linux-2.6-x86-Reserve-FIRST_DEVICE_VECTOR-in-used_vectors-bit.patch 
	linux-2.6-x86-avoid-dereferencing-beyond-stack-THREAD_SIZE.patch 
	linux-2.6-x86-early_ioremap-fix-fencepost-error.patch 
	linux-2.6-x86-improve-up-kernel-when-cpu-hotplug-and-smp.patch 
Log Message:
2.6.26.7-rc1
  Dropped patches:
    linux-2.6-x86-improve-up-kernel-when-cpu-hotplug-and-smp.patch
    linux-2.6-x86-avoid-dereferencing-beyond-stack-THREAD_SIZE.patch
    linux-2.6-x86-Reserve-FIRST_DEVICE_VECTOR-in-used_vectors-bit.patch
    linux-2.6-x86-early_ioremap-fix-fencepost-error.patch
    linux-2.6-pci-disable-aspm-per-acpi-fadt-setting.patch
    linux-2.6-pci-disable-aspm-on-pre-1.1-devices.patch
    linux-2.6-pci-check-mapped-ranges-on-sysfs-resource-files.patch
    linux-2.6-uvcvideo-return-sensible-min-max-values.patch
    linux-2.6-uvcvideo-dont-use-stack-based-buffers.patch
    linux-2.6-uvcvideo-fix-another-buffer-overflow.patch
    linux-2.6-dont-allow-splice-to-files-opened-with-o_append.patch
    linux-2.6-libata-lba-28-48-off-by-one-in-ata.h.patch
    linux-2.6-libata-always-do-follow-up-SRST-if-requested.patch
    linux-2.6-libata-fix-EH-action-overwriting-in-ata_eh_reset.patch
  Upstream reverts:
    drm-i915-fix-ioremap-of-a-user-address-for-non-root.patch

--- NEW FILE patch-2.6.26.7-rc1.bz2.sign ---
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: See http://www.kernel.org/signature.html for info

iD8DBQBI+jLnyGugalF9Dw4RAnGhAJ4vAdCtOcAXzsfUvLgMlYTyTLxlwQCeOQY6
QTxtkf3ff2W9h4LEdNGLoTg=
=1zGd
-----END PGP SIGNATURE-----


Index: .cvsignore
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/F-9/.cvsignore,v
retrieving revision 1.828
retrieving revision 1.829
diff -u -r1.828 -r1.829
--- .cvsignore	9 Oct 2008 09:50:49 -0000	1.828
+++ .cvsignore	21 Oct 2008 17:01:51 -0000	1.829
@@ -5,3 +5,4 @@
 kernel-2.6.26
 linux-2.6.26.tar.bz2
 patch-2.6.26.6.bz2
+patch-2.6.26.7-rc1.bz2


Index: TODO
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/F-9/TODO,v
retrieving revision 1.3
retrieving revision 1.4
diff -u -r1.3 -r1.4
--- TODO	13 Oct 2008 23:46:07 -0000	1.3
+++ TODO	21 Oct 2008 17:01:52 -0000	1.4
@@ -4,37 +4,21 @@
           linux-2.6-cpuidle-3-make-ladder-governor-honor-latency-requirements.patch
 
           linux-2.6-libata-pata_it821x-driver-updates-and-reworking.patch
-SENT Patch675: linux-2.6-libata-lba-28-48-off-by-one-in-ata.h.patch
-SENT Patch676: linux-2.6-libata-always-do-follow-up-SRST-if-requested.patch
-SENT Patch677: linux-2.6-libata-fix-EH-action-overwriting-in-ata_eh_reset.patch
 
-SENT Patch120: linux-2.6-pci-disable-aspm-per-acpi-fadt-setting.patch
-SENT Patch121: linux-2.6-pci-disable-aspm-on-pre-1.1-devices.patch
 BROKEN Patch122: linux-2.6-pci-add-an-option-to-allow-aspm-enabled-forcibly.patch
-SENT Patch123: linux-2.6-pci-check-mapped-ranges-on-sysfs-resource-files.patch
 
 Patch420: linux-2.6-fs-cifs-turn-off-unicode-during-session-establishment.patch
 Patch422: linux-2.6-fs-cifs-fix-plaintext-authentication.patch
 
-SENT Patch2301: linux-2.6-uvcvideo-return-sensible-min-max-values.patch
-SENT Patch2302: linux-2.6-uvcvideo-dont-use-stack-based-buffers.patch
-SENT Patch2303: linux-2.6-uvcvideo-fix-another-buffer-overflow.patch
-
 Patch2002: linux-2.6-e1000e-write-protect-nvm.patch
 
-SENT Patch103: linux-2.6-x86-avoid-dereferencing-beyond-stack-THREAD_SIZE.patch
-
 
 ---------------------------------------------------------------------------------
 Submit for -stable after merging:
-Patch102: linux-2.6-x86-improve-up-kernel-when-cpu-hotplug-and-smp.patch
 
 
 ---------------------------------------------------------------------------------
 Already scheduled for -stable:
-          linux-2.6-x86-Reserve-FIRST_DEVICE_VECTOR-in-used_vectors-bit.patch
-Patch423: linux-2.6-dont-allow-splice-to-files-opened-with-o_append.patch
-Patch105: linux-2.6-x86-early_ioremap-fix-fencepost-error.patch
 
 
 ---------------------------------------------------------------------------------


Index: kernel.spec
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/F-9/kernel.spec,v
retrieving revision 1.807
retrieving revision 1.808
diff -u -r1.807 -r1.808
--- kernel.spec	20 Oct 2008 21:04:38 -0000	1.807
+++ kernel.spec	21 Oct 2008 17:01:52 -0000	1.808
@@ -32,9 +32,9 @@
 %if 0%{?released_kernel}
 
 # Do we have a -stable update to apply?
-%define stable_update 6
+%define stable_update 7
 # Is it a -stable RC?
-%define stable_rc 0
+%define stable_rc 1
 # Set rpm version accordingly
 %if 0%{?stable_update}
 %define stablerev .%{stable_update}
@@ -609,16 +609,9 @@
 Patch97: linux-2.6-x86-hpet-04-workaround-sb700-bios.patch
 Patch100: linux-2.6-x86-pci-detect-end_bus_number.patch
 Patch101: linux-2.6-x86-check-for-null-irq-context.patch
-Patch102: linux-2.6-x86-improve-up-kernel-when-cpu-hotplug-and-smp.patch
-Patch103: linux-2.6-x86-avoid-dereferencing-beyond-stack-THREAD_SIZE.patch
-Patch104: linux-2.6-x86-Reserve-FIRST_DEVICE_VECTOR-in-used_vectors-bit.patch
-Patch105: linux-2.6-x86-early_ioremap-fix-fencepost-error.patch
 Patch106: linux-2.6-x86-sb450-skip-irq0-override-if-not-routed-to-INT2.patch
 
-Patch120: linux-2.6-pci-disable-aspm-per-acpi-fadt-setting.patch
-Patch121: linux-2.6-pci-disable-aspm-on-pre-1.1-devices.patch
 Patch122: linux-2.6-pci-add-an-option-to-allow-aspm-enabled-forcibly.patch
-Patch123: linux-2.6-pci-check-mapped-ranges-on-sysfs-resource-files.patch
 
 # ppc
 Patch140: linux-2.6-ps3-ehci-iso.patch
@@ -648,7 +641,6 @@
 Patch420: linux-2.6-fs-cifs-turn-off-unicode-during-session-establishment.patch
 Patch421: linux-2.6-squashfs.patch
 Patch422: linux-2.6-fs-cifs-fix-plaintext-authentication.patch
-Patch423: linux-2.6-dont-allow-splice-to-files-opened-with-o_append.patch
 
 Patch430: linux-2.6-net-silence-noisy-printks.patch
 
@@ -667,9 +659,6 @@
 Patch672: linux-2.6-sata-eeepc-faster.patch
 Patch673: linux-2.6-libata-pata_marvell-play-nice-with-ahci.patch
 Patch674: linux-2.6-libata-fix-a-large-collection-of-DMA-mode-mismatches.patch
-Patch675: linux-2.6-libata-lba-28-48-off-by-one-in-ata.h.patch
-Patch676: linux-2.6-libata-always-do-follow-up-SRST-if-requested.patch
-Patch677: linux-2.6-libata-fix-EH-action-overwriting-in-ata_eh_reset.patch
 Patch678: linux-2.6-libata-sata_nv-disable-swncq.patch
 
 Patch680: linux-2.6-wireless.patch
@@ -719,10 +708,6 @@
 
 # make USB EHCI driver respect "nousb" parameter
 Patch2300: linux-2.6-usb-ehci-hcd-respect-nousb.patch
-# uvc video buffer overflow
-Patch2301: linux-2.6-uvcvideo-return-sensible-min-max-values.patch
-Patch2302: linux-2.6-uvcvideo-dont-use-stack-based-buffers.patch
-Patch2303: linux-2.6-uvcvideo-fix-another-buffer-overflow.patch
 
 Patch2501: linux-2.6-ppc-use-libgcc.patch
 
@@ -1113,23 +1098,11 @@
 ApplyPatch linux-2.6-x86-pci-detect-end_bus_number.patch
 # don't oops if there's no IRQ stack available
 ApplyPatch linux-2.6-x86-check-for-null-irq-context.patch
-# add config option to disable adding CPUs after boot
-ApplyPatch linux-2.6-x86-improve-up-kernel-when-cpu-hotplug-and-smp.patch
-# fix oops in get_wchan()
-ApplyPatch linux-2.6-x86-avoid-dereferencing-beyond-stack-THREAD_SIZE.patch
-# reserve first device vector on x86-32
-ApplyPatch linux-2.6-x86-Reserve-FIRST_DEVICE_VECTOR-in-used_vectors-bit.patch
-#
-ApplyPatch linux-2.6-x86-early_ioremap-fix-fencepost-error.patch
 # fix boot on some broken HP notebooks (nx6...)
 ApplyPatch linux-2.6-x86-sb450-skip-irq0-override-if-not-routed-to-INT2.patch
 
 # disable ASPM on devices that don't support it
-ApplyPatch linux-2.6-pci-disable-aspm-per-acpi-fadt-setting.patch
-ApplyPatch linux-2.6-pci-disable-aspm-on-pre-1.1-devices.patch
 ApplyPatch linux-2.6-pci-add-an-option-to-allow-aspm-enabled-forcibly.patch
-# check range on pci mmap
-ApplyPatch linux-2.6-pci-check-mapped-ranges-on-sysfs-resource-files.patch
 
 #
 # PowerPC
@@ -1173,10 +1146,6 @@
 # USB
 # actually honor the nousb parameter
 ApplyPatch linux-2.6-usb-ehci-hcd-respect-nousb.patch
-# uvcvideo buffer overflow
-ApplyPatch linux-2.6-uvcvideo-return-sensible-min-max-values.patch
-ApplyPatch linux-2.6-uvcvideo-dont-use-stack-based-buffers.patch
-ApplyPatch linux-2.6-uvcvideo-fix-another-buffer-overflow.patch
 
 # ACPI
 # fix cpuidle misbehavior
@@ -1228,8 +1197,6 @@
 ApplyPatch linux-2.6-squashfs.patch
 # fix CIFS plaintext passwords
 ApplyPatch linux-2.6-fs-cifs-fix-plaintext-authentication.patch
-# don't allow splice to files opened with O_APPEND
-ApplyPatch linux-2.6-dont-allow-splice-to-files-opened-with-o_append.patch
 
 # Networking
 # Disable easy to trigger printk's.
@@ -1268,11 +1235,6 @@
 ApplyPatch linux-2.6-libata-pata_marvell-play-nice-with-ahci.patch
 # fix drivers making wrong assumptions about what dma values mean
 ApplyPatch linux-2.6-libata-fix-a-large-collection-of-DMA-mode-mismatches.patch
-# libata breaks lba28 rules
-ApplyPatch linux-2.6-libata-lba-28-48-off-by-one-in-ata.h.patch
-# fix libata error handling
-ApplyPatch linux-2.6-libata-always-do-follow-up-SRST-if-requested.patch
-ApplyPatch linux-2.6-libata-fix-EH-action-overwriting-in-ata_eh_reset.patch
 # disable swncq on sata_nv
 ApplyPatch linux-2.6-libata-sata_nv-disable-swncq.patch
 
@@ -1958,6 +1920,26 @@
 %kernel_variant_files -a /%{image_install_path}/xen*-%{KVERREL}.xen -e /etc/ld.so.conf.d/kernelcap-%{KVERREL}.xen.conf %{with_xen} xen
 
 %changelog
+* Tue Oct 21 2008 Chuck Ebbert <cebbert at redhat.com> 2.6.26.7-81.rc1
+- 2.6.26.7-rc1
+  Dropped patches:
+    linux-2.6-x86-improve-up-kernel-when-cpu-hotplug-and-smp.patch
+    linux-2.6-x86-avoid-dereferencing-beyond-stack-THREAD_SIZE.patch
+    linux-2.6-x86-Reserve-FIRST_DEVICE_VECTOR-in-used_vectors-bit.patch
+    linux-2.6-x86-early_ioremap-fix-fencepost-error.patch
+    linux-2.6-pci-disable-aspm-per-acpi-fadt-setting.patch
+    linux-2.6-pci-disable-aspm-on-pre-1.1-devices.patch
+    linux-2.6-pci-check-mapped-ranges-on-sysfs-resource-files.patch
+    linux-2.6-uvcvideo-return-sensible-min-max-values.patch
+    linux-2.6-uvcvideo-dont-use-stack-based-buffers.patch
+    linux-2.6-uvcvideo-fix-another-buffer-overflow.patch
+    linux-2.6-dont-allow-splice-to-files-opened-with-o_append.patch
+    linux-2.6-libata-lba-28-48-off-by-one-in-ata.h.patch
+    linux-2.6-libata-always-do-follow-up-SRST-if-requested.patch
+    linux-2.6-libata-fix-EH-action-overwriting-in-ata_eh_reset.patch
+  Upstream reverts:
+    drm-i915-fix-ioremap-of-a-user-address-for-non-root.patch
+
 * Mon Oct 20 2008 Chuck Ebbert <cebbert at redhat.com> 2.6.26.6-80
 - Disable debug printks in the memstick drivers.
 

linux-2.6-upstream-reverts.patch:

Index: linux-2.6-upstream-reverts.patch
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/F-9/linux-2.6-upstream-reverts.patch,v
retrieving revision 1.11
retrieving revision 1.12
diff -u -r1.11 -r1.12
--- linux-2.6-upstream-reverts.patch	7 Oct 2008 22:07:16 -0000	1.11
+++ linux-2.6-upstream-reverts.patch	21 Oct 2008 17:01:52 -0000	1.12
@@ -295,3 +295,39 @@
  	}
  	spin_unlock(&intf->lock);
  }
+From 4b40893918203ee1a1f6a114316c2a19c072e9bd Mon Sep 17 00:00:00 2001
+From: Matthias Hopf <mhopf at suse.de>
+Date: Sat, 18 Oct 2008 07:18:05 +1000
+Subject: drm/i915: fix ioremap of a user address for non-root (CVE-2008-3831)
+
+From: Matthias Hopf <mhopf at suse.de>
+
+commit 4b40893918203ee1a1f6a114316c2a19c072e9bd upstream
+
+Olaf Kirch noticed that the i915_set_status_page() function of the i915
+kernel driver calls ioremap with an address offset that is supplied by
+userspace via ioctl. The function zeroes the mapped memory via memset
+and tells the hardware about the address. Turns out that access to that
+ioctl is not restricted to root so users could probably exploit that to
+do nasty things. We haven't tried to write actual exploit code though.
+
+It only affects the Intel G33 series and newer.
+
+Signed-off-by: Dave Airlie <airlied at redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+
+---
+ drivers/char/drm/i915_dma.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/char/drm/i915_dma.c
++++ b/drivers/char/drm/i915_dma.c
+@@ -836,7 +836,7 @@ struct drm_ioctl_desc i915_ioctls[] = {
+ 	DRM_IOCTL_DEF(DRM_I915_SET_VBLANK_PIPE,  i915_vblank_pipe_set, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY ),
+ 	DRM_IOCTL_DEF(DRM_I915_GET_VBLANK_PIPE,  i915_vblank_pipe_get, DRM_AUTH ),
+ 	DRM_IOCTL_DEF(DRM_I915_VBLANK_SWAP, i915_vblank_swap, DRM_AUTH),
+-	DRM_IOCTL_DEF(DRM_I915_HWS_ADDR, i915_set_status_page, DRM_AUTH),
++	DRM_IOCTL_DEF(DRM_I915_HWS_ADDR, i915_set_status_page, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY),
+ };
+ 
+ int i915_max_ioctl = DRM_ARRAY_SIZE(i915_ioctls);


Index: sources
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/F-9/sources,v
retrieving revision 1.789
retrieving revision 1.790
diff -u -r1.789 -r1.790
--- sources	9 Oct 2008 09:50:49 -0000	1.789
+++ sources	21 Oct 2008 17:01:52 -0000	1.790
@@ -1,2 +1,3 @@
 5169d01c405bc3f866c59338e217968c  linux-2.6.26.tar.bz2
 522a28eca9b5d5debed3f48997e3da32  patch-2.6.26.6.bz2
+fd52639c2e8822ae57dc08ae8f902cfc  patch-2.6.26.7-rc1.bz2


Index: upstream
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/F-9/upstream,v
retrieving revision 1.708
retrieving revision 1.709
diff -u -r1.708 -r1.709
--- upstream	9 Oct 2008 09:50:49 -0000	1.708
+++ upstream	21 Oct 2008 17:01:52 -0000	1.709
@@ -1,2 +1,3 @@
 linux-2.6.26.tar.bz2
 patch-2.6.26.6.bz2
+patch-2.6.26.7-rc1.bz2


--- linux-2.6-dont-allow-splice-to-files-opened-with-o_append.patch DELETED ---


--- linux-2.6-libata-always-do-follow-up-SRST-if-requested.patch DELETED ---


--- linux-2.6-libata-fix-EH-action-overwriting-in-ata_eh_reset.patch DELETED ---


--- linux-2.6-libata-lba-28-48-off-by-one-in-ata.h.patch DELETED ---


--- linux-2.6-pci-check-mapped-ranges-on-sysfs-resource-files.patch DELETED ---


--- linux-2.6-pci-disable-aspm-on-pre-1.1-devices.patch DELETED ---


--- linux-2.6-pci-disable-aspm-per-acpi-fadt-setting.patch DELETED ---


--- linux-2.6-uvcvideo-dont-use-stack-based-buffers.patch DELETED ---


--- linux-2.6-uvcvideo-fix-another-buffer-overflow.patch DELETED ---


--- linux-2.6-uvcvideo-return-sensible-min-max-values.patch DELETED ---


--- linux-2.6-x86-Reserve-FIRST_DEVICE_VECTOR-in-used_vectors-bit.patch DELETED ---


--- linux-2.6-x86-avoid-dereferencing-beyond-stack-THREAD_SIZE.patch DELETED ---


--- linux-2.6-x86-early_ioremap-fix-fencepost-error.patch DELETED ---


--- linux-2.6-x86-improve-up-kernel-when-cpu-hotplug-and-smp.patch DELETED ---


