UBUNTU: Start new release

Ignore: yes
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
HID: pantherlord: validate output report details

BugLink: http://bugs.launchpad.net/bugs/1220196

A HID device could send a malicious output report that would cause the
pantherlord HID driver to write beyond the output report allocation
during initialization, causing a heap overflow:

[  310.939483] usb 1-1: New USB device found, idVendor=0e8f, idProduct=0003
...
[  315.980774] BUG kmalloc-192 (Tainted: G        W   ): Redzone overwritten

CVE-2013-2892

Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: stable@kernel.org
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
(cherry picked from commit 412f30105ec6735224535791eed5cdc02888ecb4)
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
Acked-by: Seth Forshee <seth.forshee@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
HID: validate HID report id size

BugLink: http://bugs.launchpad.net/bugs/1220185

The "Report ID" field of a HID report is used to build indexes of
reports. The kernel's index of these is limited to 256 entries, so any
malicious device that sets a Report ID greater than 255 will trigger
memory corruption on the host:

[ 1347.156239] BUG: unable to handle kernel paging request at ffff88094958a878
[ 1347.156261] IP: [<ffffffff813e4da0>] hid_register_report+0x2a/0x8b

CVE-2013-2888

Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: stable@kernel.org
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
(back ported from commit 43622021d2e2b82ea03d883926605bdd0525e1d1)
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
Acked-by: Seth Forshee <seth.forshee@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
ipv6: remove max_addresses check from ipv6_create_tempaddr

BugLink: http://bugs.launchpad.net/bugs/1143800

CVE-2013-0343

Because of the max_addresses check attackers were able to disable privacy
extensions on an interface by creating enough autoconfigured addresses:

<http://seclists.org/oss-sec/2012/q4/292>

But the check is not actually needed: max_addresses protects the
kernel to install too many ipv6 addresses on an interface and guards
addrconf_prefix_rcv to install further addresses as soon as this limit
is reached. We only generate temporary addresses in direct response of
a new address showing up. As soon as we filled up the maximum number of
addresses of an interface, we stop installing more addresses and thus
also stop generating more temp addresses.

Even if the attacker tries to generate a lot of temporary addresses
by announcing a prefix and removing it again (lifetime == 0) we won't
install more temp addresses, because the temporary addresses do count
to the maximum number of addresses, thus we would stop installing new
autoconfigured addresses when the limit is reached.

This patch fixes CVE-2013-0343 (but other layer-2 attacks are still
possible).

Thanks to Ding Tianhong to bring this topic up again.

Cc: Ding Tianhong <dingtianhong@huawei.com>
Cc: George Kargiotakis <kargig@void.gr>
Cc: P J P <ppandit@redhat.com>
Cc: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Acked-by: Ding Tianhong <dingtianhong@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
(back ported from commit 4b08a8f1bd8cb4541c93ec170027b4d0782dab52)
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
Acked-by: Steve Conklin <sconklin@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
UBUNTU: Ubuntu-2.6.32-52.114

Signed-off-by: Brad Figg <brad.figg@canonical.com>
add console_use_vt Patch-mainline: no $subject says all
kexec: Move asm segment handling code to the assembly file (i386) Patch-mainline: obsolete This patch moves the idt, gdt, and segment handling code from machine_kexec.c to relocate_kernel.S. The main reason behind this move is to avoid code duplication in the Xen hypervisor. With this patch all code required to kexec is put on the control page.

On top of that this patch also counts as a cleanup - I think it is much
nicer to write assembly directly in assembly files than wrap inline assembly
in C functions for no apparent reason.

Signed-off-by: Magnus Damm <magnus@valinux.co.jp>
Acked-by: jbeulich@novell.com

 Applies to 2.6.19-rc1.
 jb: fixed up register usage (paralleling what's needed for 2.6.30 on x86-64)
kexec: Move asm segment handling code to the assembly file (x86_64) Patch-mainline: obsolete This patch moves the idt, gdt, and segment handling code from machine_kexec.c to relocate_kernel.S. The main reason behind this move is to avoid code duplication in the Xen hypervisor. With this patch all code required to kexec is put on the control page.

On top of that this patch also counts as a cleanup - I think it is much
nicer to write assembly directly in assembly files than wrap inline assembly
in C functions for no apparent reason.

Signed-off-by: Magnus Damm <magnus@valinux.co.jp>
Acked-by: jbeulich@novell.com

 Applies to 2.6.19-rc1.
 jb: fixed up register usage for 2.6.30 (bnc#545206)
Subject: Allow to bring up network interface w/o ipv6 autoconf References: 161888 When bringing up a xen bridge device, it will always be configured to use a MAC address of ff:ff:ff:ff:ff:fe. This greatly confuses IPv6 DAD, which starts logging lots and lots of useless messages to syslog.

We really want to disable IPv6 on these interfaces, and there doesn't
seem to be a reliable way to do this without bringing the interface
up first (and triggering IPv6 autoconf).

This patch makes autoconf (DAD and router discovery) depend on the
interface's ability to do multicast. Turning off multicast for an
interface before bringing it up will suppress autoconfiguration.

 net/ipv6/addrconf.c |    2 ++
 1 files changed, 2 insertions(+)
xen/dom0: Reserve devices for guest use Patch-mainline: obsolete Acked-by: jbeulich@novell.com
linux/pci: reserve io/memory space for bridge Patch-mainline: obsolete reserve io/memory space for bridge which will be used later by PCI hotplug.

Signed-off-by: Isaku Yamahata <yamahata@valinux.co.jp>
Acked-by: jbeulich@novell.com
# replaces http://xenbits.xensource.com/linux-2.6.18-xen.hg c/s 421: # HG changeset patch # User Keir Fraser <keir.fraser@citrix.com> # Date 1203330569 0 # Node ID e4dd072db2595c420bb21d9e835416f4fd543526 # Parent fc90e9b2c12b316b5460ece28f013e6de881af1a Subject: Solarflare: Resource driver. References: FATE#303479 Acked-by: jbeulich@novell.com
Transcendent memory ("tmem") for Linux Patch-mainline: obsolete Tmem, when called from a tmem-capable (paravirtualized) guest, makes use of otherwise unutilized ("fallow") memory to create and manage pools of pages that can be accessed from the guest either as "ephemeral" pages or as "persistent" pages. In either case, the pages are not directly addressible by the guest, only copied to and fro via the tmem interface. Ephemeral pages are a nice place for a guest to put recently evicted clean pages that it might need again; these pages can be reclaimed synchronously by Xen for other guests or other uses. Persistent pages are a nice place for a guest to put "swap" pages to avoid sending them to disk. These pages retain data as long as the guest lives, but count against the guest memory allocation.

This patch contains the Linux paravirtualization changes to
complement the tmem Xen patch (xen-unstable c/s 19646). It
implements "precache" (ext3 only as of now), "preswap",
and limited "shared precache" (ocfs2 only as of now) support.
CONFIG options are required to turn on
the support (but in this patch they default to "y"). If
the underlying Xen does not have tmem support or has it
turned off, this is sensed early to avoid nearly all
hypercalls.

Lots of useful prose about tmem can be found at
http://oss.oracle.com/projects/tmem

Signed-off-by: Dan Magenheimer <dan.magenheimer@oracle.com>
Acked-by: jbeulich@novell.com
xen3 xen-arch Patch-mainline: obsolete Acked-by: jbeulich@novell.com List of files having Xen derivates (perhaps created during the merging of newer kernel versions), for xen-port-patches.py to pick up (i.e. this must be retained here until the XenSource tree has these in the right places): +++ linux/arch/x86/kernel/acpi/sleep-xen.c +++ linux/arch/x86/kernel/apic/apic-xen.c +++ linux/arch/x86/kernel/apic/io_apic-xen.c +++ linux/arch/x86/kernel/apic/ipi-xen.c +++ linux/arch/x86/kernel/apic/probe_32-xen.c +++ linux/arch/x86/kernel/apic-xen.c +++ linux/arch/x86/kernel/cpu/common_64-xen.c +++ linux/arch/x86/kernel/e820-xen.c +++ linux/arch/x86/kernel/head-xen.c +++ linux/arch/x86/kernel/head32-xen.c +++ linux/arch/x86/kernel/ioport-xen.c +++ linux/arch/x86/kernel/io_apic-xen.c +++ linux/arch/x86/kernel/ipi-xen.c +++ linux/arch/x86/kernel/irq-xen.c +++ linux/arch/x86/kernel/ldt-xen.c +++ linux/arch/x86/kernel/microcode_core-xen.c +++ linux/arch/x86/kernel/mpparse-xen.c +++ linux/arch/x86/kernel/pci-nommu-xen.c +++ linux/arch/x86/kernel/process-xen.c +++ linux/arch/x86/kernel/setup-xen.c +++ linux/arch/x86/kernel/smp-xen.c +++ linux/arch/x86/kernel/traps-xen.c +++ linux/arch/x86/kernel/x86_init-xen.c +++ linux/arch/x86/mm/fault-xen.c +++ linux/arch/x86/mm/init-xen.c +++ linux/arch/x86/mm/iomap_32-xen.c +++ linux/arch/x86/mm/ioremap-xen.c +++ linux/arch/x86/mm/pageattr-xen.c +++ linux/arch/x86/mm/pat-xen.c +++ linux/arch/x86/mm/pgtable-xen.c +++ linux/arch/x86/vdso/vdso32-setup-xen.c +++ linux/drivers/char/mem-xen.c +++ linux/arch/x86/include/mach-xen/asm/desc.h +++ linux/arch/x86/include/mach-xen/asm/dma-mapping.h +++ linux/arch/x86/include/mach-xen/asm/fixmap.h +++ linux/arch/x86/include/mach-xen/asm/io.h +++ linux/arch/x86/include/mach-xen/asm/ipi.h +++ linux/arch/x86/include/mach-xen/asm/irq_vectors.h +++ linux/arch/x86/include/mach-xen/asm/irqflags.h +++ linux/arch/x86/include/mach-xen/asm/mmu_context.h +++ linux/arch/x86/include/mach-xen/asm/pci.h +++ linux/arch/x86/include/mach-xen/asm/pgalloc.h +++ linux/arch/x86/include/mach-xen/asm/pgtable.h +++ linux/arch/x86/include/mach-xen/asm/pgtable-3level_types.h +++ linux/arch/x86/include/mach-xen/asm/pgtable_64_types.h +++ linux/arch/x86/include/mach-xen/asm/pgtable_types.h +++ linux/arch/x86/include/mach-xen/asm/processor.h +++ linux/arch/x86/include/mach-xen/asm/smp.h +++ linux/arch/x86/include/mach-xen/asm/spinlock.h +++ linux/arch/x86/include/mach-xen/asm/swiotlb.h +++ linux/arch/x86/include/mach-xen/asm/system.h +++ linux/arch/x86/include/mach-xen/asm/tlbflush.h +++ linux/arch/x86/include/mach-xen/asm/xor.h

List of files folded into their native counterparts (and hence removed
from this patch for xen-port-patches.py to not needlessly pick them up;
for reference, prefixed with the version the removal occured):
2.6.18/arch/x86/include/mach-xen/asm/pgtable-2level.h
2.6.18/arch/x86/include/mach-xen/asm/pgtable-2level-defs.h
2.6.19/arch/x86/include/mach-xen/asm/ptrace.h
2.6.23/arch/x86/include/mach-xen/asm/ptrace_64.h
2.6.23/arch/x86/kernel/vsyscall-note_32-xen.S
2.6.24/arch/x86/include/mach-xen/asm/arch_hooks_64.h
2.6.24/arch/x86/include/mach-xen/asm/bootsetup_64.h
2.6.24/arch/x86/include/mach-xen/asm/mmu_32.h
2.6.24/arch/x86/include/mach-xen/asm/mmu_64.h
2.6.24/arch/x86/include/mach-xen/asm/nmi_64.h
2.6.24/arch/x86/include/mach-xen/asm/setup.h
2.6.24/arch/x86/include/mach-xen/asm/time_64.h (added in 2.6.20)
2.6.24/arch/x86/include/mach-xen/mach_timer.h
2.6.24/arch/x86/kernel/early_printk_32-xen.c
2.6.25/arch/x86/ia32/syscall32-xen.c
2.6.25/arch/x86/ia32/syscall32_syscall-xen.S
2.6.25/arch/x86/ia32/vsyscall-int80.S
2.6.25/arch/x86/include/mach-xen/asm/msr.h
2.6.25/arch/x86/include/mach-xen/asm/page_32.h
2.6.25/arch/x86/include/mach-xen/asm/spinlock_32.h
2.6.25/arch/x86/include/mach-xen/asm/timer.h (added in 2.6.24)
2.6.25/arch/x86/include/mach-xen/asm/timer_64.h
2.6.25/arch/x86/include/mach-xen/mach_time.h
2.6.25/arch/x86/kernel/acpi/boot-xen.c
2.6.26/arch/x86/include/mach-xen/asm/dma-mapping_32.h
2.6.26/arch/x86/include/mach-xen/asm/dma-mapping_64.h
2.6.26/arch/x86/include/mach-xen/asm/nmi.h (added in 2.6.24)
2.6.26/arch/x86/include/mach-xen/asm/scatterlist.h (added in 2.6.24)
2.6.26/arch/x86/include/mach-xen/asm/scatterlist_32.h
2.6.26/arch/x86/include/mach-xen/asm/swiotlb_32.h
2.6.26/arch/x86/kernel/pci-dma_32-xen.c
2.6.26/arch/x86/kernel/pci-swiotlb_64-xen.c
2.6.26/include/xen/xencomm.h
2.6.27/arch/x86/include/mach-xen/asm/e820.h (added in 2.6.24)
2.6.27/arch/x86/include/mach-xen/asm/e820_64.h
2.6.27/arch/x86/include/mach-xen/asm/hw_irq.h (added in 2.6.24)
2.6.27/arch/x86/include/mach-xen/asm/hw_irq_32.h
2.6.27/arch/x86/include/mach-xen/asm/hw_irq_64.h
2.6.27/arch/x86/include/mach-xen/asm/io_32.h
2.6.27/arch/x86/include/mach-xen/asm/io_64.h
2.6.27/arch/x86/include/mach-xen/asm/irq.h (added in 2.6.24)
2.6.27/arch/x86/include/mach-xen/asm/irq_64.h
2.6.27/arch/x86/kernel/e820_32-xen.c
2.6.28/arch/x86/include/mach-xen/asm/pci_64.h
2.6.28/arch/x86/include/mach-xen/asm/segment.h (added in 2.6.24)
2.6.28/arch/x86/include/mach-xen/asm/segment_32.h
2.6.30/arch/x86/include/mach-xen/asm/page.h (added in 2.6.24)
2.6.30/arch/x86/include/mach-xen/asm/page_64.h
2.6.30/arch/x86/include/mach-xen/asm/pci_32.h
2.6.30/arch/x86/kernel/apic/apic_xen_64.c
2.6.30/arch/x86/kernel/apic/probe_64-xen.c
2.6.30/arch/x86/kernel/setup_percpu-xen.c (added in 2.6.27)
2.6.31/arch/x86/kernel/init_task-xen.c
2.6.32/arch/x86/include/mach-xen/asm/setup_arch.h
xen3 xen-drivers Patch-mainline: obsolete Acked-by: jbeulich@novell.com
xen3 include-xen-interface Patch-mainline: obsolete Acked-by: jbeulich@novell.com
xen3 xen-kconfig Patch-mainline: obsolete Acked-by: jbeulich@novell.com
xen3 common Patch-mainline: obsolete Acked-by: jbeulich@novell.com List of files that don't require modification anymore (and hence removed from this patch), for reference and in case upstream wants to take the forward porting patches: 2.6.22/include/linux/sched.h 2.6.22/kernel/softlockup.c 2.6.22/kernel/timer.c 2.6.25/mm/highmem.c 2.6.30/include/linux/pci_regs.h
xen3 arch-x86 Patch-mainline: obsolete Acked-by: jbeulich@novell.com List of files that don't require modification anymore (and hence removed from this patch), for reference and in case upstream wants to take the forward porting patches: 2.6.26/arch/x86/kernel/crash.c 2.6.30/arch/x86/kernel/acpi/boot.c
xen3 arch-i386 Patch-mainline: obsolete Acked-by: jbeulich@novell.com