Merge pull request #2596 from bgilbert/v4.11.3

sys-kernel/coreos-*: bump to v4.11.3

sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/Manifest

@@ -1,2 +1,2 @@
 DIST linux-4.11.tar.xz 95447768 SHA256 b67ecafd0a42b3383bf4d82f0850cbff92a7e72a215a6d02f42ddbafcf42a7d6 SHA512 6610eed97ffb7207c71771198c36179b8244ace7222bebb109507720e26c5f17d918079a56d5febdd8605844d67fb2df0ebe910fa2f2f53690daf6e2a8ad09c3 WHIRLPOOL f577b7c5c209cb8dfef2f1d56d77314fbd53323743a34b900e2559ab0049b7c2d6262bda136dd3d005bc0527788106e0484e46558448a8720dac389a969e5886
-DIST patch-4.11.2.xz 55484 SHA256 df7138c754c95f2c22127d1d76c122dbfe26b0b586572855d9d095f0d112b29b SHA512 e090598bb339f04a92febe9c03317b76e51f67c2e3bfebaddb97177b19a2c195332477333be29e9f46483ff937fc85fd63fea1bb4ae18dec0fbe5bc1738afbcb WHIRLPOOL 9f5f0dc2d44c3f9a2276a8be74fddba00743869fe05482b3f3f0d1fcbff4b9e70f3d360d4c59dcd63377a3ab623ca6a9661d42dfe10240cb60a550b6d93ac60c
+DIST patch-4.11.3.xz 112220 SHA256 5847b5d2a3252cd19a28ed1dc13a238d041396792c7863e9ff0bbf5b79cd5e90 SHA512 d1beb9b48ce12e87bb6ec53f0cf03d5650fd421edd8757d31dda20821c9a9f5b5c3dc8f131058ea8b9de45d67c43424ad246baf5c33e0174372f952cce26ad72 WHIRLPOOL e707a5c50af8f5d63708218a0a7a775f04b348ac478b82c755f66c9202111572e42ad97025d6daa68cb7e51994c8cc29745c59cc82eb6fa69369c5f0ca60c89c

sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.11/z0001-efi-Add-EFI_SECURE_BOOT-bit.patch

@@ -1,4 +1,4 @@
-From 086ca71645952c2622aecdc84c7afc7b3c7a7842 Mon Sep 17 00:00:00 2001
+From 83d7b5132691f13966d43039c84ad8ff3566fa2d Mon Sep 17 00:00:00 2001
 From: Josh Boyer <jwboyer@fedoraproject.org>
 Date: Mon, 21 Nov 2016 23:55:55 +0000
 Subject: [PATCH 01/24] efi: Add EFI_SECURE_BOOT bit

sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.11/z0002-Add-the-ability-to-lock-down-access-to-the-running-k.patch

@@ -1,4 +1,4 @@
-From 0cab5cca1b8851aec3e629a9fe09c1ae2731d19c Mon Sep 17 00:00:00 2001
+From 298c4a072ee32beab33db2610b11f1ef5a07b522 Mon Sep 17 00:00:00 2001
 From: David Howells <dhowells@redhat.com>
 Date: Mon, 21 Nov 2016 23:36:17 +0000
 Subject: [PATCH 02/24] Add the ability to lock down access to the running

sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.11/z0003-efi-Lock-down-the-kernel-if-booted-in-secure-boot-mo.patch

@@ -1,4 +1,4 @@
-From f694ce50f771c473c2da050f23f291ab765d0b9a Mon Sep 17 00:00:00 2001
+From 1b3e7ef6f4ac4734e94de58db32068935f8d3617 Mon Sep 17 00:00:00 2001
 From: David Howells <dhowells@redhat.com>
 Date: Mon, 21 Nov 2016 23:55:55 +0000
 Subject: [PATCH 03/24] efi: Lock down the kernel if booted in secure boot mode

sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.11/z0004-Enforce-module-signatures-if-the-kernel-is-locked-do.patch

@@ -1,4 +1,4 @@
-From b89e4a8478e4aeead12d569b4201bd49cb3fb5f8 Mon Sep 17 00:00:00 2001
+From 97755a6eabc20354dade7241bc63965b42037b31 Mon Sep 17 00:00:00 2001
 From: David Howells <dhowells@redhat.com>
 Date: Wed, 23 Nov 2016 13:22:22 +0000
 Subject: [PATCH 04/24] Enforce module signatures if the kernel is locked down

sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.11/z0005-Restrict-dev-mem-and-dev-kmem-when-the-kernel-is-loc.patch

@@ -1,4 +1,4 @@
-From af03b685e00db658c4c403473c8e3eba46f7c4dc Mon Sep 17 00:00:00 2001
+From 219442f869dc3643fb935b11330b2c04e7567b17 Mon Sep 17 00:00:00 2001
 From: Matthew Garrett <matthew.garrett@nebula.com>
 Date: Tue, 22 Nov 2016 08:46:16 +0000
 Subject: [PATCH 05/24] Restrict /dev/mem and /dev/kmem when the kernel is
@@ -15,7 +15,7 @@ Signed-off-by: David Howells <dhowells@redhat.com>
  1 file changed, 6 insertions(+)
 
 diff --git a/drivers/char/mem.c b/drivers/char/mem.c
-index 7e4a9d1..3c305b8 100644
+index 6e0cbe0..a97b22f 100644
 --- a/drivers/char/mem.c
 +++ b/drivers/char/mem.c
 @@ -179,6 +179,9 @@ static ssize_t write_mem(struct file *file, const char __user *buf,
@@ -28,7 +28,7 @@ index 7e4a9d1..3c305b8 100644
  	if (!valid_phys_addr_range(p, count))
  		return -EFAULT;
  
-@@ -535,6 +538,9 @@ static ssize_t write_kmem(struct file *file, const char __user *buf,
+@@ -540,6 +543,9 @@ static ssize_t write_kmem(struct file *file, const char __user *buf,
  	char *kbuf; /* k-addr because vwrite() takes vmlist_lock rwlock */
  	int err = 0;
  

sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.11/z0006-kexec-Disable-at-runtime-if-the-kernel-is-locked-dow.patch

@@ -1,4 +1,4 @@
-From 95da10fb45543c8498fcb0519fa0e99e6ae1f4af Mon Sep 17 00:00:00 2001
+From bd4b779f41c409e4ea15a45e2f261eaa81b5f932 Mon Sep 17 00:00:00 2001
 From: Matthew Garrett <matthew.garrett@nebula.com>
 Date: Tue, 22 Nov 2016 08:46:15 +0000
 Subject: [PATCH 06/24] kexec: Disable at runtime if the kernel is locked down

sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.11/z0007-Copy-secure_boot-flag-in-boot-params-across-kexec-re.patch

@@ -1,4 +1,4 @@
-From a338b22adf42f34d25a101de80567ae663b7b914 Mon Sep 17 00:00:00 2001
+From f0c0d9774aab218de2fa4a06db15159d436cd298 Mon Sep 17 00:00:00 2001
 From: Dave Young <dyoung@redhat.com>
 Date: Tue, 22 Nov 2016 08:46:15 +0000
 Subject: [PATCH 07/24] Copy secure_boot flag in boot params across kexec

sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.11/z0008-kexec_file-Disable-at-runtime-if-securelevel-has-bee.patch

@@ -1,4 +1,4 @@
-From ecf5af995bebbda0633c8817225344fa4f56899c Mon Sep 17 00:00:00 2001
+From 64de85ca1b576014d93bfbafe12cf36ade0fc7e0 Mon Sep 17 00:00:00 2001
 From: "Lee, Chun-Yi" <joeyli.kernel@gmail.com>
 Date: Wed, 23 Nov 2016 13:49:19 +0000
 Subject: [PATCH 08/24] kexec_file: Disable at runtime if securelevel has been

sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.11/z0009-hibernate-Disable-when-the-kernel-is-locked-down.patch

@@ -1,4 +1,4 @@
-From 185450f782f5a775d209e54cf156bdf5a0faa67f Mon Sep 17 00:00:00 2001
+From 8aeae9cff9abbab69799f9cd929196796faf6cb3 Mon Sep 17 00:00:00 2001
 From: Josh Boyer <jwboyer@fedoraproject.org>
 Date: Tue, 22 Nov 2016 08:46:15 +0000
 Subject: [PATCH 09/24] hibernate: Disable when the kernel is locked down

sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.11/z0010-uswsusp-Disable-when-the-kernel-is-locked-down.patch

@@ -1,4 +1,4 @@
-From ec58e483eab1a4a99ee628ecf5657d8672b198e8 Mon Sep 17 00:00:00 2001
+From e6d851b0ba1210c9aa2d4dc7c2d7f001e7c1a7cf Mon Sep 17 00:00:00 2001
 From: Matthew Garrett <mjg59@srcf.ucam.org>
 Date: Wed, 23 Nov 2016 13:28:17 +0000
 Subject: [PATCH 10/24] uswsusp: Disable when the kernel is locked down

sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.11/z0011-PCI-Lock-down-BAR-access-when-the-kernel-is-locked-d.patch

@@ -1,4 +1,4 @@
-From 055b28c22c690a666d9388bc30d4efe1d1dbf460 Mon Sep 17 00:00:00 2001
+From cdaa7b3c7ece156aa2a711870b58d8d22d5b3988 Mon Sep 17 00:00:00 2001
 From: Matthew Garrett <matthew.garrett@nebula.com>
 Date: Tue, 22 Nov 2016 08:46:15 +0000
 Subject: [PATCH 11/24] PCI: Lock down BAR access when the kernel is locked
@@ -19,7 +19,7 @@ Signed-off-by: David Howells <dhowells@redhat.com>
  3 files changed, 17 insertions(+), 2 deletions(-)
 
 diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
-index 25d010d..f70b366 100644
+index 7ac258f..7d29b03 100644
 --- a/drivers/pci/pci-sysfs.c
 +++ b/drivers/pci/pci-sysfs.c
 @@ -727,6 +727,9 @@ static ssize_t pci_write_config(struct file *filp, struct kobject *kobj,
@@ -32,7 +32,7 @@ index 25d010d..f70b366 100644
  	if (off > dev->cfg_size)
  		return 0;
  	if (off + count > dev->cfg_size) {
-@@ -1018,6 +1021,9 @@ static int pci_mmap_resource(struct kobject *kobj, struct bin_attribute *attr,
+@@ -1022,6 +1025,9 @@ static int pci_mmap_resource(struct kobject *kobj, struct bin_attribute *attr,
  	resource_size_t start, end;
  	int i;
  
@@ -42,7 +42,7 @@ index 25d010d..f70b366 100644
  	for (i = 0; i < PCI_ROM_RESOURCE; i++)
  		if (res == &pdev->resource[i])
  			break;
-@@ -1117,6 +1123,9 @@ static ssize_t pci_write_resource_io(struct file *filp, struct kobject *kobj,
+@@ -1121,6 +1127,9 @@ static ssize_t pci_write_resource_io(struct file *filp, struct kobject *kobj,
  				     struct bin_attribute *attr, char *buf,
  				     loff_t off, size_t count)
  {
@@ -53,7 +53,7 @@ index 25d010d..f70b366 100644
  }
  
 diff --git a/drivers/pci/proc.c b/drivers/pci/proc.c
-index f82710a..139d6f0 100644
+index dc8912e..e2c5eff 100644
 --- a/drivers/pci/proc.c
 +++ b/drivers/pci/proc.c
 @@ -116,6 +116,9 @@ static ssize_t proc_bus_pci_write(struct file *file, const char __user *buf,
@@ -78,13 +78,13 @@ index f82710a..139d6f0 100644
  		ret = pci_domain_nr(dev->bus);
 @@ -233,7 +239,7 @@ static int proc_bus_pci_mmap(struct file *file, struct vm_area_struct *vma)
  	struct pci_filp_private *fpriv = file->private_data;
- 	int i, ret, write_combine;
+ 	int i, ret, write_combine = 0, res_bit;
  
 -	if (!capable(CAP_SYS_RAWIO))
 +	if (!capable(CAP_SYS_RAWIO) || kernel_is_locked_down())
  		return -EPERM;
  
- 	/* Make sure the caller is mapping a real resource for this device */
+ 	if (fpriv->mmap_state == pci_mmap_io)
 diff --git a/drivers/pci/syscall.c b/drivers/pci/syscall.c
 index 9bf993e..c095247 100644
 --- a/drivers/pci/syscall.c

sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.11/z0012-x86-Lock-down-IO-port-access-when-the-kernel-is-lock.patch

@@ -1,4 +1,4 @@
-From b624041bf4b975b28c45f9a90d8452a0b7a9768a Mon Sep 17 00:00:00 2001
+From c6d9dd2cb16257f42a8ce7e10b0a67bc32e7baf1 Mon Sep 17 00:00:00 2001
 From: Matthew Garrett <matthew.garrett@nebula.com>
 Date: Tue, 22 Nov 2016 08:46:16 +0000
 Subject: [PATCH 12/24] x86: Lock down IO port access when the kernel is locked
@@ -42,10 +42,10 @@ index 9c3cf09..4a613fe 100644
  	}
  	regs->flags = (regs->flags & ~X86_EFLAGS_IOPL) |
 diff --git a/drivers/char/mem.c b/drivers/char/mem.c
-index 3c305b8..f68976e 100644
+index a97b22f..8705f8f 100644
 --- a/drivers/char/mem.c
 +++ b/drivers/char/mem.c
-@@ -763,6 +763,8 @@ static loff_t memory_lseek(struct file *file, loff_t offset, int orig)
+@@ -768,6 +768,8 @@ static loff_t memory_lseek(struct file *file, loff_t offset, int orig)
  
  static int open_port(struct inode *inode, struct file *filp)
  {

sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.11/z0013-x86-Restrict-MSR-access-when-the-kernel-is-locked-do.patch

@@ -1,4 +1,4 @@
-From f65a11bbddc0ed0924b8a0e599ad91789a611553 Mon Sep 17 00:00:00 2001
+From 6edde3eb28816e423ae42505765569c745ff1ff6 Mon Sep 17 00:00:00 2001
 From: Matthew Garrett <matthew.garrett@nebula.com>
 Date: Tue, 22 Nov 2016 08:46:17 +0000
 Subject: [PATCH 13/24] x86: Restrict MSR access when the kernel is locked down

sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.11/z0014-asus-wmi-Restrict-debugfs-interface-when-the-kernel-.patch

@@ -1,4 +1,4 @@
-From 55f5e715306286a687df1785757ce129f432ab10 Mon Sep 17 00:00:00 2001
+From a532ea34bed3460afab6492a2fe6cedb09e30d3d Mon Sep 17 00:00:00 2001
 From: Matthew Garrett <matthew.garrett@nebula.com>
 Date: Tue, 22 Nov 2016 08:46:16 +0000
 Subject: [PATCH 14/24] asus-wmi: Restrict debugfs interface when the kernel is

sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.11/z0015-ACPI-Limit-access-to-custom_method-when-the-kernel-i.patch

@@ -1,4 +1,4 @@
-From 9622882d597a407f6d08f2528f09bd0447159446 Mon Sep 17 00:00:00 2001
+From 74c600a00a10c86c9e5b484ed3916243ee2581e0 Mon Sep 17 00:00:00 2001
 From: Matthew Garrett <matthew.garrett@nebula.com>
 Date: Tue, 22 Nov 2016 08:46:16 +0000
 Subject: [PATCH 15/24] ACPI: Limit access to custom_method when the kernel is

sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.11/z0016-acpi-Ignore-acpi_rsdp-kernel-param-when-the-kernel-h.patch

@@ -1,4 +1,4 @@
-From f807f3b5151a867fc50140ba977e498333ec2fc4 Mon Sep 17 00:00:00 2001
+From 245dac212104da4b806cbdbda95891044460211f Mon Sep 17 00:00:00 2001
 From: Josh Boyer <jwboyer@redhat.com>
 Date: Tue, 22 Nov 2016 08:46:16 +0000
 Subject: [PATCH 16/24] acpi: Ignore acpi_rsdp kernel param when the kernel has

sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.11/z0017-acpi-Disable-ACPI-table-override-if-the-kernel-is-lo.patch

@@ -1,4 +1,4 @@
-From 2844417f1d840fd3aecad52f51bac40b7e014649 Mon Sep 17 00:00:00 2001
+From 945326918832d84f00d2bc731e4bc8e9ede3783d Mon Sep 17 00:00:00 2001
 From: Linn Crosetto <linn@hpe.com>
 Date: Wed, 23 Nov 2016 13:32:27 +0000
 Subject: [PATCH 17/24] acpi: Disable ACPI table override if the kernel is

sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.11/z0018-acpi-Disable-APEI-error-injection-if-the-kernel-is-l.patch

@@ -1,4 +1,4 @@
-From 8599cf0d85258bb86d6c8acb393a18a971b5f4bd Mon Sep 17 00:00:00 2001
+From 15fac7742c5dd9dc56e04b8e45ce93c94cca0845 Mon Sep 17 00:00:00 2001
 From: Linn Crosetto <linn@hpe.com>
 Date: Wed, 23 Nov 2016 13:39:41 +0000
 Subject: [PATCH 18/24] acpi: Disable APEI error injection if the kernel is

sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.11/z0019-bpf-Restrict-kernel-image-access-functions-when-the-.patch

@@ -1,4 +1,4 @@
-From 29786d6de058f55d7afa299ab64399768ab0c563 Mon Sep 17 00:00:00 2001
+From 5ee5afe5f7881e719d7028c5b7246fc00d9aba21 Mon Sep 17 00:00:00 2001
 From: "Lee, Chun-Yi" <jlee@suse.com>
 Date: Wed, 23 Nov 2016 13:52:16 +0000
 Subject: [PATCH 19/24] bpf: Restrict kernel image access functions when the

sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.11/z0020-scsi-Lock-down-the-eata-driver.patch

@@ -1,4 +1,4 @@
-From 924c89af0064081b030f1aac58709e5daac002e9 Mon Sep 17 00:00:00 2001
+From 971ef2fcf5dbc3fbf5cdae0ccfd25b1a680d97c6 Mon Sep 17 00:00:00 2001
 From: David Howells <dhowells@redhat.com>
 Date: Tue, 22 Nov 2016 10:10:34 +0000
 Subject: [PATCH 20/24] scsi: Lock down the eata driver

sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.11/z0021-Prohibit-PCMCIA-CIS-storage-when-the-kernel-is-locke.patch

@@ -1,4 +1,4 @@
-From 4c97245701c5eab51bbdc467e0826931732f8de4 Mon Sep 17 00:00:00 2001
+From d2476a4676593d8bd70c601073ce2de4dfb52209 Mon Sep 17 00:00:00 2001
 From: David Howells <dhowells@redhat.com>
 Date: Fri, 25 Nov 2016 14:37:45 +0000
 Subject: [PATCH 21/24] Prohibit PCMCIA CIS storage when the kernel is locked

sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.11/z0022-Lock-down-TIOCSSERIAL.patch

@@ -1,4 +1,4 @@
-From c01c88ea695bd9c4be20c5d5cec0fa52d545bbe0 Mon Sep 17 00:00:00 2001
+From 386e389f87b8df12b75d68d1b17bce9f814c2215 Mon Sep 17 00:00:00 2001
 From: David Howells <dhowells@redhat.com>
 Date: Wed, 7 Dec 2016 10:28:39 +0000
 Subject: [PATCH 22/24] Lock down TIOCSSERIAL

sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.11/z0023-kbuild-derive-relative-path-for-KBUILD_SRC-from-CURD.patch

@@ -1,4 +1,4 @@
-From e140b45ea1af9b64d8a40c6f582b73fa13c3d55c Mon Sep 17 00:00:00 2001
+From 59af287ee7c1185cfafc7a6ab9394c9f73d40aa2 Mon Sep 17 00:00:00 2001
 From: Vito Caputo <vito.caputo@coreos.com>
 Date: Wed, 25 Nov 2015 02:59:45 -0800
 Subject: [PATCH 23/24] kbuild: derive relative path for KBUILD_SRC from CURDIR
@@ -12,7 +12,7 @@ by some undesirable path component.
  1 file changed, 2 insertions(+), 1 deletion(-)
 
 diff --git a/Makefile b/Makefile
-index d7b6483..9b326fd 100644
+index 7bab127..e6b8ed3 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -149,7 +149,8 @@ $(filter-out _all sub-make $(CURDIR)/Makefile, $(MAKECMDGOALS)) _all: sub-make

sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.11/z0024-Add-arm64-coreos-verity-hash.patch

@@ -1,4 +1,4 @@
-From b591b43709ccc14de525038531bf5a4a27c5566a Mon Sep 17 00:00:00 2001
+From f12ea7dada87a3d6d249d3833d859405def9cc4e Mon Sep 17 00:00:00 2001
 From: Geoff Levand <geoff@infradead.org>
 Date: Fri, 11 Nov 2016 17:28:52 -0800
 Subject: [PATCH 24/24] Add arm64 coreos verity hash