KumiSystems/openwrtv3
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

kernel: bump 4.4 to 4.4.112

Browse source 
Refresh patches.
Remove upstreamed patches:

target/linux/generic/patches-4.4/030-2-smsc75xx-use-skb_cow_head-to-deal-with-cloned-skbs.patch
target/linux/generic/patches-4.4/030-3-cx82310_eth-use-skb_cow_head-to-deal-with-cloned-skb.patch
target/linux/generic/patches-4.4/030-4-sr9700-use-skb_cow_head-to-deal-with-cloned-skbs.patch
target/linux/generic/patches-4.4/030-5-lan78xx-use-skb_cow_head-to-deal-with-cloned-skbs.patch

CVEs completely or partially addressed:

CVE-2017-5715
CVE-2017-5753
CVE-2017-17741
CVE-2017-1000410

Compile-tested: ar71xx Archer C7 v2
Run-tested: ar71xx Archer C7 v2

Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
This commit is contained in:
Kevin Darbyshire-Bryant 2018-01-18 15:01:19 +00:00 committed by Hauke Mehrtens
parent d8565a06dc
commit a30370bbf1
12 changed files with 19 additions and 165 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
include/kernel-version.mk
View file

@ -3,12 +3,12 @@
LINUX_RELEASE?=1
LINUX_VERSION-3.18 = .71
LINUX_VERSION-4.4 = .111
LINUX_VERSION-4.4 = .112
LINUX_VERSION-4.9 = .77
LINUX_VERSION-4.14 = .14
LINUX_KERNEL_HASH-3.18.71 = 5abc9778ad44ce02ed6c8ab52ece8a21c6d20d21f6ed8a19287b4a38a50c1240
LINUX_KERNEL_HASH-4.4.111 = a201282e8eaf62b4f51edb2241e98ff805fe2d1b04a72a2328c5a6e2d77ec008
LINUX_KERNEL_HASH-4.4.112 = 544b42cbeed022896115c76a18fc97b4507d5b41d7ac0ce1dce9afd6ffd11ecd
LINUX_KERNEL_HASH-4.9.77 = 7c29bc3fb96f1e23d98f664e786dddd53a1599f56431b9b7fdfba402a4b3705c
LINUX_KERNEL_HASH-4.14.14 = 8b96362eb55ae152555980e7193fe2585b487176fb936cc69b8947d7dd32044a

2
target/linux/ar71xx/patches-4.4/910-unaligned_access_hacks.patch
View file

@ -310,7 +310,7 @@
if (t->parms.flags & IP6_TNL_F_USE_ORIG_FWMARK)
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1409,7 +1409,7 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, str
@@ -1410,7 +1410,7 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, str
dsfield = ipv6_get_dsfield(ipv6h);
if (t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS)

36
target/linux/generic/pending-4.4/030-2-smsc75xx-use-skb_cow_head-to-deal-with-cloned-skbs.patch
View file

@ -1,36 +0,0 @@
From b7c6d2675899cfff0180412c63fc9cbd5bacdb4d Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Wed, 19 Apr 2017 09:59:21 -0700
Subject: [PATCH] smsc75xx: use skb_cow_head() to deal with cloned skbs
We need to ensure there is enough headroom to push extra header,
but we also need to check if we are allowed to change headers.
skb_cow_head() is the proper helper to deal with this.
Fixes: d0cad871703b ("smsc75xx: SMSC LAN75xx USB gigabit ethernet adapter driver")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: James Hughes <james.hughes@raspberrypi.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
---
drivers/net/usb/smsc75xx.c | 8 ++------
1 file changed, 2 insertions(+), 6 deletions(-)
--- a/drivers/net/usb/smsc75xx.c
+++ b/drivers/net/usb/smsc75xx.c
@@ -2193,13 +2193,9 @@ static struct sk_buff *smsc75xx_tx_fixup
{
u32 tx_cmd_a, tx_cmd_b;
- if (skb_headroom(skb) < SMSC75XX_TX_OVERHEAD) {
- struct sk_buff *skb2 =
- skb_copy_expand(skb, SMSC75XX_TX_OVERHEAD, 0, flags);
+ if (skb_cow_head(skb, SMSC75XX_TX_OVERHEAD)) {
dev_kfree_skb_any(skb);
- skb = skb2;
- if (!skb)
- return NULL;
+ return NULL;
}
tx_cmd_a = (u32)(skb->len & TX_CMD_A_LEN) | TX_CMD_A_FCS;

35
target/linux/generic/pending-4.4/030-3-cx82310_eth-use-skb_cow_head-to-deal-with-cloned-skb.patch
View file

@ -1,35 +0,0 @@
From a9e840a2081ed28c2b7caa6a9a0041c950b3c37d Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Wed, 19 Apr 2017 09:59:22 -0700
Subject: [PATCH] cx82310_eth: use skb_cow_head() to deal with cloned skbs
We need to ensure there is enough headroom to push extra header,
but we also need to check if we are allowed to change headers.
skb_cow_head() is the proper helper to deal with this.
Fixes: cc28a20e77b2 ("introduce cx82310_eth: Conexant CX82310-based ADSL router USB ethernet driver")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: James Hughes <james.hughes@raspberrypi.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
---
drivers/net/usb/cx82310_eth.c | 7 ++-----
1 file changed, 2 insertions(+), 5 deletions(-)
--- a/drivers/net/usb/cx82310_eth.c
+++ b/drivers/net/usb/cx82310_eth.c
@@ -293,12 +293,9 @@ static struct sk_buff *cx82310_tx_fixup(
{
int len = skb->len;
- if (skb_headroom(skb) < 2) {
- struct sk_buff *skb2 = skb_copy_expand(skb, 2, 0, flags);
+ if (skb_cow_head(skb, 2)) {
dev_kfree_skb_any(skb);
- skb = skb2;
- if (!skb)
- return NULL;
+ return NULL;
}
skb_push(skb, 2);

37
target/linux/generic/pending-4.4/030-4-sr9700-use-skb_cow_head-to-deal-with-cloned-skbs.patch
View file

@ -1,37 +0,0 @@
From d532c1082f68176363ed766d09bf187616e282fe Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Wed, 19 Apr 2017 09:59:23 -0700
Subject: [PATCH] sr9700: use skb_cow_head() to deal with cloned skbs
We need to ensure there is enough headroom to push extra header,
but we also need to check if we are allowed to change headers.
skb_cow_head() is the proper helper to deal with this.
Fixes: c9b37458e956 ("USB2NET : SR9700 : One chip USB 1.1 USB2NET SR9700Device Driver Support")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: James Hughes <james.hughes@raspberrypi.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
---
drivers/net/usb/sr9700.c | 9 ++-------
1 file changed, 2 insertions(+), 7 deletions(-)
--- a/drivers/net/usb/sr9700.c
+++ b/drivers/net/usb/sr9700.c
@@ -456,14 +456,9 @@ static struct sk_buff *sr9700_tx_fixup(s
len = skb->len;
- if (skb_headroom(skb) < SR_TX_OVERHEAD) {
- struct sk_buff *skb2;
-
- skb2 = skb_copy_expand(skb, SR_TX_OVERHEAD, 0, flags);
+ if (skb_cow_head(skb, SR_TX_OVERHEAD)) {
dev_kfree_skb_any(skb);
- skb = skb2;
- if (!skb)
- return NULL;
+ return NULL;
}
__skb_push(skb, SR_TX_OVERHEAD);

38
target/linux/generic/pending-4.4/030-5-lan78xx-use-skb_cow_head-to-deal-with-cloned-skbs.patch
View file

@ -1,38 +0,0 @@
From d4ca73591916b760478d2b04334d5dcadc028e9c Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Wed, 19 Apr 2017 09:59:24 -0700
Subject: [PATCH] lan78xx: use skb_cow_head() to deal with cloned skbs
We need to ensure there is enough headroom to push extra header,
but we also need to check if we are allowed to change headers.
skb_cow_head() is the proper helper to deal with this.
Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: James Hughes <james.hughes@raspberrypi.org>
Cc: Woojung Huh <woojung.huh@microchip.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
---
drivers/net/usb/lan78xx.c | 9 ++-------
1 file changed, 2 insertions(+), 7 deletions(-)
--- a/drivers/net/usb/lan78xx.c
+++ b/drivers/net/usb/lan78xx.c
@@ -2050,14 +2050,9 @@ static struct sk_buff *lan78xx_tx_prep(s
{
u32 tx_cmd_a, tx_cmd_b;
- if (skb_headroom(skb) < TX_OVERHEAD) {
- struct sk_buff *skb2;
-
- skb2 = skb_copy_expand(skb, TX_OVERHEAD, 0, flags);
+ if (skb_cow_head(skb, TX_OVERHEAD)) {
dev_kfree_skb_any(skb);
- skb = skb2;
- if (!skb)
- return NULL;
+ return NULL;
}
if (lan78xx_linearize(skb) < 0)

22
target/linux/generic/pending-4.4/666-Add-support-for-MAP-E-FMRs-mesh-mode.patch
View file

@ -296,7 +296,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
__skb_tunnel_rx(skb, t->dev, t->net);
@@ -1247,6 +1384,7 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, str
@@ -1248,6 +1385,7 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, str
__u32 mtu;
u8 tproto;
int err;
@ -304,7 +304,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
tproto = ACCESS_ONCE(t->parms.proto);
if ((tproto != IPPROTO_IPV6 && tproto != 0) ||
@@ -1277,6 +1415,18 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, str
@@ -1278,6 +1416,18 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, str
if (t->parms.flags & IP6_TNL_F_USE_ORIG_FWMARK)
fl6.flowi6_mark = skb->mark;
@ -323,7 +323,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
err = ip6_tnl_xmit2(skb, dev, dsfield, &fl6, encap_limit, &mtu);
if (err != 0) {
if (err == -EMSGSIZE)
@@ -1391,6 +1541,14 @@ ip6_tnl_change(struct ip6_tnl *t, const
@@ -1392,6 +1542,14 @@ ip6_tnl_change(struct ip6_tnl *t, const
t->parms.flowinfo = p->flowinfo;
t->parms.link = p->link;
t->parms.proto = p->proto;
@ -338,7 +338,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
ip6_tnl_dst_reset(t);
ip6_tnl_link_config(t);
return 0;
@@ -1429,6 +1587,7 @@ ip6_tnl_parm_from_user(struct __ip6_tnl_
@@ -1430,6 +1588,7 @@ ip6_tnl_parm_from_user(struct __ip6_tnl_
p->flowinfo = u->flowinfo;
p->link = u->link;
p->proto = u->proto;
@ -346,7 +346,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
memcpy(p->name, u->name, sizeof(u->name));
}
@@ -1724,6 +1883,15 @@ static int ip6_tnl_validate(struct nlatt
@@ -1725,6 +1884,15 @@ static int ip6_tnl_validate(struct nlatt
return 0;
}
@ -362,7 +362,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
static void ip6_tnl_netlink_parms(struct nlattr *data[],
struct __ip6_tnl_parm *parms)
{
@@ -1755,6 +1923,46 @@ static void ip6_tnl_netlink_parms(struct
@@ -1756,6 +1924,46 @@ static void ip6_tnl_netlink_parms(struct
if (data[IFLA_IPTUN_PROTO])
parms->proto = nla_get_u8(data[IFLA_IPTUN_PROTO]);
@ -409,7 +409,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
}
static int ip6_tnl_newlink(struct net *src_net, struct net_device *dev,
@@ -1807,6 +2015,12 @@ static void ip6_tnl_dellink(struct net_d
@@ -1808,6 +2016,12 @@ static void ip6_tnl_dellink(struct net_d
static size_t ip6_tnl_get_size(const struct net_device *dev)
{
@ -422,7 +422,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
return
/* IFLA_IPTUN_LINK */
nla_total_size(4) +
@@ -1824,6 +2038,24 @@ static size_t ip6_tnl_get_size(const str
@@ -1825,6 +2039,24 @@ static size_t ip6_tnl_get_size(const str
nla_total_size(4) +
/* IFLA_IPTUN_PROTO */
nla_total_size(1) +
@ -447,7 +447,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
0;
}
@@ -1831,6 +2063,9 @@ static int ip6_tnl_fill_info(struct sk_b
@@ -1832,6 +2064,9 @@ static int ip6_tnl_fill_info(struct sk_b
{
struct ip6_tnl *tunnel = netdev_priv(dev);
struct __ip6_tnl_parm *parm = &tunnel->parms;
@ -457,7 +457,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
if (nla_put_u32(skb, IFLA_IPTUN_LINK, parm->link) ||
nla_put_in6_addr(skb, IFLA_IPTUN_LOCAL, &parm->laddr) ||
@@ -1839,8 +2074,27 @@ static int ip6_tnl_fill_info(struct sk_b
@@ -1840,8 +2075,27 @@ static int ip6_tnl_fill_info(struct sk_b
nla_put_u8(skb, IFLA_IPTUN_ENCAP_LIMIT, parm->encap_limit) ||
nla_put_be32(skb, IFLA_IPTUN_FLOWINFO, parm->flowinfo) ||
nla_put_u32(skb, IFLA_IPTUN_FLAGS, parm->flags) ||
@ -486,7 +486,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
return 0;
nla_put_failure:
@@ -1864,6 +2118,7 @@ static const struct nla_policy ip6_tnl_p
@@ -1865,6 +2119,7 @@ static const struct nla_policy ip6_tnl_p
[IFLA_IPTUN_FLOWINFO] = { .type = NLA_U32 },
[IFLA_IPTUN_FLAGS] = { .type = NLA_U32 },
[IFLA_IPTUN_PROTO] = { .type = NLA_U8 },

2
target/linux/generic/pending-4.4/701-phy_extension.patch
View file

@ -53,7 +53,7 @@
* @phydev: the phy_device struct
--- a/include/linux/phy.h
+++ b/include/linux/phy.h
@@ -796,6 +796,7 @@ void phy_start_machine(struct phy_device
@@ -807,6 +807,7 @@ void phy_start_machine(struct phy_device
void phy_stop_machine(struct phy_device *phydev);
int phy_ethtool_sset(struct phy_device *phydev, struct ethtool_cmd *cmd);
int phy_ethtool_gset(struct phy_device *phydev, struct ethtool_cmd *cmd);

2
target/linux/generic/pending-4.4/710-phy-add-mdio_register_board_info.patch
View file

@ -46,7 +46,7 @@
phy_device_free(phydev);
--- a/include/linux/phy.h
+++ b/include/linux/phy.h
@@ -835,6 +835,23 @@ void mdio_bus_exit(void);
@@ -846,6 +846,23 @@ void mdio_bus_exit(void);
extern struct bus_type mdio_bus_type;

2
target/linux/generic/pending-4.4/902-debloat_proc.patch
View file

@ -1,6 +1,6 @@
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -2712,6 +2712,8 @@ static const struct file_operations proc
@@ -2716,6 +2716,8 @@ static const struct file_operations proc
static int __init proc_locks_init(void)
{

2
target/linux/generic/pending-4.4/904-debloat_dma_buf.patch
View file

@ -1,6 +1,6 @@
--- a/drivers/base/Kconfig
+++ b/drivers/base/Kconfig
@@ -229,7 +229,7 @@ config SOC_BUS
@@ -232,7 +232,7 @@ config SOC_BUS
source "drivers/base/regmap/Kconfig"
config DMA_SHARED_BUFFER

2
target/linux/mvebu/patches-4.4/128-phy-export-phy_speed_to_str-for-phylink.patch
View file

@ -34,7 +34,7 @@ Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
case PHY_##_state: \
--- a/include/linux/phy.h
+++ b/include/linux/phy.h
@@ -812,6 +812,7 @@ int phy_ethtool_gset(struct phy_device *
@@ -823,6 +823,7 @@ int phy_ethtool_gset(struct phy_device *
int phy_ethtool_ioctl(struct phy_device *phydev, void *useraddr);
int phy_mii_ioctl(struct phy_device *phydev, struct ifreq *ifr, int cmd);
int phy_start_interrupts(struct phy_device *phydev);