From a30370bbf114b54df1906a39b0ebb76ba0e53a8e Mon Sep 17 00:00:00 2001 From: Kevin Darbyshire-Bryant Date: Thu, 18 Jan 2018 15:01:19 +0000 Subject: [PATCH] kernel: bump 4.4 to 4.4.112 Refresh patches. Remove upstreamed patches: target/linux/generic/patches-4.4/030-2-smsc75xx-use-skb_cow_head-to-deal-with-cloned-skbs.patch target/linux/generic/patches-4.4/030-3-cx82310_eth-use-skb_cow_head-to-deal-with-cloned-skb.patch target/linux/generic/patches-4.4/030-4-sr9700-use-skb_cow_head-to-deal-with-cloned-skbs.patch target/linux/generic/patches-4.4/030-5-lan78xx-use-skb_cow_head-to-deal-with-cloned-skbs.patch CVEs completely or partially addressed: CVE-2017-5715 CVE-2017-5753 CVE-2017-17741 CVE-2017-1000410 Compile-tested: ar71xx Archer C7 v2 Run-tested: ar71xx Archer C7 v2 Signed-off-by: Kevin Darbyshire-Bryant --- include/kernel-version.mk | 4 +- .../910-unaligned_access_hacks.patch | 2 +- ...kb_cow_head-to-deal-with-cloned-skbs.patch | 36 ------------------ ...skb_cow_head-to-deal-with-cloned-skb.patch | 35 ----------------- ...kb_cow_head-to-deal-with-cloned-skbs.patch | 37 ------------------ ...kb_cow_head-to-deal-with-cloned-skbs.patch | 38 ------------------- ...Add-support-for-MAP-E-FMRs-mesh-mode.patch | 22 +++++------ .../pending-4.4/701-phy_extension.patch | 2 +- ...710-phy-add-mdio_register_board_info.patch | 2 +- .../pending-4.4/902-debloat_proc.patch | 2 +- .../pending-4.4/904-debloat_dma_buf.patch | 2 +- ...-export-phy_speed_to_str-for-phylink.patch | 2 +- 12 files changed, 19 insertions(+), 165 deletions(-) delete mode 100644 target/linux/generic/pending-4.4/030-2-smsc75xx-use-skb_cow_head-to-deal-with-cloned-skbs.patch delete mode 100644 target/linux/generic/pending-4.4/030-3-cx82310_eth-use-skb_cow_head-to-deal-with-cloned-skb.patch delete mode 100644 target/linux/generic/pending-4.4/030-4-sr9700-use-skb_cow_head-to-deal-with-cloned-skbs.patch delete mode 100644 target/linux/generic/pending-4.4/030-5-lan78xx-use-skb_cow_head-to-deal-with-cloned-skbs.patch diff --git a/include/kernel-version.mk b/include/kernel-version.mk index fdfbbe9a57..6103cee63a 100644 --- a/include/kernel-version.mk +++ b/include/kernel-version.mk @@ -3,12 +3,12 @@ LINUX_RELEASE?=1 LINUX_VERSION-3.18 = .71 -LINUX_VERSION-4.4 = .111 +LINUX_VERSION-4.4 = .112 LINUX_VERSION-4.9 = .77 LINUX_VERSION-4.14 = .14 LINUX_KERNEL_HASH-3.18.71 = 5abc9778ad44ce02ed6c8ab52ece8a21c6d20d21f6ed8a19287b4a38a50c1240 -LINUX_KERNEL_HASH-4.4.111 = a201282e8eaf62b4f51edb2241e98ff805fe2d1b04a72a2328c5a6e2d77ec008 +LINUX_KERNEL_HASH-4.4.112 = 544b42cbeed022896115c76a18fc97b4507d5b41d7ac0ce1dce9afd6ffd11ecd LINUX_KERNEL_HASH-4.9.77 = 7c29bc3fb96f1e23d98f664e786dddd53a1599f56431b9b7fdfba402a4b3705c LINUX_KERNEL_HASH-4.14.14 = 8b96362eb55ae152555980e7193fe2585b487176fb936cc69b8947d7dd32044a diff --git a/target/linux/ar71xx/patches-4.4/910-unaligned_access_hacks.patch b/target/linux/ar71xx/patches-4.4/910-unaligned_access_hacks.patch index 8882b1758f..a8d8c15c3b 100644 --- a/target/linux/ar71xx/patches-4.4/910-unaligned_access_hacks.patch +++ b/target/linux/ar71xx/patches-4.4/910-unaligned_access_hacks.patch @@ -310,7 +310,7 @@ if (t->parms.flags & IP6_TNL_F_USE_ORIG_FWMARK) --- a/net/ipv6/ip6_tunnel.c +++ b/net/ipv6/ip6_tunnel.c -@@ -1409,7 +1409,7 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, str +@@ -1410,7 +1410,7 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, str dsfield = ipv6_get_dsfield(ipv6h); if (t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS) diff --git a/target/linux/generic/pending-4.4/030-2-smsc75xx-use-skb_cow_head-to-deal-with-cloned-skbs.patch b/target/linux/generic/pending-4.4/030-2-smsc75xx-use-skb_cow_head-to-deal-with-cloned-skbs.patch deleted file mode 100644 index 6312f0f731..0000000000 --- a/target/linux/generic/pending-4.4/030-2-smsc75xx-use-skb_cow_head-to-deal-with-cloned-skbs.patch +++ /dev/null @@ -1,36 +0,0 @@ -From b7c6d2675899cfff0180412c63fc9cbd5bacdb4d Mon Sep 17 00:00:00 2001 -From: Eric Dumazet -Date: Wed, 19 Apr 2017 09:59:21 -0700 -Subject: [PATCH] smsc75xx: use skb_cow_head() to deal with cloned skbs - -We need to ensure there is enough headroom to push extra header, -but we also need to check if we are allowed to change headers. - -skb_cow_head() is the proper helper to deal with this. - -Fixes: d0cad871703b ("smsc75xx: SMSC LAN75xx USB gigabit ethernet adapter driver") -Signed-off-by: Eric Dumazet -Cc: James Hughes -Signed-off-by: David S. Miller ---- - drivers/net/usb/smsc75xx.c | 8 ++------ - 1 file changed, 2 insertions(+), 6 deletions(-) - ---- a/drivers/net/usb/smsc75xx.c -+++ b/drivers/net/usb/smsc75xx.c -@@ -2193,13 +2193,9 @@ static struct sk_buff *smsc75xx_tx_fixup - { - u32 tx_cmd_a, tx_cmd_b; - -- if (skb_headroom(skb) < SMSC75XX_TX_OVERHEAD) { -- struct sk_buff *skb2 = -- skb_copy_expand(skb, SMSC75XX_TX_OVERHEAD, 0, flags); -+ if (skb_cow_head(skb, SMSC75XX_TX_OVERHEAD)) { - dev_kfree_skb_any(skb); -- skb = skb2; -- if (!skb) -- return NULL; -+ return NULL; - } - - tx_cmd_a = (u32)(skb->len & TX_CMD_A_LEN) | TX_CMD_A_FCS; diff --git a/target/linux/generic/pending-4.4/030-3-cx82310_eth-use-skb_cow_head-to-deal-with-cloned-skb.patch b/target/linux/generic/pending-4.4/030-3-cx82310_eth-use-skb_cow_head-to-deal-with-cloned-skb.patch deleted file mode 100644 index aee8aa9805..0000000000 --- a/target/linux/generic/pending-4.4/030-3-cx82310_eth-use-skb_cow_head-to-deal-with-cloned-skb.patch +++ /dev/null @@ -1,35 +0,0 @@ -From a9e840a2081ed28c2b7caa6a9a0041c950b3c37d Mon Sep 17 00:00:00 2001 -From: Eric Dumazet -Date: Wed, 19 Apr 2017 09:59:22 -0700 -Subject: [PATCH] cx82310_eth: use skb_cow_head() to deal with cloned skbs - -We need to ensure there is enough headroom to push extra header, -but we also need to check if we are allowed to change headers. - -skb_cow_head() is the proper helper to deal with this. - -Fixes: cc28a20e77b2 ("introduce cx82310_eth: Conexant CX82310-based ADSL router USB ethernet driver") -Signed-off-by: Eric Dumazet -Cc: James Hughes -Signed-off-by: David S. Miller ---- - drivers/net/usb/cx82310_eth.c | 7 ++----- - 1 file changed, 2 insertions(+), 5 deletions(-) - ---- a/drivers/net/usb/cx82310_eth.c -+++ b/drivers/net/usb/cx82310_eth.c -@@ -293,12 +293,9 @@ static struct sk_buff *cx82310_tx_fixup( - { - int len = skb->len; - -- if (skb_headroom(skb) < 2) { -- struct sk_buff *skb2 = skb_copy_expand(skb, 2, 0, flags); -+ if (skb_cow_head(skb, 2)) { - dev_kfree_skb_any(skb); -- skb = skb2; -- if (!skb) -- return NULL; -+ return NULL; - } - skb_push(skb, 2); - diff --git a/target/linux/generic/pending-4.4/030-4-sr9700-use-skb_cow_head-to-deal-with-cloned-skbs.patch b/target/linux/generic/pending-4.4/030-4-sr9700-use-skb_cow_head-to-deal-with-cloned-skbs.patch deleted file mode 100644 index 4d0fcf6fc2..0000000000 --- a/target/linux/generic/pending-4.4/030-4-sr9700-use-skb_cow_head-to-deal-with-cloned-skbs.patch +++ /dev/null @@ -1,37 +0,0 @@ -From d532c1082f68176363ed766d09bf187616e282fe Mon Sep 17 00:00:00 2001 -From: Eric Dumazet -Date: Wed, 19 Apr 2017 09:59:23 -0700 -Subject: [PATCH] sr9700: use skb_cow_head() to deal with cloned skbs - -We need to ensure there is enough headroom to push extra header, -but we also need to check if we are allowed to change headers. - -skb_cow_head() is the proper helper to deal with this. - -Fixes: c9b37458e956 ("USB2NET : SR9700 : One chip USB 1.1 USB2NET SR9700Device Driver Support") -Signed-off-by: Eric Dumazet -Cc: James Hughes -Signed-off-by: David S. Miller ---- - drivers/net/usb/sr9700.c | 9 ++------- - 1 file changed, 2 insertions(+), 7 deletions(-) - ---- a/drivers/net/usb/sr9700.c -+++ b/drivers/net/usb/sr9700.c -@@ -456,14 +456,9 @@ static struct sk_buff *sr9700_tx_fixup(s - - len = skb->len; - -- if (skb_headroom(skb) < SR_TX_OVERHEAD) { -- struct sk_buff *skb2; -- -- skb2 = skb_copy_expand(skb, SR_TX_OVERHEAD, 0, flags); -+ if (skb_cow_head(skb, SR_TX_OVERHEAD)) { - dev_kfree_skb_any(skb); -- skb = skb2; -- if (!skb) -- return NULL; -+ return NULL; - } - - __skb_push(skb, SR_TX_OVERHEAD); diff --git a/target/linux/generic/pending-4.4/030-5-lan78xx-use-skb_cow_head-to-deal-with-cloned-skbs.patch b/target/linux/generic/pending-4.4/030-5-lan78xx-use-skb_cow_head-to-deal-with-cloned-skbs.patch deleted file mode 100644 index 4f96041648..0000000000 --- a/target/linux/generic/pending-4.4/030-5-lan78xx-use-skb_cow_head-to-deal-with-cloned-skbs.patch +++ /dev/null @@ -1,38 +0,0 @@ -From d4ca73591916b760478d2b04334d5dcadc028e9c Mon Sep 17 00:00:00 2001 -From: Eric Dumazet -Date: Wed, 19 Apr 2017 09:59:24 -0700 -Subject: [PATCH] lan78xx: use skb_cow_head() to deal with cloned skbs - -We need to ensure there is enough headroom to push extra header, -but we also need to check if we are allowed to change headers. - -skb_cow_head() is the proper helper to deal with this. - -Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver") -Signed-off-by: Eric Dumazet -Cc: James Hughes -Cc: Woojung Huh -Signed-off-by: David S. Miller ---- - drivers/net/usb/lan78xx.c | 9 ++------- - 1 file changed, 2 insertions(+), 7 deletions(-) - ---- a/drivers/net/usb/lan78xx.c -+++ b/drivers/net/usb/lan78xx.c -@@ -2050,14 +2050,9 @@ static struct sk_buff *lan78xx_tx_prep(s - { - u32 tx_cmd_a, tx_cmd_b; - -- if (skb_headroom(skb) < TX_OVERHEAD) { -- struct sk_buff *skb2; -- -- skb2 = skb_copy_expand(skb, TX_OVERHEAD, 0, flags); -+ if (skb_cow_head(skb, TX_OVERHEAD)) { - dev_kfree_skb_any(skb); -- skb = skb2; -- if (!skb) -- return NULL; -+ return NULL; - } - - if (lan78xx_linearize(skb) < 0) diff --git a/target/linux/generic/pending-4.4/666-Add-support-for-MAP-E-FMRs-mesh-mode.patch b/target/linux/generic/pending-4.4/666-Add-support-for-MAP-E-FMRs-mesh-mode.patch index c402e04291..303d831214 100644 --- a/target/linux/generic/pending-4.4/666-Add-support-for-MAP-E-FMRs-mesh-mode.patch +++ b/target/linux/generic/pending-4.4/666-Add-support-for-MAP-E-FMRs-mesh-mode.patch @@ -296,7 +296,7 @@ Signed-off-by: Steven Barth __skb_tunnel_rx(skb, t->dev, t->net); -@@ -1247,6 +1384,7 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, str +@@ -1248,6 +1385,7 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, str __u32 mtu; u8 tproto; int err; @@ -304,7 +304,7 @@ Signed-off-by: Steven Barth tproto = ACCESS_ONCE(t->parms.proto); if ((tproto != IPPROTO_IPV6 && tproto != 0) || -@@ -1277,6 +1415,18 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, str +@@ -1278,6 +1416,18 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, str if (t->parms.flags & IP6_TNL_F_USE_ORIG_FWMARK) fl6.flowi6_mark = skb->mark; @@ -323,7 +323,7 @@ Signed-off-by: Steven Barth err = ip6_tnl_xmit2(skb, dev, dsfield, &fl6, encap_limit, &mtu); if (err != 0) { if (err == -EMSGSIZE) -@@ -1391,6 +1541,14 @@ ip6_tnl_change(struct ip6_tnl *t, const +@@ -1392,6 +1542,14 @@ ip6_tnl_change(struct ip6_tnl *t, const t->parms.flowinfo = p->flowinfo; t->parms.link = p->link; t->parms.proto = p->proto; @@ -338,7 +338,7 @@ Signed-off-by: Steven Barth ip6_tnl_dst_reset(t); ip6_tnl_link_config(t); return 0; -@@ -1429,6 +1587,7 @@ ip6_tnl_parm_from_user(struct __ip6_tnl_ +@@ -1430,6 +1588,7 @@ ip6_tnl_parm_from_user(struct __ip6_tnl_ p->flowinfo = u->flowinfo; p->link = u->link; p->proto = u->proto; @@ -346,7 +346,7 @@ Signed-off-by: Steven Barth memcpy(p->name, u->name, sizeof(u->name)); } -@@ -1724,6 +1883,15 @@ static int ip6_tnl_validate(struct nlatt +@@ -1725,6 +1884,15 @@ static int ip6_tnl_validate(struct nlatt return 0; } @@ -362,7 +362,7 @@ Signed-off-by: Steven Barth static void ip6_tnl_netlink_parms(struct nlattr *data[], struct __ip6_tnl_parm *parms) { -@@ -1755,6 +1923,46 @@ static void ip6_tnl_netlink_parms(struct +@@ -1756,6 +1924,46 @@ static void ip6_tnl_netlink_parms(struct if (data[IFLA_IPTUN_PROTO]) parms->proto = nla_get_u8(data[IFLA_IPTUN_PROTO]); @@ -409,7 +409,7 @@ Signed-off-by: Steven Barth } static int ip6_tnl_newlink(struct net *src_net, struct net_device *dev, -@@ -1807,6 +2015,12 @@ static void ip6_tnl_dellink(struct net_d +@@ -1808,6 +2016,12 @@ static void ip6_tnl_dellink(struct net_d static size_t ip6_tnl_get_size(const struct net_device *dev) { @@ -422,7 +422,7 @@ Signed-off-by: Steven Barth return /* IFLA_IPTUN_LINK */ nla_total_size(4) + -@@ -1824,6 +2038,24 @@ static size_t ip6_tnl_get_size(const str +@@ -1825,6 +2039,24 @@ static size_t ip6_tnl_get_size(const str nla_total_size(4) + /* IFLA_IPTUN_PROTO */ nla_total_size(1) + @@ -447,7 +447,7 @@ Signed-off-by: Steven Barth 0; } -@@ -1831,6 +2063,9 @@ static int ip6_tnl_fill_info(struct sk_b +@@ -1832,6 +2064,9 @@ static int ip6_tnl_fill_info(struct sk_b { struct ip6_tnl *tunnel = netdev_priv(dev); struct __ip6_tnl_parm *parm = &tunnel->parms; @@ -457,7 +457,7 @@ Signed-off-by: Steven Barth if (nla_put_u32(skb, IFLA_IPTUN_LINK, parm->link) || nla_put_in6_addr(skb, IFLA_IPTUN_LOCAL, &parm->laddr) || -@@ -1839,8 +2074,27 @@ static int ip6_tnl_fill_info(struct sk_b +@@ -1840,8 +2075,27 @@ static int ip6_tnl_fill_info(struct sk_b nla_put_u8(skb, IFLA_IPTUN_ENCAP_LIMIT, parm->encap_limit) || nla_put_be32(skb, IFLA_IPTUN_FLOWINFO, parm->flowinfo) || nla_put_u32(skb, IFLA_IPTUN_FLAGS, parm->flags) || @@ -486,7 +486,7 @@ Signed-off-by: Steven Barth return 0; nla_put_failure: -@@ -1864,6 +2118,7 @@ static const struct nla_policy ip6_tnl_p +@@ -1865,6 +2119,7 @@ static const struct nla_policy ip6_tnl_p [IFLA_IPTUN_FLOWINFO] = { .type = NLA_U32 }, [IFLA_IPTUN_FLAGS] = { .type = NLA_U32 }, [IFLA_IPTUN_PROTO] = { .type = NLA_U8 }, diff --git a/target/linux/generic/pending-4.4/701-phy_extension.patch b/target/linux/generic/pending-4.4/701-phy_extension.patch index 6cb3fdfd44..39b8fd4660 100644 --- a/target/linux/generic/pending-4.4/701-phy_extension.patch +++ b/target/linux/generic/pending-4.4/701-phy_extension.patch @@ -53,7 +53,7 @@ * @phydev: the phy_device struct --- a/include/linux/phy.h +++ b/include/linux/phy.h -@@ -796,6 +796,7 @@ void phy_start_machine(struct phy_device +@@ -807,6 +807,7 @@ void phy_start_machine(struct phy_device void phy_stop_machine(struct phy_device *phydev); int phy_ethtool_sset(struct phy_device *phydev, struct ethtool_cmd *cmd); int phy_ethtool_gset(struct phy_device *phydev, struct ethtool_cmd *cmd); diff --git a/target/linux/generic/pending-4.4/710-phy-add-mdio_register_board_info.patch b/target/linux/generic/pending-4.4/710-phy-add-mdio_register_board_info.patch index 4886dd0e3a..d78f3d48a7 100644 --- a/target/linux/generic/pending-4.4/710-phy-add-mdio_register_board_info.patch +++ b/target/linux/generic/pending-4.4/710-phy-add-mdio_register_board_info.patch @@ -46,7 +46,7 @@ phy_device_free(phydev); --- a/include/linux/phy.h +++ b/include/linux/phy.h -@@ -835,6 +835,23 @@ void mdio_bus_exit(void); +@@ -846,6 +846,23 @@ void mdio_bus_exit(void); extern struct bus_type mdio_bus_type; diff --git a/target/linux/generic/pending-4.4/902-debloat_proc.patch b/target/linux/generic/pending-4.4/902-debloat_proc.patch index f7718bc5bf..4f874e5986 100644 --- a/target/linux/generic/pending-4.4/902-debloat_proc.patch +++ b/target/linux/generic/pending-4.4/902-debloat_proc.patch @@ -1,6 +1,6 @@ --- a/fs/locks.c +++ b/fs/locks.c -@@ -2712,6 +2712,8 @@ static const struct file_operations proc +@@ -2716,6 +2716,8 @@ static const struct file_operations proc static int __init proc_locks_init(void) { diff --git a/target/linux/generic/pending-4.4/904-debloat_dma_buf.patch b/target/linux/generic/pending-4.4/904-debloat_dma_buf.patch index eac39669d0..b9fdad9c1b 100644 --- a/target/linux/generic/pending-4.4/904-debloat_dma_buf.patch +++ b/target/linux/generic/pending-4.4/904-debloat_dma_buf.patch @@ -1,6 +1,6 @@ --- a/drivers/base/Kconfig +++ b/drivers/base/Kconfig -@@ -229,7 +229,7 @@ config SOC_BUS +@@ -232,7 +232,7 @@ config SOC_BUS source "drivers/base/regmap/Kconfig" config DMA_SHARED_BUFFER diff --git a/target/linux/mvebu/patches-4.4/128-phy-export-phy_speed_to_str-for-phylink.patch b/target/linux/mvebu/patches-4.4/128-phy-export-phy_speed_to_str-for-phylink.patch index c43607029c..4fa8a6afb6 100644 --- a/target/linux/mvebu/patches-4.4/128-phy-export-phy_speed_to_str-for-phylink.patch +++ b/target/linux/mvebu/patches-4.4/128-phy-export-phy_speed_to_str-for-phylink.patch @@ -34,7 +34,7 @@ Signed-off-by: Russell King case PHY_##_state: \ --- a/include/linux/phy.h +++ b/include/linux/phy.h -@@ -812,6 +812,7 @@ int phy_ethtool_gset(struct phy_device * +@@ -823,6 +823,7 @@ int phy_ethtool_gset(struct phy_device * int phy_ethtool_ioctl(struct phy_device *phydev, void *useraddr); int phy_mii_ioctl(struct phy_device *phydev, struct ifreq *ifr, int cmd); int phy_start_interrupts(struct phy_device *phydev);