generic/3.18: bump kernel to 3.18.44

Patch 610- is updated as check_entry helper was killed in 3.18.37
Patch 666- is updated (thanks to Stijn Tintel)
Fixes CVE-2016-5195 (dirtycow)
Compile-tested on adm5120 and mcs814x

Signed-off-by: Zoltan HERPAI <wigyori@uid0.hu>

27 files changed, 72 insertions, 81 deletions

diff --git a/include/kernel-version.mk b/include/kernel-version.mk
index 579bc701cd..ee04e6bba8 100644
--- a/include/kernel-version.mk
+++ b/include/kernel-version.mk
@@ -2,11 +2,11 @@
 
 LINUX_RELEASE?=1
 
-LINUX_VERSION-3.18 = .36
+LINUX_VERSION-3.18 = .44
 LINUX_VERSION-4.1 = .27
 LINUX_VERSION-4.4 = .14
 
-LINUX_KERNEL_MD5SUM-3.18.36 = 31b1699c1285aeeb81fb25750baa50d9
+LINUX_KERNEL_MD5SUM-3.18.44 = 7c52da2f54381a84960118b5bf23381a
 LINUX_KERNEL_MD5SUM-4.1.27 = 0347b5790c85bdabce41b8b9d9d4b98e
 LINUX_KERNEL_MD5SUM-4.4.14 = 59e99c3bf5d495f1f95d26257962ca3e
 
diff --git a/target/linux/ar7/patches-3.18/500-serial_kludge.patch b/target/linux/ar7/patches-3.18/500-serial_kludge.patch
index 08bd6a6f2d..fc725309a8 100644
--- a/target/linux/ar7/patches-3.18/500-serial_kludge.patch
+++ b/target/linux/ar7/patches-3.18/500-serial_kludge.patch
@@ -14,7 +14,7 @@
  };
  
  /* Uart divisor latch read */
-@@ -3174,7 +3181,11 @@ static void serial8250_console_putchar(s
+@@ -3168,7 +3175,11 @@ static void serial8250_console_putchar(s
  {
  	struct uart_8250_port *up = up_to_u8250p(port);
  
diff --git a/target/linux/generic/patches-3.18/025-bcma_backport.patch b/target/linux/generic/patches-3.18/025-bcma_backport.patch
index ca24e86133..ec1cb004b7 100644
--- a/target/linux/generic/patches-3.18/025-bcma_backport.patch
+++ b/target/linux/generic/patches-3.18/025-bcma_backport.patch
@@ -1,6 +1,6 @@
 --- a/drivers/bcma/bcma_private.h
 +++ b/drivers/bcma/bcma_private.h
-@@ -24,6 +24,7 @@ struct bcma_bus;
+@@ -22,6 +22,7 @@ struct bcma_bus;
  /* main.c */
  bool bcma_wait_value(struct bcma_device *core, u16 reg, u32 mask, u32 value,
  		     int timeout);
@@ -223,7 +223,7 @@
  			  core->core_index, bcma_device_name(&core->id),
 --- a/include/linux/bcma/bcma.h
 +++ b/include/linux/bcma/bcma.h
-@@ -447,4 +447,6 @@ extern u32 bcma_chipco_pll_read(struct b
+@@ -448,4 +448,6 @@ extern u32 bcma_chipco_pll_read(struct b
  #define  BCMA_DMA_TRANSLATION_DMA64_CMT	0x80000000 /* Client Mode Translation for 64-bit DMA */
  extern u32 bcma_core_dma_translation(struct bcma_device *core);
  
diff --git a/target/linux/generic/patches-3.18/026-bcma-from-3.20.patch b/target/linux/generic/patches-3.18/026-bcma-from-3.20.patch
index 17c06b001f..628b0bd389 100644
--- a/target/linux/generic/patches-3.18/026-bcma-from-3.20.patch
+++ b/target/linux/generic/patches-3.18/026-bcma-from-3.20.patch
@@ -1,6 +1,6 @@
 --- a/drivers/bcma/bcma_private.h
 +++ b/drivers/bcma/bcma_private.h
-@@ -25,22 +25,18 @@ struct bcma_bus;
+@@ -23,22 +23,18 @@ struct bcma_bus;
  bool bcma_wait_value(struct bcma_device *core, u16 reg, u32 mask, u32 value,
  		     int timeout);
  void bcma_prepare_core(struct bcma_bus *bus, struct bcma_device *core);
@@ -26,7 +26,7 @@
  
  /* sprom.c */
  int bcma_sprom_get(struct bcma_bus *bus);
-@@ -111,6 +107,14 @@ extern int bcma_chipco_watchdog_register
+@@ -109,6 +105,14 @@ extern int bcma_chipco_watchdog_register
  #ifdef CONFIG_BCMA_DRIVER_PCI_HOSTMODE
  bool bcma_core_pci_is_in_hostmode(struct bcma_drv_pci *pc);
  void bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc);
@@ -467,7 +467,7 @@
  	if (!bus->drv_cc.core)
 --- a/include/linux/bcma/bcma.h
 +++ b/include/linux/bcma/bcma.h
-@@ -318,6 +318,7 @@ struct bcma_bus {
+@@ -319,6 +319,7 @@ struct bcma_bus {
  	const struct bcma_host_ops *ops;
  
  	enum bcma_hosttype hosttype;
diff --git a/target/linux/generic/patches-3.18/027-bcma-from-4.1.patch b/target/linux/generic/patches-3.18/027-bcma-from-4.1.patch
index 1d751a0c6d..c88a816fef 100644
--- a/target/linux/generic/patches-3.18/027-bcma-from-4.1.patch
+++ b/target/linux/generic/patches-3.18/027-bcma-from-4.1.patch
@@ -1,6 +1,6 @@
 --- a/drivers/bcma/bcma_private.h
 +++ b/drivers/bcma/bcma_private.h
-@@ -26,6 +26,7 @@ bool bcma_wait_value(struct bcma_device
+@@ -24,6 +24,7 @@ bool bcma_wait_value(struct bcma_device
  		     int timeout);
  void bcma_prepare_core(struct bcma_bus *bus, struct bcma_device *core);
  void bcma_init_bus(struct bcma_bus *bus);
@@ -8,7 +8,7 @@
  int bcma_bus_register(struct bcma_bus *bus);
  void bcma_bus_unregister(struct bcma_bus *bus);
  int __init bcma_bus_early_register(struct bcma_bus *bus);
-@@ -42,6 +43,9 @@ int bcma_bus_scan(struct bcma_bus *bus);
+@@ -40,6 +41,9 @@ int bcma_bus_scan(struct bcma_bus *bus);
  int bcma_sprom_get(struct bcma_bus *bus);
  
  /* driver_chipcommon.c */
@@ -18,7 +18,7 @@
  #ifdef CONFIG_BCMA_DRIVER_MIPS
  void bcma_chipco_serial_init(struct bcma_drv_cc *cc);
  extern struct platform_device bcma_pflash_dev;
-@@ -52,6 +56,8 @@ int bcma_core_chipcommon_b_init(struct b
+@@ -50,6 +54,8 @@ int bcma_core_chipcommon_b_init(struct b
  void bcma_core_chipcommon_b_free(struct bcma_drv_cc_b *ccb);
  
  /* driver_chipcommon_pmu.c */
@@ -27,7 +27,7 @@
  u32 bcma_pmu_get_alp_clock(struct bcma_drv_cc *cc);
  u32 bcma_pmu_get_cpu_clock(struct bcma_drv_cc *cc);
  
-@@ -100,7 +106,35 @@ static inline void __exit bcma_host_soc_
+@@ -98,7 +104,35 @@ static inline void __exit bcma_host_soc_
  #endif /* CONFIG_BCMA_HOST_SOC && CONFIG_OF */
  
  /* driver_pci.c */
@@ -63,7 +63,7 @@
  
  extern int bcma_chipco_watchdog_register(struct bcma_drv_cc *cc);
  
-@@ -117,6 +151,39 @@ static inline void bcma_core_pci_hostmod
+@@ -115,6 +149,39 @@ static inline void bcma_core_pci_hostmod
  }
  #endif /* CONFIG_BCMA_DRIVER_PCI_HOSTMODE */
  
@@ -500,7 +500,7 @@
  	}
 --- a/include/linux/bcma/bcma.h
 +++ b/include/linux/bcma/bcma.h
-@@ -434,6 +434,27 @@ static inline struct bcma_device *bcma_f
+@@ -435,6 +435,27 @@ static inline struct bcma_device *bcma_f
  	return bcma_find_core_unit(bus, coreid, 0);
  }
  
diff --git a/target/linux/generic/patches-3.18/032-bcma-from-4.6.patch b/target/linux/generic/patches-3.18/032-bcma-from-4.6.patch
index 9df6e2594c..85eeaad4d3 100644
--- a/target/linux/generic/patches-3.18/032-bcma-from-4.6.patch
+++ b/target/linux/generic/patches-3.18/032-bcma-from-4.6.patch
@@ -359,7 +359,7 @@
  #define BCMA_CORE_ARM_CA7		0x847
  #define BCMA_CORE_SYS_MEM		0x849
  #define BCMA_CORE_DEFAULT		0xFFF
-@@ -199,6 +201,7 @@ struct bcma_host_ops {
+@@ -200,6 +202,7 @@ struct bcma_host_ops {
  #define  BCMA_PKG_ID_BCM4707	1
  #define  BCMA_PKG_ID_BCM4708	2
  #define  BCMA_PKG_ID_BCM4709	0
@@ -470,7 +470,7 @@
  extern u32 bcma_chipco_get_alp_clock(struct bcma_drv_cc *cc);
 --- a/drivers/bcma/bcma_private.h
 +++ b/drivers/bcma/bcma_private.h
-@@ -46,10 +46,6 @@ int bcma_sprom_get(struct bcma_bus *bus)
+@@ -44,10 +44,6 @@ int bcma_sprom_get(struct bcma_bus *bus)
  void bcma_core_chipcommon_early_init(struct bcma_drv_cc *cc);
  void bcma_core_chipcommon_init(struct bcma_drv_cc *cc);
  void bcma_chipco_bcm4331_ext_pa_lines_ctl(struct bcma_drv_cc *cc, bool enable);
@@ -481,7 +481,7 @@
  
  /* driver_chipcommon_b.c */
  int bcma_core_chipcommon_b_init(struct bcma_drv_cc_b *ccb);
-@@ -61,6 +57,21 @@ void bcma_pmu_init(struct bcma_drv_cc *c
+@@ -59,6 +55,21 @@ void bcma_pmu_init(struct bcma_drv_cc *c
  u32 bcma_pmu_get_alp_clock(struct bcma_drv_cc *cc);
  u32 bcma_pmu_get_cpu_clock(struct bcma_drv_cc *cc);
  
diff --git a/target/linux/generic/patches-3.18/080-11-fib_trie-Push-rcu_read_lock-unlock-to-callers.patch b/target/linux/generic/patches-3.18/080-11-fib_trie-Push-rcu_read_lock-unlock-to-callers.patch
index b36bcd8167..fe55323a50 100644
--- a/target/linux/generic/patches-3.18/080-11-fib_trie-Push-rcu_read_lock-unlock-to-callers.patch
+++ b/target/linux/generic/patches-3.18/080-11-fib_trie-Push-rcu_read_lock-unlock-to-callers.patch
@@ -134,7 +134,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	return ret;
  }
  
-@@ -919,7 +918,7 @@ void fib_del_ifaddr(struct in_ifaddr *if
+@@ -923,7 +922,7 @@ no_promotions:
  #undef BRD1_OK
  }
  
@@ -143,7 +143,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  {
  
  	struct fib_result       res;
-@@ -929,6 +928,11 @@ static void nl_fib_lookup(struct fib_res
+@@ -933,6 +932,11 @@ static void nl_fib_lookup(struct fib_res
  		.flowi4_tos = frn->fl_tos,
  		.flowi4_scope = frn->fl_scope,
  	};
@@ -155,7 +155,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  	frn->err = -ENOENT;
  	if (tb) {
-@@ -945,6 +949,8 @@ static void nl_fib_lookup(struct fib_res
+@@ -949,6 +953,8 @@ static void nl_fib_lookup(struct fib_res
  		}
  		local_bh_enable();
  	}
@@ -164,7 +164,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  }
  
  static void nl_fib_input(struct sk_buff *skb)
-@@ -952,7 +958,6 @@ static void nl_fib_input(struct sk_buff
+@@ -956,7 +962,6 @@ static void nl_fib_input(struct sk_buff
  	struct net *net;
  	struct fib_result_nl *frn;
  	struct nlmsghdr *nlh;
@@ -172,7 +172,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	u32 portid;
  
  	net = sock_net(skb->sk);
-@@ -967,9 +972,7 @@ static void nl_fib_input(struct sk_buff
+@@ -971,9 +976,7 @@ static void nl_fib_input(struct sk_buff
  	nlh = nlmsg_hdr(skb);
  
  	frn = (struct fib_result_nl *) nlmsg_data(nlh);
diff --git a/target/linux/generic/patches-3.18/090-overlayfs-fallback-to-readonly-when-full.patch b/target/linux/generic/patches-3.18/090-overlayfs-fallback-to-readonly-when-full.patch
index 1bcd5159db..c75af99c60 100644
--- a/target/linux/generic/patches-3.18/090-overlayfs-fallback-to-readonly-when-full.patch
+++ b/target/linux/generic/patches-3.18/090-overlayfs-fallback-to-readonly-when-full.patch
@@ -44,7 +44,7 @@ Miklos
 
 --- a/fs/overlayfs/copy_up.c
 +++ b/fs/overlayfs/copy_up.c
-@@ -311,6 +311,9 @@ int ovl_copy_up_one(struct dentry *paren
+@@ -313,6 +313,9 @@ int ovl_copy_up_one(struct dentry *paren
  	struct cred *override_cred;
  	char *link = NULL;
  
@@ -76,9 +76,9 @@ Miklos
  	err = ovl_lock_rename_workdir(workdir, upperdir);
  	if (err)
  		goto out;
-@@ -506,6 +512,9 @@ static int ovl_remove_and_whiteout(struc
- 	struct dentry *opaquedir = NULL;
+@@ -507,6 +513,9 @@ static int ovl_remove_and_whiteout(struc
  	int err;
+ 	int flags = 0;
  
 +	if (WARN_ON(!workdir))
 +		return -EROFS;
@@ -88,7 +88,7 @@ Miklos
  		err = PTR_ERR(opaquedir);
 --- a/fs/overlayfs/super.c
 +++ b/fs/overlayfs/super.c
-@@ -741,9 +741,15 @@ static int ovl_fill_super(struct super_b
+@@ -760,9 +760,15 @@ static int ovl_fill_super(struct super_b
  	ufs->workdir = ovl_workdir_create(ufs->upper_mnt, workpath.dentry);
  	err = PTR_ERR(ufs->workdir);
  	if (IS_ERR(ufs->workdir)) {
diff --git a/target/linux/generic/patches-3.18/099-module_arch_freeing_init-new-hook-for-archs-before-m.patch b/target/linux/generic/patches-3.18/099-module_arch_freeing_init-new-hook-for-archs-before-m.patch
index 2e66de29df..352bf6de15 100644
--- a/target/linux/generic/patches-3.18/099-module_arch_freeing_init-new-hook-for-archs-before-m.patch
+++ b/target/linux/generic/patches-3.18/099-module_arch_freeing_init-new-hook-for-archs-before-m.patch
@@ -164,7 +164,7 @@ Origin: backport, https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.gi
  	module_free(mod, mod->module_init);
  	kfree(mod->args);
  	percpu_modfree(mod);
-@@ -2978,6 +2983,7 @@ static struct module *layout_and_allocat
+@@ -2983,6 +2988,7 @@ static struct module *layout_and_allocat
  static void module_deallocate(struct module *mod, struct load_info *info)
  {
  	percpu_modfree(mod);
@@ -172,7 +172,7 @@ Origin: backport, https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.gi
  	module_free(mod, mod->module_init);
  	module_free(mod, mod->module_core);
  }
-@@ -3100,6 +3106,7 @@ static int do_init_module(struct module
+@@ -3105,6 +3111,7 @@ static int do_init_module(struct module
  	rcu_assign_pointer(mod->kallsyms, &mod->core_kallsyms);
  #endif
  	unset_module_init_ro_nx(mod);
diff --git a/target/linux/generic/patches-3.18/190-cdc_ncm_add_support_for_moving_ndp_to_end_of_ncm_frame.patch b/target/linux/generic/patches-3.18/190-cdc_ncm_add_support_for_moving_ndp_to_end_of_ncm_frame.patch
index 09cbe0c485..0b03963f0a 100644
--- a/target/linux/generic/patches-3.18/190-cdc_ncm_add_support_for_moving_ndp_to_end_of_ncm_frame.patch
+++ b/target/linux/generic/patches-3.18/190-cdc_ncm_add_support_for_moving_ndp_to_end_of_ncm_frame.patch
@@ -61,7 +61,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  {
  	const struct usb_cdc_union_desc *union_desc = NULL;
  	struct cdc_ncm_ctx *ctx;
-@@ -855,6 +857,17 @@ advance:
+@@ -859,6 +861,17 @@ advance:
  	/* finish setting up the device specific data */
  	cdc_ncm_setup(dev);
  
@@ -79,7 +79,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	/* override ethtool_ops */
  	dev->net->ethtool_ops = &cdc_ncm_ethtool_ops;
  
-@@ -954,8 +967,11 @@ static int cdc_ncm_bind(struct usbnet *d
+@@ -958,8 +971,11 @@ static int cdc_ncm_bind(struct usbnet *d
  	if (cdc_ncm_select_altsetting(intf) != CDC_NCM_COMM_ALTSETTING_NCM)
  		return -ENODEV;
  
@@ -93,7 +93,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  	/*
  	 * We should get an event when network connection is "connected" or
-@@ -986,6 +1002,14 @@ static struct usb_cdc_ncm_ndp16 *cdc_ncm
+@@ -990,6 +1006,14 @@ static struct usb_cdc_ncm_ndp16 *cdc_ncm
  	struct usb_cdc_ncm_nth16 *nth16 = (void *)skb->data;
  	size_t ndpoffset = le16_to_cpu(nth16->wNdpIndex);
  
@@ -108,7 +108,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	/* follow the chain of NDPs, looking for a match */
  	while (ndpoffset) {
  		ndp16 = (struct usb_cdc_ncm_ndp16 *)(skb->data + ndpoffset);
-@@ -995,7 +1019,8 @@ static struct usb_cdc_ncm_ndp16 *cdc_ncm
+@@ -999,7 +1023,8 @@ static struct usb_cdc_ncm_ndp16 *cdc_ncm
  	}
  
  	/* align new NDP */
@@ -118,7 +118,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  	/* verify that there is room for the NDP and the datagram (reserve) */
  	if ((ctx->tx_max - skb->len - reserve) < ctx->max_ndp_size)
-@@ -1008,7 +1033,11 @@ static struct usb_cdc_ncm_ndp16 *cdc_ncm
+@@ -1012,7 +1037,11 @@ static struct usb_cdc_ncm_ndp16 *cdc_ncm
  		nth16->wNdpIndex = cpu_to_le16(skb->len);
  
  	/* push a new empty NDP */
@@ -131,7 +131,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	ndp16->dwSignature = sign;
  	ndp16->wLength = cpu_to_le16(sizeof(struct usb_cdc_ncm_ndp16) + sizeof(struct usb_cdc_ncm_dpe16));
  	return ndp16;
-@@ -1023,6 +1052,15 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev
+@@ -1027,6 +1056,15 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev
  	struct sk_buff *skb_out;
  	u16 n = 0, index, ndplen;
  	u8 ready2send = 0;
@@ -147,7 +147,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  	/* if there is a remaining skb, it gets priority */
  	if (skb != NULL) {
-@@ -1077,7 +1115,7 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev
+@@ -1081,7 +1119,7 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev
  		cdc_ncm_align_tail(skb_out,  ctx->tx_modulus, ctx->tx_remainder, ctx->tx_max);
  
  		/* check if we had enough room left for both NDP and frame */
@@ -156,7 +156,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  			if (n == 0) {
  				/* won't fit, MTU problem? */
  				dev_kfree_skb_any(skb);
-@@ -1150,6 +1188,17 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev
+@@ -1154,6 +1192,17 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev
  		/* variables will be reset at next call */
  	}
  
diff --git a/target/linux/generic/patches-3.18/193-USB-qmi_wwan-Add-quirk-for-Quectel-EC20-Mini-PCIe-mo.patch b/target/linux/generic/patches-3.18/193-USB-qmi_wwan-Add-quirk-for-Quectel-EC20-Mini-PCIe-mo.patch
index 9179fe8649..1b1afd5d31 100644
--- a/target/linux/generic/patches-3.18/193-USB-qmi_wwan-Add-quirk-for-Quectel-EC20-Mini-PCIe-mo.patch
+++ b/target/linux/generic/patches-3.18/193-USB-qmi_wwan-Add-quirk-for-Quectel-EC20-Mini-PCIe-mo.patch
@@ -48,7 +48,7 @@ Signed-off-by: Petr Štetiar <ynezz@true.cz>
 
 --- a/drivers/net/usb/qmi_wwan.c
 +++ b/drivers/net/usb/qmi_wwan.c
-@@ -819,6 +819,7 @@ static const struct usb_device_id produc
+@@ -822,6 +822,7 @@ static const struct usb_device_id produc
  	{QMI_GOBI_DEVICE(0x05c6, 0x9245)},	/* Samsung Gobi 2000 Modem device (VL176) */
  	{QMI_GOBI_DEVICE(0x03f0, 0x251d)},	/* HP Gobi 2000 Modem device (VP412) */
  	{QMI_GOBI_DEVICE(0x05c6, 0x9215)},	/* Acer Gobi 2000 Modem device (VP413) */
@@ -56,7 +56,7 @@ Signed-off-by: Petr Štetiar <ynezz@true.cz>
  	{QMI_GOBI_DEVICE(0x05c6, 0x9265)},	/* Asus Gobi 2000 Modem device (VR305) */
  	{QMI_GOBI_DEVICE(0x05c6, 0x9235)},	/* Top Global Gobi 2000 Modem device (VR306) */
  	{QMI_GOBI_DEVICE(0x05c6, 0x9275)},	/* iRex Technologies Gobi 2000 Modem device (VR307) */
-@@ -850,10 +851,24 @@ static const struct usb_device_id produc
+@@ -853,10 +854,24 @@ static const struct usb_device_id produc
  };
  MODULE_DEVICE_TABLE(usb, products);
  
@@ -81,7 +81,7 @@ Signed-off-by: Petr Štetiar <ynezz@true.cz>
  
  	/* Workaround to enable dynamic IDs.  This disables usbnet
  	 * blacklisting functionality.  Which, if required, can be
-@@ -865,6 +880,12 @@ static int qmi_wwan_probe(struct usb_int
+@@ -868,6 +883,12 @@ static int qmi_wwan_probe(struct usb_int
  		id->driver_info = (unsigned long)&qmi_wwan_info;
  	}
  
diff --git a/target/linux/generic/patches-3.18/204-module_strip.patch b/target/linux/generic/patches-3.18/204-module_strip.patch
index 58e4f6eab7..dab7799084 100644
--- a/target/linux/generic/patches-3.18/204-module_strip.patch
+++ b/target/linux/generic/patches-3.18/204-module_strip.patch
@@ -109,7 +109,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  config INIT_ALL_POSSIBLE
 --- a/kernel/module.c
 +++ b/kernel/module.c
-@@ -2694,6 +2694,7 @@ static struct module *setup_load_info(st
+@@ -2699,6 +2699,7 @@ static struct module *setup_load_info(st
  
  static int check_modinfo(struct module *mod, struct load_info *info, int flags)
  {
@@ -117,7 +117,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	const char *modmagic = get_modinfo(info, "vermagic");
  	int err;
  
-@@ -2719,6 +2720,7 @@ static int check_modinfo(struct module *
+@@ -2724,6 +2725,7 @@ static int check_modinfo(struct module *
  		pr_warn("%s: module is from the staging directory, the quality "
  			"is unknown, you have been warned.\n", mod->name);
  	}
diff --git a/target/linux/generic/patches-3.18/490-ubi-auto-attach-mtd-device-named-ubi-or-data-on-boot.patch b/target/linux/generic/patches-3.18/490-ubi-auto-attach-mtd-device-named-ubi-or-data-on-boot.patch
index d7b20b81f5..bca3487d18 100644
--- a/target/linux/generic/patches-3.18/490-ubi-auto-attach-mtd-device-named-ubi-or-data-on-boot.patch
+++ b/target/linux/generic/patches-3.18/490-ubi-auto-attach-mtd-device-named-ubi-or-data-on-boot.patch
@@ -11,7 +11,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
 
 --- a/drivers/mtd/ubi/build.c
 +++ b/drivers/mtd/ubi/build.c
-@@ -1209,6 +1209,49 @@ static struct mtd_info * __init open_mtd
+@@ -1212,6 +1212,49 @@ static struct mtd_info * __init open_mtd
  	return mtd;
  }
  
@@ -61,7 +61,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  static int __init ubi_init(void)
  {
  	int err, i, k;
-@@ -1298,6 +1341,12 @@ static int __init ubi_init(void)
+@@ -1301,6 +1344,12 @@ static int __init ubi_init(void)
  		}
  	}
  
diff --git a/target/linux/generic/patches-3.18/492-try-auto-mounting-ubi0-rootfs-in-init-do_mounts.c.patch b/target/linux/generic/patches-3.18/492-try-auto-mounting-ubi0-rootfs-in-init-do_mounts.c.patch
index 3f2b439362..54a2f8259c 100644
--- a/target/linux/generic/patches-3.18/492-try-auto-mounting-ubi0-rootfs-in-init-do_mounts.c.patch
+++ b/target/linux/generic/patches-3.18/492-try-auto-mounting-ubi0-rootfs-in-init-do_mounts.c.patch
@@ -41,7 +41,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  #ifdef CONFIG_ROOT_NFS
  
  #define NFSROOT_TIMEOUT_MIN	5
-@@ -527,6 +547,10 @@ void __init mount_root(void)
+@@ -527,6 +548,10 @@ void __init mount_root(void)
  			change_floppy("root floppy");
  	}
  #endif
diff --git a/target/linux/generic/patches-3.18/550-ubifs-symlink-xattr-support.patch b/target/linux/generic/patches-3.18/550-ubifs-symlink-xattr-support.patch
index d3f2ccca36..42ae9cb84a 100644
--- a/target/linux/generic/patches-3.18/550-ubifs-symlink-xattr-support.patch
+++ b/target/linux/generic/patches-3.18/550-ubifs-symlink-xattr-support.patch
@@ -1,6 +1,6 @@
 --- a/fs/ubifs/file.c
 +++ b/fs/ubifs/file.c
-@@ -1573,6 +1573,10 @@ const struct inode_operations ubifs_syml
+@@ -1597,6 +1597,10 @@ const struct inode_operations ubifs_syml
  	.follow_link = ubifs_follow_link,
  	.setattr     = ubifs_setattr,
  	.getattr     = ubifs_getattr,
diff --git a/target/linux/generic/patches-3.18/610-netfilter_match_bypass_default_checks.patch b/target/linux/generic/patches-3.18/610-netfilter_match_bypass_default_checks.patch
index 358d64b1a1..74be425049 100644
--- a/target/linux/generic/patches-3.18/610-netfilter_match_bypass_default_checks.patch
+++ b/target/linux/generic/patches-3.18/610-netfilter_match_bypass_default_checks.patch
@@ -50,25 +50,16 @@
  static bool
  ip_checkentry(const struct ipt_ip *ip)
  {
-@@ -565,7 +591,7 @@ static void cleanup_match(struct xt_entr
- }
- 
- static int
--check_entry(const struct ipt_entry *e, const char *name)
-+check_entry(struct ipt_entry *e, const char *name)
- {
- 	const struct xt_entry_target *t;
- 
-@@ -574,6 +600,8 @@ check_entry(const struct ipt_entry *e, c
- 		return -EINVAL;
- 	}
+@@ -650,6 +676,8 @@ find_check_entry(struct ipt_entry *e, st
+ 	struct xt_mtchk_param mtpar;
+ 	struct xt_entry_match *ematch;
  
 +	ip_checkdefault(&e->ip);
 +
- 	if (e->target_offset + sizeof(struct xt_entry_target) >
- 	    e->next_offset)
- 		return -EINVAL;
-@@ -935,6 +963,7 @@ copy_entries_to_user(unsigned int total_
+ 	j = 0;
+ 	mtpar.net	= net;
+ 	mtpar.table     = name;
+@@ -942,6 +970,7 @@ copy_entries_to_user(unsigned int total_
  	const struct xt_table_info *private = table->private;
  	int ret = 0;
  	const void *loc_cpu_entry;
@@ -76,7 +67,7 @@
  
  	counters = alloc_counters(table);
  	if (IS_ERR(counters))
-@@ -965,6 +994,14 @@ copy_entries_to_user(unsigned int total_
+@@ -972,6 +1001,14 @@ copy_entries_to_user(unsigned int total_
  			ret = -EFAULT;
  			goto free_counters;
  		}
diff --git a/target/linux/generic/patches-3.18/630-packet_socket_type.patch b/target/linux/generic/patches-3.18/630-packet_socket_type.patch
index 7502a1c3b4..61ddea84c6 100644
--- a/target/linux/generic/patches-3.18/630-packet_socket_type.patch
+++ b/target/linux/generic/patches-3.18/630-packet_socket_type.patch
@@ -91,7 +91,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  	if (sock->type == SOCK_PACKET)
  		po->prot_hook.func = packet_rcv_spkt;
-@@ -3408,6 +3411,16 @@ packet_setsockopt(struct socket *sock, i
+@@ -3409,6 +3412,16 @@ packet_setsockopt(struct socket *sock, i
  		po->xmit = val ? packet_direct_xmit : dev_queue_xmit;
  		return 0;
  	}
@@ -108,7 +108,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	default:
  		return -ENOPROTOOPT;
  	}
-@@ -3459,6 +3472,13 @@ static int packet_getsockopt(struct sock
+@@ -3460,6 +3473,13 @@ static int packet_getsockopt(struct sock
  	case PACKET_VNET_HDR:
  		val = po->has_vnet_hdr;
  		break;
diff --git a/target/linux/generic/patches-3.18/657-qdisc_reduce_truesize.patch b/target/linux/generic/patches-3.18/657-qdisc_reduce_truesize.patch
index 6777eecf5a..410e0b763d 100644
--- a/target/linux/generic/patches-3.18/657-qdisc_reduce_truesize.patch
+++ b/target/linux/generic/patches-3.18/657-qdisc_reduce_truesize.patch
@@ -13,7 +13,7 @@ commont qdiscs.
 
 --- a/net/sched/sch_codel.c
 +++ b/net/sched/sch_codel.c
-@@ -96,6 +96,8 @@ static int codel_qdisc_enqueue(struct sk
+@@ -97,6 +97,8 @@ static int codel_qdisc_enqueue(struct sk
  	struct codel_sched_data *q;
  
  	if (likely(qdisc_qlen(sch) < sch->limit)) {
diff --git a/target/linux/generic/patches-3.18/660-fq_codel_defaults.patch b/target/linux/generic/patches-3.18/660-fq_codel_defaults.patch
index e0f73dedb9..8a870cccc1 100644
--- a/target/linux/generic/patches-3.18/660-fq_codel_defaults.patch
+++ b/target/linux/generic/patches-3.18/660-fq_codel_defaults.patch
@@ -1,6 +1,6 @@
 --- a/net/sched/sch_fq_codel.c
 +++ b/net/sched/sch_fq_codel.c
-@@ -387,8 +387,8 @@ static int fq_codel_init(struct Qdisc *s
+@@ -394,8 +394,8 @@ static int fq_codel_init(struct Qdisc *s
  	struct fq_codel_sched_data *q = qdisc_priv(sch);
  	int i;
  
diff --git a/target/linux/generic/patches-3.18/662-use_fq_codel_by_default.patch b/target/linux/generic/patches-3.18/662-use_fq_codel_by_default.patch
index 5caf933764..39abfaabea 100644
--- a/target/linux/generic/patches-3.18/662-use_fq_codel_by_default.patch
+++ b/target/linux/generic/patches-3.18/662-use_fq_codel_by_default.patch
@@ -13,7 +13,7 @@
  	  device, it has to decide which ones to send first, which ones to
 --- a/net/sched/sch_fq_codel.c
 +++ b/net/sched/sch_fq_codel.c
-@@ -592,7 +592,7 @@ static const struct Qdisc_class_ops fq_c
+@@ -599,7 +599,7 @@ static const struct Qdisc_class_ops fq_c
  	.walk		=	fq_codel_walk,
  };
  
@@ -22,7 +22,7 @@
  	.cl_ops		=	&fq_codel_class_ops,
  	.id		=	"fq_codel",
  	.priv_size	=	sizeof(struct fq_codel_sched_data),
-@@ -608,6 +608,7 @@ static struct Qdisc_ops fq_codel_qdisc_o
+@@ -615,6 +615,7 @@ static struct Qdisc_ops fq_codel_qdisc_o
  	.dump_stats =	fq_codel_dump_stats,
  	.owner		=	THIS_MODULE,
  };
@@ -51,7 +51,7 @@
  EXPORT_SYMBOL(default_qdisc_ops);
  
  /* Main transmission queue. */
-@@ -739,7 +739,7 @@ static void attach_one_default_qdisc(str
+@@ -742,7 +742,7 @@ static void attach_one_default_qdisc(str
  
  	if (dev->tx_queue_len) {
  		qdisc = qdisc_create_dflt(dev_queue,
@@ -84,7 +84,7 @@
  		if (qdisc == NULL) {
 --- a/net/sched/sch_api.c
 +++ b/net/sched/sch_api.c
-@@ -1947,7 +1947,7 @@ static int __init pktsched_init(void)
+@@ -1949,7 +1949,7 @@ static int __init pktsched_init(void)
  		return err;
  	}
  
diff --git a/target/linux/generic/patches-3.18/663-remove_pfifo_fast.patch b/target/linux/generic/patches-3.18/663-remove_pfifo_fast.patch
index 5b26ca3515..50b90b375f 100644
--- a/target/linux/generic/patches-3.18/663-remove_pfifo_fast.patch
+++ b/target/linux/generic/patches-3.18/663-remove_pfifo_fast.patch
@@ -1,6 +1,6 @@
 --- a/net/sched/sch_generic.c
 +++ b/net/sched/sch_generic.c
-@@ -442,140 +442,6 @@ static struct Qdisc noqueue_qdisc = {
+@@ -445,140 +445,6 @@ static struct Qdisc noqueue_qdisc = {
  	.busylock	=	__SPIN_LOCK_UNLOCKED(noqueue_qdisc.busylock),
  };
  
diff --git a/target/linux/generic/patches-3.18/666-Add-support-for-MAP-E-FMRs-mesh-mode.patch b/target/linux/generic/patches-3.18/666-Add-support-for-MAP-E-FMRs-mesh-mode.patch
index 000665f047..e3e4000f93 100644
--- a/target/linux/generic/patches-3.18/666-Add-support-for-MAP-E-FMRs-mesh-mode.patch
+++ b/target/linux/generic/patches-3.18/666-Add-support-for-MAP-E-FMRs-mesh-mode.patch
@@ -297,13 +297,13 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
 +	for (fmr = t->parms.fmrs; fmr; fmr = fmr->next) {
 +		unsigned mshift = 32 - fmr->ip4_prefix_len;
 +		if (ntohl(fmr->ip4_prefix.s_addr) >> mshift ==
-+				ntohl(iph->daddr) >> mshift)
++				ntohl(ip_hdr(skb)->daddr) >> mshift)
 +			break;
 +	}
 +
 +	/* change dstaddr according to FMR */
 +	if (fmr)
-+		ip4ip6_fmr_calc(&fl6.daddr, iph, skb_tail_pointer(skb), fmr, true);
++		ip4ip6_fmr_calc(&fl6.daddr, ip_hdr(skb), skb_tail_pointer(skb), fmr, true);
 +
  	err = ip6_tnl_xmit2(skb, dev, dsfield, &fl6, encap_limit, &mtu);
  	if (err != 0) {
diff --git a/target/linux/generic/patches-3.18/773-bgmac-add-srab-switch.patch b/target/linux/generic/patches-3.18/773-bgmac-add-srab-switch.patch
index b883d73af3..52fc252447 100644
--- a/target/linux/generic/patches-3.18/773-bgmac-add-srab-switch.patch
+++ b/target/linux/generic/patches-3.18/773-bgmac-add-srab-switch.patch
@@ -30,7 +30,7 @@ Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
  /**************************************************
   * BCMA bus ops
   **************************************************/
-@@ -1664,6 +1676,16 @@ static int bgmac_probe(struct bcma_devic
+@@ -1666,6 +1678,16 @@ static int bgmac_probe(struct bcma_devic
  	net_dev->hw_features = net_dev->features;
  	net_dev->vlan_features = net_dev->features;
  
@@ -47,7 +47,7 @@ Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
  	err = register_netdev(bgmac->net_dev);
  	if (err) {
  		bgmac_err(bgmac, "Cannot register net device\n");
-@@ -1690,6 +1712,10 @@ static void bgmac_remove(struct bcma_dev
+@@ -1692,6 +1714,10 @@ static void bgmac_remove(struct bcma_dev
  {
  	struct bgmac *bgmac = bcma_get_drvdata(core);
  
diff --git a/target/linux/generic/patches-3.18/810-pci_disable_common_quirks.patch b/target/linux/generic/patches-3.18/810-pci_disable_common_quirks.patch
index 1b7bead486..5155bcdadf 100644
--- a/target/linux/generic/patches-3.18/810-pci_disable_common_quirks.patch
+++ b/target/linux/generic/patches-3.18/810-pci_disable_common_quirks.patch
@@ -23,7 +23,7 @@
  /* The Mellanox Tavor device gives false positive parity errors
   * Mark this device with a broken_parity_status, to allow
   * PCI scanning code to "skip" this now blacklisted device.
-@@ -2917,6 +2918,7 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_I
+@@ -2929,6 +2930,7 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_I
  DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x65f9, quirk_intel_mc_errata);
  DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x65fa, quirk_intel_mc_errata);
  
@@ -31,7 +31,7 @@
  
  /*
   * Ivytown NTB BAR sizes are misreported by the hardware due to an erratum.  To
-@@ -2973,6 +2975,8 @@ static void fixup_debug_report(struct pc
+@@ -2985,6 +2987,8 @@ static void fixup_debug_report(struct pc
  	}
  }
  
@@ -40,7 +40,7 @@
  /*
   * Some BIOS implementations leave the Intel GPU interrupts enabled,
   * even though no one is handling them (f.e. i915 driver is never loaded).
-@@ -3007,6 +3011,8 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_IN
+@@ -3019,6 +3023,8 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_IN
  DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x010a, disable_igfx_irq);
  DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x0152, disable_igfx_irq);
  
diff --git a/target/linux/generic/patches-3.18/863-gpiommc.patch b/target/linux/generic/patches-3.18/863-gpiommc.patch
index 2929333334..3ed4d34fc6 100644
--- a/target/linux/generic/patches-3.18/863-gpiommc.patch
+++ b/target/linux/generic/patches-3.18/863-gpiommc.patch
@@ -830,7 +830,7 @@
 +be done automatically.
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
-@@ -4279,6 +4279,11 @@ T:	git git://linuxtv.org/anttip/media_tr
+@@ -4289,6 +4289,11 @@ T:	git git://linuxtv.org/anttip/media_tr
  S:	Maintained
  F:	drivers/media/usb/hackrf/
  
diff --git a/target/linux/generic/patches-3.18/904-debloat_dma_buf.patch b/target/linux/generic/patches-3.18/904-debloat_dma_buf.patch
index 3faf97a880..a5e0be2496 100644
--- a/target/linux/generic/patches-3.18/904-debloat_dma_buf.patch
+++ b/target/linux/generic/patches-3.18/904-debloat_dma_buf.patch
@@ -34,7 +34,7 @@
 +MODULE_LICENSE("GPL");
 --- a/kernel/sched/core.c
 +++ b/kernel/sched/core.c
-@@ -1801,6 +1801,7 @@ int wake_up_state(struct task_struct *p,
+@@ -1823,6 +1823,7 @@ int wake_up_state(struct task_struct *p,
  {
  	return try_to_wake_up(p, state, 0);
  }
diff --git a/target/linux/mcs814x/patches-3.18/008-mcs814x_gpio.patch b/target/linux/mcs814x/patches-3.18/008-mcs814x_gpio.patch
index 92c85a700f..f0944bffd3 100644
--- a/target/linux/mcs814x/patches-3.18/008-mcs814x_gpio.patch
+++ b/target/linux/mcs814x/patches-3.18/008-mcs814x_gpio.patch
@@ -1,6 +1,6 @@
 --- a/drivers/gpio/Kconfig
 +++ b/drivers/gpio/Kconfig
-@@ -819,6 +819,12 @@ config GPIO_MC33880
+@@ -820,6 +820,12 @@ config GPIO_MC33880
  	  SPI driver for Freescale MC33880 high-side/low-side switch.
  	  This provides GPIO interface supporting inputs and outputs.