From 1cb9409df2c093aa6770afe57c88a288ea21c363 Mon Sep 17 00:00:00 2001 From: Zoltan HERPAI Date: Thu, 27 Oct 2016 15:47:09 +0200 Subject: generic/4.1: bump kernel to 4.1.35 Patch 610- is updated as check_entry helper was killed Patch 666- is updated (thanks to Stijn Tintel) Fixes CVE-2016-5195 (dirtycow) Compile-tested on brcm47xx and rb532 Signed-off-by: Zoltan HERPAI --- ..._add_support_for_moving_ndp_to_end_of_ncm_frame.patch | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) (limited to 'target/linux/generic/patches-4.1/190-cdc_ncm_add_support_for_moving_ndp_to_end_of_ncm_frame.patch') diff --git a/target/linux/generic/patches-4.1/190-cdc_ncm_add_support_for_moving_ndp_to_end_of_ncm_frame.patch b/target/linux/generic/patches-4.1/190-cdc_ncm_add_support_for_moving_ndp_to_end_of_ncm_frame.patch index bd0718d7f9..02644d0583 100644 --- a/target/linux/generic/patches-4.1/190-cdc_ncm_add_support_for_moving_ndp_to_end_of_ncm_frame.patch +++ b/target/linux/generic/patches-4.1/190-cdc_ncm_add_support_for_moving_ndp_to_end_of_ncm_frame.patch @@ -65,7 +65,7 @@ Signed-off-by: David S. Miller { const struct usb_cdc_union_desc *union_desc = NULL; struct cdc_ncm_ctx *ctx; -@@ -883,6 +885,17 @@ advance: +@@ -894,6 +896,17 @@ advance: /* finish setting up the device specific data */ cdc_ncm_setup(dev); @@ -83,7 +83,7 @@ Signed-off-by: David S. Miller /* override ethtool_ops */ dev->net->ethtool_ops = &cdc_ncm_ethtool_ops; -@@ -985,8 +998,11 @@ static int cdc_ncm_bind(struct usbnet *d +@@ -996,8 +1009,11 @@ static int cdc_ncm_bind(struct usbnet *d if (cdc_ncm_select_altsetting(intf) != CDC_NCM_COMM_ALTSETTING_NCM) return -ENODEV; @@ -97,7 +97,7 @@ Signed-off-by: David S. Miller /* * We should get an event when network connection is "connected" or -@@ -1017,6 +1033,14 @@ static struct usb_cdc_ncm_ndp16 *cdc_ncm +@@ -1028,6 +1044,14 @@ static struct usb_cdc_ncm_ndp16 *cdc_ncm struct usb_cdc_ncm_nth16 *nth16 = (void *)skb->data; size_t ndpoffset = le16_to_cpu(nth16->wNdpIndex); @@ -112,7 +112,7 @@ Signed-off-by: David S. Miller /* follow the chain of NDPs, looking for a match */ while (ndpoffset) { ndp16 = (struct usb_cdc_ncm_ndp16 *)(skb->data + ndpoffset); -@@ -1026,7 +1050,8 @@ static struct usb_cdc_ncm_ndp16 *cdc_ncm +@@ -1037,7 +1061,8 @@ static struct usb_cdc_ncm_ndp16 *cdc_ncm } /* align new NDP */ @@ -122,7 +122,7 @@ Signed-off-by: David S. Miller /* verify that there is room for the NDP and the datagram (reserve) */ if ((ctx->tx_max - skb->len - reserve) < ctx->max_ndp_size) -@@ -1039,7 +1064,11 @@ static struct usb_cdc_ncm_ndp16 *cdc_ncm +@@ -1050,7 +1075,11 @@ static struct usb_cdc_ncm_ndp16 *cdc_ncm nth16->wNdpIndex = cpu_to_le16(skb->len); /* push a new empty NDP */ @@ -135,7 +135,7 @@ Signed-off-by: David S. Miller ndp16->dwSignature = sign; ndp16->wLength = cpu_to_le16(sizeof(struct usb_cdc_ncm_ndp16) + sizeof(struct usb_cdc_ncm_dpe16)); return ndp16; -@@ -1054,6 +1083,15 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev +@@ -1065,6 +1094,15 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev struct sk_buff *skb_out; u16 n = 0, index, ndplen; u8 ready2send = 0; @@ -151,7 +151,7 @@ Signed-off-by: David S. Miller /* if there is a remaining skb, it gets priority */ if (skb != NULL) { -@@ -1108,7 +1146,7 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev +@@ -1119,7 +1157,7 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev cdc_ncm_align_tail(skb_out, ctx->tx_modulus, ctx->tx_remainder, ctx->tx_max); /* check if we had enough room left for both NDP and frame */ @@ -160,7 +160,7 @@ Signed-off-by: David S. Miller if (n == 0) { /* won't fit, MTU problem? */ dev_kfree_skb_any(skb); -@@ -1181,6 +1219,17 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev +@@ -1192,6 +1230,17 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev /* variables will be reset at next call */ } -- cgit v1.2.3