From 1cb9409df2c093aa6770afe57c88a288ea21c363 Mon Sep 17 00:00:00 2001 From: Zoltan HERPAI Date: Thu, 27 Oct 2016 15:47:09 +0200 Subject: generic/4.1: bump kernel to 4.1.35 Patch 610- is updated as check_entry helper was killed Patch 666- is updated (thanks to Stijn Tintel) Fixes CVE-2016-5195 (dirtycow) Compile-tested on brcm47xx and rb532 Signed-off-by: Zoltan HERPAI --- .../666-Add-support-for-MAP-E-FMRs-mesh-mode.patch | 30 +++++++++++----------- 1 file changed, 15 insertions(+), 15 deletions(-) (limited to 'target/linux/generic/patches-4.1/666-Add-support-for-MAP-E-FMRs-mesh-mode.patch') diff --git a/target/linux/generic/patches-4.1/666-Add-support-for-MAP-E-FMRs-mesh-mode.patch b/target/linux/generic/patches-4.1/666-Add-support-for-MAP-E-FMRs-mesh-mode.patch index f40fc386f5..b990f50608 100644 --- a/target/linux/generic/patches-4.1/666-Add-support-for-MAP-E-FMRs-mesh-mode.patch +++ b/target/linux/generic/patches-4.1/666-Add-support-for-MAP-E-FMRs-mesh-mode.patch @@ -295,15 +295,15 @@ Signed-off-by: Steven Barth __skb_tunnel_rx(skb, t->dev, t->net); -@@ -1123,6 +1260,7 @@ ip4ip6_tnl_xmit(struct sk_buff *skb, str +@@ -1168,6 +1305,7 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, str __u32 mtu; u8 tproto; int err; + struct __ip6_tnl_fmr *fmr; tproto = ACCESS_ONCE(t->parms.proto); - if (tproto != IPPROTO_IPIP && tproto != 0) -@@ -1142,6 +1280,18 @@ ip4ip6_tnl_xmit(struct sk_buff *skb, str + if ((tproto != IPPROTO_IPV6 && tproto != 0) || +@@ -1198,6 +1336,18 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, str if (t->parms.flags & IP6_TNL_F_USE_ORIG_FWMARK) fl6.flowi6_mark = skb->mark; @@ -311,18 +311,18 @@ Signed-off-by: Steven Barth + for (fmr = t->parms.fmrs; fmr; fmr = fmr->next) { + unsigned mshift = 32 - fmr->ip4_prefix_len; + if (ntohl(fmr->ip4_prefix.s_addr) >> mshift == -+ ntohl(iph->daddr) >> mshift) ++ ntohl(ip_hdr(skb)->daddr) >> mshift) + break; + } + + /* change dstaddr according to FMR */ + if (fmr) -+ ip4ip6_fmr_calc(&fl6.daddr, iph, skb_tail_pointer(skb), fmr, true); ++ ip4ip6_fmr_calc(&fl6.daddr, ip_hdr(skb), skb_tail_pointer(skb), fmr, true); + err = ip6_tnl_xmit2(skb, dev, dsfield, &fl6, encap_limit, &mtu); if (err != 0) { - /* XXX: send ICMP error even if DF is not set. */ -@@ -1310,6 +1460,14 @@ ip6_tnl_change(struct ip6_tnl *t, const + if (err == -EMSGSIZE) +@@ -1312,6 +1462,14 @@ ip6_tnl_change(struct ip6_tnl *t, const t->parms.flowinfo = p->flowinfo; t->parms.link = p->link; t->parms.proto = p->proto; @@ -337,7 +337,7 @@ Signed-off-by: Steven Barth ip6_tnl_dst_reset(t); ip6_tnl_link_config(t); return 0; -@@ -1348,6 +1506,7 @@ ip6_tnl_parm_from_user(struct __ip6_tnl_ +@@ -1350,6 +1508,7 @@ ip6_tnl_parm_from_user(struct __ip6_tnl_ p->flowinfo = u->flowinfo; p->link = u->link; p->proto = u->proto; @@ -345,7 +345,7 @@ Signed-off-by: Steven Barth memcpy(p->name, u->name, sizeof(u->name)); } -@@ -1634,6 +1793,15 @@ static int ip6_tnl_validate(struct nlatt +@@ -1636,6 +1795,15 @@ static int ip6_tnl_validate(struct nlatt return 0; } @@ -361,7 +361,7 @@ Signed-off-by: Steven Barth static void ip6_tnl_netlink_parms(struct nlattr *data[], struct __ip6_tnl_parm *parms) { -@@ -1665,6 +1833,46 @@ static void ip6_tnl_netlink_parms(struct +@@ -1667,6 +1835,46 @@ static void ip6_tnl_netlink_parms(struct if (data[IFLA_IPTUN_PROTO]) parms->proto = nla_get_u8(data[IFLA_IPTUN_PROTO]); @@ -408,7 +408,7 @@ Signed-off-by: Steven Barth } static int ip6_tnl_newlink(struct net *src_net, struct net_device *dev, -@@ -1717,6 +1925,12 @@ static void ip6_tnl_dellink(struct net_d +@@ -1719,6 +1927,12 @@ static void ip6_tnl_dellink(struct net_d static size_t ip6_tnl_get_size(const struct net_device *dev) { @@ -421,7 +421,7 @@ Signed-off-by: Steven Barth return /* IFLA_IPTUN_LINK */ nla_total_size(4) + -@@ -1734,6 +1948,24 @@ static size_t ip6_tnl_get_size(const str +@@ -1736,6 +1950,24 @@ static size_t ip6_tnl_get_size(const str nla_total_size(4) + /* IFLA_IPTUN_PROTO */ nla_total_size(1) + @@ -446,7 +446,7 @@ Signed-off-by: Steven Barth 0; } -@@ -1741,6 +1973,9 @@ static int ip6_tnl_fill_info(struct sk_b +@@ -1743,6 +1975,9 @@ static int ip6_tnl_fill_info(struct sk_b { struct ip6_tnl *tunnel = netdev_priv(dev); struct __ip6_tnl_parm *parm = &tunnel->parms; @@ -456,7 +456,7 @@ Signed-off-by: Steven Barth if (nla_put_u32(skb, IFLA_IPTUN_LINK, parm->link) || nla_put_in6_addr(skb, IFLA_IPTUN_LOCAL, &parm->laddr) || -@@ -1749,8 +1984,27 @@ static int ip6_tnl_fill_info(struct sk_b +@@ -1751,8 +1986,27 @@ static int ip6_tnl_fill_info(struct sk_b nla_put_u8(skb, IFLA_IPTUN_ENCAP_LIMIT, parm->encap_limit) || nla_put_be32(skb, IFLA_IPTUN_FLOWINFO, parm->flowinfo) || nla_put_u32(skb, IFLA_IPTUN_FLAGS, parm->flags) || @@ -485,7 +485,7 @@ Signed-off-by: Steven Barth return 0; nla_put_failure: -@@ -1774,6 +2028,7 @@ static const struct nla_policy ip6_tnl_p +@@ -1776,6 +2030,7 @@ static const struct nla_policy ip6_tnl_p [IFLA_IPTUN_FLOWINFO] = { .type = NLA_U32 }, [IFLA_IPTUN_FLAGS] = { .type = NLA_U32 }, [IFLA_IPTUN_PROTO] = { .type = NLA_U8 }, -- cgit v1.2.3