kernel: bump 4.14 to 4.14.136

Refreshed all patches.

Altered patches:
- 306-v4.16-netfilter-remove-saveroute-indirection-in-struct-nf_.patch

Remove upstreamed:
- 100-powerpc-4xx-uic-clear-pending-interrupt-after-irq-ty.patch
- 088-0002-i2c-qup-fixed-releasing-dma-without-flush-operation.patch
- 500-arm64-dts-marvell-Fix-A37xx-UART0-register-size.patch

Fixes:
- CVE-2019-13648
- CVE-2019-10207

Compile-tested on: ar71xx, cns3xxx, imx6, x86_64
Runtime-tested on: ar71xx, cns3xxx

Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>

6 files changed, 10 insertions, 10 deletions

diff --git a/target/linux/generic/backport-4.14/095-Allow-class-e-address-assignment-via-ifconfig-ioctl.patch b/target/linux/generic/backport-4.14/095-Allow-class-e-address-assignment-via-ifconfig-ioctl.patch
index ade5c6cc23..1c501867a9 100644
--- a/target/linux/generic/backport-4.14/095-Allow-class-e-address-assignment-via-ifconfig-ioctl.patch
+++ b/target/linux/generic/backport-4.14/095-Allow-class-e-address-assignment-via-ifconfig-ioctl.patch
@@ -48,7 +48,7 @@ Reviewed-by: John Gilmore <gnu@toad.com>
  #define	INADDR_ANY		((unsigned long int) 0x00000000)
 --- a/net/ipv4/devinet.c
 +++ b/net/ipv4/devinet.c
-@@ -921,7 +921,7 @@ static int inet_abc_len(__be32 addr)
+@@ -929,7 +929,7 @@ static int inet_abc_len(__be32 addr)
  {
  	int rc = -1;	/* Something else, probably a multicast. */
  
@@ -57,7 +57,7 @@ Reviewed-by: John Gilmore <gnu@toad.com>
  		rc = 0;
  	else {
  		__u32 haddr = ntohl(addr);
-@@ -932,6 +932,8 @@ static int inet_abc_len(__be32 addr)
+@@ -940,6 +940,8 @@ static int inet_abc_len(__be32 addr)
  			rc = 16;
  		else if (IN_CLASSC(haddr))
  			rc = 24;
diff --git a/target/linux/generic/backport-4.14/293-v4.16-netfilter-reduce-size-of-hook-entry-point-locations.patch b/target/linux/generic/backport-4.14/293-v4.16-netfilter-reduce-size-of-hook-entry-point-locations.patch
index 5e339865d3..aad588f19b 100644
--- a/target/linux/generic/backport-4.14/293-v4.16-netfilter-reduce-size-of-hook-entry-point-locations.patch
+++ b/target/linux/generic/backport-4.14/293-v4.16-netfilter-reduce-size-of-hook-entry-point-locations.patch
@@ -159,7 +159,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
  	net->nf.proc_netfilter = proc_net_mkdir(net, "netfilter",
 --- a/net/netfilter/nf_queue.c
 +++ b/net/netfilter/nf_queue.c
-@@ -202,6 +202,23 @@ repeat:
+@@ -206,6 +206,23 @@ repeat:
  	return NF_ACCEPT;
  }
  
@@ -183,7 +183,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
  /* Caller must hold rcu read-side lock */
  void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict)
  {
-@@ -217,12 +234,12 @@ void nf_reinject(struct nf_queue_entry *
+@@ -221,12 +238,12 @@ void nf_reinject(struct nf_queue_entry *
  	net = entry->state.net;
  	pf = entry->state.pf;
  
diff --git a/target/linux/generic/backport-4.14/296-v4.16-netfilter-don-t-allocate-space-for-arp-bridge-hooks-.patch b/target/linux/generic/backport-4.14/296-v4.16-netfilter-don-t-allocate-space-for-arp-bridge-hooks-.patch
index b27b02f506..41675c3494 100644
--- a/target/linux/generic/backport-4.14/296-v4.16-netfilter-don-t-allocate-space-for-arp-bridge-hooks-.patch
+++ b/target/linux/generic/backport-4.14/296-v4.16-netfilter-don-t-allocate-space-for-arp-bridge-hooks-.patch
@@ -152,7 +152,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
  #endif
 --- a/net/netfilter/nf_queue.c
 +++ b/net/netfilter/nf_queue.c
-@@ -205,8 +205,10 @@ repeat:
+@@ -209,8 +209,10 @@ repeat:
  static struct nf_hook_entries *nf_hook_entries_head(const struct net *net, u8 pf, u8 hooknum)
  {
  	switch (pf) {
diff --git a/target/linux/generic/backport-4.14/306-v4.16-netfilter-remove-saveroute-indirection-in-struct-nf_.patch b/target/linux/generic/backport-4.14/306-v4.16-netfilter-remove-saveroute-indirection-in-struct-nf_.patch
index b02ad8a0d7..943b3eed30 100644
--- a/target/linux/generic/backport-4.14/306-v4.16-netfilter-remove-saveroute-indirection-in-struct-nf_.patch
+++ b/target/linux/generic/backport-4.14/306-v4.16-netfilter-remove-saveroute-indirection-in-struct-nf_.patch
@@ -212,10 +212,10 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
  static int __nf_queue(struct sk_buff *skb, const struct nf_hook_state *state,
  		      const struct nf_hook_entries *entries,
  		      unsigned int index, unsigned int queuenum)
-@@ -144,7 +175,16 @@ static int __nf_queue(struct sk_buff *sk
+@@ -148,7 +179,16 @@ static int __nf_queue(struct sk_buff *sk
+ 	};
  
  	nf_queue_entry_get_refs(entry);
- 	skb_dst_force(skb);
 -	afinfo->saveroute(skb, entry);
 +
 +	switch (entry->state.pf) {
diff --git a/target/linux/generic/backport-4.14/308-v4.16-netfilter-move-reroute-indirection-to-struct-nf_ipv6.patch b/target/linux/generic/backport-4.14/308-v4.16-netfilter-move-reroute-indirection-to-struct-nf_ipv6.patch
index 9303a0b777..810f57ca19 100644
--- a/target/linux/generic/backport-4.14/308-v4.16-netfilter-move-reroute-indirection-to-struct-nf_ipv6.patch
+++ b/target/linux/generic/backport-4.14/308-v4.16-netfilter-move-reroute-indirection-to-struct-nf_ipv6.patch
@@ -171,7 +171,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
  
 --- a/net/netfilter/nf_queue.c
 +++ b/net/netfilter/nf_queue.c
-@@ -267,7 +267,6 @@ void nf_reinject(struct nf_queue_entry *
+@@ -271,7 +271,6 @@ void nf_reinject(struct nf_queue_entry *
  	const struct nf_hook_entry *hook_entry;
  	const struct nf_hook_entries *hooks;
  	struct sk_buff *skb = entry->skb;
@@ -179,7 +179,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
  	const struct net *net;
  	unsigned int i;
  	int err;
-@@ -294,8 +293,7 @@ void nf_reinject(struct nf_queue_entry *
+@@ -298,8 +297,7 @@ void nf_reinject(struct nf_queue_entry *
  		verdict = nf_hook_entry_hookfn(hook_entry, skb, &entry->state);
  
  	if (verdict == NF_ACCEPT) {
diff --git a/target/linux/generic/backport-4.14/309-v4.16-netfilter-remove-route_key_size-field-in-struct-nf_a.patch b/target/linux/generic/backport-4.14/309-v4.16-netfilter-remove-route_key_size-field-in-struct-nf_a.patch
index b4a13dd539..20820e40ca 100644
--- a/target/linux/generic/backport-4.14/309-v4.16-netfilter-remove-route_key_size-field-in-struct-nf_a.patch
+++ b/target/linux/generic/backport-4.14/309-v4.16-netfilter-remove-route_key_size-field-in-struct-nf_a.patch
@@ -83,7 +83,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
  	if (!entry) {
  		status = -ENOMEM;
  		goto err;
-@@ -170,7 +180,7 @@ static int __nf_queue(struct sk_buff *sk
+@@ -175,7 +185,7 @@ static int __nf_queue(struct sk_buff *sk
  		.skb	= skb,
  		.state	= *state,
  		.hook_index = index,