kernel: bump 4.14 to 4.14.136

Refreshed all patches.

Altered patches:
- 306-v4.16-netfilter-remove-saveroute-indirection-in-struct-nf_.patch

Remove upstreamed:
- 100-powerpc-4xx-uic-clear-pending-interrupt-after-irq-ty.patch
- 088-0002-i2c-qup-fixed-releasing-dma-without-flush-operation.patch
- 500-arm64-dts-marvell-Fix-A37xx-UART0-register-size.patch

Fixes:
- CVE-2019-13648
- CVE-2019-10207

Compile-tested on: ar71xx, cns3xxx, imx6, x86_64
Runtime-tested on: ar71xx, cns3xxx

Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>

16 files changed, 26 insertions, 26 deletions

diff --git a/target/linux/generic/backport-4.14/095-Allow-class-e-address-assignment-via-ifconfig-ioctl.patch b/target/linux/generic/backport-4.14/095-Allow-class-e-address-assignment-via-ifconfig-ioctl.patch
index ade5c6cc23..1c501867a9 100644
--- a/target/linux/generic/backport-4.14/095-Allow-class-e-address-assignment-via-ifconfig-ioctl.patch
+++ b/target/linux/generic/backport-4.14/095-Allow-class-e-address-assignment-via-ifconfig-ioctl.patch
@@ -48,7 +48,7 @@ Reviewed-by: John Gilmore <gnu@toad.com>
  #define	INADDR_ANY		((unsigned long int) 0x00000000)
 --- a/net/ipv4/devinet.c
 +++ b/net/ipv4/devinet.c
-@@ -921,7 +921,7 @@ static int inet_abc_len(__be32 addr)
+@@ -929,7 +929,7 @@ static int inet_abc_len(__be32 addr)
  {
  	int rc = -1;	/* Something else, probably a multicast. */
  
@@ -57,7 +57,7 @@ Reviewed-by: John Gilmore <gnu@toad.com>
  		rc = 0;
  	else {
  		__u32 haddr = ntohl(addr);
-@@ -932,6 +932,8 @@ static int inet_abc_len(__be32 addr)
+@@ -940,6 +940,8 @@ static int inet_abc_len(__be32 addr)
  			rc = 16;
  		else if (IN_CLASSC(haddr))
  			rc = 24;
diff --git a/target/linux/generic/backport-4.14/293-v4.16-netfilter-reduce-size-of-hook-entry-point-locations.patch b/target/linux/generic/backport-4.14/293-v4.16-netfilter-reduce-size-of-hook-entry-point-locations.patch
index 5e339865d3..aad588f19b 100644
--- a/target/linux/generic/backport-4.14/293-v4.16-netfilter-reduce-size-of-hook-entry-point-locations.patch
+++ b/target/linux/generic/backport-4.14/293-v4.16-netfilter-reduce-size-of-hook-entry-point-locations.patch
@@ -159,7 +159,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
  	net->nf.proc_netfilter = proc_net_mkdir(net, "netfilter",
 --- a/net/netfilter/nf_queue.c
 +++ b/net/netfilter/nf_queue.c
-@@ -202,6 +202,23 @@ repeat:
+@@ -206,6 +206,23 @@ repeat:
  	return NF_ACCEPT;
  }
  
@@ -183,7 +183,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
  /* Caller must hold rcu read-side lock */
  void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict)
  {
-@@ -217,12 +234,12 @@ void nf_reinject(struct nf_queue_entry *
+@@ -221,12 +238,12 @@ void nf_reinject(struct nf_queue_entry *
  	net = entry->state.net;
  	pf = entry->state.pf;
  
diff --git a/target/linux/generic/backport-4.14/296-v4.16-netfilter-don-t-allocate-space-for-arp-bridge-hooks-.patch b/target/linux/generic/backport-4.14/296-v4.16-netfilter-don-t-allocate-space-for-arp-bridge-hooks-.patch
index b27b02f506..41675c3494 100644
--- a/target/linux/generic/backport-4.14/296-v4.16-netfilter-don-t-allocate-space-for-arp-bridge-hooks-.patch
+++ b/target/linux/generic/backport-4.14/296-v4.16-netfilter-don-t-allocate-space-for-arp-bridge-hooks-.patch
@@ -152,7 +152,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
  #endif
 --- a/net/netfilter/nf_queue.c
 +++ b/net/netfilter/nf_queue.c
-@@ -205,8 +205,10 @@ repeat:
+@@ -209,8 +209,10 @@ repeat:
  static struct nf_hook_entries *nf_hook_entries_head(const struct net *net, u8 pf, u8 hooknum)
  {
  	switch (pf) {
diff --git a/target/linux/generic/backport-4.14/306-v4.16-netfilter-remove-saveroute-indirection-in-struct-nf_.patch b/target/linux/generic/backport-4.14/306-v4.16-netfilter-remove-saveroute-indirection-in-struct-nf_.patch
index b02ad8a0d7..943b3eed30 100644
--- a/target/linux/generic/backport-4.14/306-v4.16-netfilter-remove-saveroute-indirection-in-struct-nf_.patch
+++ b/target/linux/generic/backport-4.14/306-v4.16-netfilter-remove-saveroute-indirection-in-struct-nf_.patch
@@ -212,10 +212,10 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
  static int __nf_queue(struct sk_buff *skb, const struct nf_hook_state *state,
  		      const struct nf_hook_entries *entries,
  		      unsigned int index, unsigned int queuenum)
-@@ -144,7 +175,16 @@ static int __nf_queue(struct sk_buff *sk
+@@ -148,7 +179,16 @@ static int __nf_queue(struct sk_buff *sk
+ 	};
  
  	nf_queue_entry_get_refs(entry);
- 	skb_dst_force(skb);
 -	afinfo->saveroute(skb, entry);
 +
 +	switch (entry->state.pf) {
diff --git a/target/linux/generic/backport-4.14/308-v4.16-netfilter-move-reroute-indirection-to-struct-nf_ipv6.patch b/target/linux/generic/backport-4.14/308-v4.16-netfilter-move-reroute-indirection-to-struct-nf_ipv6.patch
index 9303a0b777..810f57ca19 100644
--- a/target/linux/generic/backport-4.14/308-v4.16-netfilter-move-reroute-indirection-to-struct-nf_ipv6.patch
+++ b/target/linux/generic/backport-4.14/308-v4.16-netfilter-move-reroute-indirection-to-struct-nf_ipv6.patch
@@ -171,7 +171,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
  
 --- a/net/netfilter/nf_queue.c
 +++ b/net/netfilter/nf_queue.c
-@@ -267,7 +267,6 @@ void nf_reinject(struct nf_queue_entry *
+@@ -271,7 +271,6 @@ void nf_reinject(struct nf_queue_entry *
  	const struct nf_hook_entry *hook_entry;
  	const struct nf_hook_entries *hooks;
  	struct sk_buff *skb = entry->skb;
@@ -179,7 +179,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
  	const struct net *net;
  	unsigned int i;
  	int err;
-@@ -294,8 +293,7 @@ void nf_reinject(struct nf_queue_entry *
+@@ -298,8 +297,7 @@ void nf_reinject(struct nf_queue_entry *
  		verdict = nf_hook_entry_hookfn(hook_entry, skb, &entry->state);
  
  	if (verdict == NF_ACCEPT) {
diff --git a/target/linux/generic/backport-4.14/309-v4.16-netfilter-remove-route_key_size-field-in-struct-nf_a.patch b/target/linux/generic/backport-4.14/309-v4.16-netfilter-remove-route_key_size-field-in-struct-nf_a.patch
index b4a13dd539..20820e40ca 100644
--- a/target/linux/generic/backport-4.14/309-v4.16-netfilter-remove-route_key_size-field-in-struct-nf_a.patch
+++ b/target/linux/generic/backport-4.14/309-v4.16-netfilter-remove-route_key_size-field-in-struct-nf_a.patch
@@ -83,7 +83,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
  	if (!entry) {
  		status = -ENOMEM;
  		goto err;
-@@ -170,7 +180,7 @@ static int __nf_queue(struct sk_buff *sk
+@@ -175,7 +185,7 @@ static int __nf_queue(struct sk_buff *sk
  		.skb	= skb,
  		.state	= *state,
  		.hook_index = index,
diff --git a/target/linux/generic/hack-4.14/207-disable-modorder.patch b/target/linux/generic/hack-4.14/207-disable-modorder.patch
index 6744cd726e..b45a8e3bc2 100644
--- a/target/linux/generic/hack-4.14/207-disable-modorder.patch
+++ b/target/linux/generic/hack-4.14/207-disable-modorder.patch
@@ -15,7 +15,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/Makefile
 +++ b/Makefile
-@@ -1239,7 +1239,6 @@ all: modules
+@@ -1240,7 +1240,6 @@ all: modules
  
  PHONY += modules
  modules: $(vmlinux-dirs) $(if $(KBUILD_BUILTIN),vmlinux) modules.builtin
@@ -23,7 +23,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	@$(kecho) '  Building modules, stage 2.';
  	$(Q)$(MAKE) -f $(srctree)/scripts/Makefile.modpost
  
-@@ -1268,7 +1267,6 @@ _modinst_:
+@@ -1269,7 +1268,6 @@ _modinst_:
  		rm -f $(MODLIB)/build ; \
  		ln -s $(CURDIR) $(MODLIB)/build ; \
  	fi
diff --git a/target/linux/generic/hack-4.14/220-gc_sections.patch b/target/linux/generic/hack-4.14/220-gc_sections.patch
index 2f3f43c07f..d257232403 100644
--- a/target/linux/generic/hack-4.14/220-gc_sections.patch
+++ b/target/linux/generic/hack-4.14/220-gc_sections.patch
@@ -33,7 +33,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
  # Read KERNELRELEASE from include/config/kernel.release (if it exists)
  KERNELRELEASE = $(shell cat include/config/kernel.release 2> /dev/null)
  KERNELVERSION = $(VERSION)$(if $(PATCHLEVEL),.$(PATCHLEVEL)$(if $(SUBLEVEL),.$(SUBLEVEL)))$(EXTRAVERSION)
-@@ -787,11 +792,6 @@ ifdef CONFIG_DEBUG_SECTION_MISMATCH
+@@ -788,11 +793,6 @@ ifdef CONFIG_DEBUG_SECTION_MISMATCH
  KBUILD_CFLAGS += $(call cc-option, -fno-inline-functions-called-once)
  endif
  
diff --git a/target/linux/generic/hack-4.14/259-regmap_dynamic.patch b/target/linux/generic/hack-4.14/259-regmap_dynamic.patch
index 59dfbf3ad2..2cbd791b28 100644
--- a/target/linux/generic/hack-4.14/259-regmap_dynamic.patch
+++ b/target/linux/generic/hack-4.14/259-regmap_dynamic.patch
@@ -86,7 +86,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  #include <linux/mutex.h>
  #include <linux/err.h>
  #include <linux/of.h>
-@@ -2926,3 +2927,5 @@ static int __init regmap_initcall(void)
+@@ -2928,3 +2929,5 @@ static int __init regmap_initcall(void)
  	return 0;
  }
  postcore_initcall(regmap_initcall);
diff --git a/target/linux/generic/hack-4.14/702-phy_add_aneg_done_function.patch b/target/linux/generic/hack-4.14/702-phy_add_aneg_done_function.patch
index 24d3cdffa3..97bbee96a9 100644
--- a/target/linux/generic/hack-4.14/702-phy_add_aneg_done_function.patch
+++ b/target/linux/generic/hack-4.14/702-phy_add_aneg_done_function.patch
@@ -15,7 +15,7 @@
  
 --- a/drivers/net/phy/phy_device.c
 +++ b/drivers/net/phy/phy_device.c
-@@ -1455,6 +1455,9 @@ int genphy_update_link(struct phy_device
+@@ -1461,6 +1461,9 @@ int genphy_update_link(struct phy_device
  {
  	int status;
  
diff --git a/target/linux/generic/hack-4.14/902-debloat_proc.patch b/target/linux/generic/hack-4.14/902-debloat_proc.patch
index 12809bb1be..2a20058ed3 100644
--- a/target/linux/generic/hack-4.14/902-debloat_proc.patch
+++ b/target/linux/generic/hack-4.14/902-debloat_proc.patch
@@ -221,7 +221,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	if (!root_irq_dir)
 --- a/kernel/time/timer_list.c
 +++ b/kernel/time/timer_list.c
-@@ -389,6 +389,8 @@ static int __init init_timer_list_procfs
+@@ -390,6 +390,8 @@ static int __init init_timer_list_procfs
  {
  	struct proc_dir_entry *pe;
  
diff --git a/target/linux/generic/hack-4.14/904-debloat_dma_buf.patch b/target/linux/generic/hack-4.14/904-debloat_dma_buf.patch
index 4d9f947edc..195507996f 100644
--- a/target/linux/generic/hack-4.14/904-debloat_dma_buf.patch
+++ b/target/linux/generic/hack-4.14/904-debloat_dma_buf.patch
@@ -45,7 +45,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  #include <uapi/linux/dma-buf.h>
  
-@@ -1205,4 +1206,5 @@ static void __exit dma_buf_deinit(void)
+@@ -1206,4 +1207,5 @@ static void __exit dma_buf_deinit(void)
  {
  	dma_buf_uninit_debugfs();
  }
diff --git a/target/linux/generic/pending-4.14/201-extra_optimization.patch b/target/linux/generic/pending-4.14/201-extra_optimization.patch
index 857951cbf9..6f4e465f65 100644
--- a/target/linux/generic/pending-4.14/201-extra_optimization.patch
+++ b/target/linux/generic/pending-4.14/201-extra_optimization.patch
@@ -14,7 +14,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/Makefile
 +++ b/Makefile
-@@ -654,12 +654,12 @@ KBUILD_CFLAGS	+= $(call cc-disable-warni
+@@ -655,12 +655,12 @@ KBUILD_CFLAGS	+= $(call cc-disable-warni
  KBUILD_CFLAGS	+= $(call cc-disable-warning, attribute-alias)
  
  ifdef CONFIG_CC_OPTIMIZE_FOR_SIZE
diff --git a/target/linux/generic/pending-4.14/203-kallsyms_uncompressed.patch b/target/linux/generic/pending-4.14/203-kallsyms_uncompressed.patch
index 5f66c3d501..b0cd863be4 100644
--- a/target/linux/generic/pending-4.14/203-kallsyms_uncompressed.patch
+++ b/target/linux/generic/pending-4.14/203-kallsyms_uncompressed.patch
@@ -65,7 +65,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  static int absolute_percpu = 0;
  static char symbol_prefix_char = '\0';
  static int base_relative = 0;
-@@ -458,6 +459,9 @@ static void write_src(void)
+@@ -461,6 +462,9 @@ static void write_src(void)
  
  	free(markers);
  
@@ -75,7 +75,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	output_label("kallsyms_token_table");
  	off = 0;
  	for (i = 0; i < 256; i++) {
-@@ -516,6 +520,9 @@ static void *find_token(unsigned char *s
+@@ -519,6 +523,9 @@ static void *find_token(unsigned char *s
  {
  	int i;
  
@@ -85,7 +85,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	for (i = 0; i < len - 1; i++) {
  		if (str[i] == token[0] && str[i+1] == token[1])
  			return &str[i];
-@@ -588,6 +595,9 @@ static void optimize_result(void)
+@@ -591,6 +598,9 @@ static void optimize_result(void)
  {
  	int i, best;
  
@@ -95,7 +95,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	/* using the '\0' symbol last allows compress_symbols to use standard
  	 * fast string functions */
  	for (i = 255; i >= 0; i--) {
-@@ -776,6 +786,8 @@ int main(int argc, char **argv)
+@@ -779,6 +789,8 @@ int main(int argc, char **argv)
  				symbol_prefix_char = *p;
  			} else if (strcmp(argv[i], "--base-relative") == 0)
  				base_relative = 1;
diff --git a/target/linux/generic/pending-4.14/703-phy-add-detach-callback-to-struct-phy_driver.patch b/target/linux/generic/pending-4.14/703-phy-add-detach-callback-to-struct-phy_driver.patch
index 119b53c6d7..4ba722183c 100644
--- a/target/linux/generic/pending-4.14/703-phy-add-detach-callback-to-struct-phy_driver.patch
+++ b/target/linux/generic/pending-4.14/703-phy-add-detach-callback-to-struct-phy_driver.patch
@@ -11,7 +11,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
 
 --- a/drivers/net/phy/phy_device.c
 +++ b/drivers/net/phy/phy_device.c
-@@ -1099,6 +1099,9 @@ void phy_detach(struct phy_device *phyde
+@@ -1105,6 +1105,9 @@ void phy_detach(struct phy_device *phyde
  	struct module *ndev_owner = dev->dev.parent->driver->owner;
  	struct mii_bus *bus;
  
diff --git a/target/linux/generic/pending-4.14/811-pci_disable_usb_common_quirks.patch b/target/linux/generic/pending-4.14/811-pci_disable_usb_common_quirks.patch
index f40214c29b..aeb13c5ef7 100644
--- a/target/linux/generic/pending-4.14/811-pci_disable_usb_common_quirks.patch
+++ b/target/linux/generic/pending-4.14/811-pci_disable_usb_common_quirks.patch
@@ -19,7 +19,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  static struct amd_chipset_info {
  	struct pci_dev	*nb_dev;
  	struct pci_dev	*smbus_dev;
-@@ -620,6 +622,10 @@ bool usb_amd_pt_check_port(struct device
+@@ -627,6 +629,10 @@ bool usb_amd_pt_check_port(struct device
  }
  EXPORT_SYMBOL_GPL(usb_amd_pt_check_port);
  
@@ -30,7 +30,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  /*
   * Make sure the controller is completely inactive, unable to
   * generate interrupts or do DMA.
-@@ -699,8 +705,17 @@ reset_needed:
+@@ -706,8 +712,17 @@ reset_needed:
  	uhci_reset_hc(pdev, base);
  	return 1;
  }
@@ -48,7 +48,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  static inline int io_type_enabled(struct pci_dev *pdev, unsigned int mask)
  {
  	u16 cmd;
-@@ -1287,3 +1302,4 @@ bool usb_xhci_needs_pci_reset(struct pci
+@@ -1294,3 +1309,4 @@ bool usb_xhci_needs_pci_reset(struct pci
  	return false;
  }
  EXPORT_SYMBOL_GPL(usb_xhci_needs_pci_reset);