kernel: bump 4.14 to 4.14.59

Drop patch that was superseded upstream:
ramips/0036-mtd-fix-cfi-cmdset-0002-erase-status-check.patch

Drop upstreamed patches:
- apm821xx/020-0001-crypto-crypto4xx-remove-bad-list_del.patch
- apm821xx/020-0011-crypto-crypto4xx-fix-crypto4xx_build_pdr-crypto4xx_b.patch
- ath79/0011-MIPS-ath79-fix-register-address-in-ath79_ddr_wb_flus.patch
- brcm63xx/001-4.15-08-bcm63xx_enet-correct-clock-usage.patch
- brcm63xx/001-4.15-09-bcm63xx_enet-do-not-write-to-random-DMA-channel-on-B.patch
- generic/backport/080-net-convert-sock.sk_wmem_alloc-from-atomic_t-to-refc.patch
- generic/pending/170-usb-dwc2-Fix-DMA-alignment-to-start-at-allocated-boun.patch
- generic/pending/900-gen_stats-fix-netlink-stats-padding.patch

In 4.14.55, a patch was introduced that breaks ext4 images in some
cases. The newly introduced patch
backport-4.14/500-ext4-fix-check-to-prevent-initializing-reserved-inod.patch
addresses this breakage.

Fixes the following CVEs:
- CVE-2018-10876
- CVE-2018-10877
- CVE-2018-10879
- CVE-2018-10880
- CVE-2018-10881
- CVE-2018-10882
- CVE-2018-10883

Compile-tested: ath79, octeon, x86/64
Runtime-tested: ath79, octeon, x86/64

Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>

20 files changed, 96 insertions, 383 deletions

diff --git a/target/linux/generic/backport-4.14/012-kbuild-add-macro-for-controlling-warnings-to-linux-c.patch b/target/linux/generic/backport-4.14/012-kbuild-add-macro-for-controlling-warnings-to-linux-c.patch
index 6b56a68b31..892b65fbc0 100644
--- a/target/linux/generic/backport-4.14/012-kbuild-add-macro-for-controlling-warnings-to-linux-c.patch
+++ b/target/linux/generic/backport-4.14/012-kbuild-add-macro-for-controlling-warnings-to-linux-c.patch
@@ -84,7 +84,7 @@ Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
 
 --- a/include/linux/compiler-gcc.h
 +++ b/include/linux/compiler-gcc.h
-@@ -343,3 +343,28 @@
+@@ -358,3 +358,28 @@
   * code
   */
  #define uninitialized_var(x) x = x
diff --git a/target/linux/generic/backport-4.14/025-tcp-allow-drivers-to-tweak-TSQ-logic.patch b/target/linux/generic/backport-4.14/025-tcp-allow-drivers-to-tweak-TSQ-logic.patch
index 89117bd874..d9215505ee 100644
--- a/target/linux/generic/backport-4.14/025-tcp-allow-drivers-to-tweak-TSQ-logic.patch
+++ b/target/linux/generic/backport-4.14/025-tcp-allow-drivers-to-tweak-TSQ-logic.patch
@@ -65,7 +65,7 @@ Cc: Kir Kolyshkin <kir@openvz.org>
  	 * Before updating sk_refcnt, we must commit prior changes to memory
 --- a/net/ipv4/tcp_output.c
 +++ b/net/ipv4/tcp_output.c
-@@ -1671,7 +1671,7 @@ u32 tcp_tso_autosize(const struct sock *
+@@ -1683,7 +1683,7 @@ u32 tcp_tso_autosize(const struct sock *
  {
  	u32 bytes, segs;
  
@@ -74,7 +74,7 @@ Cc: Kir Kolyshkin <kir@openvz.org>
  		    sk->sk_gso_max_size - 1 - MAX_TCP_HEADER);
  
  	/* Goal is to send at least one packet per ms,
-@@ -2172,7 +2172,7 @@ static bool tcp_small_queue_check(struct
+@@ -2184,7 +2184,7 @@ static bool tcp_small_queue_check(struct
  {
  	unsigned int limit;
  
diff --git a/target/linux/generic/backport-4.14/030-v4.17-0001-usb-dwc2-add-support-for-host-mode-external-vbus-sup.patch b/target/linux/generic/backport-4.14/030-v4.17-0001-usb-dwc2-add-support-for-host-mode-external-vbus-sup.patch
index 1154150259..dc85efd1e1 100644
--- a/target/linux/generic/backport-4.14/030-v4.17-0001-usb-dwc2-add-support-for-host-mode-external-vbus-sup.patch
+++ b/target/linux/generic/backport-4.14/030-v4.17-0001-usb-dwc2-add-support-for-host-mode-external-vbus-sup.patch
@@ -63,7 +63,7 @@ Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
  /**
   * dwc2_enable_host_interrupts() - Enables the Host mode interrupts
   *
-@@ -3276,6 +3293,7 @@ static void dwc2_conn_id_status_change(s
+@@ -3278,6 +3295,7 @@ static void dwc2_conn_id_status_change(s
  
  	/* B-Device connector (Device Mode) */
  	if (gotgctl & GOTGCTL_CONID_B) {
@@ -71,7 +71,7 @@ Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
  		/* Wait for switch to device mode */
  		dev_dbg(hsotg->dev, "connId B\n");
  		if (hsotg->bus_suspended) {
-@@ -4382,6 +4400,9 @@ static int _dwc2_hcd_start(struct usb_hc
+@@ -4384,6 +4402,9 @@ static int _dwc2_hcd_start(struct usb_hc
  	}
  
  	spin_unlock_irqrestore(&hsotg->lock, flags);
@@ -81,7 +81,7 @@ Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
  	return 0;
  }
  
-@@ -4409,6 +4430,8 @@ static void _dwc2_hcd_stop(struct usb_hc
+@@ -4411,6 +4432,8 @@ static void _dwc2_hcd_stop(struct usb_hc
  	clear_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);
  	spin_unlock_irqrestore(&hsotg->lock, flags);
  
@@ -90,7 +90,7 @@ Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
  	usleep_range(1000, 3000);
  }
  
-@@ -4445,6 +4468,7 @@ static int _dwc2_hcd_suspend(struct usb_
+@@ -4447,6 +4470,7 @@ static int _dwc2_hcd_suspend(struct usb_
  		hprt0 |= HPRT0_SUSP;
  		hprt0 &= ~HPRT0_PWR;
  		dwc2_writel(hprt0, hsotg->regs + HPRT0);
@@ -98,7 +98,7 @@ Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
  	}
  
  	/* Enter hibernation */
-@@ -4525,6 +4549,8 @@ static int _dwc2_hcd_resume(struct usb_h
+@@ -4527,6 +4551,8 @@ static int _dwc2_hcd_resume(struct usb_h
  		spin_unlock_irqrestore(&hsotg->lock, flags);
  		dwc2_port_resume(hsotg);
  	} else {
diff --git a/target/linux/generic/backport-4.14/030-v4.17-0002-usb-dwc2-dwc2_vbus_supply_init-fix-error-check.patch b/target/linux/generic/backport-4.14/030-v4.17-0002-usb-dwc2-dwc2_vbus_supply_init-fix-error-check.patch
index f860cde0f6..8dac0bffc2 100644
--- a/target/linux/generic/backport-4.14/030-v4.17-0002-usb-dwc2-dwc2_vbus_supply_init-fix-error-check.patch
+++ b/target/linux/generic/backport-4.14/030-v4.17-0002-usb-dwc2-dwc2_vbus_supply_init-fix-error-check.patch
@@ -42,7 +42,7 @@ Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
  
  	return regulator_enable(hsotg->vbus_supply);
  }
-@@ -4401,9 +4406,7 @@ static int _dwc2_hcd_start(struct usb_hc
+@@ -4403,9 +4408,7 @@ static int _dwc2_hcd_start(struct usb_hc
  
  	spin_unlock_irqrestore(&hsotg->lock, flags);
  
diff --git a/target/linux/generic/backport-4.14/080-net-convert-sock.sk_wmem_alloc-from-atomic_t-to-refc.patch b/target/linux/generic/backport-4.14/080-net-convert-sock.sk_wmem_alloc-from-atomic_t-to-refc.patch
deleted file mode 100644
index 06d00886f1..0000000000
--- a/target/linux/generic/backport-4.14/080-net-convert-sock.sk_wmem_alloc-from-atomic_t-to-refc.patch
+++ /dev/null
@@ -1,172 +0,0 @@
-From 9bbe60a67be5a1c6f79b3c9be5003481a50529ff Mon Sep 17 00:00:00 2001
-From: David Woodhouse <dwmw2@infradead.org>
-Date: Sat, 16 Jun 2018 11:55:44 +0100
-Subject: atm: Preserve value of skb->truesize when accounting to vcc
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-ATM accounts for in-flight TX packets in sk_wmem_alloc of the VCC on
-which they are to be sent. But it doesn't take ownership of those
-packets from the sock (if any) which originally owned them. They should
-remain owned by their actual sender until they've left the box.
-
-There's a hack in pskb_expand_head() to avoid adjusting skb->truesize
-for certain skbs, precisely to avoid messing up sk_wmem_alloc
-accounting. Ideally that hack would cover the ATM use case too, but it
-doesn't — skbs which aren't owned by any sock, for example PPP control
-frames, still get their truesize adjusted when the low-level ATM driver
-adds headroom.
-
-This has always been an issue, it seems. The truesize of a packet
-increases, and sk_wmem_alloc on the VCC goes negative. But this wasn't
-for normal traffic, only for control frames. So I think we just got away
-with it, and we probably needed to send 2GiB of LCP echo frames before
-the misaccounting would ever have caused a problem and caused
-atm_may_send() to start refusing packets.
-
-Commit 14afee4b609 ("net: convert sock.sk_wmem_alloc from atomic_t to
-refcount_t") did exactly what it was intended to do, and turned this
-mostly-theoretical problem into a real one, causing PPPoATM to fail
-immediately as sk_wmem_alloc underflows and atm_may_send() *immediately*
-starts refusing to allow new packets.
-
-The least intrusive solution to this problem is to stash the value of
-skb->truesize that was accounted to the VCC, in a new member of the
-ATM_SKB(skb) structure. Then in atm_pop_raw() subtract precisely that
-value instead of the then-current value of skb->truesize.
-
-Fixes: 158f323b9868 ("net: adjust skb->truesize in pskb_expand_head()")
-Signed-off-by: David Woodhouse <dwmw2@infradead.org>
-Tested-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
-Signed-off-by: David S. Miller <davem@davemloft.net>
----
- include/linux/atmdev.h | 15 +++++++++++++++
- net/atm/br2684.c       |  3 +--
- net/atm/clip.c         |  3 +--
- net/atm/common.c       |  3 +--
- net/atm/lec.c          |  3 +--
- net/atm/mpc.c          |  3 +--
- net/atm/pppoatm.c      |  3 +--
- net/atm/raw.c          |  4 ++--
- 8 files changed, 23 insertions(+), 14 deletions(-)
-
---- a/include/linux/atmdev.h
-+++ b/include/linux/atmdev.h
-@@ -214,6 +214,7 @@ struct atmphy_ops {
- struct atm_skb_data {
- 	struct atm_vcc	*vcc;		/* ATM VCC */
- 	unsigned long	atm_options;	/* ATM layer options */
-+	unsigned int	acct_truesize;  /* truesize accounted to vcc */
- };
- 
- #define VCC_HTABLE_SIZE 32
-@@ -241,6 +242,20 @@ void vcc_insert_socket(struct sock *sk);
- 
- void atm_dev_release_vccs(struct atm_dev *dev);
- 
-+static inline void atm_account_tx(struct atm_vcc *vcc, struct sk_buff *skb)
-+{
-+	/*
-+	 * Because ATM skbs may not belong to a sock (and we don't
-+	 * necessarily want to), skb->truesize may be adjusted,
-+	 * escaping the hack in pskb_expand_head() which avoids
-+	 * doing so for some cases. So stash the value of truesize
-+	 * at the time we accounted it, and atm_pop_raw() can use
-+	 * that value later, in case it changes.
-+	 */
-+	refcount_add(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
-+	ATM_SKB(skb)->acct_truesize = skb->truesize;
-+	ATM_SKB(skb)->atm_options = vcc->atm_options;
-+}
- 
- static inline void atm_force_charge(struct atm_vcc *vcc,int truesize)
- {
---- a/net/atm/br2684.c
-+++ b/net/atm/br2684.c
-@@ -252,8 +252,7 @@ static int br2684_xmit_vcc(struct sk_buf
- 
- 	ATM_SKB(skb)->vcc = atmvcc = brvcc->atmvcc;
- 	pr_debug("atm_skb(%p)->vcc(%p)->dev(%p)\n", skb, atmvcc, atmvcc->dev);
--	refcount_add(skb->truesize, &sk_atm(atmvcc)->sk_wmem_alloc);
--	ATM_SKB(skb)->atm_options = atmvcc->atm_options;
-+	atm_account_tx(atmvcc, skb);
- 	dev->stats.tx_packets++;
- 	dev->stats.tx_bytes += skb->len;
- 
---- a/net/atm/clip.c
-+++ b/net/atm/clip.c
-@@ -381,8 +381,7 @@ static netdev_tx_t clip_start_xmit(struc
- 		memcpy(here, llc_oui, sizeof(llc_oui));
- 		((__be16 *) here)[3] = skb->protocol;
- 	}
--	refcount_add(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
--	ATM_SKB(skb)->atm_options = vcc->atm_options;
-+	atm_account_tx(vcc, skb);
- 	entry->vccs->last_use = jiffies;
- 	pr_debug("atm_skb(%p)->vcc(%p)->dev(%p)\n", skb, vcc, vcc->dev);
- 	old = xchg(&entry->vccs->xoff, 1);	/* assume XOFF ... */
---- a/net/atm/common.c
-+++ b/net/atm/common.c
-@@ -630,10 +630,9 @@ int vcc_sendmsg(struct socket *sock, str
- 		goto out;
- 	}
- 	pr_debug("%d += %d\n", sk_wmem_alloc_get(sk), skb->truesize);
--	refcount_add(skb->truesize, &sk->sk_wmem_alloc);
-+	atm_account_tx(vcc, skb);
- 
- 	skb->dev = NULL; /* for paths shared with net_device interfaces */
--	ATM_SKB(skb)->atm_options = vcc->atm_options;
- 	if (!copy_from_iter_full(skb_put(skb, size), size, &m->msg_iter)) {
- 		kfree_skb(skb);
- 		error = -EFAULT;
---- a/net/atm/lec.c
-+++ b/net/atm/lec.c
-@@ -182,9 +182,8 @@ lec_send(struct atm_vcc *vcc, struct sk_
- 	struct net_device *dev = skb->dev;
- 
- 	ATM_SKB(skb)->vcc = vcc;
--	ATM_SKB(skb)->atm_options = vcc->atm_options;
-+	atm_account_tx(vcc, skb);
- 
--	refcount_add(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
- 	if (vcc->send(vcc, skb) < 0) {
- 		dev->stats.tx_dropped++;
- 		return;
---- a/net/atm/mpc.c
-+++ b/net/atm/mpc.c
-@@ -555,8 +555,7 @@ static int send_via_shortcut(struct sk_b
- 					sizeof(struct llc_snap_hdr));
- 	}
- 
--	refcount_add(skb->truesize, &sk_atm(entry->shortcut)->sk_wmem_alloc);
--	ATM_SKB(skb)->atm_options = entry->shortcut->atm_options;
-+	atm_account_tx(entry->shortcut, skb);
- 	entry->shortcut->send(entry->shortcut, skb);
- 	entry->packets_fwded++;
- 	mpc->in_ops->put(entry);
---- a/net/atm/pppoatm.c
-+++ b/net/atm/pppoatm.c
-@@ -350,8 +350,7 @@ static int pppoatm_send(struct ppp_chann
- 		return 1;
- 	}
- 
--	refcount_add(skb->truesize, &sk_atm(ATM_SKB(skb)->vcc)->sk_wmem_alloc);
--	ATM_SKB(skb)->atm_options = ATM_SKB(skb)->vcc->atm_options;
-+	atm_account_tx(vcc, skb);
- 	pr_debug("atm_skb(%p)->vcc(%p)->dev(%p)\n",
- 		 skb, ATM_SKB(skb)->vcc, ATM_SKB(skb)->vcc->dev);
- 	ret = ATM_SKB(skb)->vcc->send(ATM_SKB(skb)->vcc, skb)
---- a/net/atm/raw.c
-+++ b/net/atm/raw.c
-@@ -35,8 +35,8 @@ static void atm_pop_raw(struct atm_vcc *
- 	struct sock *sk = sk_atm(vcc);
- 
- 	pr_debug("(%d) %d -= %d\n",
--		 vcc->vci, sk_wmem_alloc_get(sk), skb->truesize);
--	WARN_ON(refcount_sub_and_test(skb->truesize, &sk->sk_wmem_alloc));
-+		 vcc->vci, sk_wmem_alloc_get(sk), ATM_SKB(skb)->acct_truesize);
-+	WARN_ON(refcount_sub_and_test(ATM_SKB(skb)->acct_truesize, &sk->sk_wmem_alloc));
- 	dev_kfree_skb_any(skb);
- 	sk->sk_write_space(sk);
- }
diff --git a/target/linux/generic/backport-4.14/336-v4.15-netfilter-exit_net-cleanup-check-added.patch b/target/linux/generic/backport-4.14/336-v4.15-netfilter-exit_net-cleanup-check-added.patch
index 37975ae038..5c942e3a54 100644
--- a/target/linux/generic/backport-4.14/336-v4.15-netfilter-exit_net-cleanup-check-added.patch
+++ b/target/linux/generic/backport-4.14/336-v4.15-netfilter-exit_net-cleanup-check-added.patch
@@ -62,7 +62,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
  static struct pernet_operations nfnl_log_net_ops = {
 --- a/net/netfilter/nfnetlink_queue.c
 +++ b/net/netfilter/nfnetlink_queue.c
-@@ -1512,10 +1512,15 @@ static int __net_init nfnl_queue_net_ini
+@@ -1515,10 +1515,15 @@ static int __net_init nfnl_queue_net_ini
  
  static void __net_exit nfnl_queue_net_exit(struct net *net)
  {
diff --git a/target/linux/generic/backport-4.14/500-ext4-fix-check-to-prevent-initializing-reserved-inod.patch b/target/linux/generic/backport-4.14/500-ext4-fix-check-to-prevent-initializing-reserved-inod.patch
new file mode 100644
index 0000000000..8e63189e80
--- /dev/null
+++ b/target/linux/generic/backport-4.14/500-ext4-fix-check-to-prevent-initializing-reserved-inod.patch
@@ -0,0 +1,65 @@
+From 5012284700775a4e6e3fbe7eac4c543c4874b559 Mon Sep 17 00:00:00 2001
+From: Theodore Ts'o <tytso@mit.edu>
+Date: Sat, 28 Jul 2018 08:12:04 -0400
+Subject: [PATCH] ext4: fix check to prevent initializing reserved inodes
+
+Commit 8844618d8aa7: "ext4: only look at the bg_flags field if it is
+valid" will complain if block group zero does not have the
+EXT4_BG_INODE_ZEROED flag set.  Unfortunately, this is not correct,
+since a freshly created file system has this flag cleared.  It gets
+almost immediately after the file system is mounted read-write --- but
+the following somewhat unlikely sequence will end up triggering a
+false positive report of a corrupted file system:
+
+   mkfs.ext4 /dev/vdc
+   mount -o ro /dev/vdc /vdc
+   mount -o remount,rw /dev/vdc
+
+Instead, when initializing the inode table for block group zero, test
+to make sure that itable_unused count is not too large, since that is
+the case that will result in some or all of the reserved inodes
+getting cleared.
+
+This fixes the failures reported by Eric Whiteney when running
+generic/230 and generic/231 in the the nojournal test case.
+
+Fixes: 8844618d8aa7 ("ext4: only look at the bg_flags field if it is valid")
+Reported-by: Eric Whitney <enwlinux@gmail.com>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+---
+ fs/ext4/ialloc.c | 5 ++++-
+ fs/ext4/super.c  | 8 +-------
+ 2 files changed, 5 insertions(+), 8 deletions(-)
+
+--- a/fs/ext4/ialloc.c
++++ b/fs/ext4/ialloc.c
+@@ -1394,7 +1394,10 @@ int ext4_init_inode_table(struct super_b
+ 			    ext4_itable_unused_count(sb, gdp)),
+ 			    sbi->s_inodes_per_block);
+ 
+-	if ((used_blks < 0) || (used_blks > sbi->s_itb_per_group)) {
++	if ((used_blks < 0) || (used_blks > sbi->s_itb_per_group) ||
++	    ((group == 0) && ((EXT4_INODES_PER_GROUP(sb) -
++			       ext4_itable_unused_count(sb, gdp)) <
++			      EXT4_FIRST_INO(sb)))) {
+ 		ext4_error(sb, "Something is wrong with group %u: "
+ 			   "used itable blocks: %d; "
+ 			   "itable unused count: %u",
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -3103,14 +3103,8 @@ static ext4_group_t ext4_has_uninit_itab
+ 		if (!gdp)
+ 			continue;
+ 
+-		if (gdp->bg_flags & cpu_to_le16(EXT4_BG_INODE_ZEROED))
+-			continue;
+-		if (group != 0)
++		if (!(gdp->bg_flags & cpu_to_le16(EXT4_BG_INODE_ZEROED)))
+ 			break;
+-		ext4_error(sb, "Inode table for bg 0 marked as "
+-			   "needing zeroing");
+-		if (sb_rdonly(sb))
+-			return ngroups;
+ 	}
+ 
+ 	return group;
diff --git a/target/linux/generic/hack-4.14/207-disable-modorder.patch b/target/linux/generic/hack-4.14/207-disable-modorder.patch
index 5fb956c98d..8e920d1c51 100644
--- a/target/linux/generic/hack-4.14/207-disable-modorder.patch
+++ b/target/linux/generic/hack-4.14/207-disable-modorder.patch
@@ -15,7 +15,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/Makefile
 +++ b/Makefile
-@@ -1227,7 +1227,6 @@ all: modules
+@@ -1228,7 +1228,6 @@ all: modules
  
  PHONY += modules
  modules: $(vmlinux-dirs) $(if $(KBUILD_BUILTIN),vmlinux) modules.builtin
@@ -23,7 +23,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	@$(kecho) '  Building modules, stage 2.';
  	$(Q)$(MAKE) -f $(srctree)/scripts/Makefile.modpost
  
-@@ -1256,7 +1255,6 @@ _modinst_:
+@@ -1257,7 +1256,6 @@ _modinst_:
  		rm -f $(MODLIB)/build ; \
  		ln -s $(CURDIR) $(MODLIB)/build ; \
  	fi
diff --git a/target/linux/generic/hack-4.14/211-host_tools_portability.patch b/target/linux/generic/hack-4.14/211-host_tools_portability.patch
index 59f1479436..d806df8a5f 100644
--- a/target/linux/generic/hack-4.14/211-host_tools_portability.patch
+++ b/target/linux/generic/hack-4.14/211-host_tools_portability.patch
@@ -12,7 +12,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/tools/build/Build.include
 +++ b/tools/build/Build.include
-@@ -97,4 +97,4 @@ cxx_flags = -Wp,-MD,$(depfile) -Wp,-MT,$
+@@ -98,4 +98,4 @@ cxx_flags = -Wp,-MD,$(depfile) -Wp,-MT,$
  ###
  ## HOSTCC C flags
  
diff --git a/target/linux/generic/hack-4.14/220-gc_sections.patch b/target/linux/generic/hack-4.14/220-gc_sections.patch
index 7fd493d2ff..cdca0bdb5f 100644
--- a/target/linux/generic/hack-4.14/220-gc_sections.patch
+++ b/target/linux/generic/hack-4.14/220-gc_sections.patch
@@ -33,7 +33,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
  # Read KERNELRELEASE from include/config/kernel.release (if it exists)
  KERNELRELEASE = $(shell cat include/config/kernel.release 2> /dev/null)
  KERNELVERSION = $(VERSION)$(if $(PATCHLEVEL),.$(PATCHLEVEL)$(if $(SUBLEVEL),.$(SUBLEVEL)))$(EXTRAVERSION)
-@@ -781,11 +786,6 @@ ifdef CONFIG_DEBUG_SECTION_MISMATCH
+@@ -782,11 +787,6 @@ ifdef CONFIG_DEBUG_SECTION_MISMATCH
  KBUILD_CFLAGS += $(call cc-option, -fno-inline-functions-called-once)
  endif
  
diff --git a/target/linux/generic/hack-4.14/902-debloat_proc.patch b/target/linux/generic/hack-4.14/902-debloat_proc.patch
index 3f47d22355..4f5fb7022c 100644
--- a/target/linux/generic/hack-4.14/902-debloat_proc.patch
+++ b/target/linux/generic/hack-4.14/902-debloat_proc.patch
@@ -243,7 +243,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  }
 --- a/mm/vmstat.c
 +++ b/mm/vmstat.c
-@@ -1946,10 +1946,12 @@ void __init init_mm_internals(void)
+@@ -1944,10 +1944,12 @@ void __init init_mm_internals(void)
  	start_shepherd_timer();
  #endif
  #ifdef CONFIG_PROC_FS
diff --git a/target/linux/generic/pending-4.14/0931-w1-gpio-fix-problem-with-platfom-data-in-w1-gpio.patch b/target/linux/generic/pending-4.14/0931-w1-gpio-fix-problem-with-platfom-data-in-w1-gpio.patch
index 5ce2bf87b9..0c4a13f9df 100644
--- a/target/linux/generic/pending-4.14/0931-w1-gpio-fix-problem-with-platfom-data-in-w1-gpio.patch
+++ b/target/linux/generic/pending-4.14/0931-w1-gpio-fix-problem-with-platfom-data-in-w1-gpio.patch
@@ -13,11 +13,9 @@ Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
  drivers/w1/masters/w1-gpio.c | 7 +++----
  1 file changed, 3 insertions(+), 4 deletions(-)
 
-diff --git a/drivers/w1/masters/w1-gpio.c b/drivers/w1/masters/w1-gpio.c
-index a90728ceec5a..7b80762941af 100644
 --- a/drivers/w1/masters/w1-gpio.c
 +++ b/drivers/w1/masters/w1-gpio.c
-@@ -112,17 +112,16 @@ static int w1_gpio_probe_dt(struct platform_device *pdev)
+@@ -112,17 +112,16 @@ static int w1_gpio_probe_dt(struct platf
  static int w1_gpio_probe(struct platform_device *pdev)
  {
  	struct w1_bus_master *master;
@@ -38,6 +36,3 @@ index a90728ceec5a..7b80762941af 100644
  	if (!pdata) {
  		dev_err(&pdev->dev, "No configuration data\n");
  		return -ENXIO;
--- 
-2.14.1
-
diff --git a/target/linux/generic/pending-4.14/102-MIPS-only-process-negative-stack-offsets-on-stack-tr.patch b/target/linux/generic/pending-4.14/102-MIPS-only-process-negative-stack-offsets-on-stack-tr.patch
index cc17053121..b3dc43ea68 100644
--- a/target/linux/generic/pending-4.14/102-MIPS-only-process-negative-stack-offsets-on-stack-tr.patch
+++ b/target/linux/generic/pending-4.14/102-MIPS-only-process-negative-stack-offsets-on-stack-tr.patch
@@ -46,7 +46,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/arch/mips/kernel/process.c
 +++ b/arch/mips/kernel/process.c
-@@ -357,6 +357,8 @@ static inline int is_sp_move_ins(union m
+@@ -358,6 +358,8 @@ static inline int is_sp_move_ins(union m
  
  	if (ip->i_format.opcode == addiu_op ||
  	    ip->i_format.opcode == daddiu_op) {
diff --git a/target/linux/generic/pending-4.14/150-bridge_allow_receiption_on_disabled_port.patch b/target/linux/generic/pending-4.14/150-bridge_allow_receiption_on_disabled_port.patch
index 03267310a0..9fcffdee06 100644
--- a/target/linux/generic/pending-4.14/150-bridge_allow_receiption_on_disabled_port.patch
+++ b/target/linux/generic/pending-4.14/150-bridge_allow_receiption_on_disabled_port.patch
@@ -15,7 +15,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/net/bridge/br_input.c
 +++ b/net/bridge/br_input.c
-@@ -238,7 +238,8 @@ static int br_handle_local_finish(struct
+@@ -239,7 +239,8 @@ static int br_handle_local_finish(struct
  {
  	struct net_bridge_port *p = br_port_get_rcu(skb->dev);
  
@@ -25,7 +25,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  	BR_INPUT_SKB_CB(skb)->brdev = p->br->dev;
  	br_pass_frame_up(skb);
-@@ -326,6 +327,15 @@ rx_handler_result_t br_handle_frame(stru
+@@ -327,6 +328,15 @@ rx_handler_result_t br_handle_frame(stru
  
  forward:
  	switch (p->state) {
diff --git a/target/linux/generic/pending-4.14/170-usb-dwc2-Fix-DMA-alignment-to-start-at-allocated-boun.patch b/target/linux/generic/pending-4.14/170-usb-dwc2-Fix-DMA-alignment-to-start-at-allocated-boun.patch
deleted file mode 100644
index 49b33d514f..0000000000
--- a/target/linux/generic/pending-4.14/170-usb-dwc2-Fix-DMA-alignment-to-start-at-allocated-boun.patch
+++ /dev/null
@@ -1,126 +0,0 @@
-From 028c9191bdf88f120f65626920a6a679170fcc3e Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Antti=20Sepp=C3=A4l=C3=A4?= <a.seppala@gmail.com>
-Date: Thu, 5 Jul 2018 11:37:03 +0300
-Subject: [PATCH 1/2] usb: dwc2: Fix DMA alignment to start at allocated
- boundary
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-The commit 3bc04e28a030 ("usb: dwc2: host: Get aligned DMA in a more
-supported way") introduced a common way to align DMA allocations.
-The code in the commit aligns the struct dma_aligned_buffer but the
-actual DMA address pointed by data[0] gets aligned to an offset from
-the allocated boundary by the kmalloc_ptr and the old_xfer_buffer
-pointers.
-
-This is against the recommendation in Documentation/DMA-API.txt which
-states:
-
-  Therefore, it is recommended that driver writers who don't take
-  special care to determine the cache line size at run time only map
-  virtual regions that begin and end on page boundaries (which are
-  guaranteed also to be cache line boundaries).
-
-The effect of this is that architectures with non-coherent DMA caches
-may run into memory corruption or kernel crashes with Unhandled
-kernel unaligned accesses exceptions.
-
-Fix the alignment by positioning the DMA area in front of the allocation
-and use memory at the end of the area for storing the orginal
-transfer_buffer pointer. This may have the added benefit of increased
-performance as the DMA area is now fully aligned on all architectures.
-
-Tested with Lantiq xRX200 (MIPS) and RPi Model B Rev 2 (ARM).
-
-Fixes: 3bc04e28a030 ("usb: dwc2: host: Get aligned DMA in a more
-supported way")
-
-Signed-off-by: Antti Seppälä <a.seppala@gmail.com>
----
- drivers/usb/dwc2/hcd.c | 44 +++++++++++++++++++++++---------------------
- 1 file changed, 23 insertions(+), 21 deletions(-)
-
---- a/drivers/usb/dwc2/hcd.c
-+++ b/drivers/usb/dwc2/hcd.c
-@@ -2628,34 +2628,29 @@ static void dwc2_hc_init_xfer(struct dwc
- 
- #define DWC2_USB_DMA_ALIGN 4
- 
--struct dma_aligned_buffer {
--	void *kmalloc_ptr;
--	void *old_xfer_buffer;
--	u8 data[0];
--};
--
- static void dwc2_free_dma_aligned_buffer(struct urb *urb)
- {
--	struct dma_aligned_buffer *temp;
-+	void *stored_xfer_buffer;
- 
- 	if (!(urb->transfer_flags & URB_ALIGNED_TEMP_BUFFER))
- 		return;
- 
--	temp = container_of(urb->transfer_buffer,
--			    struct dma_aligned_buffer, data);
-+	/* Restore urb->transfer_buffer from the end of the allocated area */
-+	memcpy(&stored_xfer_buffer, urb->transfer_buffer +
-+	       urb->transfer_buffer_length, sizeof(urb->transfer_buffer));
- 
- 	if (usb_urb_dir_in(urb))
--		memcpy(temp->old_xfer_buffer, temp->data,
-+		memcpy(stored_xfer_buffer, urb->transfer_buffer,
- 		       urb->transfer_buffer_length);
--	urb->transfer_buffer = temp->old_xfer_buffer;
--	kfree(temp->kmalloc_ptr);
-+	kfree(urb->transfer_buffer);
-+	urb->transfer_buffer = stored_xfer_buffer;
- 
- 	urb->transfer_flags &= ~URB_ALIGNED_TEMP_BUFFER;
- }
- 
- static int dwc2_alloc_dma_aligned_buffer(struct urb *urb, gfp_t mem_flags)
- {
--	struct dma_aligned_buffer *temp, *kmalloc_ptr;
-+	void *kmalloc_ptr;
- 	size_t kmalloc_size;
- 
- 	if (urb->num_sgs || urb->sg ||
-@@ -2663,22 +2658,29 @@ static int dwc2_alloc_dma_aligned_buffer
- 	    !((uintptr_t)urb->transfer_buffer & (DWC2_USB_DMA_ALIGN - 1)))
- 		return 0;
- 
--	/* Allocate a buffer with enough padding for alignment */
-+	/*
-+	 * Allocate a buffer with enough padding for original transfer_buffer
-+	 * pointer. This allocation is guaranteed to be aligned properly for
-+	 * DMA
-+	 */
- 	kmalloc_size = urb->transfer_buffer_length +
--		sizeof(struct dma_aligned_buffer) + DWC2_USB_DMA_ALIGN - 1;
-+		sizeof(urb->transfer_buffer);
- 
- 	kmalloc_ptr = kmalloc(kmalloc_size, mem_flags);
- 	if (!kmalloc_ptr)
- 		return -ENOMEM;
- 
--	/* Position our struct dma_aligned_buffer such that data is aligned */
--	temp = PTR_ALIGN(kmalloc_ptr + 1, DWC2_USB_DMA_ALIGN) - 1;
--	temp->kmalloc_ptr = kmalloc_ptr;
--	temp->old_xfer_buffer = urb->transfer_buffer;
-+	/*
-+	 * Position value of original urb->transfer_buffer pointer to the end
-+	 * of allocation for later referencing
-+	 */
-+	memcpy(kmalloc_ptr + urb->transfer_buffer_length,
-+	       &urb->transfer_buffer, sizeof(urb->transfer_buffer));
-+
- 	if (usb_urb_dir_out(urb))
--		memcpy(temp->data, urb->transfer_buffer,
-+		memcpy(kmalloc_ptr, urb->transfer_buffer,
- 		       urb->transfer_buffer_length);
--	urb->transfer_buffer = temp->data;
-+	urb->transfer_buffer = kmalloc_ptr;
- 
- 	urb->transfer_flags |= URB_ALIGNED_TEMP_BUFFER;
- 
diff --git a/target/linux/generic/pending-4.14/201-extra_optimization.patch b/target/linux/generic/pending-4.14/201-extra_optimization.patch
index 445c0bd87d..b40f01d41f 100644
--- a/target/linux/generic/pending-4.14/201-extra_optimization.patch
+++ b/target/linux/generic/pending-4.14/201-extra_optimization.patch
@@ -14,7 +14,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/Makefile
 +++ b/Makefile
-@@ -645,12 +645,12 @@ KBUILD_CFLAGS	+= $(call cc-disable-warni
+@@ -646,12 +646,12 @@ KBUILD_CFLAGS	+= $(call cc-disable-warni
  
  ifdef CONFIG_CC_OPTIMIZE_FOR_SIZE
  KBUILD_CFLAGS	+= $(call cc-option,-Oz,-Os)
diff --git a/target/linux/generic/pending-4.14/610-netfilter_match_bypass_default_checks.patch b/target/linux/generic/pending-4.14/610-netfilter_match_bypass_default_checks.patch
index 3611879609..2541230ff5 100644
--- a/target/linux/generic/pending-4.14/610-netfilter_match_bypass_default_checks.patch
+++ b/target/linux/generic/pending-4.14/610-netfilter_match_bypass_default_checks.patch
@@ -68,7 +68,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	if (!xt_percpu_counter_alloc(alloc_state, &e->counters))
  		return -ENOMEM;
  
-@@ -817,6 +845,7 @@ copy_entries_to_user(unsigned int total_
+@@ -818,6 +846,7 @@ copy_entries_to_user(unsigned int total_
  	const struct xt_table_info *private = table->private;
  	int ret = 0;
  	const void *loc_cpu_entry;
@@ -76,7 +76,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  	counters = alloc_counters(table);
  	if (IS_ERR(counters))
-@@ -844,6 +873,14 @@ copy_entries_to_user(unsigned int total_
+@@ -845,6 +874,14 @@ copy_entries_to_user(unsigned int total_
  			goto free_counters;
  		}
  
@@ -91,7 +91,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  		for (i = sizeof(struct ipt_entry);
  		     i < e->target_offset;
  		     i += m->u.match_size) {
-@@ -1226,12 +1263,15 @@ compat_copy_entry_to_user(struct ipt_ent
+@@ -1227,12 +1264,15 @@ compat_copy_entry_to_user(struct ipt_ent
  	compat_uint_t origsize;
  	const struct xt_entry_match *ematch;
  	int ret = 0;
diff --git a/target/linux/generic/pending-4.14/630-packet_socket_type.patch b/target/linux/generic/pending-4.14/630-packet_socket_type.patch
index e1736214f5..82e2c51afd 100644
--- a/target/linux/generic/pending-4.14/630-packet_socket_type.patch
+++ b/target/linux/generic/pending-4.14/630-packet_socket_type.patch
@@ -87,7 +87,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	if (!net_eq(dev_net(dev), sock_net(sk)))
  		goto drop;
  
-@@ -3262,6 +3264,7 @@ static int packet_create(struct net *net
+@@ -3260,6 +3262,7 @@ static int packet_create(struct net *net
  	mutex_init(&po->pg_vec_lock);
  	po->rollover = NULL;
  	po->prot_hook.func = packet_rcv;
@@ -95,7 +95,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  	if (sock->type == SOCK_PACKET)
  		po->prot_hook.func = packet_rcv_spkt;
-@@ -3875,6 +3878,16 @@ packet_setsockopt(struct socket *sock, i
+@@ -3873,6 +3876,16 @@ packet_setsockopt(struct socket *sock, i
  		po->xmit = val ? packet_direct_xmit : dev_queue_xmit;
  		return 0;
  	}
@@ -112,7 +112,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	default:
  		return -ENOPROTOOPT;
  	}
-@@ -3927,6 +3940,13 @@ static int packet_getsockopt(struct sock
+@@ -3925,6 +3938,13 @@ static int packet_getsockopt(struct sock
  	case PACKET_VNET_HDR:
  		val = po->has_vnet_hdr;
  		break;
diff --git a/target/linux/generic/pending-4.14/834-ledtrig-libata.patch b/target/linux/generic/pending-4.14/834-ledtrig-libata.patch
index 280536e1e6..2eec024b72 100644
--- a/target/linux/generic/pending-4.14/834-ledtrig-libata.patch
+++ b/target/linux/generic/pending-4.14/834-ledtrig-libata.patch
@@ -65,7 +65,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  /**
   *	ata_build_rw_tf - Build ATA taskfile for given read/write request
   *	@tf: Target ATA taskfile
-@@ -5117,6 +5130,9 @@ struct ata_queued_cmd *ata_qc_new_init(s
+@@ -5120,6 +5133,9 @@ struct ata_queued_cmd *ata_qc_new_init(s
  		if (tag < 0)
  			return NULL;
  	}
@@ -75,7 +75,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  
  	qc = __ata_qc_from_tag(ap, tag);
  	qc->tag = tag;
-@@ -6018,6 +6034,9 @@ struct ata_port *ata_port_alloc(struct a
+@@ -6021,6 +6037,9 @@ struct ata_port *ata_port_alloc(struct a
  	ap->stats.unhandled_irq = 1;
  	ap->stats.idle_irq = 1;
  #endif
@@ -85,7 +85,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  	ata_sff_port_init(ap);
  
  	return ap;
-@@ -6039,6 +6058,12 @@ static void ata_host_release(struct devi
+@@ -6042,6 +6061,12 @@ static void ata_host_release(struct devi
  
  		kfree(ap->pmp_link);
  		kfree(ap->slave_link);
@@ -98,7 +98,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  		kfree(ap);
  		host->ports[i] = NULL;
  	}
-@@ -6485,7 +6510,23 @@ int ata_host_register(struct ata_host *h
+@@ -6488,7 +6513,23 @@ int ata_host_register(struct ata_host *h
  		host->ports[i]->print_id = atomic_inc_return(&ata_print_id);
  		host->ports[i]->local_port_no = i + 1;
  	}
@@ -134,7 +134,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  
  /*
   * Define if arch has non-standard setup.  This is a _PCI_ standard
-@@ -889,6 +892,12 @@ struct ata_port {
+@@ -890,6 +893,12 @@ struct ata_port {
  #ifdef CONFIG_ATA_ACPI
  	struct ata_acpi_gtm	__acpi_init_gtm; /* use ata_acpi_init_gtm() */
  #endif
diff --git a/target/linux/generic/pending-4.14/900-gen_stats-fix-netlink-stats-padding.patch b/target/linux/generic/pending-4.14/900-gen_stats-fix-netlink-stats-padding.patch
deleted file mode 100644
index f5ceecca93..0000000000
--- a/target/linux/generic/pending-4.14/900-gen_stats-fix-netlink-stats-padding.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-The gen_stats facility will add a header for the toplevel nlattr of type
-TCA_STATS2 that contains all stats added by qdisc callbacks. A reference
-to this header is stored in the gnet_dump struct, and when all the
-per-qdisc callbacks have finished adding their stats, the length of the
-containing header will be adjusted to the right value.
-
-However, on architectures that need padding (i.e., that don't set
-CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS), the padding nlattr is added
-before the stats, which means that the stored pointer will point to the
-padding, and so when the header is fixed up, the result is just a very
-big padding nlattr. Because most qdiscs also supply the legacy TCA_STATS
-struct, this problem has been mostly invisible, but we exposed it with
-the netlink attribute-based statistics in CAKE.
-
-Fix the issue by fixing up the stored pointer if it points to a padding
-nlattr.
-
-Tested-by: Pete Heist <pete@heistp.net>
-Tested-by: Kevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk>
-Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
----
- net/core/gen_stats.c |   16 ++++++++++++++--
- 1 file changed, 14 insertions(+), 2 deletions(-)
-
---- a/net/core/gen_stats.c
-+++ b/net/core/gen_stats.c
-@@ -77,8 +77,20 @@ gnet_stats_start_copy_compat(struct sk_b
- 		d->lock = lock;
- 		spin_lock_bh(lock);
- 	}
--	if (d->tail)
--		return gnet_stats_copy(d, type, NULL, 0, padattr);
-+	if (d->tail) {
-+		int ret = gnet_stats_copy(d, type, NULL, 0, padattr);
-+
-+		/* The initial attribute added in gnet_stats_copy() may be
-+		 * preceded by a padding attribute, in which case d->tail will
-+		 * end up pointing at the padding instead of the real attribute.
-+		 * Fix this so gnet_stats_finish_copy() adjusts the length of
-+		 * the right attribute.
-+		 */
-+		if (ret == 0 && d->tail->nla_type == padattr)
-+			d->tail = (struct nlattr *)((char *)d->tail +
-+						    NLA_ALIGN(d->tail->nla_len));
-+		return ret;
-+	}
- 
- 	return 0;
- }