kernel: bump 4.9 to 4.9.77

Refresh patches.
Remove upstreamed patches:

target/linux/generic/backport-4.9/023-2-smsc75xx-use-skb_cow_head-to-deal-with-cloned-skbs.patch
target/linux/generic/backport-4.9/023-3-cx82310_eth-use-skb_cow_head-to-deal-with-cloned-skb.patch
target/linux/generic/backport-4.9/023-4-sr9700-use-skb_cow_head-to-deal-with-cloned-skbs.patch
target/linux/generic/backport-4.9/023-5-lan78xx-use-skb_cow_head-to-deal-with-cloned-skbs.patch

CVEs completely or partially addressed:

CVE-2017-5715
CVE-2017-5753
CVE-2017-17741
CVE-2017-1000410

Compile-tested: ar71xx Archer C7 v2
Run-tested: ar71xx Archer C7 v2

Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
Tested-by: Koen Vandeputte <koen.vandeputte@ncentric.com>

11 files changed, 21 insertions, 167 deletions

diff --git a/target/linux/generic/backport-4.9/023-2-smsc75xx-use-skb_cow_head-to-deal-with-cloned-skbs.patch b/target/linux/generic/backport-4.9/023-2-smsc75xx-use-skb_cow_head-to-deal-with-cloned-skbs.patch
deleted file mode 100644
index 99d98e101c..0000000000
--- a/target/linux/generic/backport-4.9/023-2-smsc75xx-use-skb_cow_head-to-deal-with-cloned-skbs.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From b7c6d2675899cfff0180412c63fc9cbd5bacdb4d Mon Sep 17 00:00:00 2001
-From: Eric Dumazet <edumazet@google.com>
-Date: Wed, 19 Apr 2017 09:59:21 -0700
-Subject: [PATCH] smsc75xx: use skb_cow_head() to deal with cloned skbs
-
-We need to ensure there is enough headroom to push extra header,
-but we also need to check if we are allowed to change headers.
-
-skb_cow_head() is the proper helper to deal with this.
-
-Fixes: d0cad871703b ("smsc75xx: SMSC LAN75xx USB gigabit ethernet adapter driver")
-Signed-off-by: Eric Dumazet <edumazet@google.com>
-Cc: James Hughes <james.hughes@raspberrypi.org>
-Signed-off-by: David S. Miller <davem@davemloft.net>
----
- drivers/net/usb/smsc75xx.c | 8 ++------
- 1 file changed, 2 insertions(+), 6 deletions(-)
-
---- a/drivers/net/usb/smsc75xx.c
-+++ b/drivers/net/usb/smsc75xx.c
-@@ -2205,13 +2205,9 @@ static struct sk_buff *smsc75xx_tx_fixup
- {
- 	u32 tx_cmd_a, tx_cmd_b;
- 
--	if (skb_headroom(skb) < SMSC75XX_TX_OVERHEAD) {
--		struct sk_buff *skb2 =
--			skb_copy_expand(skb, SMSC75XX_TX_OVERHEAD, 0, flags);
-+	if (skb_cow_head(skb, SMSC75XX_TX_OVERHEAD)) {
- 		dev_kfree_skb_any(skb);
--		skb = skb2;
--		if (!skb)
--			return NULL;
-+		return NULL;
- 	}
- 
- 	tx_cmd_a = (u32)(skb->len & TX_CMD_A_LEN) | TX_CMD_A_FCS;
diff --git a/target/linux/generic/backport-4.9/023-3-cx82310_eth-use-skb_cow_head-to-deal-with-cloned-skb.patch b/target/linux/generic/backport-4.9/023-3-cx82310_eth-use-skb_cow_head-to-deal-with-cloned-skb.patch
deleted file mode 100644
index aee8aa9805..0000000000
--- a/target/linux/generic/backport-4.9/023-3-cx82310_eth-use-skb_cow_head-to-deal-with-cloned-skb.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-From a9e840a2081ed28c2b7caa6a9a0041c950b3c37d Mon Sep 17 00:00:00 2001
-From: Eric Dumazet <edumazet@google.com>
-Date: Wed, 19 Apr 2017 09:59:22 -0700
-Subject: [PATCH] cx82310_eth: use skb_cow_head() to deal with cloned skbs
-
-We need to ensure there is enough headroom to push extra header,
-but we also need to check if we are allowed to change headers.
-
-skb_cow_head() is the proper helper to deal with this.
-
-Fixes: cc28a20e77b2 ("introduce cx82310_eth: Conexant CX82310-based ADSL router USB ethernet driver")
-Signed-off-by: Eric Dumazet <edumazet@google.com>
-Cc: James Hughes <james.hughes@raspberrypi.org>
-Signed-off-by: David S. Miller <davem@davemloft.net>
----
- drivers/net/usb/cx82310_eth.c | 7 ++-----
- 1 file changed, 2 insertions(+), 5 deletions(-)
-
---- a/drivers/net/usb/cx82310_eth.c
-+++ b/drivers/net/usb/cx82310_eth.c
-@@ -293,12 +293,9 @@ static struct sk_buff *cx82310_tx_fixup(
- {
- 	int len = skb->len;
- 
--	if (skb_headroom(skb) < 2) {
--		struct sk_buff *skb2 = skb_copy_expand(skb, 2, 0, flags);
-+	if (skb_cow_head(skb, 2)) {
- 		dev_kfree_skb_any(skb);
--		skb = skb2;
--		if (!skb)
--			return NULL;
-+		return NULL;
- 	}
- 	skb_push(skb, 2);
- 
diff --git a/target/linux/generic/backport-4.9/023-4-sr9700-use-skb_cow_head-to-deal-with-cloned-skbs.patch b/target/linux/generic/backport-4.9/023-4-sr9700-use-skb_cow_head-to-deal-with-cloned-skbs.patch
deleted file mode 100644
index 4d0fcf6fc2..0000000000
--- a/target/linux/generic/backport-4.9/023-4-sr9700-use-skb_cow_head-to-deal-with-cloned-skbs.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From d532c1082f68176363ed766d09bf187616e282fe Mon Sep 17 00:00:00 2001
-From: Eric Dumazet <edumazet@google.com>
-Date: Wed, 19 Apr 2017 09:59:23 -0700
-Subject: [PATCH] sr9700: use skb_cow_head() to deal with cloned skbs
-
-We need to ensure there is enough headroom to push extra header,
-but we also need to check if we are allowed to change headers.
-
-skb_cow_head() is the proper helper to deal with this.
-
-Fixes: c9b37458e956 ("USB2NET : SR9700 : One chip USB 1.1 USB2NET SR9700Device Driver Support")
-Signed-off-by: Eric Dumazet <edumazet@google.com>
-Cc: James Hughes <james.hughes@raspberrypi.org>
-Signed-off-by: David S. Miller <davem@davemloft.net>
----
- drivers/net/usb/sr9700.c | 9 ++-------
- 1 file changed, 2 insertions(+), 7 deletions(-)
-
---- a/drivers/net/usb/sr9700.c
-+++ b/drivers/net/usb/sr9700.c
-@@ -456,14 +456,9 @@ static struct sk_buff *sr9700_tx_fixup(s
- 
- 	len = skb->len;
- 
--	if (skb_headroom(skb) < SR_TX_OVERHEAD) {
--		struct sk_buff *skb2;
--
--		skb2 = skb_copy_expand(skb, SR_TX_OVERHEAD, 0, flags);
-+	if (skb_cow_head(skb, SR_TX_OVERHEAD)) {
- 		dev_kfree_skb_any(skb);
--		skb = skb2;
--		if (!skb)
--			return NULL;
-+		return NULL;
- 	}
- 
- 	__skb_push(skb, SR_TX_OVERHEAD);
diff --git a/target/linux/generic/backport-4.9/023-5-lan78xx-use-skb_cow_head-to-deal-with-cloned-skbs.patch b/target/linux/generic/backport-4.9/023-5-lan78xx-use-skb_cow_head-to-deal-with-cloned-skbs.patch
deleted file mode 100644
index ea8279940b..0000000000
--- a/target/linux/generic/backport-4.9/023-5-lan78xx-use-skb_cow_head-to-deal-with-cloned-skbs.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From d4ca73591916b760478d2b04334d5dcadc028e9c Mon Sep 17 00:00:00 2001
-From: Eric Dumazet <edumazet@google.com>
-Date: Wed, 19 Apr 2017 09:59:24 -0700
-Subject: [PATCH] lan78xx: use skb_cow_head() to deal with cloned skbs
-
-We need to ensure there is enough headroom to push extra header,
-but we also need to check if we are allowed to change headers.
-
-skb_cow_head() is the proper helper to deal with this.
-
-Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver")
-Signed-off-by: Eric Dumazet <edumazet@google.com>
-Cc: James Hughes <james.hughes@raspberrypi.org>
-Cc: Woojung Huh <woojung.huh@microchip.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
----
- drivers/net/usb/lan78xx.c | 9 ++-------
- 1 file changed, 2 insertions(+), 7 deletions(-)
-
---- a/drivers/net/usb/lan78xx.c
-+++ b/drivers/net/usb/lan78xx.c
-@@ -2419,14 +2419,9 @@ static struct sk_buff *lan78xx_tx_prep(s
- {
- 	u32 tx_cmd_a, tx_cmd_b;
- 
--	if (skb_headroom(skb) < TX_OVERHEAD) {
--		struct sk_buff *skb2;
--
--		skb2 = skb_copy_expand(skb, TX_OVERHEAD, 0, flags);
-+	if (skb_cow_head(skb, TX_OVERHEAD)) {
- 		dev_kfree_skb_any(skb);
--		skb = skb2;
--		if (!skb)
--			return NULL;
-+		return NULL;
- 	}
- 
- 	if (lan78xx_linearize(skb) < 0)
diff --git a/target/linux/generic/backport-4.9/090-net-generalize-napi_complete_done.patch b/target/linux/generic/backport-4.9/090-net-generalize-napi_complete_done.patch
index aaa7435196..5c6e334b19 100644
--- a/target/linux/generic/backport-4.9/090-net-generalize-napi_complete_done.patch
+++ b/target/linux/generic/backport-4.9/090-net-generalize-napi_complete_done.patch
@@ -1095,7 +1095,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  		dma_intr_ena = smsc9420_reg_read(pd, DMAC_INTR_ENA);
 --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
 +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
-@@ -2678,7 +2678,7 @@ static int stmmac_poll(struct napi_struc
+@@ -2684,7 +2684,7 @@ static int stmmac_poll(struct napi_struc
  
  	work_done = stmmac_rx(priv, budget);
  	if (work_done < budget) {
diff --git a/target/linux/generic/hack-4.9/204-module_strip.patch b/target/linux/generic/hack-4.9/204-module_strip.patch
index fd07cca066..e36846adb8 100644
--- a/target/linux/generic/hack-4.9/204-module_strip.patch
+++ b/target/linux/generic/hack-4.9/204-module_strip.patch
@@ -137,7 +137,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  		add_taint_module(mod, TAINT_CRAP, LOCKDEP_STILL_OK);
 --- a/scripts/mod/modpost.c
 +++ b/scripts/mod/modpost.c
-@@ -1964,7 +1964,9 @@ static void read_symbols(char *modname)
+@@ -1965,7 +1965,9 @@ static void read_symbols(char *modname)
  		symname = remove_dot(info.strtab + sym->st_name);
  
  		handle_modversions(mod, &info, sym, symname);
@@ -147,7 +147,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	}
  	if (!is_vmlinux(modname) ||
  	     (is_vmlinux(modname) && vmlinux_section_warnings))
-@@ -2108,7 +2110,9 @@ static void add_header(struct buffer *b,
+@@ -2109,7 +2111,9 @@ static void add_header(struct buffer *b,
  	buf_printf(b, "#include <linux/vermagic.h>\n");
  	buf_printf(b, "#include <linux/compiler.h>\n");
  	buf_printf(b, "\n");
@@ -157,7 +157,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	buf_printf(b, "\n");
  	buf_printf(b, "__visible struct module __this_module\n");
  	buf_printf(b, "__attribute__((section(\".gnu.linkonce.this_module\"))) = {\n");
-@@ -2125,16 +2129,20 @@ static void add_header(struct buffer *b,
+@@ -2126,16 +2130,20 @@ static void add_header(struct buffer *b,
  
  static void add_intree_flag(struct buffer *b, int is_intree)
  {
@@ -178,7 +178,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  }
  
  /* In kernel, this size is defined in linux/module.h;
-@@ -2238,11 +2246,13 @@ static void add_depends(struct buffer *b
+@@ -2239,11 +2247,13 @@ static void add_depends(struct buffer *b
  
  static void add_srcversion(struct buffer *b, struct module *mod)
  {
@@ -192,7 +192,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  }
  
  static void write_if_changed(struct buffer *b, const char *fname)
-@@ -2476,7 +2486,9 @@ int main(int argc, char **argv)
+@@ -2477,7 +2487,9 @@ int main(int argc, char **argv)
  		add_staging_flag(&buf, mod->name);
  		err |= add_versions(&buf, mod);
  		add_depends(&buf, mod, modules);
diff --git a/target/linux/generic/hack-4.9/710-phy-add-mdio_register_board_info.patch b/target/linux/generic/hack-4.9/710-phy-add-mdio_register_board_info.patch
index 55607bc6ea..217cf4a486 100644
--- a/target/linux/generic/hack-4.9/710-phy-add-mdio_register_board_info.patch
+++ b/target/linux/generic/hack-4.9/710-phy-add-mdio_register_board_info.patch
@@ -50,7 +50,7 @@
  		phy_device_free(phydev);
 --- a/include/linux/phy.h
 +++ b/include/linux/phy.h
-@@ -859,6 +859,23 @@ void mdio_bus_exit(void);
+@@ -870,6 +870,23 @@ void mdio_bus_exit(void);
  
  extern struct bus_type mdio_bus_type;
  
diff --git a/target/linux/generic/hack-4.9/904-debloat_dma_buf.patch b/target/linux/generic/hack-4.9/904-debloat_dma_buf.patch
index 4f432c3568..81db6dcb3e 100644
--- a/target/linux/generic/hack-4.9/904-debloat_dma_buf.patch
+++ b/target/linux/generic/hack-4.9/904-debloat_dma_buf.patch
@@ -13,7 +13,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/drivers/base/Kconfig
 +++ b/drivers/base/Kconfig
-@@ -241,7 +241,7 @@ config SOC_BUS
+@@ -244,7 +244,7 @@ config SOC_BUS
  source "drivers/base/regmap/Kconfig"
  
  config DMA_SHARED_BUFFER
diff --git a/target/linux/generic/pending-4.9/470-mtd-spi-nor-support-limiting-4K-sectors-support-base.patch b/target/linux/generic/pending-4.9/470-mtd-spi-nor-support-limiting-4K-sectors-support-base.patch
index 1c5b9c3b26..e1c1de3602 100644
--- a/target/linux/generic/pending-4.9/470-mtd-spi-nor-support-limiting-4K-sectors-support-base.patch
+++ b/target/linux/generic/pending-4.9/470-mtd-spi-nor-support-limiting-4K-sectors-support-base.patch
@@ -39,7 +39,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	depends on ARCH_AT91 || (ARM && COMPILE_TEST)
 --- a/drivers/mtd/spi-nor/spi-nor.c
 +++ b/drivers/mtd/spi-nor/spi-nor.c
-@@ -1640,10 +1640,12 @@ int spi_nor_scan(struct spi_nor *nor, co
+@@ -1642,10 +1642,12 @@ int spi_nor_scan(struct spi_nor *nor, co
  
  #ifdef CONFIG_MTD_SPI_NOR_USE_4K_SECTORS
  	/* prefer "small sector" erase if possible */
diff --git a/target/linux/generic/pending-4.9/666-Add-support-for-MAP-E-FMRs-mesh-mode.patch b/target/linux/generic/pending-4.9/666-Add-support-for-MAP-E-FMRs-mesh-mode.patch
index ee58c2c5e9..0941b79b66 100644
--- a/target/linux/generic/pending-4.9/666-Add-support-for-MAP-E-FMRs-mesh-mode.patch
+++ b/target/linux/generic/pending-4.9/666-Add-support-for-MAP-E-FMRs-mesh-mode.patch
@@ -300,7 +300,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  /**
   * ip6_tnl_addr_conflict - compare packet addresses to tunnel's own
   *   @t: the outgoing tunnel device
-@@ -1286,6 +1426,7 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, str
+@@ -1287,6 +1427,7 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, str
  {
  	struct ip6_tnl *t = netdev_priv(dev);
  	struct ipv6hdr *ipv6h = ipv6_hdr(skb);
@@ -308,7 +308,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  	int encap_limit = -1;
  	__u16 offset;
  	struct flowi6 fl6;
-@@ -1344,6 +1485,18 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, str
+@@ -1345,6 +1486,18 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, str
  			fl6.flowi6_mark = skb->mark;
  	}
  
@@ -327,7 +327,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  	if (iptunnel_handle_offloads(skb, SKB_GSO_IPXIP6))
  		return -1;
  
-@@ -1471,6 +1624,14 @@ ip6_tnl_change(struct ip6_tnl *t, const
+@@ -1472,6 +1625,14 @@ ip6_tnl_change(struct ip6_tnl *t, const
  	t->parms.flowinfo = p->flowinfo;
  	t->parms.link = p->link;
  	t->parms.proto = p->proto;
@@ -342,7 +342,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  	dst_cache_reset(&t->dst_cache);
  	ip6_tnl_link_config(t);
  	return 0;
-@@ -1509,6 +1670,7 @@ ip6_tnl_parm_from_user(struct __ip6_tnl_
+@@ -1510,6 +1671,7 @@ ip6_tnl_parm_from_user(struct __ip6_tnl_
  	p->flowinfo = u->flowinfo;
  	p->link = u->link;
  	p->proto = u->proto;
@@ -350,7 +350,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  	memcpy(p->name, u->name, sizeof(u->name));
  }
  
-@@ -1886,6 +2048,15 @@ static int ip6_tnl_validate(struct nlatt
+@@ -1887,6 +2049,15 @@ static int ip6_tnl_validate(struct nlatt
  	return 0;
  }
  
@@ -366,7 +366,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  static void ip6_tnl_netlink_parms(struct nlattr *data[],
  				  struct __ip6_tnl_parm *parms)
  {
-@@ -1920,6 +2091,46 @@ static void ip6_tnl_netlink_parms(struct
+@@ -1921,6 +2092,46 @@ static void ip6_tnl_netlink_parms(struct
  
  	if (data[IFLA_IPTUN_COLLECT_METADATA])
  		parms->collect_md = true;
@@ -413,7 +413,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  }
  
  static bool ip6_tnl_netlink_encap_parms(struct nlattr *data[],
-@@ -2029,6 +2240,12 @@ static void ip6_tnl_dellink(struct net_d
+@@ -2030,6 +2241,12 @@ static void ip6_tnl_dellink(struct net_d
  
  static size_t ip6_tnl_get_size(const struct net_device *dev)
  {
@@ -426,7 +426,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  	return
  		/* IFLA_IPTUN_LINK */
  		nla_total_size(4) +
-@@ -2056,6 +2273,24 @@ static size_t ip6_tnl_get_size(const str
+@@ -2057,6 +2274,24 @@ static size_t ip6_tnl_get_size(const str
  		nla_total_size(2) +
  		/* IFLA_IPTUN_COLLECT_METADATA */
  		nla_total_size(0) +
@@ -451,7 +451,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  		0;
  }
  
-@@ -2063,6 +2298,9 @@ static int ip6_tnl_fill_info(struct sk_b
+@@ -2064,6 +2299,9 @@ static int ip6_tnl_fill_info(struct sk_b
  {
  	struct ip6_tnl *tunnel = netdev_priv(dev);
  	struct __ip6_tnl_parm *parm = &tunnel->parms;
@@ -461,7 +461,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  
  	if (nla_put_u32(skb, IFLA_IPTUN_LINK, parm->link) ||
  	    nla_put_in6_addr(skb, IFLA_IPTUN_LOCAL, &parm->laddr) ||
-@@ -2071,9 +2309,27 @@ static int ip6_tnl_fill_info(struct sk_b
+@@ -2072,9 +2310,27 @@ static int ip6_tnl_fill_info(struct sk_b
  	    nla_put_u8(skb, IFLA_IPTUN_ENCAP_LIMIT, parm->encap_limit) ||
  	    nla_put_be32(skb, IFLA_IPTUN_FLOWINFO, parm->flowinfo) ||
  	    nla_put_u32(skb, IFLA_IPTUN_FLAGS, parm->flags) ||
@@ -490,7 +490,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  	if (nla_put_u16(skb, IFLA_IPTUN_ENCAP_TYPE, tunnel->encap.type) ||
  	    nla_put_be16(skb, IFLA_IPTUN_ENCAP_SPORT, tunnel->encap.sport) ||
  	    nla_put_be16(skb, IFLA_IPTUN_ENCAP_DPORT, tunnel->encap.dport) ||
-@@ -2111,6 +2367,7 @@ static const struct nla_policy ip6_tnl_p
+@@ -2112,6 +2368,7 @@ static const struct nla_policy ip6_tnl_p
  	[IFLA_IPTUN_ENCAP_SPORT]	= { .type = NLA_U16 },
  	[IFLA_IPTUN_ENCAP_DPORT]	= { .type = NLA_U16 },
  	[IFLA_IPTUN_COLLECT_METADATA]	= { .type = NLA_FLAG },
diff --git a/target/linux/generic/pending-4.9/701-phy_extension.patch b/target/linux/generic/pending-4.9/701-phy_extension.patch
index b480b1d78d..4569336bf3 100644
--- a/target/linux/generic/pending-4.9/701-phy_extension.patch
+++ b/target/linux/generic/pending-4.9/701-phy_extension.patch
@@ -62,7 +62,7 @@ Signed-off-by: John Crispin <john@phrozen.org>
   * @phydev: the phy_device struct
 --- a/include/linux/phy.h
 +++ b/include/linux/phy.h
-@@ -816,6 +816,7 @@ int phy_ethtool_ksettings_get(struct phy
+@@ -827,6 +827,7 @@ int phy_ethtool_ksettings_get(struct phy
  			      struct ethtool_link_ksettings *cmd);
  int phy_ethtool_ksettings_set(struct phy_device *phydev,
  			      const struct ethtool_link_ksettings *cmd);