aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* kernel: bump 4.14 to 4.14.232Koen Vandeputte2021-05-104-7/+7
| | | | | | | | | | | | Refreshed all patches. Fixes: - CVE-2021-23133 Compile-tested on: ar71xx, cns3xxx, imx6, x86_64 Runtime-tested on: ar71xx, cns3xxx, imx6 Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* Extend checks on build prerequisites for building OpenWRT coreBas Mevissen2021-05-081-1/+12
| | | | | | | | | | | | | | OpenWRT requires a number of Perl modules to be installed. It wasn't checking on all of them. This patch adds checks for Perl FindBin, File::Copy, File::Compare and Thread::Queue modules. Failing to install these, will have the build break at some point. By adding these to the prereq-build.mk script, they are checked on forehand. Tested on a Fedora 33 and 34 (beta) that was freshly installed. Fedora appears to break up Perl modules into small packages that need to be installed for the build to succeed. Signed-off-by: Bas Mevissen <abuse@basmevissen.nl> (cherry picked from commit f68c9474acf9a65b5a9538db8e45c173462487e3)
* prereq-build: test for perl's Data::DumperRosen Penev2021-05-081-0/+4
| | | | | | | | | | | | | | | | | | | | | | | Required for installation of autoconf: make[5]: Entering directory `/openwrt/build_dir/host/autoconf-2.69' Making all in bin make[6]: Entering directory `/openwrt/build_dir/host/autoconf-2.69/bin' autom4te_perllibdir='..'/lib AUTOM4TE_CFG='../lib/autom4te.cfg' ../bin/autom4te -B '..'/lib -B '..'/lib --language M4sh --cache '' --melt ./autoconf.as -o autoconf.in Can't locate Data/Dumper.pm in @INC (@INC contains: ../lib /usr/local/lib64/perl5 /usr/local/share/perl5 /usr/lib64/perl5/vendor_perl /usr/share/perl5/vendor_perl /usr/lib64/perl5 /usr/share/perl5 .) at ../lib/Autom4te/C4che.pm line 33. BEGIN failed--compilation aborted at ../lib/Autom4te/C4che.pm line 33. Compilation failed in require at ../bin/autom4te line 40. BEGIN failed--compilation aborted at ../bin/autom4te line 40. make[6]: *** [autoconf.in] Error 2 Signed-off-by: Rosen Penev <rosenp@gmail.com> (cherry picked from commit dc467eac38f2447b652b6680cf4af75b05fd6cd2)
* tplink-safeloader: fix C7v5 factory flashing from vendor fw > v1.1.xPetr Štetiar2021-05-061-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently it's not possible to flash factory images on devices shipped with vendor firmware versions 1.1.0 Build 20201120 rel. 50406 (published 2020-12-22): (curFw_ver, newFw_ver) == (1.1, 1.0) [NM_Error](nm_checkSoftVer) 00848: Firmwave not supports, check failed. [NM_Error](nm_checkUpdateContent) 01084: software version dismatched [NM_Error](nm_buildUpgradeStruct) 01188: checkUpdateContent failed. They've even following note in release notes: Note: You will be unable to downgrade to the previous firmware version after updating this firmware. This version check in vendor firmware is implemented in /usr/bin/nvrammanager binary likely as following C code[1]: sscanf(buf, "%d.%d.%*s",&upd_fw_major, &upd_fw_minor); ... if (((int)upd_fw_major < (int)cur_fw_major) || ((ret = 1, cur_fw_major == upd_fw_major && (upd_fw_minor < (int)cur_fw_minor)))) { ret = 0; printf("[NM_Error](%s) %05d: Firmwave not supports, check failed.\r\n\r\n","nm_checkSoftVer" ,0x350); } ... return ret; So in order to fix this and make it future proof it should be enough to ship our factory firmware images with major version 7 (lucky number). Tested on latest firmware version 1.1.2 Build 20210125 rel.37999: Firmwave supports, check OK. (curFw_ver, newFw_ver) == (1.1, 7.0) check firmware ok! Flashing back to vendor firmware c7v5_us-up-ver1-1-2-P1[20210125-rel37999]_2021-01-25_10.33.55.bin works as well: U-Boot 1.1.4-gbec22107-dirty (Nov 18 2020 - 18:19:12) ... Firmware downloaded... filesize = 0xeeae77 fileaddr = 0x80060000. Firmware Recovery file length : 15642231 Firmware process id 2. handle_fw_cloud 146 Image verify OK! Firmware file Verify ok! product-info:product_name:Archer C7 product_ver:5.0.0 special_id:55530000 [Error]sysmgr_cfg_checkSupportList(): 1023 @ specialId 45550000 NOT Match. Firmware supports, check OK. Firmware Recovery check ok! 1. https://gist.github.com/ynezz/2e0583647d863386a66c3d231541b6d1 Signed-off-by: Petr Štetiar <ynezz@true.cz> (cherry picked from commit e6d66375cbbb54e0e82a67030e385a5486273766) Signed-off-by: Petr Štetiar <ynezz@true.cz>
* mac80211: Update to backports version 4.19.189-1Hauke Mehrtens2021-05-0444-499/+146
| | | | | | The removed patches were applied upstream. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* dropbear: Fix CVE-2020-36254Hauke Mehrtens2021-05-031-0/+21
| | | | | | | | This backports a fix from dropbear 2020.81. CVE-2020-36254 description: scp.c in Dropbear before 2020.79 mishandles the filename of . or an empty filename, a related issue to CVE-2018-20685. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* ramips: backport unlocked mdiobus accessorsDavid Bauer2021-05-031-0/+141
| | | | | | | | | | | Commit 718e97c5c843 ("ramips: mt7530 swconfig: fix race condition in register access") backports a fix which depends on unlocked MMD accessors, however these were not yet included in Kernel 4.14 and they were not backported yet. Fixes commit 718e97c5c843 ("ramips: mt7530 swconfig: fix race condition in register access") Signed-off-by: David Bauer <mail@david-bauer.net>
* openvpn: update to 2.4.11Magnus Kroken2021-05-022-3/+3
| | | | | | | | | | | | Fixes two related security vulnerabilities (CVE-2020-15078) which under very specific circumstances allow tricking a server using delayed authentication (plugin or management) into returning a PUSH_REPLY before the AUTH_FAILED message, which can possibly be used to gather information about a VPN setup. This release also includes other bug fixes and improvements. Signed-off-by: Magnus Kroken <mkroken@gmail.com>
* openvpn: update to 2.4.9Magnus Kroken2021-05-023-4/+4
| | | | | | | | | | | | | | | | This is primarily a maintenance release with bugfixes and improvements. This release also fixes a security issue (CVE-2020-11810) which allows disrupting service of a freshly connected client that has not yet negotiated session keys. The vulnerability cannot be used to inject or steal VPN traffic. Release announcement: https://openvpn.net/community-downloads/#heading-13812 Full list of changes: https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn24#OpenVPN2.4.9 Signed-off-by: Magnus Kroken <mkroken@gmail.com> (cherry-picked from commit d7e98bd7c5316f95cc11635371a39c6c0e18b9a7)
* openvpn: update to 2.4.8Magnus Kroken2021-05-025-6/+129
| | | | | | | | | | | Backport two upstream commits that allow building openvpn-openssl without OpenSSLs deprecated APIs. Full changelog: https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn24#OpenVPN2.4.8 Signed-off-by: Magnus Kroken <mkroken@gmail.com> (cherry-picked from commit bf43e5bbf91ca1a90df8dae3e2cce6bbb61d5cd9)
* ramips: mt7530 swconfig: fix race condition in register accessDENG Qingfang2021-05-021-6/+10
| | | | | | | | | | | | | | | | | | | [ Upstream commit f99c9cd9c4d4c49a676d678327546fd41690fe2a ] The mt7530_{r,w}32 operation over MDIO uses 3 mdiobus operations and does not hold a lock, which causes a race condition when multiple threads try to access a register, they may get unexpected results. To avoid this, handle the MDIO lock manually, and use the unlocked __mdiobus_{read,write} in the critical section. This fixes the "Ghost VLAN" artifact[1] in MT7530/7621 when the VLAN operation and the swconfig LED link status poll race between each other. [1] https://forum.openwrt.org/t/mysterious-vlan-ids-on-mt7621-device/64495 Signed-off-by: DENG Qingfang <dqfext@gmail.com> (cherry picked from commit f99c9cd9c4d4c49a676d678327546fd41690fe2a)
* ppp/pppoe-discovery: fix -W optionMartin Schiller2021-05-021-0/+60
| | | | | | | | | This patch is already included in ppp-2.4.9 which is used in openwrt master. Backport this patch to openwrt-19.07. Signed-off-by: Martin Schiller <ms@dev.tdt.de>
* kernel: bump 4.14 to 4.14.231Koen Vandeputte2021-04-303-10/+10
| | | | | | | | | | | | | | Refreshed all patches. Fixes: - CVE-2020-25672 - CVE-2020-25671 - CVE-2020-25670 Compile-tested on: ar71xx, cns3xxx, imx6, x86_64 Runtime-tested on: ar71xx, cns3xxx, imx6 Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* kernel: bump 4.14 to 4.14.230Koen Vandeputte2021-04-307-83/+33
| | | | | | | | | | | | Refreshed all patches. Remove upstreamed: - 840-can-flexcan-flexcan_chip_freeze-fix-chip-freeze-for-.patch Compile-tested on: ar71xx, cns3xxx, imx6, x86_64 Runtime-tested on: ar71xx, cns3xxx, imx6 Signed-off-by: Koen Vandeputte <koen.vandeputte@citymesh.com>
* mac80211: backport upstream fixesKoen Vandeputte2021-04-098-1/+354
| | | | | | | Refreshed all patches. Includes all fixes up to 4.19.184 Signed-off-by: Koen Vandeputte <koen.vandeputte@citymesh.com>
* kernel: backport fix for flexcan bugKoen Vandeputte2021-04-091-0/+50
| | | | | | | | This patch fixes a DIV/0 error which was introduced in 4.14.225 This patch was forgotten in upstream <= 4.14 and is now queued for future release. Signed-off-by: Koen Vandeputte <koen.vandeputte@citymesh.com>
* kernel: bump 4.14 to 4.14.229Koen Vandeputte2021-04-097-11/+11
| | | | | | | | | Refreshed all patches. Compile-tested on: ar71xx, cns3xxx, imx6, x86_64 Runtime-tested on: ar71xx, cns3xxx, imx6 Signed-off-by: Koen Vandeputte <koen.vandeputte@citymesh.com>
* kernel: bump 4.14 to 4.14.228Koen Vandeputte2021-04-094-32/+32
| | | | | | | | | Refreshed all patches. Compile-tested on: ar71xx, cns3xxx, imx6, x86_64 Runtime-tested on: ar71xx, cns3xxx, imx6 Signed-off-by: Koen Vandeputte <koen.vandeputte@citymesh.com>
* kernel: bump 4.14 to 4.14.227Koen Vandeputte2021-04-0927-75/+75
| | | | | | | | | | | | Refreshed all patches. Altered patches: - 809-flexcan-support-layerscape.patch Compile-tested on: ar71xx, cns3xxx, imx6, layerscape, x86_64 Runtime-tested on: ar71xx, cns3xxx, imx6 Signed-off-by: Koen Vandeputte <koen.vandeputte@citymesh.com>
* openssl: bump to 1.1.1kEneas U de Queiroz2021-03-272-24/+23
| | | | | | | | | | | | | This version fixes 2 security vulnerabilities, among other changes: - CVE-2021-3450: problem with verifying a certificate chain when using the X509_V_FLAG_X509_STRICT flag. - CVE-2021-3449: OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com> (cherry picked from commit 0bd0de7d43b3846ad0d7006294e1daaadfa7b532)
* openssl: sync package download URLs with masterPetr Štetiar2021-03-271-3/+5
| | | | | | | Apparently it fixes some broken URLs and as a bonus it makes cherry-picking of fixes easier. Signed-off-by: Petr Štetiar <ynezz@true.cz>
* mbedtls: update to 2.16.10Magnus Kroken2021-03-272-13/+13
| | | | | | | | | | | | | | | | | | | | This release of Mbed TLS provides bug fixes and minor enhancements. This release includes fixes for security issues. Security fixes: * Fix a buffer overflow in mbedtls_mpi_sub_abs() * Fix an errorneous estimation for an internal buffer in mbedtls_pk_write_key_pem() * Fix a stack buffer overflow with mbedtls_net_poll() and mbedtls_net_recv_timeout() * Guard against strong local side channel attack against base64 tables by making access aceess to them use constant flow code Full release announcement: https://github.com/ARMmbed/mbedtls/releases/tag/v2.16.10 Signed-off-by: Magnus Kroken <mkroken@gmail.com> (cherry picked from commit dbde2bcf60b5d5f54501a4b440f25fe7d02fbe5d)
* mwlwifi: add PKG_FLAGS:=nonsharedDaniel Golle2021-03-241-0/+1
| | | | | | | | | This should fix the problem of mwlwifi-firmware-* not being found when using the ImageBuilder. Signed-off-by: Daniel Golle <daniel@makrotopia.org> (cherry picked from commit 9b3aaf1cdb873cc2a7b2f2ef4e72ddb716afba38) Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* scripts: bundle-libraries.sh: fix broken SDK compilerPetr Štetiar2021-03-201-1/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | Recent versions (> 5.33) of `file` report liblto_plugin.so as executable: $ file liblto_plugin.so liblto_plugin.so.0.0.0: ELF 64-bit LSB pie executable ... Which then leads to improper packaging of the plugin, resulting in the broken compiler: configure: checking whether the C compiler works mips-openwrt-linux-musl/bin/ld: liblto_plugin.so: error loading plugin: liblto_plugin.so: invalid ELF header As the LTO compiler plugin library is incorrectly packaged as SDK executable: $ head -1 ~/staging_dir/toolchain...libexec/gcc/.../liblto_plugin.so #!/usr/bin/env bash Fix this by filtering out shared libraries from the patching. Ref: https://bugzilla.redhat.com/show_bug.cgi?id=1296868 Acked-by: Jo-Philipp Wich <jo@mein.io> Signed-off-by: Petr Štetiar <ynezz@true.cz> (cherry picked from commit 4b7165722cb0e2ba62ab68e8b90d4d4b0909744c)
* build: reduce number of files passed to ipk-removeEneas U de Queiroz2021-03-191-11/+8
| | | | | | | | | | | | | | | | | | | | | Instead of using xargs to pass a huge number of files to script/ipkg-remove, which will usually pick only one, use a more restrictive wildcard so that, currently, at the most 325 files are examined, instead of up to over 2,300. The 325-file package is python, which is picking up python3* ipks. It is about to be removed. Runner-up is ddns-scripts with 7 files. This makes a second run of make package/luci/compile go from real 16.40s; user 17.42s; sys 2.73s to real 10.71s; user 9.51s; sys 1.27s There is a caveat though: if one were to remove the ABI_VERSION of a package that ends in a digit [0-9], then the old package ipk will not be removed from the bin directory by make package/abc2/clean. Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com> (cherry picked from commit 11192484fa320cd233849441bd00ddf58964de42)
* build: call ipkg-remove using xargs if #args>=512Eneas U de Queiroz2021-03-191-1/+11
| | | | | | | | | | | | | | The wildcard call to clean up luci package (luci*) can pick up over 2,300 files when the full tree is built. Running make package/luci/clean or a second run of make package/luci/compile would fail with an 'Argument list too long' error. To avoid that, a maybe_use_xargs function was created that runs the command straight as usual if the number of arguments is < 512, or saves the list in a temporary file and feeds it to xargs otherwise. Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com> (cherry picked from commit 78d1f3ac61b1740f2a45c40bcde0e83246308a18)
* build: package-ipkg: avoid calling wildcard twiceEneas U de Queiroz2021-03-191-2/+8
| | | | | | | | | Instead of calling $(wildcard) to check if the removal list is empty, then calling it again to actually remove the files, define a function so that the arguments are expanded only once when it gets called. Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com> (cherry picked from commit 40acc13ca72ca7d2815dc5d94549d5dc48e16e98)
* kernel: bump 4.14 to 4.14.224Koen Vandeputte2021-03-104-6/+6
| | | | | | | | | Refreshed all patches. Compile-tested on: ar71xx, cns3xxx, imx6, x86_64 Compile-tested on: ar71xx, cns3xxx, imx6 Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* kernel: bump 4.14 to 4.14.223Koen Vandeputte2021-03-1019-51/+51
| | | | | | | | | Refreshed all patches. Compile-tested on: ar71xx, cns3xxx, imx6, x86_64 Runtime-tested on: ar71xx, cns3xxx, imx6 Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* wolfssl: bump to v4.7.0-stableEneas U de Queiroz2021-03-065-92/+4
| | | | | | | | | | | | | | | Biggest fix for this version is CVE-2021-3336, which has already been applied here. There are a couple of low severity security bug fixes as well. Three patches are no longer needed, and were removed; the one remaining was refreshed. This tool shows no ABI changes: https://abi-laboratory.pro/index.php?view=objects_report&l=wolfssl&v1=4.6.0&v2=4.7.0 Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com> (cherry picked from commit d1dfb577f1c0d5b1f1fa35000c9ad7abdb7d10ed)
* hostapd: P2P: Fix a corner case in peer addition based on PD RequestStefan Lippers-Hollmann2021-03-062-1/+46
| | | | | | | | | | | | | | | | | | | | | | | | | | | p2p_add_device() may remove the oldest entry if there is no room in the peer table for a new peer. This would result in any pointer to that removed entry becoming stale. A corner case with an invalid PD Request frame could result in such a case ending up using (read+write) freed memory. This could only by triggered when the peer table has reached its maximum size and the PD Request frame is received from the P2P Device Address of the oldest remaining entry and the frame has incorrect P2P Device Address in the payload. Fix this by fetching the dev pointer again after having called p2p_add_device() so that the stale pointer cannot be used. This fixes the following security vulnerabilities/bugs: - CVE-2021-27803 - A vulnerability was discovered in how p2p/p2p_pd.c in wpa_supplicant before 2.10 processes P2P (Wi-Fi Direct) provision discovery requests. It could result in denial of service or other impact (potentially execution of arbitrary code), for an attacker within radio range. Fixes: 17bef1e97a50 ("P2P: Add peer entry based on Provision Discovery Request") Signed-off-by: Jouni Malinen <jouni@codeaurora.org> Signed-off-by: Stefan Lippers-Hollmann <s.l-h@gmx.de> (cherry picked from commit 1ca5de13a153061feae260864d73d96f7c463785)
* build: fix checks for GCC11Petr Štetiar2021-03-061-4/+4
| | | | | | | | Fedora 34 already uses GCC11. Reported-by: Marcin Juszkiewicz <marcin-openwrt@juszkiewicz.com.pl> Signed-off-by: Petr Štetiar <ynezz@true.cz> (cherry picked from commit cae69d558135456976b8fc6cb08530d1358cf6d5)
* Revert "base-files: source functions.sh in /lib/functions/system.sh"Adrian Schmutzler2021-03-012-3/+1
| | | | | | | | | | | | | | | | This reverts commit 86aeac4fc98f42ac0ce7e0dcf1cb240e16b28f8f. The reverted commit introduced a cyclic dependency between /lib/functions.sh and /lib/functions/system.sh. Further details are found in 282e8173509a ("base-files: do not source system.sh in functions.sh"), which was applied to master some time ago and is included in 21.02. With the current age of 19.07 branch, it seems safer to revert this mostly cosmetic feature than investing further time into disentangling the dependencies. Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* kernel: bump 4.14 to 4.14.222Koen Vandeputte2021-02-268-16/+16
| | | | | | | | | Refreshed all patches. Compile-tested on: ar71xx, cns3xxx, imx6, x86_64 Runtime-tested on: ar71xx, cns3xxx, imx6 Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* base-files: source functions.sh in /lib/functions/system.shAdrian Schmutzler2021-02-242-1/+3
| | | | | | | | | The file /lib/functions/system.sh depends on find_mtd_index() and find_mtd_part() located in /lib/function.sh, so let's source that file. Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de> (backported from commit ae636effd24a7637cefca58a143063f395c82d05)
* hostapd: backport ignoring 4addr mode enabling errorRaphaël Mélotte2021-02-202-1/+79
| | | | | | | | | | | | | | | | | | | This is a backport of the upstream commit 58bbbb598144 ("nl80211: Ignore 4addr mode enabling error if it was already enabled"). nl80211_set_4addr_mode() could fail when trying to enable 4addr mode on an interface that is in a bridge and has 4addr mode already enabled. This operation would not have been necessary in the first place and this failure results in disconnecting, e.g., when roaming from one backhaul BSS to another BSS with Multi AP. Avoid this issue by ignoring the nl80211 command failure in the case where 4addr mode is being enabled while it has already been enabled. Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be> [bump PKG_RELEASE, more verbose commit description] Signed-off-by: Petr Štetiar <ynezz@true.cz> (cherry picked from commit fb860b4e418c28a0f388f215e5acce103dcee1bf)
* ramips: remove factory image for TP-Link Archer C20 v1Stijn Segers2021-02-191-1/+0
| | | | | | | | | | | | | Similarly to the Archer C2 v1, the Archer C20 v1 will brick when one tries to flash an OpenWrt factory image through the TP-Link web UI. The wiki page contains an explicit warning about this [1]. Disable the factory image altogether since it serves no purpose. [1] https://openwrt.org/toh/tp-link/tp-link_archer_c20_v1#installation Signed-off-by: Stijn Segers <foss@volatilesystems.org> (backported from commit 0265cba40ad4f2b8ff4473ada123c35b53ffd97a)
* lantiq: fritz7320: enable USB power supplyMathias Kresin2021-02-181-0/+46
| | | | | | | | | | | | | The USB ports if a FRIZZ!Box 7320 do not supply power to connected devices. Add the GPIOs enabling USB power as regulator, to enable USB power supply as soon as the USB driver is loaded. Fixes FS#3624 Signed-off-by: Mathias Kresin <dev@kresin.me> (cherry picked from commit 6e4e97b2256327bb380ee2a83da9a1ddf657e395)
* openssl: bump to 1.1.1jEneas U de Queiroz2021-02-171-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This fixes 4 security vulnerabilities/bugs: - CVE-2021-2839 - SSLv2 vulnerability. Openssl 1.1.1 does not support SSLv2, but the affected functions still exist. Considered just a bug. - CVE-2021-2840 - calls EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. - CVE-2021-2841 - The X509_issuer_and_serial_hash() function attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it was failing to correctly handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a potential denial of service attack. - Fixed SRP_Calc_client_key so that it runs in constant time. This could be exploited in a side channel attack to recover the password. The 3 CVEs above are currently awaiting analysis. Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com> (cherry picked from commit 482c9ff289c65480c8e7340e1740db24c62f91df)
* OpenWrt v19.07.7: revert to branch defaultsHauke Mehrtens2021-02-165-12/+10
| | | | Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* OpenWrt v19.07.7: adjust config defaultsv19.07.7Hauke Mehrtens2021-02-165-10/+12
| | | | Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* kernel: bump 4.14 to 4.14.221Koen Vandeputte2021-02-158-31/+22
| | | | | | | | | | | | Refreshed all patches. Remove upstreamed hunk in: - 302-dts-support-layerscape.patch Compile-tested on: ar71xx, cns3xxx, imx6, x86_64 Runtime-tested on: ar71xx, cns3xxx, imx6 Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* ramips: ethernet: Disable TSO support to improve stabilityBaptiste Jonglez2021-02-151-2/+1
| | | | | | | | | | | | | | | | | | | | | | | Stability of this Ethernet driver has been a long-standing issue, with many people reporting frequent "transmit queue timeouts" and even occasional crashes. Disabling TSO in the driver helps with stability, although it is likely a workaround and might not fix the issue completely. There is a slight slowdown in forwarding performance for TCP packets (75 kpps vs. 80 kpps with comparable CPU utilization), but this is still enough to forward close to 1 Gbit/s of full-sized packets across multiple flows. Master is using a different ethernet driver, so this is not a backport. Because of this different driver, the upcoming 21.02 release does not seem to be affected by these stability issues. Thanks to mrakotiq for the initial patch. Fixes: FS#2628 Signed-off-by: Baptiste Jonglez <git@bitsofnetworks.org>
* mt76: update to the latest versionDavid Bauer2021-02-151-3/+3
| | | | | | 5c768de mt76: mt76x0: disable GTK offloading Signed-off-by: David Bauer <mail@david-bauer.net>
* ramips: mark toggle input on EX6150 as a switchKurt Roeckx2021-02-151-0/+1
| | | | | | | | | | The Netgear EX6150 has an Access Point/Extender switch. Set it as an EV_SW. Otherwise when it's set to Access Point, it will trigger failsafe mode during boot. Fixes: FS#3590 Signed-off-by: Kurt Roeckx <kurt@roeckx.be> (cherry picked from commit 539966554d6d0686dc8ce62e39ff9e8f4e2d4e74)
* mac80211: Remove 357-mac80211-optimize-skb-resizing.patchHauke Mehrtens2021-02-144-221/+6
| | | | | | | | | This patch was adapted to apply on top of some stable changes, but we are not sure if this is working correctly. Felix suggested to remove this patch for now. Fixes: 0a59e2a76e6d ("mac80211: Update to version 4.19.161-1") Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* ramips: remove factory image for TP-Link Archer C2 v1Stijn Segers2021-02-141-1/+0
| | | | | | | | | | | | | | | | | | | | Initial commit 8375623a0640 ("ramips: add support for TP-Link Archer C2") contains detailed installation instructions, which do not mention a factory image. From what I can see, no support to install OpenWrt through the vendor web interface has been added since. The factory image is also conspicuously absent from the device page in the wiki. Yet, it is available for download. I bricked my Archer C2 loading the factory image through the web UI. Serial showed this error during bootloop: Uncompressing Kernel Image ... LZMA ERROR 1 - must RESET board to recover This patch disables the undocumented factory image so users won't get tricked into thinking easy web UI flashing actually works. Signed-off-by: Stijn Segers <foss@volatilesystems.org> (backported from commit ad5e29d38a48ce6ffbcabaf5d83bc76a64dfbe56)
* ath79: fix USB power GPIO for TP-Link TL-WR810N v1Adrian Schmutzler2021-02-121-1/+1
| | | | | | | | | | | | | | | | | | | The TP-Link TL-WR810N v1 is known to cause soft-brick on ath79 and work fine for ar71xx [1]. On closer inspection, the only apparent difference is the GPIO used for the USB regulator, which deviates between the two targets. This applies the value from ar71xx to ath79. Tested successfully by a forum user. [1] https://forum.openwrt.org/t/tp-link-tl-wr810n-v1-ath79/48267 Fixes: cdbf2de77768 ("ath79: Add support for TP-Link WR810N") Fixes: FS#3522 Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de> (cherry picked from commit 6934d30cf8d95bc8652b4dcd8180d14e5e8e2417)
* wolfssl: Backport fix for CVE-2021-3336Hauke Mehrtens2021-02-102-1/+54
| | | | | | | | | | | | | This should fix CVE-2021-3336: DoTls13CertificateVerify in tls13.c in wolfSSL through 4.6.0 does not cease processing for certain anomalous peer behavior (sending an ED22519, ED448, ECC, or RSA signature without the corresponding certificate). The patch is backported from the upstream wolfssl development branch. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> (cherry picked from commit 1f559cafe5cc1193a5962d40a2d938c66c783171)
* bcm63xx: sprom: override the PCI device IDDaniel González Cabanelas2021-02-072-1/+79
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The PCI device ID detected by the wifi drivers on devices using a fallback SPROM is wrong. Currently the chipnum is used for this parameter. Most SSB based Broadcom wifi chips are 2.4 and 5GHz capable. But on devices without a physical SPROM, the only one way to detect if the device suports both bands or only the 5GHz band, is by reading the device ID from the fallback SPROM. In some devices, this may lead to a non working wifi on a 5GHz-only card, or in the best case a working 2.4GHz-only in a dual band wifi card. The offset for the deviceid in SSB SPROMs is 0x0008, whereas in BCMA is 0x0060. This is true for any SPROM version. Override the PCI device ID with the one defined at the fallback SPROM, to detect the correct wifi card model and allow using the 5GHz band if supported. The patch has been tested with the following wifi radios: BCM43222: b43: both 2.4/5GHz working brcm-wl: both 2.4/5GHz working BCM43225: b43: 2.4GHz, working brcmsmac: working brcm-wl: it lacks support BCM43217: b43: 2.4GHz, working brcmsmac: it lacks support brcm-wl: it lacks support Signed-off-by: Daniel González Cabanelas <dgcbueu@gmail.com> Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com> Backported from a0e0e621ca
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-13 13:26:29 +0000