aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* openssl: bump to 1.1.1tJohn Audia2023-02-122-55/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Removed upstreamed patch: 010-padlock.patch Changes between 1.1.1s and 1.1.1t [7 Feb 2023] *) Fixed X.400 address type confusion in X.509 GeneralName. There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but subsequently interpreted by GENERAL_NAME_cmp as an ASN1_TYPE. This vulnerability may allow an attacker who can provide a certificate chain and CRL (neither of which need have a valid signature) to pass arbitrary pointers to a memcmp call, creating a possible read primitive, subject to some constraints. Refer to the advisory for more information. Thanks to David Benjamin for discovering this issue. (CVE-2023-0286) This issue has been fixed by changing the public header file definition of GENERAL_NAME so that x400Address reflects the implementation. It was not possible for any existing application to successfully use the existing definition; however, if any application references the x400Address field (e.g. in dead code), note that the type of this field has changed. There is no ABI change. [Hugo Landau] *) Fixed Use-after-free following BIO_new_NDEF. The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications. The function receives a BIO from the caller, prepends a new BIO_f_asn1 filter BIO onto the front of it to form a BIO chain, and then returns the new head of the BIO chain to the caller. Under certain conditions, for example if a CMS recipient public key is invalid, the new filter BIO is freed and the function returns a NULL result indicating a failure. However, in this case, the BIO chain is not properly cleaned up and the BIO passed by the caller still retains internal pointers to the previously freed filter BIO. If the caller then goes on to call BIO_pop() on the BIO then a use-after-free will occur. This will most likely result in a crash. (CVE-2023-0215) [Viktor Dukhovni, Matt Caswell] *) Fixed Double free after calling PEM_read_bio_ex. The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data. If the function succeeds then the "name_out", "header" and "data" arguments are populated with pointers to buffers containing the relevant decoded data. The caller is responsible for freeing those buffers. It is possible to construct a PEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex() will return a failure code but will populate the header argument with a pointer to a buffer that has already been freed. If the caller also frees this buffer then a double free will occur. This will most likely lead to a crash. The functions PEM_read_bio() and PEM_read() are simple wrappers around PEM_read_bio_ex() and therefore these functions are also directly affected. These functions are also called indirectly by a number of other OpenSSL functions including PEM_X509_INFO_read_bio_ex() and SSL_CTX_use_serverinfo_file() which are also vulnerable. Some OpenSSL internal uses of these functions are not vulnerable because the caller does not free the header argument if PEM_read_bio_ex() returns a failure code. (CVE-2022-4450) [Kurt Roeckx, Matt Caswell] *) Fixed Timing Oracle in RSA Decryption. A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. (CVE-2022-4304) [Dmitry Belyavsky, Hubert Kario] Signed-off-by: John Audia <therealgraysky@proton.me>
* kernel: bump 5.15 to 5.15.93John Audia2023-02-1120-48/+48
| | | | | | | | | | All patches automatically rebased. Build system: x86_64 Build-tested: bcm2711/RPi4B, filogic/xiaomi_redmi-router-ax6000-ubootmod Run-tested: bcm2711/RPi4B, filogic/xiaomi_redmi-router-ax6000-ubootmod Signed-off-by: John Audia <therealgraysky@proton.me>
* mediatek: mt7622: fix rootfs/ubi detection for Xiaomi AX6SOleg S2023-02-111-1/+0
| | | | | | | | | | | | | | | | | By specifying the flag "denx,fit" for partition "kernel", the kernel try to find rootfs in the same partition during boot. Reality is that the placement of rootfs is precisely determined by the name of another partition -"ubi". It was also found that on some device (for example devices with NAND chips), the "Denx search engine" manages to find roots at the end of partition "kernel", but such partition doesn't exist and is empty there. Fix this by removing the "denx,fit" flag from partition "kernel". With this change the original behavior of searchif rootfs in partition "ubi" is restored. Signed-off-by: Oleg S <remittor@gmail.com>
* kernel: kmod-fs-ntfs3: fix typoXu Yiming2023-02-091-1/+1
| | | | | | Fix typo that mistaken the description of ntfs3 for fuse. Signed-off-by: Xu Yiming <xuyiming.open@outlook.com>
* realtek: fix dts whitespaceFelix Baumann2023-02-094-9/+9
| | | | | | Remove whitespace from otherwise empty lines Signed-off-by: Felix Baumann <felix.bau@gmx.de>
* ramips: fix dts whitespaceFelix Baumann2023-02-096-15/+15
| | | | | | | Replace blanks with tabs Remove whitespace from otherwise empty lines Signed-off-by: Felix Baumann <felix.bau@gmx.de>
* mediatek: fix dts whitespaceFelix Baumann2023-02-091-1/+1
| | | | | | Replace blanks with tabs Signed-off-by: Felix Baumann <felix.bau@gmx.de>
* kirkwood: fix dts whitespaceFelix Baumann2023-02-091-1/+1
| | | | | | Replace blanks with tabs Signed-off-by: Felix Baumann <felix.bau@gmx.de>
* ipq807x: fix dts whitespaceFelix Baumann2023-02-091-1/+1
| | | | | | Replace blanks with tabs Signed-off-by: Felix Baumann <felix.bau@gmx.de>
* ipq806x: fix dts whitespaceFelix Baumann2023-02-091-9/+9
| | | | | | Replace blanks with tabs Signed-off-by: Felix Baumann <felix.bau@gmx.de>
* bcm63xx: fix dts whitespaceFelix Baumann2023-02-091-1/+1
| | | | | | Remove whitespace from otherwise empty lines Signed-off-by: Felix Baumann <felix.bau@gmx.de>
* ath79: fix dts whitespaceFelix Baumann2023-02-096-30/+30
| | | | | | | Replace blanks with tabs Remove whitespace from otherwise empty lines Signed-off-by: Felix Baumann <felix.bau@gmx.de>
* ipq40xx: fix dts whitespaceFelix Baumann2023-02-092-2/+2
| | | | | | Remove whitespace from otherwise empty lines Signed-off-by: Felix Baumann <felix.bau@gmx.de>
* tools/cmake: remove rpath ldflagRosen Penev2023-02-091-2/+0
| | | | | | no longer needed because of tools/zstd Signed-off-by: Rosen Penev <rosenp@gmail.com>
* tools/zstd: build libraries as staticRosen Penev2023-02-091-1/+1
| | | | | | Enables to get rid of rpath hack for all users. Signed-off-by: Rosen Penev <rosenp@gmail.com>
* toolchain/gcc: clean up CFLAGSAndre Heider2023-02-091-9/+13
| | | | | | | | | | | Instead of having two different ways to pass flags to the gcc build process, add them as configure args, which is a reliable way to let gcc pass them around to its various pieces. Also add CXXFLAGS, since gcc started to use c++ for itself recently (~10 years ago now). Signed-off-by: Andre Heider <a.heider@gmail.com>
* toolchain/gcc: use explicit configure argsAndre Heider2023-02-092-0/+3
| | | | | | | Spell out what we want to enable or disable. This prevents host libs to leak in, so everyone get the same feature set. Signed-off-by: Andre Heider <a.heider@gmail.com>
* toolchain/binutils: use explicit configure argsAndre Heider2023-02-091-0/+4
| | | | | | | Spell out what we want to enable or disable. This prevents host libs to leak in, so everyone get the same feature set. Signed-off-by: Andre Heider <a.heider@gmail.com>
* kernel: set default values for ARM low level debugging symbolsRobert Marko2023-02-081-0/+6
| | | | | | | | | | | | | | | | | | | | | Set default values for KERNEL_DEBUG_LL and KERNEL_DEBUG_LL_UART_NONE again as both of these symbols are non visible if KERNEL_EARLY_PRINTK is not selected and KConfig wont write their value to .config. This usually is the intended behaviour, but in OpenWrt we are relying on the KConfig to set these and disable the debug console settings that multiple targets like mvebu have set in their kernel config. This was the behaviour before removing all of the "default n" settings as KConfig by default considers symbols disabled but they are not visible anymore and thus their value is not set in .config and build system then later does not override the values from target kernel config. So, to restore the behaviour to the previous one lets a default value for KERNEL_DEBUG_LL and KERNEL_DEBUG_LL_UART_NONE. Fixes: 8bc72ea7be39 ("treewide: strip useless default n Kconfig lines") Tested-by: Georgi Valkov <gvalkov@gmail.com> Signed-off-by: Robert Marko <robimarko@gmail.com>
* ipq4019: fix dts white-spaceFelix Baumann2023-02-088-438/+438
| | | | | | | Replace blanks with tabs Remove whitespace from otherwise empty lines Signed-off-by: Felix Baumann <felix.bau@gmx.de>
* kernel: bump 5.10 to 5.10.167John Audia2023-02-083-4/+4
| | | | | | | | | | All patches automatically rebased. Build system: x86_64 Build-tested: ramips/tplink_archer-a6-v3 Run-tested: ramips/tplink_archer-a6-v3 Signed-off-by: John Audia <therealgraysky@proton.me>
* kernel: bump 5.15 to 5.15.92John Audia2023-02-083-5/+5
| | | | | | | | | | All other patches automatically rebased. Build system: x86_64 Build-tested: bcm2711/RPi4B, filogic/xiaomi_redmi-router-ax6000-ubootmod Run-tested: bcm2711/RPi4B, filogic/xiaomi_redmi-router-ax6000-ubootmod Signed-off-by: John Audia <therealgraysky@proton.me>
* lantiq: ar9/vr9: add fritz-tffs packageFelix Baumann2023-02-082-8/+12
| | | | | | | Add fritz-tffs package to AVM devices Reorder some devices packages for consistency Signed-off-by: Felix Baumann <felix.bau@gmx.de>
* e2fsprogs: update to 1.46.6Nick Hainke2023-02-082-53/+3
| | | | | | | | | | Release information: https://e2fsprogs.sourceforge.net/e2fsprogs-release.html#1.46.6 Remove upstreamed patch: - 004-CVE-2022-1304-libext2fs-add-sanity-check-to-extent-manipulation.patch Signed-off-by: Nick Hainke <vincent@systemli.org>
* tools/e2fsprogs: update to 1.46.6Nick Hainke2023-02-083-57/+7
| | | | | | | | | | | | | Release information: https://e2fsprogs.sourceforge.net/e2fsprogs-release.html#1.46.6 Remove upstreamed patch: - 004-CVE-2022-1304-libext2fs-add-sanity-check-to-extent-manipulation.patch Refresh patch: - 003-no-crond.patch Signed-off-by: Nick Hainke <vincent@systemli.org>
* mpc85xx: p2020: kernel: enable CONFIG_BLK_DEV_NVMEŠimon Bořek2023-02-071-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Enables use of NVMe storage devices with appropriate adapter in miniPCIe slots (including for boot) in Turris 1.x routers and possibly NXP P2020RDB boards (these are the only currently supported p2020 devices according to docs[^1]). Proper detection, mountability and readability was proved to be working on Turris 1.1, OpenWrt 21.02 with similar configuration. Increases gzip compressed kernel size by approximately 37 KiB (from 3 703 KiB to 3 740 KiB). Should boot from those devices be possible the driver needs to be built in. Inclusion as a module would prevent this functionality. CONFIG_BLK_DEV_NVME=y Includes NVMe driver in the kernel.[^2] CONFIG_NVME_CORE=y Selected by CONFIG_BLK_DEV_NVME.[^3] Not necessarily needed to be enabled explicitly, but included to match the form of similar functionality implementations for mvebu, x86_64 and rockchip_armv8 targets. CONFIG_NVME_MULTIPATH disabled explicitly to prevent using more space than necessary. [^1]: https://openwrt.org/docs/techref/targets/mpc85xx [^2]: https://cateee.net/lkddb/web-lkddb/BLK_DEV_NVME.html [^3]: https://cateee.net/lkddb/web-lkddb/NVME_CORE.html Signed-off-by: Šimon Bořek <simon.borek@nic.cz>
* mpc85xx: p2020: kernel: refresh configurationŠimon Bořek2023-02-071-5/+15
| | | | | | | 'make kernel_oldconfig CONFIG_TARGET=subtarget' applied to current master Signed-off-by: Šimon Bořek <simon.borek@nic.cz>
* base-files: ipcalc.sh: fix awk regex syntaxLeon M. George2023-02-071-1/+1
| | | | | | It worked fine before but gawk warns about it. Signed-off-by: Leon M. George <leon@georgemail.eu>
* base-files: ipcalc.sh: trim for statementLeon M. George2023-02-071-2/+8
| | | | | | For gawk compatibility. Signed-off-by: Leon M. George <leon@georgemail.eu>
* dnsmasq: refuse to add empty DHCP rangeLeon M. George2023-02-071-7/+6
| | | | | | | | | | | | Use ipcalc's return value to react to invalid range specifications. By simply ignoring the range instead of aborting with an error code, dnsmasq should still start when there's an error (best effort). Aborting the config generation or working with invalid range specs leaves dnsmasq crash-looping which is the right thing to do concerning that particular interface but it also hinders DHCP service on other interfaces and DNS on the router itself. Signed-off-by: Leon M. George <leon@georgemail.eu>
* base-files: ipcalc.sh: use shebang to invoke awkLeon M. George2023-02-071-3/+1
| | | | | | | | | | | There's hardly an shell logic in ipcalc.sh and a $* that would garble parameter positions. Move the awk invokation to the shebang. A rename from "ipcalc.sh" to "ipcalc" is desirable but could prove tricky with packages in other repositories depending on the filename. Signed-off-by: Leon M. George <leon@georgemail.eu>
* base-files: ipcalc.sh: fail when network is too smallLeon M. George2023-02-071-1/+7
| | | | | | | | It's possible to move range boundaries in a way that the start address lies behind the end address. Detect this condition and exit with an error message. Signed-off-by: Leon M. George <leon@georgemail.eu>
* base-files: ipcalc.sh: don't include own address in rangeLeon M. George2023-02-071-0/+7
| | | | | | Make sure our own address doesn't lie in the calculated range. Signed-off-by: Leon M. George <leon@georgemail.eu>
* base-files: ipcalc.sh: check for params before calculating start/endLeon M. George2023-02-071-12/+13
| | | | | | | With this patch, ipcalc only calculates range boundaries if the corresponding parameters are supplied. Signed-off-by: Leon M. George <leon@georgemail.eu>
* bcm47xx: revert bgmac back to the old limited max frame sizeRafał Miłecki2023-02-072-0/+66
| | | | | | | | | | | | | | Bumping max frame size has significantly affected network performance and memory usage. It was done by upstream commit that first appeared in the 5.7 release. Allocating 512 (BGMAC_RX_RING_SLOTS) buffers, 10 k each, is clearly a bad idea on 32 MiB devices. This commit fixes support for Linksys E1000 V2.1 which gives up after allocating ~346 such buffers running 5.15 kernel. Ref: 230c9da963aa ("bcm53xx: revert bgmac back to the old limited max frame size") Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
* ipq806x: add missing enclosing reserved-memory block on C2600/AD7200Filip Matijević2023-02-071-8/+10
| | | | | | | | | | | | Most of the time when booting kernel prints a warning from mm/page_alloc.c when pstore/ramoops is being initialized and ramoops is not functional. Fix this by moving ramopps node into reserved-memory block as described in kernel documentation. Fixes: 2964e5024c ("ipq806x: kernel ramoops storage for C2600/AD7200") Signed-off-by: Filip Matijević <filip.matijevic.pz@gmail.com>
* ipq807x: refresh kernel configRobert Marko2023-02-071-1/+3
| | | | | | | Refresh the ipq807x kernel config to keep it up to date and in sync with the generic one. Signed-off-by: Robert Marko <robimarko@gmail.com>
* iwinfo: bump to latest git HEADChristian Marangi2023-02-061-3/+3
| | | | | | | c7eb8eb nl80211: restore iterating over all devices in nl80211_phy2ifname() Fixes: #11902 Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
* ipq40xx: fix assignment of lan port numbers for Cell C RTL30VWCezary Jackiewicz2023-02-061-2/+2
| | | | | | After switching to DSA, the LAN ports in Cell C RTL30VW have swapped numbers. Assigning the right numbers. Signed-off-by: Cezary Jackiewicz <cezary@eko.one.pl>
* tools/pkgconf: add PKG_CPE_IDNick Hainke2023-02-051-0/+2
| | | | | | Add PKG_CPE_ID to track vulnerabilities. Signed-off-by: Nick Hainke <vincent@systemli.org>
* tools/pkgconf: update to 1.9.4Nick Hainke2023-02-051-3/+3
| | | | | | | | | | | | Release information: https://github.com/pkgconf/pkgconf/blob/master/NEWS Fixes CVE-2023-24056. Further, this commit corrects the "-Dtests" flag and changes it from "false" to "disabled". Signed-off-by: Nick Hainke <vincent@systemli.org>
* tools/coreutils: update to 9.1John Audia2023-02-052-2/+98
| | | | | | | | | | | In addition to version update, this commit applies a fixup to allow building on MacOS involving renaming: [gt_TYPE_WINT_T] --> [gt_TYPE_WINT_T_GNUTLS] suggested by zhanhb. Build system: x86_64 Build-tested: bcm2711/RPi4B Signed-off-by: John Audia <graysky@archlinux.us>
* ipq806x: onhub: Enable fstools_partname_fallback_scanBrian Norris2023-02-043-9/+3
| | | | | | | | | | | | | | | | | | | | When fstools is unable to parse our root=<...> arg correctly, it can fall back to scanning all block devices for a 'rootfs_data' partition. This fallback was deemed wrong (or at least, a breaking/incompatible change) for some targets, so we're forced to opt back into it with fstools_partname_fallback_scan=1. Without this, OnHub devices will use a rootfs-appended loop device for rootfs_data instead of the intended 3rd partition. While I'm at it, just move all the boot args into the 'cros-vboot' build rule, instead of using the custom bootargs-append. All cros-vboot subtargets here are using the same rootwait (to support both eMMC and USB boot) and root/partition args. Signed-off-by: Brian Norris <computersforpeace@gmail.com> [ drop unrelated comments in commit description ] Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
* fstools: bump to latest Git HEADChristian Marangi2023-02-041-3/+3
| | | | | | 14d535e partname: Correct fstools_partname_fallback_scan comparison Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
* ipq807x: remove libwolfsslcpu-crypto dependencyRosen Penev2023-02-041-1/+1
| | | | Signed-off-by: Rosen Penev <rosenp@gmail.com>
* treewide: replace libustream-wolfssl with -mbedtlsRosen Penev2023-02-041-1/+1
| | | | | | | Previous commit does the same for wpad-basic. Also matches DEFAULT_VARIANT in ustream-ssl Makefile. Signed-off-by: Rosen Penev <rosenp@gmail.com>
* treewide: replace wpad-basic-wolfssl defaultRosen Penev2023-02-0459-143/+143
| | | | | | | The newly merged mbedtls backend is smaller and has fewer ABI related issues than the wolfSSL one. Signed-off-by: Rosen Penev <rosenp@gmail.com>
* scripts: size_compare: print a grand totalAndre Heider2023-02-031-1/+4
| | | | | | | | | | | Usefull to check the impact of treewide changes: Change Local Remote Package +281 6191 5910 ubus -547 56166 56713 procd -13294 91544 104838 ubi-utils ~~~~~~~ total change -13560 Signed-off-by: Andre Heider <a.heider@gmail.com>
* scripts: size_compare: fix support for CONFIG_BINARY_FOLDERAndre Heider2023-02-031-8/+11
| | | | | | | | There is no CONFIG_BINARY_DIR, it's CONFIG_BINARY_FOLDER. While at it, don't parse the shell compatible .config, eval it. Signed-off-by: Andre Heider <a.heider@gmail.com>
* scripts: qemustart: support CONFIG_BINARY_FOLDERAndre Heider2023-02-031-1/+2
| | | | | | | | | | If CONFIG_BINARY_FOLDER is set in .config, use that instead of "bin" as the bindir. That allows to set that config and easily run e.g. `./scripts/qemustart armvirt 32`. Signed-off-by: Andre Heider <a.heider@gmail.com>
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-08 19:45:32 +0000