aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* hostapd: Fix AP mode PMF disconnection protection bypassHauke Mehrtens2019-09-214-6/+72
| | | | | | | | | This fixes * CVE-2019-16275 AP mode PMF disconnection protection bypass https://w1.fi/security/2019-7/ap-mode-pmf-disconnection-protection-bypass.txt Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> (cherry picked from commit a6981604b30bc1ddc1713b368fe853d89c2ba40d)
* hostapd: SAE/EAP-pwd side-channel attack updateHauke Mehrtens2019-09-219-1/+397
| | | | | | | | | Fixes this security problem: * SAE/EAP-pwd side-channel attack update https://w1.fi/security/2019-6/sae-eap-pwd-side-channel-attack-update.txt Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> (cherry picked from commit 7bed9bf10fc8d05df34c7efc66e8b4ade37a1a0c)
* mbedtls: update to 2.16.3Magnus Kroken2019-09-214-62/+35
| | | | | | | | Remove 300-bn_mul.h-Use-optimized-MULADDC-code-only-on-ARM-6.patch, the issue has been fixed upstream. Signed-off-by: Magnus Kroken <mkroken@gmail.com> (cherry picked from commit 49d96ffc5c47e40b7f3d99a91a42ea8a54a38bd9)
* mbedtls: Update to version 2.16.2Josef Schlehofer2019-09-212-4/+4
| | | | | Signed-off-by: Josef Schlehofer <josef.schlehofer@nic.cz> (cherry picked from commit a2f54f6d5d98211e9c58420eed8c67f4fca83665)
* openssl: bump to 1.0.2t, add maintainerEneas U de Queiroz2019-09-202-3/+4
| | | | | | | | | | | | | This version fixes 3 low-severity vulnerabilities: - CVE-2019-1547: ECDSA remote timing attack - CVE-2019-1549: Fork Protection - CVE-2019-1563: Padding Oracle in PKCS7_dataDecode and CMS_decrypt_set1_pkey Patches were refreshed, and Eneas U de Queiroz added as maintainer. Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
* kernel: bump 4.14 to 4.14.145Koen Vandeputte2019-09-2010-22/+22
| | | | | | | | | Refreshed all patches. Compile-tested on: cns3xxx Runtime-tested on: cns3xxx Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* kernel: bump 4.14 to 4.14.144Koen Vandeputte2019-09-202-4/+4
| | | | | | | | | | | | Refreshed all patches. Fixes: - CVE-2019-15030 Compile-tested on: cns3xxx Runtime-tested on: cns3xxx Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* kernel: bump 4.9 to 4.9.193Koen Vandeputte2019-09-205-20/+15
| | | | | | | | | | | | Refreshed all patches. Fixes: - CVE-2019-15030 Compile-tested on: ar71xx Runtime-tested on: ar71xx Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* mac80211: brcmfmac: backport the last 5.4 changesRafał Miłecki2019-09-164-1/+402
| | | | | | | | This makes brcmfmac use the same wiphy after PCIe reset to help user space handle corner cases (e.g. firmware crash). Signed-off-by: Rafał Miłecki <rafal@milecki.pl> (cherry picked from commit f39f4b2f6d4300995270f635261b07197e8cf61e)
* ar71xx: fix potential IRQ misses during dispatch for qca953xKoen Vandeputte2019-09-131-0/+27
| | | | | | | | | | | If both interrupts are set in the current implementation only the 1st will be handled and the 2nd will be skipped due to the "if else" condition. Fix this by using the same approach as done for QCA955x just below it. Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* ar71xx: Fix potentially missed IRQ handling during dispatchKoen Vandeputte2019-09-131-0/+57
| | | | | | | | | | | If both interrupts are set in the current implementation only the 1st will be handled and the 2nd will be skipped due to the "if else" condition. Fix this by using the same approach as done for QCA955x just below it. Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* kernel: bump 4.14 to 4.14.143Koen Vandeputte2019-09-132-3/+3
| | | | | | | | | Refreshed all patches. Compile-tested on: cns3xxx Runtime-tested on: cns3xxx Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* kernel: bump 4.9 to 4.9.192Koen Vandeputte2019-09-136-9/+9
| | | | | | | | | Refreshed all patches. Compile-tested on: ar71xx Runtime-tested on: ar71xx Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* tools: mkimage: fix __u64 typedef conflict with new glibcYousong Zhou2019-09-121-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Including "sys/stat.h" from newer glibc will cause __u64 from linux uapi header to be included, causing compilation failure for u-boot tools USE_HOSTCC Remove typedef for __u64 in include/compiler.h to fix the issue. It should be safe because as of u-boot-2018.03, no ref to __u64 is found under u-boot tools/ directory Error message snippet follows HOSTCC tools/mkenvimage.o In file included from /usr/include/asm-generic/types.h:7, from /usr/include/asm/types.h:5, from /usr/include/linux/types.h:5, from /usr/include/linux/stat.h:5, from /usr/include/bits/statx.h:30, from /usr/include/sys/stat.h:446, from tools/mkenvimage.c:21: /usr/include/asm-generic/int-ll64.h:31:42: error: conflicting types for '__u64' 31 | __extension__ typedef unsigned long long __u64; | ^~~~~ In file included from <command-line>: ././include/compiler.h:69:18: note: previous declaration of '__u64' was here 69 | typedef uint64_t __u64; | ^~~~~ make[5]: *** [scripts/Makefile.host:116: tools/mkenvimage.o] Error 1 Ref: https://forum.openwrt.org/t/compile-error-19-07/44423 Ref: https://bugzilla.redhat.com/show_bug.cgi?id=1699194 Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* kernel: bump 4.14 to 4.14.142Koen Vandeputte2019-09-115-35/+9
| | | | | | | | | | | | Refreshed all patches. Remove upstreamed: - 0032-usb-host-fotg2-restart-hcd-after-port-reset.patch Compile-tested on: cns3xxx, imx6 Runtime-tested on: cns3xxx, imx6 Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* kernel: bump 4.9 to 4.9.191Koen Vandeputte2019-09-112-5/+5
| | | | | | | | | Refreshed all patches. Compile-tested on: ar71xx Runtime-tested on: ar71xx Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* ramips: fix duplicate network setup for dlink, dir-615-h1Adrian Schmutzler2019-09-091-1/+0
| | | | | | | | | | | | | | | In 555ca422d1cb ("ramips: fix D-Link DIR-615 H1 switch port mapping"), port setup for dir-615-h1 was changed without removing the old one. This was working as the new one was triggered earlier than the old one. (In the meantine, changed sorting during ramips rename patches actually inversed that order.) Anyway, just remove the wrong case now. Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de> (cherry picked from commit e35e4a996e26f17b69d200505ecea78af96a2704)
* ramips: fix D-Link DIR-615 H1 switch port mappingMirko Parthey2019-09-091-0/+1
| | | | | | | | | | Reuse a device-specific switch port mapping which also applies to the D-Link DIR-615 H1. Signed-off-by: Mirko Parthey <mirko.parthey@web.de> [cherry-pick/rebase] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de> (cherry picked from commit 555ca422d1cbc2db354c0ed03d1a79650f590859)
* ramips: remove duplicate case for MAC setup of freestation5Adrian Schmutzler2019-09-091-1/+0
| | | | | | | | | | | | | ARC FreeStation5 is present twice in MAC address setup. >From older commits/changes, it is not possible to reconstruct the correct choice only by reading the annotations. Thus, remove the second case and keep the first one, so behavior stays the same (as nobody seems to have complained about it). Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de> (cherry picked from commit ad4eb2241b33b05b0942a3fa7ed2e53fb6e84386)
* mac80211: brcmfmac: backport more kernel 5.4 changesRafał Miłecki2019-09-098-9/+283
| | | | | | | | Patch getting RAM info got upstreamed. A debugging fs entry for testing reset feature was added. Signed-off-by: Rafał Miłecki <rafal@milecki.pl> (cherry picked from commit 681acdcc54d2e59135bb706c38bed942f74ccf74)
* bzip2: Fix CVE-2019-12900Josef Schlehofer2019-09-032-1/+66
| | | | | | | More details about this CVE: https://nvd.nist.gov/vuln/detail/CVE-2019-12900 Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
* ar71xx: WNR2200: remove redundant GPIO for WLAN LEDMichal Cieslakiewicz2019-08-301-0/+1
| | | | | | | | | | | | | | | | | | | | | | | Without this patch, an extra entry appears for AR9287 GPIO that duplicates WLAN LED but in fact drives nothing: gpiochip1: GPIOs 502-511, ath9k-phy0: gpio-502 ( |netgear:blue:wlan ) out hi gpio-503 ( |netgear:amber:test ) out hi gpio-504 ( |netgear:green:power ) out lo gpio-505 ( |rfkill ) in hi gpio-507 ( |wps ) in hi gpio-508 ( |reset ) in hi gpio-510 ( |ath9k-phy0 ) out hi <===! The pin pointed above is default LED GPIO (8) for AR9287. For WNR2200 it is not connected anywhere - pin 0 drives blue WLAN LED instead - but initialization code is missing that information. This fix calls ap9x_pci_setup_wmac_led_pin() function at device setup, forcing WLAN LED pin to be 0 and removing redundant entry. Signed-off-by: Michal Cieslakiewicz <michal.cieslakiewicz@wp.pl>
* kernel: bump 4.14 to 4.14.141Koen Vandeputte2019-08-301-2/+2
| | | | | | | | | Refreshed all patches. Compile-tested on: cns3xxx Runtime-tested on: cns3xxx Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* ath9k: backport dynack improvementsKoen Vandeputte2019-08-284-0/+300
| | | | | | | | | | | | | | | | | | | | | | | | | | | Close cooperation with Lorenzo Bianconi resulted in these patches which fix all remaining seen issues when using dynack. Fix link losses when: - Late Ack's are not seen or not present - switching from too low static coverage class to dynack on a live link These are fixed by setting the Ack Timeout/Slottime to the max possible value for the currently used channel width when a new station has been discovered. When traffic flows, dynack is able to adjust to optimal values within a few packets received (typically < 1 second) These changes have been thoroughly tested on ~60 offshore devices all interconnected using mesh over IBSS and dynack enabled on all. Distances between devices varied from <100m up to ~35km [move patches to correct folder + renumber] Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> (cherry picked from commit f6e8ba0238fe349b7529357793e2fb18635819ed)
* kernel: bump 4.14 to 4.14.140Koen Vandeputte2019-08-283-6/+6
| | | | | | | | | Refreshed all patches. Compile-tested on: cns3xxx Runtime-tested on: cns3xxx Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* kernel: bump 4.9 to 4.9.190Koen Vandeputte2019-08-286-9/+9
| | | | | | | | | | | | Refreshed all patches. Fixes: - CVE-2019-3900 Compile-tested on: ar71xx Runtime-tested on: ar71xx Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* kernel: bump 4.14 to 4.14.139Koen Vandeputte2019-08-276-3/+7
| | | | | | | | | | | | Refreshed all patches. Also add a missing symbol for x86 which got used now in this bump. - ISCSI_IBFT Compile-tested on: cns3xxx Runtime-tested on: cns3xxx Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* musl: Fix CVE-2019-14697Hauke Mehrtens2019-08-193-1/+208
| | | | | | | | | | | | musl libc through 1.1.23 has an x87 floating-point stack adjustment imbalance, related to the math/i386/ directory. In some cases, use of this library could introduce out-of-bounds writes that are not present in an application's source code. This problem only affects x86 and no other architectures. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> (cherry picked from commit c262daf308e0f0bd93bb5c5ee6238773935079ee)
* iptables: patch CVE-2019-11360 (security fix)Jan Pavlinec2019-08-172-1/+14
| | | | Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
* musl: ldso/dlsym: fix mips returning undef dlsymLuiz Angelo Daros de Luca2019-08-173-2/+141
| | | | | | | | | | | | | | | This happens only the second time a library is loaded by dlopen(). After lib1 is loaded, dlsym(lib1,"undef1") correctly resolves the undef symbol from lib1 dependencies. After the second library is loaded, dlsym(lib2,"undef1") was returning the address of "undef1" in lib2 instead of searching lib2 dependencies. Backporting upstream fix which now uses the same logic for relocation time and dlsym. Fixes openwrt/packages#9297 Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
* wolfssl: fixes for CVE-2018-16870 & CVE-2019-13628Eneas U de Queiroz2019-08-174-4/+665
| | | | | | | | | | | | | CVE-2018-16870: medium-severity, new variant of the Bleichenbacher attack to perform downgrade attacks against TLS, which may lead to leakage of sensible data. Backported from 3.15.7. CVE-2019-13628 (currently assigned-only): potential leak of nonce sizes when performing ECDSA signing operations. The leak is considered to be difficult to exploit but it could potentially be used maliciously to perform a lattice based timing attack. Backported from 4.1.0. Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
* kernel: bump 4.14 to 4.14.138Koen Vandeputte2019-08-146-19/+19
| | | | | | | | | Refreshed all patches. Compile-tested on: cns3xxx Runtime-tested on: cns3xxx Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* kernel: bump 4.9 to 4.9.189Koen Vandeputte2019-08-1411-30/+30
| | | | | | | | | Refreshed all patches. Compile-tested on: ar71xx Runtime-tested on: ar71xx Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* xfsprogs: Replace valloc with posix_memalignRosen Penev2019-08-142-1/+32
| | | | | | | Fixes compilation under uClibc-ng. Signed-off-by: Rosen Penev <rosenp@gmail.com> (cherry picked from commit e49b6bb61828b8b903db0ef48113b4065a215c63)
* libbsd: Fix compilation under ARCRosen Penev2019-08-142-1/+31
| | | | | | | | | The 8 year old file does not have any ARC definitions. Signed-off-by: Rosen Penev <rosenp@gmail.com> [updated content of the patch with version sent to upstream] Signed-off-by: Petr Štetiar <ynezz@true.cz> (cherry picked from commit 395bef4bbacc0dd1cca72907529539194504be27)
* nftables: Fix compilation with uClibc-ngRosen Penev2019-08-142-1/+29
| | | | | | | | | Missing header for va_list. Signed-off-by: Rosen Penev <rosenp@gmail.com> Signed-off-by: Petr Štetiar <ynezz@true.cz> [updated with upstream version of the patch] (cherry picked from commit 2f977974714468e1a0ee20e4cce233da63d06dd0)
* tools/patch: apply upstream patch for cve-2019-13638Russell Senior2019-08-142-1/+39
| | | | | | | | | | | | | GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by opening a crafted patch file that contains an ed style diff payload with shell metacharacters. The ed editor does not need to be present on the vulnerable system. This is different from CVE-2018-1000156. https://nvd.nist.gov/vuln/detail/CVE-2019-13638 Signed-off-by: Russell Senior <russell@personaltelco.net> (cherry picked from commit bcfd1d76852974170780dbe368e6194dbb0e123e)
* tools/patch: apply upstream patch for CVE-2019-13636Russell Senior2019-08-142-1/+109
| | | | | | | | | | In GNU patch through 2.7.6, the following of symlinks is mishandled in certain cases other than input files. This affects inp.c and util.c. https://nvd.nist.gov/vuln/detail/CVE-2019-13636 Signed-off-by: Russell Senior <russell@personaltelco.net> (cherry picked from commit 995bcc532943639f3df36dbcaa361f9167f9f4d5)
* kernel: bump 4.14 to 4.14.137Koen Vandeputte2019-08-096-9/+9
| | | | | | | | | Refreshed all patches. Compile-tested on: cns3xxx Runtime-tested on: cns3xxx Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* kernel: bump 4.9 to 4.9.188Koen Vandeputte2019-08-098-15/+15
| | | | | | | | | Refreshed all patches. Compile-tested on: ar71xx Runtime-tested on: ar71xx Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* config: introduce separate CONFIG_SIGNATURE_CHECK optionJo-Philipp Wich2019-08-072-2/+6
| | | | | | | | | | | | | | | | | | | | Introduce a new option CONFIG_SIGNATURE_CHECK which defaults to the value of CONFIG_SIGNED_PACKAGES and thus is enabled by default. This option is needed to support building target opkg with enabled signature verification while having the signed package lists disabled. Our buildbots currently disable package signing globally in the buildroot and SDK to avoid the need to ship private signing keys to the build workers and to prevent the triggering of random key generation on the worker nodes since package signing happens off-line on the master nodes. As unintended side-effect, updated opkg packages will get built with disabled signature verification, hence the need for a new override option. Signed-off-by: Jo-Philipp Wich <jo@mein.io> (cherry picked from commit f565f276e2c06ac8f3176e0b16d6f2d40cd653d4)
* packages: apply usign padding workarounds to package indexes if neededJo-Philipp Wich2019-08-071-2/+6
| | | | | | | | | | | | | | | Since usign miscalculates SHA-512 digests for input sizes of exactly 64 + N * 128 + 110 or 64 + N * 128 + 111 bytes, we need to apply some white space padding to avoid triggering the hashing edge case. While usign itself has been fixed already, there is still many firmwares in the wild which use broken usign versions to verify current package indexes so we'll need to carry this workaround in the forseeable future. Ref: https://forum.openwrt.org/t/signature-check-failed/41945 Ref: https://git.openwrt.org/5a52b379902471cef495687547c7b568142f66d2 Signed-off-by: Jo-Philipp Wich <jo@mein.io> (backported from commit e1f588e446c7ceb696b644b37aeab9b3476e2a57)
* usign: update to latest Git HEADJo-Philipp Wich2019-08-061-3/+3
| | | | | | | | | | | | | | | This update fixes usign signature verification on files with certain file sizes triggering a bug in the shipped SHA-512 implementation. 5a52b37 sha512: fix bad hardcoded constant in sha512_final() 3e6648b README: replace unicode character 716c3f2 README: add reference to OpenBSD signify 86d3668 README: provide reference for ed25519 algorithm 939ec35 usign: main.c: describe necessary arguments for -G Ref: https://forum.openwrt.org/t/signature-check-failed/41945 Signed-off-by: Jo-Philipp Wich <jo@mein.io> (cherry picked from commit 991dd5a89340367920315a3fd0390a7423e6b34a)
* kernel: bump 4.14 to 4.14.136Koen Vandeputte2019-08-0621-75/+36
| | | | | | | | | | | | | | | | | | | Refreshed all patches. Altered patches: - 306-v4.16-netfilter-remove-saveroute-indirection-in-struct-nf_.patch Remove upstreamed: - 505-arm64-dts-marvell-Fix-A37xx-UART0-register-size Fixes: - CVE-2019-13648 - CVE-2019-10207 Compile-tested on: cns3xxx Runtime-tested on: cns3xxx Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* kernel: bump 4.9 to 4.9.187Koen Vandeputte2019-08-0619-272/+127
| | | | | | | | | | | | | | | | | | | | Refreshed all patches. Altered patches: - 021-bridge-multicast-to-unicast.patch Remove upstreamed: - 001-um-Allow-building-and-running-on-older-hosts.patch - 003-um-Fix-check-for-_xstate-for-older-hosts.patch Fixes: - CVE-2019-10207 - CVE-2019-13648 Compile-tested on: ar71xx Runtime-tested on: ar71xx Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* ar71xx: wpj531: fix SIG1/RSS1 LED GPIOLeon M. George2019-08-041-1/+1
| | | | | | | | | | | | | | | In commit 6c937df749c7 ("ar71xx: wpj531: fix GPIOs for LED") wrong GPIO 13 for SIG1/RSS1 LED was commited, the correct GPIO number for this LED is 12. It's listed in "Hardware Guide - wpj531 7A06 (02/07/2019)" as GPIO12/RSS1 on the LED header and same GPIO 12 is used in the vendor's SDK as well. Fixes: 6c937df749c7 ("ar71xx: wpj531: fix GPIOs for LED") Signed-off-by: Leon M. George <leon@georgemail.eu> [commit subject/message facelift] Signed-off-by: Petr Štetiar <ynezz@true.cz> (cherry picked from commit c070662980047838004b83f7af59e7015d3c7922)
* ar71xx: fix HiveAP 121 PLL for 1000MDavid Bauer2019-08-011-1/+1
| | | | | | | | | | | | | The Aerohive HiveAP 121 has the wrong PLL value set for Gigabit speeds, leading to packet-loss. 10M and 100M work fine. This commit sets the Gigabit Ethernet PLL value to the correct value, fixing packet loss. Confirmed with iperf and floodping. Signed-off-by: David Bauer <mail@david-bauer.net> (cherry picked from commit cb49e46a8a4526d86270ced3ba3aa90225ca82d7)
* kernel: bump 4.14 to 4.14.134Koen Vandeputte2019-07-313-8/+8
| | | | | | | | | | | | | Refreshed all patches. Fixes: - CVE-2019-3846 - CVE-2019-3900 Compile-tested on: cns3xxx Runtime-tested on: cns3xxx Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* kernel: bump 4.9 to 4.9.186Koen Vandeputte2019-07-3119-41/+41
| | | | | | | | | | | | Refreshed all patches. Fixes: - CVE-2019-3846 Compile-tested on: ar71xx Runtime-tested on: ar71xx Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* imx6: bump SDMA firmware to 3.5Koen Vandeputte2019-07-311-0/+0
| | | | | | | | | | | - add uart rom script address in header of sdma firmware to support the uart driver of latest kernel working well while old firmware assume ram script used for uart driver as NXP internal legacy kernel. - add multi-fifo SAI/PDM scripts. Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com> (cherry picked from commit 819b6345a206ad182dd3c2d786a3d7f04e33f751)
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-08 08:11:32 +0000