aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* kernel: Update kernel 4.14 to version 4.14.195Hauke Mehrtens2020-08-2720-51/+51
| | | | | | Compile and runtime tested on x86/64. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* x86: Add CONFIG_EFI_CUSTOM_SSDT_OVERLAYSHauke Mehrtens2020-08-111-0/+1
| | | | | | | | | | The CONFIG_EFI_CUSTOM_SSDT_OVERLAYS option was added in kernel 4.14.188, set it for the x86/generic target. This fixes a build problem in the x86/generic target. Fixes: 35e9edc3dfef ("kernel: Update kernel 4.14 to version 4.14.193") Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* ar71xx: fix ZyXEL NBG6616 wifi switchChristoph Krapp2020-08-111-2/+2
| | | | | | | | The device uses a rf-kill switch instead of a button. Furthermore the GPIO is active high. Signed-off-by: Christoph Krapp <achterin@googlemail.com> (cherry picked from commit 0af656e978f1adac4061516d9d2e661e101ba64c)
* tools/cmake: fix typo in parallel make patchPiotr Stefaniak2020-08-112-1/+2
| | | | | | | | | | | | | | The variable in the case argument was mistyped, so the case always checked against an empty string and never matched. Fix the variable name. Add a PKG_RELEASE to Makefile so we can bump it. Fixes: d6de31310cc1 ("cmake: restore parallel build support for bootstrap") Signed-off-by: Piotr Stefaniak <pstef@freebsd.org> [add commit message, add PKG_RELEASE, fix commit title, add Fixes:] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de> (cherry picked from commit e27fbae63c3436ce5588ca06b78ea88c7a316fee)
* uboot-envtools: ar71xx: add ZyXEL NBG6616 uboot env supportChristoph Krapp2020-08-111-0/+1
| | | | | | | | | This adds support for ZyXEL NBG6616 uboot-env access Signed-off-by: Christoph Krapp <achterin@googlemail.com> [add "ar71xx" to commit title] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de> (cherry picked from commit eb95ca3b5c8b33e3212896f906922eba5f72abb3)
* ar71xx: change u-boot-env to read-write for ZyXEL NBG6616Christoph Krapp2020-08-111-1/+1
| | | | | | | | | | As the ath79 port of this device uses a combined kernel + root partition the uboot bootcmd variable needs to be changed. As using cli/luci is more convenient than opening up the case and using a uart connection, lets unlock the uboot-env partition for write access. Signed-off-by: Christoph Krapp <achterin@googlemail.com> (cherry picked from commit 982c1f6e42c5b3e0f23eedd825a317a2872aa37b)
* kernel: update kernel 4.9 to version 4.9.232Hauke Mehrtens2020-08-0816-109/+33
| | | | | | | | | 821-usb-Remove-annoying-warning-about-bogus-URB.patch does not apply any more and was also deleted in master and nobody complained. ;-) Compile and runtime tested on lantiq/xrx200. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* kernel: Update kernel 4.14 to version 4.14.193Hauke Mehrtens2020-08-0812-21/+21
| | | | | | Compile and runtime tested on x86/64. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* ar71xx: enable ethernet LED of Arduino YunSungbo Eo2020-08-021-2/+1
| | | | | | | | | Commit 05d73a2a7379 enabled GPIO on ethernet LED, but proper LED setup was not added then. This commit fixes it by reverting the change on the LED. Fixes: 05d73a2a7379 ("ar71xx: Arduino Yun board 'WLAN RST' button support") Signed-off-by: Sungbo Eo <mans0n@gorani.run> (cherry picked from commit a5e404d1923d135d335e4ece83f87e6e891396e2)
* ar71xx: fix sysupgrade for Arduino YunSungbo Eo2020-08-021-1/+1
| | | | | | | | | | Commit bb46b635df48 changed its partition scheme, but sysupgrade image validation still uses the old format. This commit fixes it so that force flag is not needed for sysupgrade. Fixes: bb46b635df48 ("ar71xx: move Arduino Yun to generic building code") Signed-off-by: Sungbo Eo <mans0n@gorani.run> (cherry picked from commit 58dc1d0637425cfe023192466e6212009332b677)
* ramips: add kmod-usb-dwc2 to ZyXEL Keenetic imageAlexey Dobrovolsky2020-08-021-1/+2
| | | | | | | | | | | | ZyXEL Keenetic has a USB port. Thus, DWC2 USB controller driver should be in the default image for this device. Fixes: a7cbf59e0e04 ("ramips: add new device ZyXEL Keenetic as kn") Signed-off-by: Alexey Dobrovolsky <dobrovolskiy.alexey@gmail.com> [fixed whitespace issue] Signed-off-by: Petr Štetiar <ynezz@true.cz> (backported from commit 0a182fcba6d9cb2cf74cae9114ea4770ef928f75) Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* ramips: remove patches for USB-dwc2Alexey Dobrovolsky2020-08-021-29/+0
| | | | | | | | | | | | | | | In FS#2738 we can see that patch first introduced in e8ebcff ("ramips: add a explicit reset to dwc2") breaks USB functionality since 18.06. Thus, this patch should be removed. Removed: - 0032-USB-dwc2-add-device_reset.patch Fixes: FS#2738 Fixes: FS#2964 Signed-off-by: Alexey Dobrovolsky <dobrovolskiy.alexey@gmail.com> (cherry picked from commit ab841b4393a4077a5819da1da040ab9a89e3b69d)
* firewall: backport patch for mss clamping in both directionsYousong Zhou2020-07-262-1/+34
| | | | Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* ar71xx: Fix mikrotik NAND compile problemHauke Mehrtens2020-07-071-1/+1
| | | | | | | | | | | This fixes the following compile error: drivers/mtd/nand/rb91x_nand.c: In function 'rb91x_nand_remove': drivers/mtd/nand/rb91x_nand.c:445:16: error: 'rbni' undeclared (first use in this function) nand_release(&rbni->chip); Fixes: 0f07496f520c ("kernel: Update kernel 4.9 to version 4.9.229") Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> (cherry picked from commit 66e04abbb6d0dec8642be5deb2fca4bba470f8ac)
* ar71xx: Fix mikrotik NAND compile problemHauke Mehrtens2020-07-061-1/+1
| | | | | | | | There is one closing bracket too much. Fixes: 0f07496f520c ("kernel: Update kernel 4.9 to version 4.9.229") Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> (cherry picked from commit 014d3f593acea13ee6aa002d858f182806ed43f0)
* wireguard: bump to 1.0.20200611Stijn Segers2020-07-051-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This bump fixes breakage introduced by kernel commit 8ab8786f78c3fc930f9abf6d6d85e95567de4e1f, which is part of the 4.14.181 kernel bump, and backported ip6_dst_lookup_flow to 4.14. This breaks the older WireGuard version currently in 19.07. For reference, the compilation error is the one below: build_dir/target-x86_64_musl/linux-x86_64/wireguard-linux-compat-1.0.20200506/src/compat/compat.h:104:42: error: 'const struct ipv6_stub' has no member named 'ipv6_dst_lookup'; did you mean 'ipv6_dst_lookup_flow'? #define ipv6_dst_lookup_flow(a, b, c, d) ipv6_dst_lookup(a, b, &dst, c) + (void *)0 ?: dst Changelogs below taken from the official release announcements. == Changes since v1.0.20200506 == This release aligns with the changes I sent to DaveM for 5.7-rc7 and were pushed to net.git about 45 minutes ago. * qemu: use newer iproute2 for gcc-10 * qemu: add -fcommon for compiling ping with gcc-10 These enable the test suite to compile with gcc-10. * noise: read preshared key while taking lock Matt noticed a benign data race when porting the Linux code to OpenBSD. * queueing: preserve flow hash across packet scrubbing * noise: separate receive counter from send counter WireGuard now works with fq_codel, cake, and other qdiscs that make use of skb->hash. This should significantly improve latency spikes related to buffer bloat. Here's a before and after graph from some data Toke measured: https://data.zx2c4.com/removal-of-buffer-bloat-in-wireguard.png * compat: support RHEL 8 as 8.2, drop 8.1 support * compat: support CentOS 8 explicitly * compat: RHEL7 backported the skb hash renamings The usual RHEL churn. * compat: backport renamed/missing skb hash members The new support for fq_codel and friends meant more backporting work. * compat: ip6_dst_lookup_flow was backported to 4.14, 4.9, and 4.4 == Changes since v1.0.20200611 == * qemu: always use cbuild gcc rather than system gcc * qemu: remove -Werror in order to build ancient kernels better * qemu: patch kernels that rely on ancient make * qemu: force 2MB pages for binutils 2.31 * qemu: use cbuild gcc for avx512 exclusion * qemu: add extra fill in idt handler for newer binutils * qemu: support fetching kernels for arbitrary URLs * qemu: patch in UTS_UBUNTU_RELEASE_ABI for Ubuntu detection * qemu: work around broken centos8 kernel * qemu: mark per_cpu_load_addr as static for gcc-10 Our qemu test suite can now handle more kernels and more compilers. Scroll down to the bottom of https://www.wireguard.com/build-status/ to see the expanded array of kernels we now test against, including some distro kernels. * compat: widen breadth of integer constants * compat: widen breadth of memzero_explicit backport * compat: backport skb_scrub_packet to 3.11 * compat: widen breadth of prandom_u32_max backport * compat: narrow the breadth of iptunnel_xmit backport * compat: backport iptunnel_xmit to 3.11 With the expanded qemu test suite, it was possible to expand our list of mainline kernels, so the backport compat layer is now more precise. * compat: ubuntu appears to have backported ipv6_dst_lookup_flow * compat: bionic-hwe-5.0/disco kernel backported skb_reset_redirect and ipv6 flow Ubuntu kernels changed recently, so this ensures we can compile with the latest Ubuntu releases. * compat: remove stale suse support Signed-off-by: Stijn Segers <foss@volatilesystems.org> (cherry picked from commit 1fd1f5e8cff18f97675ce303b05d411136b99fb0)
* libubox: backport additional length-checking fixesBaptiste Jonglez2020-07-055-1/+284
| | | | | | | Fixes: FS#3177 Cc: Felix Fietkau <nbd@nbd.name> Cc: Rafał Miłecki <rafal@milecki.pl> Signed-off-by: Baptiste Jonglez <git@bitsofnetworks.org>
* kernel: Update kernel 4.9 to version 4.9.229Hauke Mehrtens2020-07-0536-78/+74
| | | | | | | | | | Fixes: - CVE-2020-10757 Run tested: ar71xx Build tested: ar71xx Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* kernel: Update kernel 4.14 to version 4.14.187Hauke Mehrtens2020-07-0539-137/+80
| | | | | | | | | | Fixes: - CVE-2020-10757 Run tested: x86 Build tested: x86 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* bcm63xx: a226m-fwb: fix linux partition offsetDaniel González Cabanelas2020-06-151-4/+4
| | | | | | | | | | | | | | | | | | | The Pirelli A226M-FWB has a wrong linux partition offset, caused by a copy-paste error. As of result of this, OpenWrt is currently broken in this unit. Fix it. While at it, also use generic node names and fix the addresses there as well. Fixes: a27d59bb4274 ("brcm63xx: switch to new partition layout specification") Signed-off-by: Daniel González Cabanelas <dgcbueu@gmail.com> [also fix/update node names, extend commit message] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de> (cherry picked from commit d64d5ed1425f4397d093c8777ca03f70ff1ee90c)
* ipq40xx: essedma: Disable TCP segmentation offload for IPv6Sven Eckelmann2020-06-131-0/+46
| | | | | | | | | | | | | | | | | | | | | | | | | | | It was noticed that the the whole MAC can hang when transferring data from one ar40xx port (WAN ports) to the CPU and from the CPU back to another ar40xx port (LAN ports). The CPU was doing only NATing in that process. Usually, the problem first starts with a simple data corruption: $ wget https://cdimage.debian.org/debian-cd/current/amd64/iso-cd/debian-10.4.0-amd64-netinst.iso -O /dev/null ... Connecting to saimei.ftp.acc.umu.se (saimei.ftp.acc.umu.se)|2001:6b0:19::138|:443... connected. ... Read error at byte 48807936/352321536 (Decryption has failed.). Retrying. But after a short while, the whole MAC will stop to react. No traffic can be transported anymore from the CPU port from/to the AR40xx PHY/switch and the MAC has to be resetted. The whole problem can be avoided by disabling the TSO for IPv6 for this ethernet MAC driver. Signed-off-by: Sven Eckelmann <sven@narfation.org> Acked-by: John Crispin <john@phrozen.org> (backported from commit 678569505623e50bbbbc344c7e820fb315b79ede, with updated commit message) Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
* ca-certificates: update to version 20200601Christian Lamparter2020-06-101-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch updates the ca-certificates and ca-bundle package. This version changed the files directory again, to work/, so PKG_BUILD_DIR was brought back. A list of changes from Debian's change-log entry for 20200601 [0]: * mozilla/{certdata.txt,nssckbi.h}: Update Mozilla certificate authority bundle to version 2.40. Closes: #956411, #955038 * mozilla/blacklist.txt Add distrusted Symantec CA list to blacklist for explicit removal. Closes: #911289 Blacklist expired root certificate, "AddTrust External Root" Closes: #961907 The following certificate authorities were added (+): + "Certigna Root CA" + "emSign ECC Root CA - C3" + "emSign ECC Root CA - G3" + "emSign Root CA - C1" + "emSign Root CA - G1" + "Entrust Root Certification Authority - G4" + "GTS Root R1" + "GTS Root R2" + "GTS Root R3" + "GTS Root R4" + "Hongkong Post Root CA 3" + "UCA Extended Validation Root" + "UCA Global G2 Root" The following certificate authorities were removed (-): - "AddTrust External Root" - "Certinomis - Root CA" - "Certplus Class 2 Primary CA" - "Deutsche Telekom Root CA 2" - "GeoTrust Global CA" - "GeoTrust Primary Certification Authority" - "GeoTrust Primary Certification Authority - G2" - "GeoTrust Primary Certification Authority - G3" - "GeoTrust Universal CA" - "thawte Primary Root CA" - "thawte Primary Root CA - G2" - "thawte Primary Root CA - G3" - "VeriSign Class 3 Public Primary Certification Authority - G4" - "VeriSign Class 3 Public Primary Certification Authority - G5" - "VeriSign Universal Root Certification Authority" [0] <https://metadata.ftp-master.debian.org/changelogs//main/c/ca-certificates/ca-certificates_20200601_changelog> Signed-off-by: Christian Lamparter <chunkeey@gmail.com> (cherry picked from commit f611b014a713d82d7c7da4c171f3aa04a8984063)
* musl: fix locking synchronization bugMatthias Schiffer2020-05-261-0/+69
| | | | | | | | | | | | | | Import proposed upstream fix [2] for the critical locking synchronization bug recently found in musl [1]. This affects all programs that are temporarily multithreaded, but then return to single-threaded operation. [1] https://www.openwall.com/lists/musl/2020/05/22/3 [2] https://www.openwall.com/lists/musl/2020/05/22/10 Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net> (cherry picked from commit 10c211031ccd4703230493025a5a3b9d6fcad2f2)
* rpcd: update to latest openwrt-18.06 Git HEADJo-Philipp Wich2020-05-261-4/+4
| | | | | | | | | | | | | | | | | | | 7be1f17 file: exec: properly free memory on error 313964c file: avoid closing stdio descriptors in rpc_file_exec_run cd09c5f file: patch process stdin to /dev/null efbcedb file: remove unused members from struct rpc_file_exec_context 71b00ab file: rpc_file_exec_run: fix potential memory leak and integer overflow c7bb956 plugin: fix double free in finish callback 16de3fa plugin: do not free method name separately 29c9c11 exec: properly free memory on rpc_exec() error 5cd4f4e plugin: exec: properly free memory on parse error d80f70e plugin: fix leaking invoked method name for exec plugins 53a0952 session: deny access if password login is disabled 662d034 uci: reset uci_ptr flags when merging options during section add dd46d6d uci: free configs list memory on return abbc302 uci: reset uci_ptr flags when merging set operations Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* usign: update to latest git HEADMatthias Schiffer2020-05-241-3/+3
| | | | | | | f1f65026a941 Always pad fingerprints to 16 characters Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net> (cherry picked from commit e35e40ad824eab9d51cdd690fb747e576e01412f)
* usign: update to latest Git HEADHauke Mehrtens2020-05-241-3/+3
| | | | | | | f34a383 main: fix some resource leaks Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> (cherry picked from commit 81e93fff7d867851f2fedd966a931336d4092686)
* squashfs: Fix compile with GCC 10Hauke Mehrtens2020-05-241-0/+25
| | | | | | | | | | Fixes the following build error with GCC 10: /usr/bin/ld: read_fs.o:(.bss+0x0): multiple definition of `swap'; mksquashfs.o:(.bss+0x1b2a88): first defined here And a compile warning. Fixes: FS#3104, FS#3119 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> (cherry picked from commit 1bbc1aa884902fd05cc579b53d68b2ba0b18683f)
* build: prereq: tidy gcc version checksKevin Darbyshire-Bryant2020-05-241-16/+0
| | | | | | | | | | | | | | | | | | There is a restriction in the number of parameters(10) that may be passed to the SetupHostCommand macro so continually adding explicit gcc'n' version checks ends up breaking the compiler check for the later versions and oddballs like Darwin as was done in 835d1c68a0 which added gcc10. Drop all the explicitly specified gcc version checks. If a suitable gcc compiler is not found, it may be specified at the dependency checking stage after which that version will be symlinked into the build staging host directory. eg. 'CC=gccfoo CXX=g++foo make prereq' Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk> Acked-by: Jo-Philipp Wich <jo@mein.io> (cherry picked from commit 1fb3c003d68d3feaf797e8b64edccc9fa622d250)
* build: add GCC 10 version detectionRobert Marko2020-05-241-4/+6
| | | | | | | | Lets add GCC 10 detection to the build system as distributions like Fedora 32 have started shipping with it. Some tools like mtd-utils need work to compile under GCC10, but that will be next step. Signed-off-by: Robert Marko <robert.marko@sartura.hr> (cherry picked from commit 835d1c68a0f036c8b0d837a48b5a05fdfb2e8218)
* build: adjust gcc/g++ version checks for newer apple compilersFelix Fietkau2020-05-241-2/+2
| | | | | Signed-off-by: Felix Fietkau <nbd@nbd.name> (cherry-picked from commit 46a129194de0f9e2f71b6526634569e1ec802504)
* ramips: drop non-existant ralink,port-map for Ravpower WD03Adrian Schmutzler2020-05-191-1/+0
| | | | | | | | | | | The property "ralink,port-map" has been obsolete long before this device was added, and the device is a one-port anyway. Just remove it. Fixes: 5ef79af4f80f ("ramips: add support for Ravpower WD03") Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de> (cherry picked from commit c00b2df6c8e421ea7aa96f53178dc85db99f2305)
* bcm63xx: mask interrupts on initÁlvaro Fernández Rojas2020-05-181-0/+12
| | | | | | | | Fixes BCM6348/BCM6358 hangs while booting: https://bugs.openwrt.org/index.php?do=details&task_id=2202 Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com> (cherry picked from commit 13c33f3f121ca6fe2ab1f80e04cf2d4f2cd6abec)
* bcm63xx: ext_intc: fix warningÁlvaro Fernández Rojas2020-05-181-0/+28
| | | | | | | | | | | | | | | | | | In file included from ./arch/mips/include/asm/io.h:34, from ./arch/mips/include/asm/mmiowb.h:5, from ./include/linux/spinlock.h:60, from ./include/linux/irq.h:14, from drivers/irqchip/irq-bcm6345-ext.c:10: drivers/irqchip/irq-bcm6345-ext.c: In function 'bcm6345_ext_intc_of_init': ./arch/mips/include/asm/mach-bcm63xx/ioremap.h:48:9: warning: 'base' may be used uninitialized in this function [-Wmaybe-uninitialized] return is_bcm63xx_internal_registers((unsigned long)addr); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/irqchip/irq-bcm6345-ext.c:255:16: note: 'base' was declared here void __iomem *base; ^~~~ Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com> (cherry picked from commit 29c3bb5f413f0962971c66e6516b8409a78e0135)
* bcm63xx: periph_intc: fix warningÁlvaro Fernández Rojas2020-05-181-0/+20
| | | | | | | | | | drivers/irqchip/irq-bcm6345-periph.c: In function 'bcm6345_periph_irq_handle': drivers/irqchip/irq-bcm6345-periph.c:55:21: warning: 'block' may be used uninitialized in this function [-Wmaybe-uninitialized] struct intc_block *block; ^~~~~ Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com> (cherry picked from commit f2f2cf07a61e9c170ab8d65e1e054f0131a84e2a)
* bcm63xx: redboot: fix warningÁlvaro Fernández Rojas2020-05-181-1/+1
| | | | | | | | | | drivers/mtd/parsers/redboot.c: In function 'parse_redboot_partitions': drivers/mtd/parsers/redboot.c:194:59: warning: suggest parentheses around '-' in operand of '&' [-Wparentheses] fis_origin = (buf[i].flash_base & (master->size << 1) - 1); ~~~~~~~~~~~~~~~~~~~~^~~ Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com> (cherry picked from commit f314cbe54be4d90e748e18ae5e9fb00d5fd31c91)
* bcm63xx: bcm6362: fix pinctrl bugÁlvaro Fernández Rojas2020-05-181-0/+11
| | | | | Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com> (cherry picked from commit ee6bf7e865510ff1e0645b08bec65f8212ed70d4)
* bcm63xx: refresh kernel configÁlvaro Fernández Rojas2020-05-181-0/+1
| | | | Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
* mbedtls: update to 2.16.6Magnus Kroken2020-05-162-4/+4
| | | | | | | | | | | | | Security fixes for: * CVE-2020-10932 * a potentially remotely exploitable buffer overread in a DTLS client * bug in DTLS handling of new associations with the same parameters Full release announement: https://tls.mbed.org/tech-updates/releases/mbedtls-2.16.6-and-2.7.15-released Signed-off-by: Magnus Kroken <mkroken@gmail.com> (cherry picked from commit 02fcbe2f3d4eaf65e90bb167aa7818eacc08c633)
* mbedtls: update to version 2.16.5Josef Schlehofer2020-05-162-4/+4
| | | | | | | | | | | Changelog: https://tls.mbed.org/tech-updates/releases/mbedtls-2.16.5-and-2.7.14-released Security advisory: https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-02 Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com> (cherry picked from commit 36af1967f5fcfc889594a8af0f92f873f445d249)
* libjson-c: backport security fixesRobert Marko2020-05-164-2/+117
| | | | | | | | | | | | | This backports upstream fixes for the out of bounds write vulnerability in json-c. It was reported and patches in this upstream PR: https://github.com/json-c/json-c/pull/592 Addresses CVE-2020-12762 Signed-off-by: Robert Marko <robert.marko@sartura.hr> Signed-off-by: Luka Perkov <luka.perkov@sartura.hr> [bump PKG_RELEASE, rebase patches on top of json-c 0.12] Signed-off-by: Jo-Philipp Wich <jo@mein.io> (backported from commit bc0288b76816578f5aeccb2abd679f82bfc5738e)
* kernel: bump 4.14 to 4.14.180Koen Vandeputte2020-05-127-18/+18
| | | | | | | | | | | | | Refreshed all patches. Fixed: - CVE-2020-12114 - CVE-2020-11669 Compile-tested on: cns3xxx Runtime-tested on: cns3xxx Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* kernel: bump 4.9 to 4.9.223Koen Vandeputte2020-05-127-15/+15
| | | | | | | | | | | | Refreshed all patches. Fixes: - CVE-2020-12114 Compile-tested on: ar71xx Runtime-tested on: ar71xx Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* wireguard: bump to 1.0.20200506Jason A. Donenfeld2020-05-071-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * compat: timeconst.h is a generated artifact Before we were trying to check for timeconst.h by looking in the kernel source directory. This isn't quite correct on configurations in which the object directory is separate from the kernel source directory, for example when using O="elsewhere" as a make option when building the kernel. The correct fix is to use $(CURDIR), which should point to where we want. * compat: use bash instead of bc for HZ-->USEC calculation This should make packaging somewhat easier, as bash is generally already available (at least for dkms), whereas bc isn't provided by distros by default in their build meta packages. * socket: remove errant restriction on looping to self It's already possible to create two different interfaces and loop packets between them. This has always been possible with tunnels in the kernel, and isn't specific to wireguard. Therefore, the networking stack already needs to deal with that. At the very least, the packet winds up exceeding the MTU and is discarded at that point. So, since this is already something that happens, there's no need to forbid the not very exceptional case of routing a packet back to the same interface; this loop is no different than others, and we shouldn't special case it, but rather rely on generic handling of loops in general. This also makes it easier to do interesting things with wireguard such as onion routing. At the same time, we add a selftest for this, ensuring that both onion routing works and infinite routing loops do not crash the kernel. We also add a test case for wireguard interfaces nesting packets and sending traffic between each other, as well as the loop in this case too. We make sure to send some throughput-heavy traffic for this use case, to stress out any possible recursion issues with the locks around workqueues. * send: cond_resched() when processing tx ringbuffers Users with pathological hardware reported CPU stalls on CONFIG_ PREEMPT_VOLUNTARY=y, because the ringbuffers would stay full, meaning these workers would never terminate. That turned out not to be okay on systems without forced preemption. This commit adds a cond_resched() to the bottom of each loop iteration, so that these workers don't hog the core. We don't do this on encryption/decryption because the compat module here uses simd_relax, which already includes a call to schedule in preempt_enable. * selftests: initalize ipv6 members to NULL to squelch clang warning This fixes a worthless warning from clang. * send/receive: use explicit unlikely branch instead of implicit coalescing Some code readibility cleanups. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> (cherry picked from commit 4f6343ffe7fe8f7018f904b153dea9fc6038daf4)
* wireguard: bump to 20191226Jason A. Donenfeld2020-05-074-34/+61
| | | | | | | | | | | | | | | | | As announced on the mailing list, WireGuard will be in Linux 5.6. As a result, the wg(8) tool, used by OpenWRT in the same manner as ip(8), is moving to its own wireguard-tools repo. Meanwhile, the out-of-tree kernel module for kernels 3.10 - 5.5 moved to its own wireguard-linux- compat repo. Yesterday, releases were cut out of these repos, so this commit bumps packages to match. Since wg(8) and the compat kernel module are versioned and released separately, we create a wireguard-tools Makefile to contain the source for the new tools repo. Later, when OpenWRT moves permanently to Linux 5.6, we'll drop the original module package, leaving only the tools. So this commit shuffles the build definition around a bit but is basically the same idea as before. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> (cherry picked from commit ea980fb9c6de24350976dcc6c20da2bed5fc8cb8)
* relayd: bump to version 2020-04-25Kevin Darbyshire-Bryant2020-05-041-3/+3
| | | | | | | | | f4d759b dhcp.c: further improve validation Further improve input validation for CVE-2020-11752 Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk> (cherry picked from commit 9e7d11f3e275d6f5d6b3edd7f0fa0440da43c45a)
* relayd: bump to version 2020-04-20Kevin Darbyshire-Bryant2020-05-041-3/+3
| | | | | | | | | 796da66 dhcp.c: improve input validation & length checks Addresses CVE-2020-11752 Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk> (cherry picked from commit be172e663f318ec364c13f795df025bbcce9ac18)
* umdns: update to version 2020-04-25Kevin Darbyshire-Bryant2020-05-041-3/+3
| | | | | | | | | | | | cdac046 dns.c: fix input validation fix Due to a slight foobar typo, failing to de-reference a pointer, previous fix not quite as complete as it should have been. Improve CVE-2020-11750 fix Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk> (cherry picked from commit 9f7c8ed0786be97eda879e5f6681994e4de53d74)
* umdns: update to version 2020-04-20Kevin Darbyshire-Bryant2020-05-041-4/+4
| | | | | | | | | e74a3f9 dns.c: improve input validation Addresses CVE-2020-11750 Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk> (cherry picked from commit 533da61ac63079f218a9946cd8e347b880c33dc0)
* umdns: update to the version 2020-04-05Kevin Darbyshire-Bryant2020-05-041-4/+4
| | | | | | | | ab7a39a umdns: fix unused error 45c4953 dns: explicitly endian-convert all fields in header and question Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk> (cherry picked from commit 22ae8bd50ef6d056b25a96ce6c77de0b0d53c1a1)
* umdns: suppress address-of-packed-member warningKevin Darbyshire-Bryant2020-05-041-2/+2
| | | | | | | | | | | | | | | | | | gcc 8 & 9 appear to be more picky with regards access alignment to packed structures, leading to this warning in dns.c: dns.c:261:2: error: converting a packed ‘struct dns_question’ pointer (alignment 1) to a ‘uint16_t’ {aka ‘short unsigned int’} pointer (alignment 2) may result in an unaligned pointer value [-Werror=address-of-packed-member] 261 | uint16_t *swap = (uint16_t *) q; Work around what I think is a false positive by turning the warning off. Not ideal, but not quite as not ideal as build failure. Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk> (cherry picked from commit 02640f014719a994e2e538b2cb6376a189cd39de)
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-17 11:42:29 +0000