From d8565a06dc01b55ed1018d571e655c122b9d2a33 Mon Sep 17 00:00:00 2001 From: Kevin Darbyshire-Bryant Date: Thu, 18 Jan 2018 13:51:13 +0000 Subject: kernel: bump 4.9 to 4.9.77 Refresh patches. Remove upstreamed patches: target/linux/generic/backport-4.9/023-2-smsc75xx-use-skb_cow_head-to-deal-with-cloned-skbs.patch target/linux/generic/backport-4.9/023-3-cx82310_eth-use-skb_cow_head-to-deal-with-cloned-skb.patch target/linux/generic/backport-4.9/023-4-sr9700-use-skb_cow_head-to-deal-with-cloned-skbs.patch target/linux/generic/backport-4.9/023-5-lan78xx-use-skb_cow_head-to-deal-with-cloned-skbs.patch CVEs completely or partially addressed: CVE-2017-5715 CVE-2017-5753 CVE-2017-17741 CVE-2017-1000410 Compile-tested: ar71xx Archer C7 v2 Run-tested: ar71xx Archer C7 v2 Signed-off-by: Kevin Darbyshire-Bryant Tested-by: Koen Vandeputte --- ...use-skb_cow_head-to-deal-with-cloned-skbs.patch | 36 -------------------- ...-use-skb_cow_head-to-deal-with-cloned-skb.patch | 35 -------------------- ...use-skb_cow_head-to-deal-with-cloned-skbs.patch | 37 --------------------- ...use-skb_cow_head-to-deal-with-cloned-skbs.patch | 38 ---------------------- .../090-net-generalize-napi_complete_done.patch | 2 +- .../linux/generic/hack-4.9/204-module_strip.patch | 10 +++--- .../710-phy-add-mdio_register_board_info.patch | 2 +- .../generic/hack-4.9/904-debloat_dma_buf.patch | 2 +- ...-support-limiting-4K-sectors-support-base.patch | 2 +- .../666-Add-support-for-MAP-E-FMRs-mesh-mode.patch | 22 ++++++------- .../generic/pending-4.9/701-phy_extension.patch | 2 +- 11 files changed, 21 insertions(+), 167 deletions(-) delete mode 100644 target/linux/generic/backport-4.9/023-2-smsc75xx-use-skb_cow_head-to-deal-with-cloned-skbs.patch delete mode 100644 target/linux/generic/backport-4.9/023-3-cx82310_eth-use-skb_cow_head-to-deal-with-cloned-skb.patch delete mode 100644 target/linux/generic/backport-4.9/023-4-sr9700-use-skb_cow_head-to-deal-with-cloned-skbs.patch delete mode 100644 target/linux/generic/backport-4.9/023-5-lan78xx-use-skb_cow_head-to-deal-with-cloned-skbs.patch (limited to 'target/linux/generic') diff --git a/target/linux/generic/backport-4.9/023-2-smsc75xx-use-skb_cow_head-to-deal-with-cloned-skbs.patch b/target/linux/generic/backport-4.9/023-2-smsc75xx-use-skb_cow_head-to-deal-with-cloned-skbs.patch deleted file mode 100644 index 99d98e101c..0000000000 --- a/target/linux/generic/backport-4.9/023-2-smsc75xx-use-skb_cow_head-to-deal-with-cloned-skbs.patch +++ /dev/null @@ -1,36 +0,0 @@ -From b7c6d2675899cfff0180412c63fc9cbd5bacdb4d Mon Sep 17 00:00:00 2001 -From: Eric Dumazet -Date: Wed, 19 Apr 2017 09:59:21 -0700 -Subject: [PATCH] smsc75xx: use skb_cow_head() to deal with cloned skbs - -We need to ensure there is enough headroom to push extra header, -but we also need to check if we are allowed to change headers. - -skb_cow_head() is the proper helper to deal with this. - -Fixes: d0cad871703b ("smsc75xx: SMSC LAN75xx USB gigabit ethernet adapter driver") -Signed-off-by: Eric Dumazet -Cc: James Hughes -Signed-off-by: David S. Miller ---- - drivers/net/usb/smsc75xx.c | 8 ++------ - 1 file changed, 2 insertions(+), 6 deletions(-) - ---- a/drivers/net/usb/smsc75xx.c -+++ b/drivers/net/usb/smsc75xx.c -@@ -2205,13 +2205,9 @@ static struct sk_buff *smsc75xx_tx_fixup - { - u32 tx_cmd_a, tx_cmd_b; - -- if (skb_headroom(skb) < SMSC75XX_TX_OVERHEAD) { -- struct sk_buff *skb2 = -- skb_copy_expand(skb, SMSC75XX_TX_OVERHEAD, 0, flags); -+ if (skb_cow_head(skb, SMSC75XX_TX_OVERHEAD)) { - dev_kfree_skb_any(skb); -- skb = skb2; -- if (!skb) -- return NULL; -+ return NULL; - } - - tx_cmd_a = (u32)(skb->len & TX_CMD_A_LEN) | TX_CMD_A_FCS; diff --git a/target/linux/generic/backport-4.9/023-3-cx82310_eth-use-skb_cow_head-to-deal-with-cloned-skb.patch b/target/linux/generic/backport-4.9/023-3-cx82310_eth-use-skb_cow_head-to-deal-with-cloned-skb.patch deleted file mode 100644 index aee8aa9805..0000000000 --- a/target/linux/generic/backport-4.9/023-3-cx82310_eth-use-skb_cow_head-to-deal-with-cloned-skb.patch +++ /dev/null @@ -1,35 +0,0 @@ -From a9e840a2081ed28c2b7caa6a9a0041c950b3c37d Mon Sep 17 00:00:00 2001 -From: Eric Dumazet -Date: Wed, 19 Apr 2017 09:59:22 -0700 -Subject: [PATCH] cx82310_eth: use skb_cow_head() to deal with cloned skbs - -We need to ensure there is enough headroom to push extra header, -but we also need to check if we are allowed to change headers. - -skb_cow_head() is the proper helper to deal with this. - -Fixes: cc28a20e77b2 ("introduce cx82310_eth: Conexant CX82310-based ADSL router USB ethernet driver") -Signed-off-by: Eric Dumazet -Cc: James Hughes -Signed-off-by: David S. Miller ---- - drivers/net/usb/cx82310_eth.c | 7 ++----- - 1 file changed, 2 insertions(+), 5 deletions(-) - ---- a/drivers/net/usb/cx82310_eth.c -+++ b/drivers/net/usb/cx82310_eth.c -@@ -293,12 +293,9 @@ static struct sk_buff *cx82310_tx_fixup( - { - int len = skb->len; - -- if (skb_headroom(skb) < 2) { -- struct sk_buff *skb2 = skb_copy_expand(skb, 2, 0, flags); -+ if (skb_cow_head(skb, 2)) { - dev_kfree_skb_any(skb); -- skb = skb2; -- if (!skb) -- return NULL; -+ return NULL; - } - skb_push(skb, 2); - diff --git a/target/linux/generic/backport-4.9/023-4-sr9700-use-skb_cow_head-to-deal-with-cloned-skbs.patch b/target/linux/generic/backport-4.9/023-4-sr9700-use-skb_cow_head-to-deal-with-cloned-skbs.patch deleted file mode 100644 index 4d0fcf6fc2..0000000000 --- a/target/linux/generic/backport-4.9/023-4-sr9700-use-skb_cow_head-to-deal-with-cloned-skbs.patch +++ /dev/null @@ -1,37 +0,0 @@ -From d532c1082f68176363ed766d09bf187616e282fe Mon Sep 17 00:00:00 2001 -From: Eric Dumazet -Date: Wed, 19 Apr 2017 09:59:23 -0700 -Subject: [PATCH] sr9700: use skb_cow_head() to deal with cloned skbs - -We need to ensure there is enough headroom to push extra header, -but we also need to check if we are allowed to change headers. - -skb_cow_head() is the proper helper to deal with this. - -Fixes: c9b37458e956 ("USB2NET : SR9700 : One chip USB 1.1 USB2NET SR9700Device Driver Support") -Signed-off-by: Eric Dumazet -Cc: James Hughes -Signed-off-by: David S. Miller ---- - drivers/net/usb/sr9700.c | 9 ++------- - 1 file changed, 2 insertions(+), 7 deletions(-) - ---- a/drivers/net/usb/sr9700.c -+++ b/drivers/net/usb/sr9700.c -@@ -456,14 +456,9 @@ static struct sk_buff *sr9700_tx_fixup(s - - len = skb->len; - -- if (skb_headroom(skb) < SR_TX_OVERHEAD) { -- struct sk_buff *skb2; -- -- skb2 = skb_copy_expand(skb, SR_TX_OVERHEAD, 0, flags); -+ if (skb_cow_head(skb, SR_TX_OVERHEAD)) { - dev_kfree_skb_any(skb); -- skb = skb2; -- if (!skb) -- return NULL; -+ return NULL; - } - - __skb_push(skb, SR_TX_OVERHEAD); diff --git a/target/linux/generic/backport-4.9/023-5-lan78xx-use-skb_cow_head-to-deal-with-cloned-skbs.patch b/target/linux/generic/backport-4.9/023-5-lan78xx-use-skb_cow_head-to-deal-with-cloned-skbs.patch deleted file mode 100644 index ea8279940b..0000000000 --- a/target/linux/generic/backport-4.9/023-5-lan78xx-use-skb_cow_head-to-deal-with-cloned-skbs.patch +++ /dev/null @@ -1,38 +0,0 @@ -From d4ca73591916b760478d2b04334d5dcadc028e9c Mon Sep 17 00:00:00 2001 -From: Eric Dumazet -Date: Wed, 19 Apr 2017 09:59:24 -0700 -Subject: [PATCH] lan78xx: use skb_cow_head() to deal with cloned skbs - -We need to ensure there is enough headroom to push extra header, -but we also need to check if we are allowed to change headers. - -skb_cow_head() is the proper helper to deal with this. - -Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver") -Signed-off-by: Eric Dumazet -Cc: James Hughes -Cc: Woojung Huh -Signed-off-by: David S. Miller ---- - drivers/net/usb/lan78xx.c | 9 ++------- - 1 file changed, 2 insertions(+), 7 deletions(-) - ---- a/drivers/net/usb/lan78xx.c -+++ b/drivers/net/usb/lan78xx.c -@@ -2419,14 +2419,9 @@ static struct sk_buff *lan78xx_tx_prep(s - { - u32 tx_cmd_a, tx_cmd_b; - -- if (skb_headroom(skb) < TX_OVERHEAD) { -- struct sk_buff *skb2; -- -- skb2 = skb_copy_expand(skb, TX_OVERHEAD, 0, flags); -+ if (skb_cow_head(skb, TX_OVERHEAD)) { - dev_kfree_skb_any(skb); -- skb = skb2; -- if (!skb) -- return NULL; -+ return NULL; - } - - if (lan78xx_linearize(skb) < 0) diff --git a/target/linux/generic/backport-4.9/090-net-generalize-napi_complete_done.patch b/target/linux/generic/backport-4.9/090-net-generalize-napi_complete_done.patch index aaa7435196..5c6e334b19 100644 --- a/target/linux/generic/backport-4.9/090-net-generalize-napi_complete_done.patch +++ b/target/linux/generic/backport-4.9/090-net-generalize-napi_complete_done.patch @@ -1095,7 +1095,7 @@ Signed-off-by: David S. Miller dma_intr_ena = smsc9420_reg_read(pd, DMAC_INTR_ENA); --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -@@ -2678,7 +2678,7 @@ static int stmmac_poll(struct napi_struc +@@ -2684,7 +2684,7 @@ static int stmmac_poll(struct napi_struc work_done = stmmac_rx(priv, budget); if (work_done < budget) { diff --git a/target/linux/generic/hack-4.9/204-module_strip.patch b/target/linux/generic/hack-4.9/204-module_strip.patch index fd07cca066..e36846adb8 100644 --- a/target/linux/generic/hack-4.9/204-module_strip.patch +++ b/target/linux/generic/hack-4.9/204-module_strip.patch @@ -137,7 +137,7 @@ Signed-off-by: Felix Fietkau add_taint_module(mod, TAINT_CRAP, LOCKDEP_STILL_OK); --- a/scripts/mod/modpost.c +++ b/scripts/mod/modpost.c -@@ -1964,7 +1964,9 @@ static void read_symbols(char *modname) +@@ -1965,7 +1965,9 @@ static void read_symbols(char *modname) symname = remove_dot(info.strtab + sym->st_name); handle_modversions(mod, &info, sym, symname); @@ -147,7 +147,7 @@ Signed-off-by: Felix Fietkau } if (!is_vmlinux(modname) || (is_vmlinux(modname) && vmlinux_section_warnings)) -@@ -2108,7 +2110,9 @@ static void add_header(struct buffer *b, +@@ -2109,7 +2111,9 @@ static void add_header(struct buffer *b, buf_printf(b, "#include \n"); buf_printf(b, "#include \n"); buf_printf(b, "\n"); @@ -157,7 +157,7 @@ Signed-off-by: Felix Fietkau buf_printf(b, "\n"); buf_printf(b, "__visible struct module __this_module\n"); buf_printf(b, "__attribute__((section(\".gnu.linkonce.this_module\"))) = {\n"); -@@ -2125,16 +2129,20 @@ static void add_header(struct buffer *b, +@@ -2126,16 +2130,20 @@ static void add_header(struct buffer *b, static void add_intree_flag(struct buffer *b, int is_intree) { @@ -178,7 +178,7 @@ Signed-off-by: Felix Fietkau } /* In kernel, this size is defined in linux/module.h; -@@ -2238,11 +2246,13 @@ static void add_depends(struct buffer *b +@@ -2239,11 +2247,13 @@ static void add_depends(struct buffer *b static void add_srcversion(struct buffer *b, struct module *mod) { @@ -192,7 +192,7 @@ Signed-off-by: Felix Fietkau } static void write_if_changed(struct buffer *b, const char *fname) -@@ -2476,7 +2486,9 @@ int main(int argc, char **argv) +@@ -2477,7 +2487,9 @@ int main(int argc, char **argv) add_staging_flag(&buf, mod->name); err |= add_versions(&buf, mod); add_depends(&buf, mod, modules); diff --git a/target/linux/generic/hack-4.9/710-phy-add-mdio_register_board_info.patch b/target/linux/generic/hack-4.9/710-phy-add-mdio_register_board_info.patch index 55607bc6ea..217cf4a486 100644 --- a/target/linux/generic/hack-4.9/710-phy-add-mdio_register_board_info.patch +++ b/target/linux/generic/hack-4.9/710-phy-add-mdio_register_board_info.patch @@ -50,7 +50,7 @@ phy_device_free(phydev); --- a/include/linux/phy.h +++ b/include/linux/phy.h -@@ -859,6 +859,23 @@ void mdio_bus_exit(void); +@@ -870,6 +870,23 @@ void mdio_bus_exit(void); extern struct bus_type mdio_bus_type; diff --git a/target/linux/generic/hack-4.9/904-debloat_dma_buf.patch b/target/linux/generic/hack-4.9/904-debloat_dma_buf.patch index 4f432c3568..81db6dcb3e 100644 --- a/target/linux/generic/hack-4.9/904-debloat_dma_buf.patch +++ b/target/linux/generic/hack-4.9/904-debloat_dma_buf.patch @@ -13,7 +13,7 @@ Signed-off-by: Felix Fietkau --- a/drivers/base/Kconfig +++ b/drivers/base/Kconfig -@@ -241,7 +241,7 @@ config SOC_BUS +@@ -244,7 +244,7 @@ config SOC_BUS source "drivers/base/regmap/Kconfig" config DMA_SHARED_BUFFER diff --git a/target/linux/generic/pending-4.9/470-mtd-spi-nor-support-limiting-4K-sectors-support-base.patch b/target/linux/generic/pending-4.9/470-mtd-spi-nor-support-limiting-4K-sectors-support-base.patch index 1c5b9c3b26..e1c1de3602 100644 --- a/target/linux/generic/pending-4.9/470-mtd-spi-nor-support-limiting-4K-sectors-support-base.patch +++ b/target/linux/generic/pending-4.9/470-mtd-spi-nor-support-limiting-4K-sectors-support-base.patch @@ -39,7 +39,7 @@ Signed-off-by: Felix Fietkau depends on ARCH_AT91 || (ARM && COMPILE_TEST) --- a/drivers/mtd/spi-nor/spi-nor.c +++ b/drivers/mtd/spi-nor/spi-nor.c -@@ -1640,10 +1640,12 @@ int spi_nor_scan(struct spi_nor *nor, co +@@ -1642,10 +1642,12 @@ int spi_nor_scan(struct spi_nor *nor, co #ifdef CONFIG_MTD_SPI_NOR_USE_4K_SECTORS /* prefer "small sector" erase if possible */ diff --git a/target/linux/generic/pending-4.9/666-Add-support-for-MAP-E-FMRs-mesh-mode.patch b/target/linux/generic/pending-4.9/666-Add-support-for-MAP-E-FMRs-mesh-mode.patch index ee58c2c5e9..0941b79b66 100644 --- a/target/linux/generic/pending-4.9/666-Add-support-for-MAP-E-FMRs-mesh-mode.patch +++ b/target/linux/generic/pending-4.9/666-Add-support-for-MAP-E-FMRs-mesh-mode.patch @@ -300,7 +300,7 @@ Signed-off-by: Steven Barth /** * ip6_tnl_addr_conflict - compare packet addresses to tunnel's own * @t: the outgoing tunnel device -@@ -1286,6 +1426,7 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, str +@@ -1287,6 +1427,7 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, str { struct ip6_tnl *t = netdev_priv(dev); struct ipv6hdr *ipv6h = ipv6_hdr(skb); @@ -308,7 +308,7 @@ Signed-off-by: Steven Barth int encap_limit = -1; __u16 offset; struct flowi6 fl6; -@@ -1344,6 +1485,18 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, str +@@ -1345,6 +1486,18 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, str fl6.flowi6_mark = skb->mark; } @@ -327,7 +327,7 @@ Signed-off-by: Steven Barth if (iptunnel_handle_offloads(skb, SKB_GSO_IPXIP6)) return -1; -@@ -1471,6 +1624,14 @@ ip6_tnl_change(struct ip6_tnl *t, const +@@ -1472,6 +1625,14 @@ ip6_tnl_change(struct ip6_tnl *t, const t->parms.flowinfo = p->flowinfo; t->parms.link = p->link; t->parms.proto = p->proto; @@ -342,7 +342,7 @@ Signed-off-by: Steven Barth dst_cache_reset(&t->dst_cache); ip6_tnl_link_config(t); return 0; -@@ -1509,6 +1670,7 @@ ip6_tnl_parm_from_user(struct __ip6_tnl_ +@@ -1510,6 +1671,7 @@ ip6_tnl_parm_from_user(struct __ip6_tnl_ p->flowinfo = u->flowinfo; p->link = u->link; p->proto = u->proto; @@ -350,7 +350,7 @@ Signed-off-by: Steven Barth memcpy(p->name, u->name, sizeof(u->name)); } -@@ -1886,6 +2048,15 @@ static int ip6_tnl_validate(struct nlatt +@@ -1887,6 +2049,15 @@ static int ip6_tnl_validate(struct nlatt return 0; } @@ -366,7 +366,7 @@ Signed-off-by: Steven Barth static void ip6_tnl_netlink_parms(struct nlattr *data[], struct __ip6_tnl_parm *parms) { -@@ -1920,6 +2091,46 @@ static void ip6_tnl_netlink_parms(struct +@@ -1921,6 +2092,46 @@ static void ip6_tnl_netlink_parms(struct if (data[IFLA_IPTUN_COLLECT_METADATA]) parms->collect_md = true; @@ -413,7 +413,7 @@ Signed-off-by: Steven Barth } static bool ip6_tnl_netlink_encap_parms(struct nlattr *data[], -@@ -2029,6 +2240,12 @@ static void ip6_tnl_dellink(struct net_d +@@ -2030,6 +2241,12 @@ static void ip6_tnl_dellink(struct net_d static size_t ip6_tnl_get_size(const struct net_device *dev) { @@ -426,7 +426,7 @@ Signed-off-by: Steven Barth return /* IFLA_IPTUN_LINK */ nla_total_size(4) + -@@ -2056,6 +2273,24 @@ static size_t ip6_tnl_get_size(const str +@@ -2057,6 +2274,24 @@ static size_t ip6_tnl_get_size(const str nla_total_size(2) + /* IFLA_IPTUN_COLLECT_METADATA */ nla_total_size(0) + @@ -451,7 +451,7 @@ Signed-off-by: Steven Barth 0; } -@@ -2063,6 +2298,9 @@ static int ip6_tnl_fill_info(struct sk_b +@@ -2064,6 +2299,9 @@ static int ip6_tnl_fill_info(struct sk_b { struct ip6_tnl *tunnel = netdev_priv(dev); struct __ip6_tnl_parm *parm = &tunnel->parms; @@ -461,7 +461,7 @@ Signed-off-by: Steven Barth if (nla_put_u32(skb, IFLA_IPTUN_LINK, parm->link) || nla_put_in6_addr(skb, IFLA_IPTUN_LOCAL, &parm->laddr) || -@@ -2071,9 +2309,27 @@ static int ip6_tnl_fill_info(struct sk_b +@@ -2072,9 +2310,27 @@ static int ip6_tnl_fill_info(struct sk_b nla_put_u8(skb, IFLA_IPTUN_ENCAP_LIMIT, parm->encap_limit) || nla_put_be32(skb, IFLA_IPTUN_FLOWINFO, parm->flowinfo) || nla_put_u32(skb, IFLA_IPTUN_FLAGS, parm->flags) || @@ -490,7 +490,7 @@ Signed-off-by: Steven Barth if (nla_put_u16(skb, IFLA_IPTUN_ENCAP_TYPE, tunnel->encap.type) || nla_put_be16(skb, IFLA_IPTUN_ENCAP_SPORT, tunnel->encap.sport) || nla_put_be16(skb, IFLA_IPTUN_ENCAP_DPORT, tunnel->encap.dport) || -@@ -2111,6 +2367,7 @@ static const struct nla_policy ip6_tnl_p +@@ -2112,6 +2368,7 @@ static const struct nla_policy ip6_tnl_p [IFLA_IPTUN_ENCAP_SPORT] = { .type = NLA_U16 }, [IFLA_IPTUN_ENCAP_DPORT] = { .type = NLA_U16 }, [IFLA_IPTUN_COLLECT_METADATA] = { .type = NLA_FLAG }, diff --git a/target/linux/generic/pending-4.9/701-phy_extension.patch b/target/linux/generic/pending-4.9/701-phy_extension.patch index b480b1d78d..4569336bf3 100644 --- a/target/linux/generic/pending-4.9/701-phy_extension.patch +++ b/target/linux/generic/pending-4.9/701-phy_extension.patch @@ -62,7 +62,7 @@ Signed-off-by: John Crispin * @phydev: the phy_device struct --- a/include/linux/phy.h +++ b/include/linux/phy.h -@@ -816,6 +816,7 @@ int phy_ethtool_ksettings_get(struct phy +@@ -827,6 +827,7 @@ int phy_ethtool_ksettings_get(struct phy struct ethtool_link_ksettings *cmd); int phy_ethtool_ksettings_set(struct phy_device *phydev, const struct ethtool_link_ksettings *cmd); -- cgit v1.2.3