kernel: bump 4.4 to 4.4.112

Refresh patches.
Remove upstreamed patches:

target/linux/generic/patches-4.4/030-2-smsc75xx-use-skb_cow_head-to-deal-with-cloned-skbs.patch
target/linux/generic/patches-4.4/030-3-cx82310_eth-use-skb_cow_head-to-deal-with-cloned-skb.patch
target/linux/generic/patches-4.4/030-4-sr9700-use-skb_cow_head-to-deal-with-cloned-skbs.patch
target/linux/generic/patches-4.4/030-5-lan78xx-use-skb_cow_head-to-deal-with-cloned-skbs.patch

CVEs completely or partially addressed:

CVE-2017-5715
CVE-2017-5753
CVE-2017-17741
CVE-2017-1000410

Compile-tested: ar71xx Archer C7 v2
Run-tested: ar71xx Archer C7 v2

Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>

12 files changed, 19 insertions, 165 deletions

diff --git a/include/kernel-version.mk b/include/kernel-version.mk
index fdfbbe9a57..6103cee63a 100644
--- a/include/kernel-version.mk
+++ b/include/kernel-version.mk
@@ -3,12 +3,12 @@
 LINUX_RELEASE?=1
 
 LINUX_VERSION-3.18 = .71
-LINUX_VERSION-4.4 = .111
+LINUX_VERSION-4.4 = .112
 LINUX_VERSION-4.9 = .77
 LINUX_VERSION-4.14 = .14
 
 LINUX_KERNEL_HASH-3.18.71 = 5abc9778ad44ce02ed6c8ab52ece8a21c6d20d21f6ed8a19287b4a38a50c1240
-LINUX_KERNEL_HASH-4.4.111 = a201282e8eaf62b4f51edb2241e98ff805fe2d1b04a72a2328c5a6e2d77ec008
+LINUX_KERNEL_HASH-4.4.112 = 544b42cbeed022896115c76a18fc97b4507d5b41d7ac0ce1dce9afd6ffd11ecd
 LINUX_KERNEL_HASH-4.9.77 = 7c29bc3fb96f1e23d98f664e786dddd53a1599f56431b9b7fdfba402a4b3705c
 LINUX_KERNEL_HASH-4.14.14 = 8b96362eb55ae152555980e7193fe2585b487176fb936cc69b8947d7dd32044a
 
diff --git a/target/linux/ar71xx/patches-4.4/910-unaligned_access_hacks.patch b/target/linux/ar71xx/patches-4.4/910-unaligned_access_hacks.patch
index 8882b1758f..a8d8c15c3b 100644
--- a/target/linux/ar71xx/patches-4.4/910-unaligned_access_hacks.patch
+++ b/target/linux/ar71xx/patches-4.4/910-unaligned_access_hacks.patch
@@ -310,7 +310,7 @@
  	if (t->parms.flags & IP6_TNL_F_USE_ORIG_FWMARK)
 --- a/net/ipv6/ip6_tunnel.c
 +++ b/net/ipv6/ip6_tunnel.c
-@@ -1409,7 +1409,7 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, str
+@@ -1410,7 +1410,7 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, str
  
  	dsfield = ipv6_get_dsfield(ipv6h);
  	if (t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS)
diff --git a/target/linux/generic/pending-4.4/030-2-smsc75xx-use-skb_cow_head-to-deal-with-cloned-skbs.patch b/target/linux/generic/pending-4.4/030-2-smsc75xx-use-skb_cow_head-to-deal-with-cloned-skbs.patch
deleted file mode 100644
index 6312f0f731..0000000000
--- a/target/linux/generic/pending-4.4/030-2-smsc75xx-use-skb_cow_head-to-deal-with-cloned-skbs.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From b7c6d2675899cfff0180412c63fc9cbd5bacdb4d Mon Sep 17 00:00:00 2001
-From: Eric Dumazet <edumazet@google.com>
-Date: Wed, 19 Apr 2017 09:59:21 -0700
-Subject: [PATCH] smsc75xx: use skb_cow_head() to deal with cloned skbs
-
-We need to ensure there is enough headroom to push extra header,
-but we also need to check if we are allowed to change headers.
-
-skb_cow_head() is the proper helper to deal with this.
-
-Fixes: d0cad871703b ("smsc75xx: SMSC LAN75xx USB gigabit ethernet adapter driver")
-Signed-off-by: Eric Dumazet <edumazet@google.com>
-Cc: James Hughes <james.hughes@raspberrypi.org>
-Signed-off-by: David S. Miller <davem@davemloft.net>
----
- drivers/net/usb/smsc75xx.c | 8 ++------
- 1 file changed, 2 insertions(+), 6 deletions(-)
-
---- a/drivers/net/usb/smsc75xx.c
-+++ b/drivers/net/usb/smsc75xx.c
-@@ -2193,13 +2193,9 @@ static struct sk_buff *smsc75xx_tx_fixup
- {
- 	u32 tx_cmd_a, tx_cmd_b;
- 
--	if (skb_headroom(skb) < SMSC75XX_TX_OVERHEAD) {
--		struct sk_buff *skb2 =
--			skb_copy_expand(skb, SMSC75XX_TX_OVERHEAD, 0, flags);
-+	if (skb_cow_head(skb, SMSC75XX_TX_OVERHEAD)) {
- 		dev_kfree_skb_any(skb);
--		skb = skb2;
--		if (!skb)
--			return NULL;
-+		return NULL;
- 	}
- 
- 	tx_cmd_a = (u32)(skb->len & TX_CMD_A_LEN) | TX_CMD_A_FCS;
diff --git a/target/linux/generic/pending-4.4/030-3-cx82310_eth-use-skb_cow_head-to-deal-with-cloned-skb.patch b/target/linux/generic/pending-4.4/030-3-cx82310_eth-use-skb_cow_head-to-deal-with-cloned-skb.patch
deleted file mode 100644
index aee8aa9805..0000000000
--- a/target/linux/generic/pending-4.4/030-3-cx82310_eth-use-skb_cow_head-to-deal-with-cloned-skb.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-From a9e840a2081ed28c2b7caa6a9a0041c950b3c37d Mon Sep 17 00:00:00 2001
-From: Eric Dumazet <edumazet@google.com>
-Date: Wed, 19 Apr 2017 09:59:22 -0700
-Subject: [PATCH] cx82310_eth: use skb_cow_head() to deal with cloned skbs
-
-We need to ensure there is enough headroom to push extra header,
-but we also need to check if we are allowed to change headers.
-
-skb_cow_head() is the proper helper to deal with this.
-
-Fixes: cc28a20e77b2 ("introduce cx82310_eth: Conexant CX82310-based ADSL router USB ethernet driver")
-Signed-off-by: Eric Dumazet <edumazet@google.com>
-Cc: James Hughes <james.hughes@raspberrypi.org>
-Signed-off-by: David S. Miller <davem@davemloft.net>
----
- drivers/net/usb/cx82310_eth.c | 7 ++-----
- 1 file changed, 2 insertions(+), 5 deletions(-)
-
---- a/drivers/net/usb/cx82310_eth.c
-+++ b/drivers/net/usb/cx82310_eth.c
-@@ -293,12 +293,9 @@ static struct sk_buff *cx82310_tx_fixup(
- {
- 	int len = skb->len;
- 
--	if (skb_headroom(skb) < 2) {
--		struct sk_buff *skb2 = skb_copy_expand(skb, 2, 0, flags);
-+	if (skb_cow_head(skb, 2)) {
- 		dev_kfree_skb_any(skb);
--		skb = skb2;
--		if (!skb)
--			return NULL;
-+		return NULL;
- 	}
- 	skb_push(skb, 2);
- 
diff --git a/target/linux/generic/pending-4.4/030-4-sr9700-use-skb_cow_head-to-deal-with-cloned-skbs.patch b/target/linux/generic/pending-4.4/030-4-sr9700-use-skb_cow_head-to-deal-with-cloned-skbs.patch
deleted file mode 100644
index 4d0fcf6fc2..0000000000
--- a/target/linux/generic/pending-4.4/030-4-sr9700-use-skb_cow_head-to-deal-with-cloned-skbs.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From d532c1082f68176363ed766d09bf187616e282fe Mon Sep 17 00:00:00 2001
-From: Eric Dumazet <edumazet@google.com>
-Date: Wed, 19 Apr 2017 09:59:23 -0700
-Subject: [PATCH] sr9700: use skb_cow_head() to deal with cloned skbs
-
-We need to ensure there is enough headroom to push extra header,
-but we also need to check if we are allowed to change headers.
-
-skb_cow_head() is the proper helper to deal with this.
-
-Fixes: c9b37458e956 ("USB2NET : SR9700 : One chip USB 1.1 USB2NET SR9700Device Driver Support")
-Signed-off-by: Eric Dumazet <edumazet@google.com>
-Cc: James Hughes <james.hughes@raspberrypi.org>
-Signed-off-by: David S. Miller <davem@davemloft.net>
----
- drivers/net/usb/sr9700.c | 9 ++-------
- 1 file changed, 2 insertions(+), 7 deletions(-)
-
---- a/drivers/net/usb/sr9700.c
-+++ b/drivers/net/usb/sr9700.c
-@@ -456,14 +456,9 @@ static struct sk_buff *sr9700_tx_fixup(s
- 
- 	len = skb->len;
- 
--	if (skb_headroom(skb) < SR_TX_OVERHEAD) {
--		struct sk_buff *skb2;
--
--		skb2 = skb_copy_expand(skb, SR_TX_OVERHEAD, 0, flags);
-+	if (skb_cow_head(skb, SR_TX_OVERHEAD)) {
- 		dev_kfree_skb_any(skb);
--		skb = skb2;
--		if (!skb)
--			return NULL;
-+		return NULL;
- 	}
- 
- 	__skb_push(skb, SR_TX_OVERHEAD);
diff --git a/target/linux/generic/pending-4.4/030-5-lan78xx-use-skb_cow_head-to-deal-with-cloned-skbs.patch b/target/linux/generic/pending-4.4/030-5-lan78xx-use-skb_cow_head-to-deal-with-cloned-skbs.patch
deleted file mode 100644
index 4f96041648..0000000000
--- a/target/linux/generic/pending-4.4/030-5-lan78xx-use-skb_cow_head-to-deal-with-cloned-skbs.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From d4ca73591916b760478d2b04334d5dcadc028e9c Mon Sep 17 00:00:00 2001
-From: Eric Dumazet <edumazet@google.com>
-Date: Wed, 19 Apr 2017 09:59:24 -0700
-Subject: [PATCH] lan78xx: use skb_cow_head() to deal with cloned skbs
-
-We need to ensure there is enough headroom to push extra header,
-but we also need to check if we are allowed to change headers.
-
-skb_cow_head() is the proper helper to deal with this.
-
-Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver")
-Signed-off-by: Eric Dumazet <edumazet@google.com>
-Cc: James Hughes <james.hughes@raspberrypi.org>
-Cc: Woojung Huh <woojung.huh@microchip.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
----
- drivers/net/usb/lan78xx.c | 9 ++-------
- 1 file changed, 2 insertions(+), 7 deletions(-)
-
---- a/drivers/net/usb/lan78xx.c
-+++ b/drivers/net/usb/lan78xx.c
-@@ -2050,14 +2050,9 @@ static struct sk_buff *lan78xx_tx_prep(s
- {
- 	u32 tx_cmd_a, tx_cmd_b;
- 
--	if (skb_headroom(skb) < TX_OVERHEAD) {
--		struct sk_buff *skb2;
--
--		skb2 = skb_copy_expand(skb, TX_OVERHEAD, 0, flags);
-+	if (skb_cow_head(skb, TX_OVERHEAD)) {
- 		dev_kfree_skb_any(skb);
--		skb = skb2;
--		if (!skb)
--			return NULL;
-+		return NULL;
- 	}
- 
- 	if (lan78xx_linearize(skb) < 0)
diff --git a/target/linux/generic/pending-4.4/666-Add-support-for-MAP-E-FMRs-mesh-mode.patch b/target/linux/generic/pending-4.4/666-Add-support-for-MAP-E-FMRs-mesh-mode.patch
index c402e04291..303d831214 100644
--- a/target/linux/generic/pending-4.4/666-Add-support-for-MAP-E-FMRs-mesh-mode.patch
+++ b/target/linux/generic/pending-4.4/666-Add-support-for-MAP-E-FMRs-mesh-mode.patch
@@ -296,7 +296,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  
  		__skb_tunnel_rx(skb, t->dev, t->net);
  
-@@ -1247,6 +1384,7 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, str
+@@ -1248,6 +1385,7 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, str
  	__u32 mtu;
  	u8 tproto;
  	int err;
@@ -304,7 +304,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  
  	tproto = ACCESS_ONCE(t->parms.proto);
  	if ((tproto != IPPROTO_IPV6 && tproto != 0) ||
-@@ -1277,6 +1415,18 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, str
+@@ -1278,6 +1416,18 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, str
  	if (t->parms.flags & IP6_TNL_F_USE_ORIG_FWMARK)
  		fl6.flowi6_mark = skb->mark;
  
@@ -323,7 +323,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  	err = ip6_tnl_xmit2(skb, dev, dsfield, &fl6, encap_limit, &mtu);
  	if (err != 0) {
  		if (err == -EMSGSIZE)
-@@ -1391,6 +1541,14 @@ ip6_tnl_change(struct ip6_tnl *t, const
+@@ -1392,6 +1542,14 @@ ip6_tnl_change(struct ip6_tnl *t, const
  	t->parms.flowinfo = p->flowinfo;
  	t->parms.link = p->link;
  	t->parms.proto = p->proto;
@@ -338,7 +338,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  	ip6_tnl_dst_reset(t);
  	ip6_tnl_link_config(t);
  	return 0;
-@@ -1429,6 +1587,7 @@ ip6_tnl_parm_from_user(struct __ip6_tnl_
+@@ -1430,6 +1588,7 @@ ip6_tnl_parm_from_user(struct __ip6_tnl_
  	p->flowinfo = u->flowinfo;
  	p->link = u->link;
  	p->proto = u->proto;
@@ -346,7 +346,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  	memcpy(p->name, u->name, sizeof(u->name));
  }
  
-@@ -1724,6 +1883,15 @@ static int ip6_tnl_validate(struct nlatt
+@@ -1725,6 +1884,15 @@ static int ip6_tnl_validate(struct nlatt
  	return 0;
  }
  
@@ -362,7 +362,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  static void ip6_tnl_netlink_parms(struct nlattr *data[],
  				  struct __ip6_tnl_parm *parms)
  {
-@@ -1755,6 +1923,46 @@ static void ip6_tnl_netlink_parms(struct
+@@ -1756,6 +1924,46 @@ static void ip6_tnl_netlink_parms(struct
  
  	if (data[IFLA_IPTUN_PROTO])
  		parms->proto = nla_get_u8(data[IFLA_IPTUN_PROTO]);
@@ -409,7 +409,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  }
  
  static int ip6_tnl_newlink(struct net *src_net, struct net_device *dev,
-@@ -1807,6 +2015,12 @@ static void ip6_tnl_dellink(struct net_d
+@@ -1808,6 +2016,12 @@ static void ip6_tnl_dellink(struct net_d
  
  static size_t ip6_tnl_get_size(const struct net_device *dev)
  {
@@ -422,7 +422,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  	return
  		/* IFLA_IPTUN_LINK */
  		nla_total_size(4) +
-@@ -1824,6 +2038,24 @@ static size_t ip6_tnl_get_size(const str
+@@ -1825,6 +2039,24 @@ static size_t ip6_tnl_get_size(const str
  		nla_total_size(4) +
  		/* IFLA_IPTUN_PROTO */
  		nla_total_size(1) +
@@ -447,7 +447,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  		0;
  }
  
-@@ -1831,6 +2063,9 @@ static int ip6_tnl_fill_info(struct sk_b
+@@ -1832,6 +2064,9 @@ static int ip6_tnl_fill_info(struct sk_b
  {
  	struct ip6_tnl *tunnel = netdev_priv(dev);
  	struct __ip6_tnl_parm *parm = &tunnel->parms;
@@ -457,7 +457,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  
  	if (nla_put_u32(skb, IFLA_IPTUN_LINK, parm->link) ||
  	    nla_put_in6_addr(skb, IFLA_IPTUN_LOCAL, &parm->laddr) ||
-@@ -1839,8 +2074,27 @@ static int ip6_tnl_fill_info(struct sk_b
+@@ -1840,8 +2075,27 @@ static int ip6_tnl_fill_info(struct sk_b
  	    nla_put_u8(skb, IFLA_IPTUN_ENCAP_LIMIT, parm->encap_limit) ||
  	    nla_put_be32(skb, IFLA_IPTUN_FLOWINFO, parm->flowinfo) ||
  	    nla_put_u32(skb, IFLA_IPTUN_FLAGS, parm->flags) ||
@@ -486,7 +486,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  	return 0;
  
  nla_put_failure:
-@@ -1864,6 +2118,7 @@ static const struct nla_policy ip6_tnl_p
+@@ -1865,6 +2119,7 @@ static const struct nla_policy ip6_tnl_p
  	[IFLA_IPTUN_FLOWINFO]		= { .type = NLA_U32 },
  	[IFLA_IPTUN_FLAGS]		= { .type = NLA_U32 },
  	[IFLA_IPTUN_PROTO]		= { .type = NLA_U8 },
diff --git a/target/linux/generic/pending-4.4/701-phy_extension.patch b/target/linux/generic/pending-4.4/701-phy_extension.patch
index 6cb3fdfd44..39b8fd4660 100644
--- a/target/linux/generic/pending-4.4/701-phy_extension.patch
+++ b/target/linux/generic/pending-4.4/701-phy_extension.patch
@@ -53,7 +53,7 @@
   * @phydev: the phy_device struct
 --- a/include/linux/phy.h
 +++ b/include/linux/phy.h
-@@ -796,6 +796,7 @@ void phy_start_machine(struct phy_device
+@@ -807,6 +807,7 @@ void phy_start_machine(struct phy_device
  void phy_stop_machine(struct phy_device *phydev);
  int phy_ethtool_sset(struct phy_device *phydev, struct ethtool_cmd *cmd);
  int phy_ethtool_gset(struct phy_device *phydev, struct ethtool_cmd *cmd);
diff --git a/target/linux/generic/pending-4.4/710-phy-add-mdio_register_board_info.patch b/target/linux/generic/pending-4.4/710-phy-add-mdio_register_board_info.patch
index 4886dd0e3a..d78f3d48a7 100644
--- a/target/linux/generic/pending-4.4/710-phy-add-mdio_register_board_info.patch
+++ b/target/linux/generic/pending-4.4/710-phy-add-mdio_register_board_info.patch
@@ -46,7 +46,7 @@
  		phy_device_free(phydev);
 --- a/include/linux/phy.h
 +++ b/include/linux/phy.h
-@@ -835,6 +835,23 @@ void mdio_bus_exit(void);
+@@ -846,6 +846,23 @@ void mdio_bus_exit(void);
  
  extern struct bus_type mdio_bus_type;
  
diff --git a/target/linux/generic/pending-4.4/902-debloat_proc.patch b/target/linux/generic/pending-4.4/902-debloat_proc.patch
index f7718bc5bf..4f874e5986 100644
--- a/target/linux/generic/pending-4.4/902-debloat_proc.patch
+++ b/target/linux/generic/pending-4.4/902-debloat_proc.patch
@@ -1,6 +1,6 @@
 --- a/fs/locks.c
 +++ b/fs/locks.c
-@@ -2712,6 +2712,8 @@ static const struct file_operations proc
+@@ -2716,6 +2716,8 @@ static const struct file_operations proc
  
  static int __init proc_locks_init(void)
  {
diff --git a/target/linux/generic/pending-4.4/904-debloat_dma_buf.patch b/target/linux/generic/pending-4.4/904-debloat_dma_buf.patch
index eac39669d0..b9fdad9c1b 100644
--- a/target/linux/generic/pending-4.4/904-debloat_dma_buf.patch
+++ b/target/linux/generic/pending-4.4/904-debloat_dma_buf.patch
@@ -1,6 +1,6 @@
 --- a/drivers/base/Kconfig
 +++ b/drivers/base/Kconfig
-@@ -229,7 +229,7 @@ config SOC_BUS
+@@ -232,7 +232,7 @@ config SOC_BUS
  source "drivers/base/regmap/Kconfig"
  
  config DMA_SHARED_BUFFER
diff --git a/target/linux/mvebu/patches-4.4/128-phy-export-phy_speed_to_str-for-phylink.patch b/target/linux/mvebu/patches-4.4/128-phy-export-phy_speed_to_str-for-phylink.patch
index c43607029c..4fa8a6afb6 100644
--- a/target/linux/mvebu/patches-4.4/128-phy-export-phy_speed_to_str-for-phylink.patch
+++ b/target/linux/mvebu/patches-4.4/128-phy-export-phy_speed_to_str-for-phylink.patch
@@ -34,7 +34,7 @@ Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
  	case PHY_##_state:			\
 --- a/include/linux/phy.h
 +++ b/include/linux/phy.h
-@@ -812,6 +812,7 @@ int phy_ethtool_gset(struct phy_device *
+@@ -823,6 +823,7 @@ int phy_ethtool_gset(struct phy_device *
  int phy_ethtool_ioctl(struct phy_device *phydev, void *useraddr);
  int phy_mii_ioctl(struct phy_device *phydev, struct ifreq *ifr, int cmd);
  int phy_start_interrupts(struct phy_device *phydev);