Runtime-tested on ar71xx.
Fixes:
CVE-2016-2543
CVE-2017-12190
CVE-2017-15265
CVE-2017-15649
CVE-2017-15299
CVE-2017-12193
Signed-off-by: Zoltan HERPAI <wigyori@uid0.hu>
-LINUX_VERSION-3.18 = .75
+LINUX_VERSION-3.18 = .79
-LINUX_KERNEL_MD5SUM-3.18.75 = 7e49dc4c2e7abc4398172c04c431dbce
+LINUX_KERNEL_MD5SUM-3.18.79 = bcf26ceacb456577c72773185ee59f66
ifdef KERNEL_PATCHVER
LINUX_VERSION:=$(KERNEL_PATCHVER)$(strip $(LINUX_VERSION-$(KERNEL_PATCHVER)))
ifdef KERNEL_PATCHVER
LINUX_VERSION:=$(KERNEL_PATCHVER)$(strip $(LINUX_VERSION-$(KERNEL_PATCHVER)))
module_param_named(mousepoll, hid_mousepoll_interval, uint, 0644);
MODULE_PARM_DESC(mousepoll, "Polling interval of mice");
module_param_named(mousepoll, hid_mousepoll_interval, uint, 0644);
MODULE_PARM_DESC(mousepoll, "Polling interval of mice");
-@@ -1071,8 +1071,12 @@ static int usbhid_start(struct hid_devic
+@@ -1081,8 +1081,12 @@ static int usbhid_start(struct hid_devic
}
/* Change the polling interval of mice. */
}
/* Change the polling interval of mice. */
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
-@@ -4933,7 +4933,7 @@ static void port_event(struct usb_hub *h
+@@ -4936,7 +4936,7 @@ static void port_event(struct usb_hub *h
if (portchange & USB_PORT_STAT_C_OVERCURRENT) {
u16 status = 0, unused;
if (portchange & USB_PORT_STAT_C_OVERCURRENT) {
u16 status = 0, unused;
--- a/include/uapi/linux/spi/spidev.h
+++ b/include/uapi/linux/spi/spidev.h
--- a/include/uapi/linux/spi/spidev.h
+++ b/include/uapi/linux/spi/spidev.h
-@@ -111,7 +111,7 @@ struct spi_ioc_transfer {
+@@ -112,7 +112,7 @@ struct spi_ioc_transfer {
/* not all platforms use <asm-generic/ioctl.h> or _IOC_TYPECHECK() ... */
#define SPI_MSGSIZE(N) \
/* not all platforms use <asm-generic/ioctl.h> or _IOC_TYPECHECK() ... */
#define SPI_MSGSIZE(N) \
--- a/crypto/Kconfig
+++ b/crypto/Kconfig
--- a/crypto/Kconfig
+++ b/crypto/Kconfig
-@@ -1437,6 +1437,13 @@ config CRYPTO_LZ4HC
+@@ -1438,6 +1438,13 @@ config CRYPTO_LZ4HC
help
This is the LZ4 high compression mode algorithm.
help
This is the LZ4 high compression mode algorithm.
#define PACKET_FANOUT_LB 1
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
#define PACKET_FANOUT_LB 1
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
-@@ -1529,6 +1529,7 @@ static int packet_rcv_spkt(struct sk_buf
+@@ -1544,6 +1544,7 @@ static int packet_rcv_spkt(struct sk_buf
{
struct sock *sk;
struct sockaddr_pkt *spkt;
{
struct sock *sk;
struct sockaddr_pkt *spkt;
/*
* When we registered the protocol we saved the socket in the data
/*
* When we registered the protocol we saved the socket in the data
-@@ -1536,6 +1537,7 @@ static int packet_rcv_spkt(struct sk_buf
+@@ -1551,6 +1552,7 @@ static int packet_rcv_spkt(struct sk_buf
*/
sk = pt->af_packet_priv;
*/
sk = pt->af_packet_priv;
/*
* Yank back the headers [hope the device set this
/*
* Yank back the headers [hope the device set this
-@@ -1548,7 +1550,7 @@ static int packet_rcv_spkt(struct sk_buf
+@@ -1563,7 +1565,7 @@ static int packet_rcv_spkt(struct sk_buf
* so that this procedure is noop.
*/
* so that this procedure is noop.
*/
goto out;
if (!net_eq(dev_net(dev), sock_net(sk)))
goto out;
if (!net_eq(dev_net(dev), sock_net(sk)))
-@@ -1747,12 +1749,12 @@ static int packet_rcv(struct sk_buff *sk
+@@ -1762,12 +1764,12 @@ static int packet_rcv(struct sk_buff *sk
int skb_len = skb->len;
unsigned int snaplen, res;
int skb_len = skb->len;
unsigned int snaplen, res;
if (!net_eq(dev_net(dev), sock_net(sk)))
goto drop;
if (!net_eq(dev_net(dev), sock_net(sk)))
goto drop;
-@@ -1872,12 +1874,12 @@ static int tpacket_rcv(struct sk_buff *s
+@@ -1887,12 +1889,12 @@ static int tpacket_rcv(struct sk_buff *s
BUILD_BUG_ON(TPACKET_ALIGN(sizeof(*h.h2)) != 32);
BUILD_BUG_ON(TPACKET_ALIGN(sizeof(*h.h3)) != 48);
BUILD_BUG_ON(TPACKET_ALIGN(sizeof(*h.h2)) != 32);
BUILD_BUG_ON(TPACKET_ALIGN(sizeof(*h.h3)) != 48);
if (!net_eq(dev_net(dev), sock_net(sk)))
goto drop;
if (!net_eq(dev_net(dev), sock_net(sk)))
goto drop;
-@@ -2831,6 +2833,7 @@ static int packet_create(struct net *net
+@@ -2848,6 +2850,7 @@ static int packet_create(struct net *net
spin_lock_init(&po->bind_lock);
mutex_init(&po->pg_vec_lock);
po->prot_hook.func = packet_rcv;
spin_lock_init(&po->bind_lock);
mutex_init(&po->pg_vec_lock);
po->prot_hook.func = packet_rcv;
if (sock->type == SOCK_PACKET)
po->prot_hook.func = packet_rcv_spkt;
if (sock->type == SOCK_PACKET)
po->prot_hook.func = packet_rcv_spkt;
-@@ -3425,6 +3428,16 @@ packet_setsockopt(struct socket *sock, i
+@@ -3442,6 +3445,16 @@ packet_setsockopt(struct socket *sock, i
po->xmit = val ? packet_direct_xmit : dev_queue_xmit;
return 0;
}
po->xmit = val ? packet_direct_xmit : dev_queue_xmit;
return 0;
}
default:
return -ENOPROTOOPT;
}
default:
return -ENOPROTOOPT;
}
-@@ -3476,6 +3489,13 @@ static int packet_getsockopt(struct sock
+@@ -3493,6 +3506,13 @@ static int packet_getsockopt(struct sock
case PACKET_VNET_HDR:
val = po->has_vnet_hdr;
break;
case PACKET_VNET_HDR:
val = po->has_vnet_hdr;
break;
goto err;
--- a/net/core/sock.c
+++ b/net/core/sock.c
goto err;
--- a/net/core/sock.c
+++ b/net/core/sock.c
-@@ -2939,6 +2939,8 @@ static __net_initdata struct pernet_oper
+@@ -2941,6 +2941,8 @@ static __net_initdata struct pernet_oper
static int __init proto_init(void)
{
static int __init proto_init(void)
{
--- a/crypto/Kconfig
+++ b/crypto/Kconfig
--- a/crypto/Kconfig
+++ b/crypto/Kconfig
-@@ -1519,3 +1519,6 @@ source "drivers/crypto/Kconfig"
+@@ -1520,3 +1520,6 @@ source "drivers/crypto/Kconfig"
source crypto/asymmetric_keys/Kconfig
endif # if CRYPTO
source crypto/asymmetric_keys/Kconfig
endif # if CRYPTO
choice
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
choice
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
-@@ -4320,7 +4320,7 @@ hub_port_init (struct usb_hub *hub, stru
+@@ -4323,7 +4323,7 @@ hub_port_init (struct usb_hub *hub, stru
udev->ttport = hdev->ttport;
} else if (udev->speed != USB_SPEED_HIGH
&& hdev->speed == USB_SPEED_HIGH) {
udev->ttport = hdev->ttport;
} else if (udev->speed != USB_SPEED_HIGH
&& hdev->speed == USB_SPEED_HIGH) {