kernel: bump 4.4 to 4.4.112
authorKevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
Thu, 18 Jan 2018 15:01:19 +0000 (15:01 +0000)
committerHauke Mehrtens <hauke@hauke-m.de>
Sat, 20 Jan 2018 19:22:01 +0000 (20:22 +0100)
Refresh patches.
Remove upstreamed patches:

target/linux/generic/patches-4.4/030-2-smsc75xx-use-skb_cow_head-to-deal-with-cloned-skbs.patch
target/linux/generic/patches-4.4/030-3-cx82310_eth-use-skb_cow_head-to-deal-with-cloned-skb.patch
target/linux/generic/patches-4.4/030-4-sr9700-use-skb_cow_head-to-deal-with-cloned-skbs.patch
target/linux/generic/patches-4.4/030-5-lan78xx-use-skb_cow_head-to-deal-with-cloned-skbs.patch

CVEs completely or partially addressed:

CVE-2017-5715
CVE-2017-5753
CVE-2017-17741
CVE-2017-1000410

Compile-tested: ar71xx Archer C7 v2
Run-tested: ar71xx Archer C7 v2

Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
12 files changed:
include/kernel-version.mk
target/linux/ar71xx/patches-4.4/910-unaligned_access_hacks.patch
target/linux/generic/pending-4.4/030-2-smsc75xx-use-skb_cow_head-to-deal-with-cloned-skbs.patch [deleted file]
target/linux/generic/pending-4.4/030-3-cx82310_eth-use-skb_cow_head-to-deal-with-cloned-skb.patch [deleted file]
target/linux/generic/pending-4.4/030-4-sr9700-use-skb_cow_head-to-deal-with-cloned-skbs.patch [deleted file]
target/linux/generic/pending-4.4/030-5-lan78xx-use-skb_cow_head-to-deal-with-cloned-skbs.patch [deleted file]
target/linux/generic/pending-4.4/666-Add-support-for-MAP-E-FMRs-mesh-mode.patch
target/linux/generic/pending-4.4/701-phy_extension.patch
target/linux/generic/pending-4.4/710-phy-add-mdio_register_board_info.patch
target/linux/generic/pending-4.4/902-debloat_proc.patch
target/linux/generic/pending-4.4/904-debloat_dma_buf.patch
target/linux/mvebu/patches-4.4/128-phy-export-phy_speed_to_str-for-phylink.patch

index fdfbbe9..6103cee 100644 (file)
@@ -3,12 +3,12 @@
 LINUX_RELEASE?=1
 
 LINUX_VERSION-3.18 = .71
-LINUX_VERSION-4.4 = .111
+LINUX_VERSION-4.4 = .112
 LINUX_VERSION-4.9 = .77
 LINUX_VERSION-4.14 = .14
 
 LINUX_KERNEL_HASH-3.18.71 = 5abc9778ad44ce02ed6c8ab52ece8a21c6d20d21f6ed8a19287b4a38a50c1240
-LINUX_KERNEL_HASH-4.4.111 = a201282e8eaf62b4f51edb2241e98ff805fe2d1b04a72a2328c5a6e2d77ec008
+LINUX_KERNEL_HASH-4.4.112 = 544b42cbeed022896115c76a18fc97b4507d5b41d7ac0ce1dce9afd6ffd11ecd
 LINUX_KERNEL_HASH-4.9.77 = 7c29bc3fb96f1e23d98f664e786dddd53a1599f56431b9b7fdfba402a4b3705c
 LINUX_KERNEL_HASH-4.14.14 = 8b96362eb55ae152555980e7193fe2585b487176fb936cc69b8947d7dd32044a
 
index 8882b17..a8d8c15 100644 (file)
        if (t->parms.flags & IP6_TNL_F_USE_ORIG_FWMARK)
 --- a/net/ipv6/ip6_tunnel.c
 +++ b/net/ipv6/ip6_tunnel.c
-@@ -1409,7 +1409,7 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, str
+@@ -1410,7 +1410,7 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, str
  
        dsfield = ipv6_get_dsfield(ipv6h);
        if (t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS)
diff --git a/target/linux/generic/pending-4.4/030-2-smsc75xx-use-skb_cow_head-to-deal-with-cloned-skbs.patch b/target/linux/generic/pending-4.4/030-2-smsc75xx-use-skb_cow_head-to-deal-with-cloned-skbs.patch
deleted file mode 100644 (file)
index 6312f0f..0000000
+++ /dev/null
@@ -1,36 +0,0 @@
-From b7c6d2675899cfff0180412c63fc9cbd5bacdb4d Mon Sep 17 00:00:00 2001
-From: Eric Dumazet <edumazet@google.com>
-Date: Wed, 19 Apr 2017 09:59:21 -0700
-Subject: [PATCH] smsc75xx: use skb_cow_head() to deal with cloned skbs
-
-We need to ensure there is enough headroom to push extra header,
-but we also need to check if we are allowed to change headers.
-
-skb_cow_head() is the proper helper to deal with this.
-
-Fixes: d0cad871703b ("smsc75xx: SMSC LAN75xx USB gigabit ethernet adapter driver")
-Signed-off-by: Eric Dumazet <edumazet@google.com>
-Cc: James Hughes <james.hughes@raspberrypi.org>
-Signed-off-by: David S. Miller <davem@davemloft.net>
----
- drivers/net/usb/smsc75xx.c | 8 ++------
- 1 file changed, 2 insertions(+), 6 deletions(-)
-
---- a/drivers/net/usb/smsc75xx.c
-+++ b/drivers/net/usb/smsc75xx.c
-@@ -2193,13 +2193,9 @@ static struct sk_buff *smsc75xx_tx_fixup
- {
-       u32 tx_cmd_a, tx_cmd_b;
--      if (skb_headroom(skb) < SMSC75XX_TX_OVERHEAD) {
--              struct sk_buff *skb2 =
--                      skb_copy_expand(skb, SMSC75XX_TX_OVERHEAD, 0, flags);
-+      if (skb_cow_head(skb, SMSC75XX_TX_OVERHEAD)) {
-               dev_kfree_skb_any(skb);
--              skb = skb2;
--              if (!skb)
--                      return NULL;
-+              return NULL;
-       }
-       tx_cmd_a = (u32)(skb->len & TX_CMD_A_LEN) | TX_CMD_A_FCS;
diff --git a/target/linux/generic/pending-4.4/030-3-cx82310_eth-use-skb_cow_head-to-deal-with-cloned-skb.patch b/target/linux/generic/pending-4.4/030-3-cx82310_eth-use-skb_cow_head-to-deal-with-cloned-skb.patch
deleted file mode 100644 (file)
index aee8aa9..0000000
+++ /dev/null
@@ -1,35 +0,0 @@
-From a9e840a2081ed28c2b7caa6a9a0041c950b3c37d Mon Sep 17 00:00:00 2001
-From: Eric Dumazet <edumazet@google.com>
-Date: Wed, 19 Apr 2017 09:59:22 -0700
-Subject: [PATCH] cx82310_eth: use skb_cow_head() to deal with cloned skbs
-
-We need to ensure there is enough headroom to push extra header,
-but we also need to check if we are allowed to change headers.
-
-skb_cow_head() is the proper helper to deal with this.
-
-Fixes: cc28a20e77b2 ("introduce cx82310_eth: Conexant CX82310-based ADSL router USB ethernet driver")
-Signed-off-by: Eric Dumazet <edumazet@google.com>
-Cc: James Hughes <james.hughes@raspberrypi.org>
-Signed-off-by: David S. Miller <davem@davemloft.net>
----
- drivers/net/usb/cx82310_eth.c | 7 ++-----
- 1 file changed, 2 insertions(+), 5 deletions(-)
-
---- a/drivers/net/usb/cx82310_eth.c
-+++ b/drivers/net/usb/cx82310_eth.c
-@@ -293,12 +293,9 @@ static struct sk_buff *cx82310_tx_fixup(
- {
-       int len = skb->len;
--      if (skb_headroom(skb) < 2) {
--              struct sk_buff *skb2 = skb_copy_expand(skb, 2, 0, flags);
-+      if (skb_cow_head(skb, 2)) {
-               dev_kfree_skb_any(skb);
--              skb = skb2;
--              if (!skb)
--                      return NULL;
-+              return NULL;
-       }
-       skb_push(skb, 2);
diff --git a/target/linux/generic/pending-4.4/030-4-sr9700-use-skb_cow_head-to-deal-with-cloned-skbs.patch b/target/linux/generic/pending-4.4/030-4-sr9700-use-skb_cow_head-to-deal-with-cloned-skbs.patch
deleted file mode 100644 (file)
index 4d0fcf6..0000000
+++ /dev/null
@@ -1,37 +0,0 @@
-From d532c1082f68176363ed766d09bf187616e282fe Mon Sep 17 00:00:00 2001
-From: Eric Dumazet <edumazet@google.com>
-Date: Wed, 19 Apr 2017 09:59:23 -0700
-Subject: [PATCH] sr9700: use skb_cow_head() to deal with cloned skbs
-
-We need to ensure there is enough headroom to push extra header,
-but we also need to check if we are allowed to change headers.
-
-skb_cow_head() is the proper helper to deal with this.
-
-Fixes: c9b37458e956 ("USB2NET : SR9700 : One chip USB 1.1 USB2NET SR9700Device Driver Support")
-Signed-off-by: Eric Dumazet <edumazet@google.com>
-Cc: James Hughes <james.hughes@raspberrypi.org>
-Signed-off-by: David S. Miller <davem@davemloft.net>
----
- drivers/net/usb/sr9700.c | 9 ++-------
- 1 file changed, 2 insertions(+), 7 deletions(-)
-
---- a/drivers/net/usb/sr9700.c
-+++ b/drivers/net/usb/sr9700.c
-@@ -456,14 +456,9 @@ static struct sk_buff *sr9700_tx_fixup(s
-       len = skb->len;
--      if (skb_headroom(skb) < SR_TX_OVERHEAD) {
--              struct sk_buff *skb2;
--
--              skb2 = skb_copy_expand(skb, SR_TX_OVERHEAD, 0, flags);
-+      if (skb_cow_head(skb, SR_TX_OVERHEAD)) {
-               dev_kfree_skb_any(skb);
--              skb = skb2;
--              if (!skb)
--                      return NULL;
-+              return NULL;
-       }
-       __skb_push(skb, SR_TX_OVERHEAD);
diff --git a/target/linux/generic/pending-4.4/030-5-lan78xx-use-skb_cow_head-to-deal-with-cloned-skbs.patch b/target/linux/generic/pending-4.4/030-5-lan78xx-use-skb_cow_head-to-deal-with-cloned-skbs.patch
deleted file mode 100644 (file)
index 4f96041..0000000
+++ /dev/null
@@ -1,38 +0,0 @@
-From d4ca73591916b760478d2b04334d5dcadc028e9c Mon Sep 17 00:00:00 2001
-From: Eric Dumazet <edumazet@google.com>
-Date: Wed, 19 Apr 2017 09:59:24 -0700
-Subject: [PATCH] lan78xx: use skb_cow_head() to deal with cloned skbs
-
-We need to ensure there is enough headroom to push extra header,
-but we also need to check if we are allowed to change headers.
-
-skb_cow_head() is the proper helper to deal with this.
-
-Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver")
-Signed-off-by: Eric Dumazet <edumazet@google.com>
-Cc: James Hughes <james.hughes@raspberrypi.org>
-Cc: Woojung Huh <woojung.huh@microchip.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
----
- drivers/net/usb/lan78xx.c | 9 ++-------
- 1 file changed, 2 insertions(+), 7 deletions(-)
-
---- a/drivers/net/usb/lan78xx.c
-+++ b/drivers/net/usb/lan78xx.c
-@@ -2050,14 +2050,9 @@ static struct sk_buff *lan78xx_tx_prep(s
- {
-       u32 tx_cmd_a, tx_cmd_b;
--      if (skb_headroom(skb) < TX_OVERHEAD) {
--              struct sk_buff *skb2;
--
--              skb2 = skb_copy_expand(skb, TX_OVERHEAD, 0, flags);
-+      if (skb_cow_head(skb, TX_OVERHEAD)) {
-               dev_kfree_skb_any(skb);
--              skb = skb2;
--              if (!skb)
--                      return NULL;
-+              return NULL;
-       }
-       if (lan78xx_linearize(skb) < 0)
index c402e04..303d831 100644 (file)
@@ -296,7 +296,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  
                __skb_tunnel_rx(skb, t->dev, t->net);
  
-@@ -1247,6 +1384,7 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, str
+@@ -1248,6 +1385,7 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, str
        __u32 mtu;
        u8 tproto;
        int err;
@@ -304,7 +304,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  
        tproto = ACCESS_ONCE(t->parms.proto);
        if ((tproto != IPPROTO_IPV6 && tproto != 0) ||
-@@ -1277,6 +1415,18 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, str
+@@ -1278,6 +1416,18 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, str
        if (t->parms.flags & IP6_TNL_F_USE_ORIG_FWMARK)
                fl6.flowi6_mark = skb->mark;
  
@@ -323,7 +323,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
        err = ip6_tnl_xmit2(skb, dev, dsfield, &fl6, encap_limit, &mtu);
        if (err != 0) {
                if (err == -EMSGSIZE)
-@@ -1391,6 +1541,14 @@ ip6_tnl_change(struct ip6_tnl *t, const
+@@ -1392,6 +1542,14 @@ ip6_tnl_change(struct ip6_tnl *t, const
        t->parms.flowinfo = p->flowinfo;
        t->parms.link = p->link;
        t->parms.proto = p->proto;
@@ -338,7 +338,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
        ip6_tnl_dst_reset(t);
        ip6_tnl_link_config(t);
        return 0;
-@@ -1429,6 +1587,7 @@ ip6_tnl_parm_from_user(struct __ip6_tnl_
+@@ -1430,6 +1588,7 @@ ip6_tnl_parm_from_user(struct __ip6_tnl_
        p->flowinfo = u->flowinfo;
        p->link = u->link;
        p->proto = u->proto;
@@ -346,7 +346,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
        memcpy(p->name, u->name, sizeof(u->name));
  }
  
-@@ -1724,6 +1883,15 @@ static int ip6_tnl_validate(struct nlatt
+@@ -1725,6 +1884,15 @@ static int ip6_tnl_validate(struct nlatt
        return 0;
  }
  
@@ -362,7 +362,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  static void ip6_tnl_netlink_parms(struct nlattr *data[],
                                  struct __ip6_tnl_parm *parms)
  {
-@@ -1755,6 +1923,46 @@ static void ip6_tnl_netlink_parms(struct
+@@ -1756,6 +1924,46 @@ static void ip6_tnl_netlink_parms(struct
  
        if (data[IFLA_IPTUN_PROTO])
                parms->proto = nla_get_u8(data[IFLA_IPTUN_PROTO]);
@@ -409,7 +409,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  }
  
  static int ip6_tnl_newlink(struct net *src_net, struct net_device *dev,
-@@ -1807,6 +2015,12 @@ static void ip6_tnl_dellink(struct net_d
+@@ -1808,6 +2016,12 @@ static void ip6_tnl_dellink(struct net_d
  
  static size_t ip6_tnl_get_size(const struct net_device *dev)
  {
@@ -422,7 +422,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
        return
                /* IFLA_IPTUN_LINK */
                nla_total_size(4) +
-@@ -1824,6 +2038,24 @@ static size_t ip6_tnl_get_size(const str
+@@ -1825,6 +2039,24 @@ static size_t ip6_tnl_get_size(const str
                nla_total_size(4) +
                /* IFLA_IPTUN_PROTO */
                nla_total_size(1) +
@@ -447,7 +447,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
                0;
  }
  
-@@ -1831,6 +2063,9 @@ static int ip6_tnl_fill_info(struct sk_b
+@@ -1832,6 +2064,9 @@ static int ip6_tnl_fill_info(struct sk_b
  {
        struct ip6_tnl *tunnel = netdev_priv(dev);
        struct __ip6_tnl_parm *parm = &tunnel->parms;
@@ -457,7 +457,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  
        if (nla_put_u32(skb, IFLA_IPTUN_LINK, parm->link) ||
            nla_put_in6_addr(skb, IFLA_IPTUN_LOCAL, &parm->laddr) ||
-@@ -1839,8 +2074,27 @@ static int ip6_tnl_fill_info(struct sk_b
+@@ -1840,8 +2075,27 @@ static int ip6_tnl_fill_info(struct sk_b
            nla_put_u8(skb, IFLA_IPTUN_ENCAP_LIMIT, parm->encap_limit) ||
            nla_put_be32(skb, IFLA_IPTUN_FLOWINFO, parm->flowinfo) ||
            nla_put_u32(skb, IFLA_IPTUN_FLAGS, parm->flags) ||
@@ -486,7 +486,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
        return 0;
  
  nla_put_failure:
-@@ -1864,6 +2118,7 @@ static const struct nla_policy ip6_tnl_p
+@@ -1865,6 +2119,7 @@ static const struct nla_policy ip6_tnl_p
        [IFLA_IPTUN_FLOWINFO]           = { .type = NLA_U32 },
        [IFLA_IPTUN_FLAGS]              = { .type = NLA_U32 },
        [IFLA_IPTUN_PROTO]              = { .type = NLA_U8 },
index 6cb3fdf..39b8fd4 100644 (file)
@@ -53,7 +53,7 @@
   * @phydev: the phy_device struct
 --- a/include/linux/phy.h
 +++ b/include/linux/phy.h
-@@ -796,6 +796,7 @@ void phy_start_machine(struct phy_device
+@@ -807,6 +807,7 @@ void phy_start_machine(struct phy_device
  void phy_stop_machine(struct phy_device *phydev);
  int phy_ethtool_sset(struct phy_device *phydev, struct ethtool_cmd *cmd);
  int phy_ethtool_gset(struct phy_device *phydev, struct ethtool_cmd *cmd);
index 4886dd0..d78f3d4 100644 (file)
@@ -46,7 +46,7 @@
                phy_device_free(phydev);
 --- a/include/linux/phy.h
 +++ b/include/linux/phy.h
-@@ -835,6 +835,23 @@ void mdio_bus_exit(void);
+@@ -846,6 +846,23 @@ void mdio_bus_exit(void);
  
  extern struct bus_type mdio_bus_type;
  
index f7718bc..4f874e5 100644 (file)
@@ -1,6 +1,6 @@
 --- a/fs/locks.c
 +++ b/fs/locks.c
-@@ -2712,6 +2712,8 @@ static const struct file_operations proc
+@@ -2716,6 +2716,8 @@ static const struct file_operations proc
  
  static int __init proc_locks_init(void)
  {
index eac3966..b9fdad9 100644 (file)
@@ -1,6 +1,6 @@
 --- a/drivers/base/Kconfig
 +++ b/drivers/base/Kconfig
-@@ -229,7 +229,7 @@ config SOC_BUS
+@@ -232,7 +232,7 @@ config SOC_BUS
  source "drivers/base/regmap/Kconfig"
  
  config DMA_SHARED_BUFFER
index c436070..4fa8a6a 100644 (file)
@@ -34,7 +34,7 @@ Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
        case PHY_##_state:                      \
 --- a/include/linux/phy.h
 +++ b/include/linux/phy.h
-@@ -812,6 +812,7 @@ int phy_ethtool_gset(struct phy_device *
+@@ -823,6 +823,7 @@ int phy_ethtool_gset(struct phy_device *
  int phy_ethtool_ioctl(struct phy_device *phydev, void *useraddr);
  int phy_mii_ioctl(struct phy_device *phydev, struct ifreq *ifr, int cmd);
  int phy_start_interrupts(struct phy_device *phydev);