Fixes the following security vulnerabilities:
CVE-2017-8890
The inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c in the
Linux kernel through 4.10.15 allows attackers to cause a denial of service
(double free) or possibly have unspecified other impact by leveraging use
of the accept system call.
CVE-2017-9074
The IPv6 fragmentation implementation in the Linux kernel through 4.11.1
does not consider that the nexthdr field may be associated with an invalid
option, which allows local users to cause a denial of service (out-of-bounds
read and BUG) or possibly have unspecified other impact via crafted socket
and send system calls.
CVE-2017-9075
The sctp_v6_create_accept_sk function in net/sctp/ipv6.c in the Linux kernel
through 4.11.1 mishandles inheritance, which allows local users to cause a
denial of service or possibly have unspecified other impact via crafted
system calls, a related issue to CVE-2017-8890.
CVE-2017-9076
The dccp_v6_request_recv_sock function in net/dccp/ipv6.c in the Linux
kernel through 4.11.1 mishandles inheritance, which allows local users to
cause a denial of service or possibly have unspecified other impact via
crafted system calls, a related issue to CVE-2017-8890.
CVE-2017-9077
The tcp_v6_syn_recv_sock function in net/ipv6/tcp_ipv6.c in the Linux kernel
through 4.11.1 mishandles inheritance, which allows local users to cause a
denial of service or possibly have unspecified other impact via crafted
system calls, a related issue to CVE-2017-8890.
CVE-2017-9242
The __ip6_append_data function in net/ipv6/ip6_output.c in the Linux kernel
through 4.11.3 is too late in checking whether an overwrite of an skb data
structure may occur, which allows local users to cause a denial of service
(system crash) via crafted system calls.
Ref: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8890
Ref: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9074
Ref: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9075
Ref: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9076
Ref: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9077
Ref: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9242
Ref: https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.31
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
CONFIG_SG_POOL symbol is selected only by CONFIG_SCSI, since the last
one is disabled by default then disable CONFIG_SG_POOL by default too.
And explicitly enable it only for platforms that use CONFIG_SCSI.
Signed-off-by: Sergey Ryazanov <ryazanov.s.a@gmail.com>
With cpufreq disabled, the CPU stays locked at the frequency set by the
bootloader. This severely degrades performance as the bootloader sets
the CPU at the lowest frequency by default.
Enable cpufreq for all subtargets and use the ondemand governor.
Tested bcm2708 on RPi0W. Tested bcm2709 and bcm2710 on RPi3.
Reported-by: Bryan Mayland <bmayland@capnbry.net>
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
This fixes:
Thermal sensors on bcm2835 SoC (BCM2835_THERMAL) [N/m/y/?] (NEW) aborted!
This symbol depends on ARCH_BCM2835 so it should be OK to disable it at
brcm2708 target only.
Fixes: 7d32caa61fb0 ("brcm2708: backport upstream sdhost controller driver")
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
This gets us in sync with dts from kernel 4.11. Two patches were already
backported earlier.
I decided to use 03x prefix as it's kind of similar to the 3xx prefix:
3xx - architecture specific patches
It isn't any documented or strict rule though. We don't need to stick to
it if we hit any problems.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Acked-by: Álvaro Fernández Rojas <noltari@gmail.com>
Right now all brcm2708 patches are extracted from the non-mainline
raspberrypi/linux git tree. Many of them are hacks and/or are unneeded
in LEDE. Raspberry Pi is getting better and better mainline support so
it would be nice to finally start maintaining patches in a cleaner way:
1) Backport patches accepted in upstream tree
2) Start using upstream drivers
3) Pick only these patches that are needed for more complete support
Handling above tasks requires grouping patches - ideally using the same
prefixes as generic ones. It means we should rename existing patches to
use some high prefix. This will allow e.g. use 0xx for backported code.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Acked-by: Florian Fainelli <f.fainelli@gmail.com>
Acked-by: Stijn Tintel <stijn@linux-ipv6.be>
As usual these patches were extracted and rebased from the raspberry pi repo:
https://github.com/raspberrypi/linux/tree/rpi-4.9.y
- Remove led1 from diag.sh for RPi3 since it causes boot issues.
- Fix modules.mk typos.
Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
buildbot fails to build without regmap, which I couldn't reproduce locally.
Hopefully this fixes it.
Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
64 bit support for Raspberry Pi 3 is experimental. However, bcm2709 subtarget
should serve as a stable and compatible 32 bit support.
Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
This adds support for Raspberry Pi 3 on the bcm2709 subtarget, in order to
keep 32 bit image support when 64 bit support is added on bcm2710 subtarget.
Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
Bump kernel to 4.4.44. Compile-tested on ar71xx, ramips/mt7621 and x86/64.
.44 has been run-tested on the 17.01 branch here on ar71xx and mt7621.
Signed-off-by: Stijn Segers <francesco.borromini@inventati.org>
Refresh patches for all targets that support kernel 4.4.
Compile-tested on all targets that use kernel 4.4 and aren't marked broken.
Runtime-tested on ar71xx, octeon.
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
Refresh patches for all targets that support kernel 4.4.
compile/run-tested on ar71xx, brcm47xx, kirkwood.
Signed-off-by: Paul Wassi <p.wassi@gmx.at>
Tested-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
COPYING is not present in $(LINUX_DIR) on imagebuilder and prevents a
successful image creation.
Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
Forgot to update kernel-version.mk, so updated patch. Compile-tested on x86/64 and ar71xx; run-tested on x86/64 and ar71xx.
Signed-off-by: Stijn Segers <francesco.borromini@inventati.org>
Now that the firmware for BCM43430 has been submitted to linux-firmware use it
and remove RPiDistro package.
Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
As usual these patches were extracted and rebased from the raspberry pi repo:
https://github.com/raspberrypi/linux/tree/rpi-4.4.y
Also adds support for Raspberry Pi Compute Module 3 (untested).
Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
Refresh patches for all targets that support kernel 4.4.
Compile-tested on all targets that use kernel 4.4 and aren't marked broken.
Runtime-tested on ar71xx, octeon and x86/64.
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
It is used by a core build template, so the variable should be
initialized and added to DEVICE_VARS in the core.
Same for DEVICE_DTS_DIR
Signed-off-by: Felix Fietkau <nbd@nbd.name>
kmod-sound-soc-digidac1-soundcard is also missing snd-soc-wm8804 dependency
for snd-soc-wm8804-i2c
Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
As usual these patches were extracted from the raspberry pi repo:
https://github.com/raspberrypi/linux/tree/rpi-4.4.y
Also alphabetically order sound-soc kernel packages.
Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
This regression was introduced while rebasing LEDE's commits over the latest
OpenWrt repository.
Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
Implement a crude but functioning sysupgrade image check for the
Raspberry Pi. The code only checks if the master boot record boot
signature (0x55aa) is present in the first 512-bytes at the correct
location. This can prevent the odd bricking of a system when flashing
the wrong file.
Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
This update also adds individual download of firmware files instead of fetching
every file on the repository (10-MiB vs 100+MiB).
Also copy Linux license from kernel directory instead of using the rpi-firmware
one.
Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
As usual these patches were extracted from the raspberry repo:
https://github.com/raspberrypi/linux/commits/rpi-4.4.y
- Disable unused MFD RPISENSE driver.
- Disable ethernet HW checksums in order to avoid kernel exceptions.
Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
SVN-Revision: 48985
- random-bcm2708 and spi-bcm2708 have been removed.
- sound-soc-bcm2708-i2s has been upstreamed as sound-soc-bcm2835-i2s.
Let's keep linux 4.1 for a while, since linux 4.4 appears to have some issues
with multicast traffic on RPi ethernet:
https://gist.github.com/Noltari/5b1cfdecce5ed4bc08fd
Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
SVN-Revision: 48266
Replace former uci-defaults.sh implementation with the uci-defaults-new.sh one
and update all users accordingly.
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
SVN-Revision: 47867
This way it's easier to configure device tree overlays, customize other
parameters...
Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
SVN-Revision: 47126
Right now, selecting kmod-sound-soc-bcm2708-i2s causes build errors due to
missing configs.
kmod-regmap enables I2C and SPI, causing build errors due to depending
variables not defined.
Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
SVN-Revision: 47123
Make the device name accessible for any build commands instead of
forcing targets to define it themselves.
Signed-off-by: Jonas Gorski <jogo@openwrt.org>
SVN-Revision: 46597
Implement sysupgrade for Raspberry Pi, similar to the way it is done on x86:
The config files are saved in the boot partition and moved to where they are
normally expected in preinit.
Also add optional gzip compression for the SD card image, since this can save
a lot of space (76M vs 6M), also similar to x86.
Signed-off-by: Bruno Randolf <br1@einfach.org>
SVN-Revision: 46347
HAMRADIO enabled in all generic configs, but no one platform directly
use related drivers/protocols. This symbol is only used for kmod-ax25
package modules. Furthermore, half of platforms explicitly disables
this symbol, what silently disables build of modules for kmod-ax25
package.
So disable HAMRADIO by-default in generic config, add it to kmod-ax25
package and remove it from platform specific configs.
Signed-off-by: Sergey Ryazanov <ryazanov.s.a@gmail.com>
SVN-Revision: 44613
procd gets last console from cmdline, so swapping tty1 (framebuffer) and ttyAMA0 (uart) is enough to force procd output via uart
Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
SVN-Revision: 44448
