kernel: bump to 3.18.109HEADchaos_calmer

Fixes:
CVE-2018-1093
CVE-2017-18255

Compile-tested: ar71xx, kirkwood, lantiq, sunxi
Runtime-tested: ar71xx, sunxi

Signed-off-by: Zoltan HERPAI <wigyori@uid0.hu>

12 files changed, 28 insertions, 28 deletions

diff --git a/include/kernel-version.mk b/include/kernel-version.mk
index 328201e686..26a48b7f8f 100644
--- a/include/kernel-version.mk
+++ b/include/kernel-version.mk
@@ -2,9 +2,9 @@
 
 LINUX_RELEASE?=1
 
-LINUX_VERSION-3.18 = .107
+LINUX_VERSION-3.18 = .109
 
-LINUX_KERNEL_MD5SUM-3.18.107 = 888cd1b64db705eb8a0172eaaeef175d
+LINUX_KERNEL_MD5SUM-3.18.109 = 3c24a9ec3b4ba945ae1f144167f5b521
 
 ifdef KERNEL_PATCHVER
   LINUX_VERSION:=$(KERNEL_PATCHVER)$(strip $(LINUX_VERSION-$(KERNEL_PATCHVER)))
diff --git a/target/linux/ar71xx/patches-3.18/403-mtd_fix_cfi_cmdset_0002_status_check.patch b/target/linux/ar71xx/patches-3.18/403-mtd_fix_cfi_cmdset_0002_status_check.patch
index 1ccce4ecec..8f41d9432c 100644
--- a/target/linux/ar71xx/patches-3.18/403-mtd_fix_cfi_cmdset_0002_status_check.patch
+++ b/target/linux/ar71xx/patches-3.18/403-mtd_fix_cfi_cmdset_0002_status_check.patch
@@ -1,6 +1,6 @@
 --- a/drivers/mtd/chips/cfi_cmdset_0002.c
 +++ b/drivers/mtd/chips/cfi_cmdset_0002.c
-@@ -1632,8 +1632,8 @@ static int __xipram do_write_oneword(str
+@@ -1633,8 +1633,8 @@ static int __xipram do_write_oneword(str
  			break;
  		}
  
@@ -11,7 +11,7 @@
  
  		/* Latency issues. Drop the lock, wait a while and retry */
  		UDELAY(map, chip, adr, 1);
-@@ -1649,6 +1649,8 @@ static int __xipram do_write_oneword(str
+@@ -1650,6 +1650,8 @@ static int __xipram do_write_oneword(str
  
  		ret = -EIO;
  	}
@@ -20,7 +20,7 @@
  	xip_enable(map, chip, adr);
   op_done:
  	if (mode == FL_OTP_WRITE)
-@@ -2227,7 +2229,6 @@ static int cfi_amdstd_panic_write(struct
+@@ -2228,7 +2230,6 @@ static int cfi_amdstd_panic_write(struct
  	return 0;
  }
  
@@ -28,7 +28,7 @@
  /*
   * Handle devices with one erase region, that only implement
   * the chip erase command.
-@@ -2291,8 +2292,8 @@ static int __xipram do_erase_chip(struct
+@@ -2293,8 +2294,8 @@ static int __xipram do_erase_chip(struct
  			chip->erase_suspended = 0;
  		}
  
@@ -39,7 +39,7 @@
  
  		if (time_after(jiffies, timeo)) {
  			printk(KERN_WARNING "MTD %s(): software timeout\n",
-@@ -2312,6 +2313,7 @@ static int __xipram do_erase_chip(struct
+@@ -2314,6 +2315,7 @@ static int __xipram do_erase_chip(struct
  		ret = -EIO;
  	}
  
@@ -47,7 +47,7 @@
  	chip->state = FL_READY;
  	xip_enable(map, chip, adr);
  	DISABLE_VPP(map);
-@@ -2380,9 +2382,9 @@ static int __xipram do_erase_oneblock(st
+@@ -2383,9 +2385,9 @@ static int __xipram do_erase_oneblock(st
  			chip->erase_suspended = 0;
  		}
  
@@ -59,7 +59,7 @@
  		}
  
  		if (time_after(jiffies, timeo)) {
-@@ -2404,6 +2406,7 @@ static int __xipram do_erase_oneblock(st
+@@ -2407,6 +2409,7 @@ static int __xipram do_erase_oneblock(st
  		ret = -EIO;
  	}
  
diff --git a/target/linux/ar71xx/patches-3.18/411-mtd-cfi_cmdset_0002-force-word-write.patch b/target/linux/ar71xx/patches-3.18/411-mtd-cfi_cmdset_0002-force-word-write.patch
index 39c5478182..28c6ad875d 100644
--- a/target/linux/ar71xx/patches-3.18/411-mtd-cfi_cmdset_0002-force-word-write.patch
+++ b/target/linux/ar71xx/patches-3.18/411-mtd-cfi_cmdset_0002-force-word-write.patch
@@ -35,7 +35,7 @@
  
  /* Atmel chips don't use the same PRI format as AMD chips */
  static void fixup_convert_atmel_pri(struct mtd_info *mtd)
-@@ -1791,6 +1795,7 @@ static int cfi_amdstd_write_words(struct
+@@ -1792,6 +1796,7 @@ static int cfi_amdstd_write_words(struct
  /*
   * FIXME: interleaved mode not tested, and probably not supported!
   */
@@ -43,7 +43,7 @@
  static int __xipram do_write_buffer(struct map_info *map, struct flchip *chip,
  				    unsigned long adr, const u_char *buf,
  				    int len)
-@@ -1919,7 +1924,6 @@ static int __xipram do_write_buffer(stru
+@@ -1920,7 +1925,6 @@ static int __xipram do_write_buffer(stru
  	return ret;
  }
  
@@ -51,7 +51,7 @@
  static int cfi_amdstd_write_buffers(struct mtd_info *mtd, loff_t to, size_t len,
  				    size_t *retlen, const u_char *buf)
  {
-@@ -1994,6 +1998,7 @@ static int cfi_amdstd_write_buffers(stru
+@@ -1995,6 +1999,7 @@ static int cfi_amdstd_write_buffers(stru
  
  	return 0;
  }
diff --git a/target/linux/brcm2708/patches-3.18/0055-usb-core-make-overcurrent-messages-more-prominent.patch b/target/linux/brcm2708/patches-3.18/0055-usb-core-make-overcurrent-messages-more-prominent.patch
index 6d5d421426..84cae3f269 100644
--- a/target/linux/brcm2708/patches-3.18/0055-usb-core-make-overcurrent-messages-more-prominent.patch
+++ b/target/linux/brcm2708/patches-3.18/0055-usb-core-make-overcurrent-messages-more-prominent.patch
@@ -10,7 +10,7 @@ Hub overcurrent messages are more serious than "debug". Increase loglevel.
 
 --- a/drivers/usb/core/hub.c
 +++ b/drivers/usb/core/hub.c
-@@ -4945,7 +4945,7 @@ static void port_event(struct usb_hub *h
+@@ -4953,7 +4953,7 @@ static void port_event(struct usb_hub *h
  	if (portchange & USB_PORT_STAT_C_OVERCURRENT) {
  		u16 status = 0, unused;
  
diff --git a/target/linux/generic/patches-3.18/461-mtd-cfi_cmdset_0002-add-buffer-write-cmd-timeout.patch b/target/linux/generic/patches-3.18/461-mtd-cfi_cmdset_0002-add-buffer-write-cmd-timeout.patch
index c437a140f0..382b44a939 100644
--- a/target/linux/generic/patches-3.18/461-mtd-cfi_cmdset_0002-add-buffer-write-cmd-timeout.patch
+++ b/target/linux/generic/patches-3.18/461-mtd-cfi_cmdset_0002-add-buffer-write-cmd-timeout.patch
@@ -8,7 +8,7 @@ Signed-off-by: George Kashperko <george@znau.edu.ua>
  1 file changed, 1 insertion(+)
 --- a/drivers/mtd/chips/cfi_cmdset_0002.c
 +++ b/drivers/mtd/chips/cfi_cmdset_0002.c
-@@ -1830,6 +1830,7 @@ static int __xipram do_write_buffer(stru
+@@ -1831,6 +1831,7 @@ static int __xipram do_write_buffer(stru
  
  	/* Write Buffer Load */
  	map_write(map, CMD(0x25), cmd_adr);
diff --git a/target/linux/generic/patches-3.18/834-ledtrig-libata.patch b/target/linux/generic/patches-3.18/834-ledtrig-libata.patch
index 766bdd2e0d..922414663a 100644
--- a/target/linux/generic/patches-3.18/834-ledtrig-libata.patch
+++ b/target/linux/generic/patches-3.18/834-ledtrig-libata.patch
@@ -69,7 +69,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  /**
   *	ata_build_rw_tf - Build ATA taskfile for given read/write request
   *	@tf: Target ATA taskfile
-@@ -4821,6 +4834,9 @@ static struct ata_queued_cmd *ata_qc_new
+@@ -4824,6 +4837,9 @@ static struct ata_queued_cmd *ata_qc_new
  			break;
  		}
  	}
@@ -79,7 +79,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  
  	return qc;
  }
-@@ -5730,6 +5746,9 @@ struct ata_port *ata_port_alloc(struct a
+@@ -5733,6 +5749,9 @@ struct ata_port *ata_port_alloc(struct a
  	ap->stats.unhandled_irq = 1;
  	ap->stats.idle_irq = 1;
  #endif
@@ -89,7 +89,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  	ata_sff_port_init(ap);
  
  	return ap;
-@@ -5751,6 +5770,12 @@ static void ata_host_release(struct devi
+@@ -5754,6 +5773,12 @@ static void ata_host_release(struct devi
  
  		kfree(ap->pmp_link);
  		kfree(ap->slave_link);
@@ -102,7 +102,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  		kfree(ap);
  		host->ports[i] = NULL;
  	}
-@@ -6197,7 +6222,23 @@ int ata_host_register(struct ata_host *h
+@@ -6200,7 +6225,23 @@ int ata_host_register(struct ata_host *h
  		host->ports[i]->print_id = atomic_inc_return(&ata_print_id);
  		host->ports[i]->local_port_no = i + 1;
  	}
diff --git a/target/linux/ixp4xx/patches-3.18/600-skb_avoid_dmabounce.patch b/target/linux/ixp4xx/patches-3.18/600-skb_avoid_dmabounce.patch
index f495fbf2bf..0276ad6d2a 100644
--- a/target/linux/ixp4xx/patches-3.18/600-skb_avoid_dmabounce.patch
+++ b/target/linux/ixp4xx/patches-3.18/600-skb_avoid_dmabounce.patch
@@ -10,7 +10,7 @@
  
  	/* Get the HEAD */
  	skb = kmem_cache_alloc_node(cache, gfp_mask & ~__GFP_DMA, node);
-@@ -1098,6 +1101,10 @@ int pskb_expand_head(struct sk_buff *skb
+@@ -1099,6 +1102,10 @@ int pskb_expand_head(struct sk_buff *skb
  	if (skb_shared(skb))
  		BUG();
  
diff --git a/target/linux/lantiq/patches-3.18/0032-USB-fix-roothub-for-IFXHCD.patch b/target/linux/lantiq/patches-3.18/0032-USB-fix-roothub-for-IFXHCD.patch
index dcd8461a0e..912c8ddd86 100644
--- a/target/linux/lantiq/patches-3.18/0032-USB-fix-roothub-for-IFXHCD.patch
+++ b/target/linux/lantiq/patches-3.18/0032-USB-fix-roothub-for-IFXHCD.patch
@@ -20,7 +20,7 @@ Subject: [PATCH 32/36] USB: fix roothub for IFXHCD
  choice
 --- a/drivers/usb/core/hub.c
 +++ b/drivers/usb/core/hub.c
-@@ -4323,7 +4323,7 @@ hub_port_init (struct usb_hub *hub, stru
+@@ -4331,7 +4331,7 @@ hub_port_init (struct usb_hub *hub, stru
  		udev->ttport = hdev->ttport;
  	} else if (udev->speed != USB_SPEED_HIGH
  			&& hdev->speed == USB_SPEED_HIGH) {
diff --git a/target/linux/oxnas/patches-3.18/999-libata-hacks.patch b/target/linux/oxnas/patches-3.18/999-libata-hacks.patch
index 8a01b07b06..b801e060c2 100644
--- a/target/linux/oxnas/patches-3.18/999-libata-hacks.patch
+++ b/target/linux/oxnas/patches-3.18/999-libata-hacks.patch
@@ -15,7 +15,7 @@
  	/* initialize internal qc */
  
  	/* XXX: Tag 0 is used for drivers with legacy EH as some
-@@ -4817,6 +4825,9 @@ static struct ata_queued_cmd *ata_qc_new
+@@ -4820,6 +4828,9 @@ static struct ata_queued_cmd *ata_qc_new
  	if (unlikely(ap->pflags & ATA_PFLAG_FROZEN))
  		return NULL;
  
@@ -25,7 +25,7 @@
  	for (i = 0, tag = ap->last_tag + 1; i < max_queue; i++, tag++) {
  		if (ap->flags & ATA_FLAG_LOWTAG)
  			tag = i;
-@@ -4889,6 +4900,8 @@ void ata_qc_free(struct ata_queued_cmd *
+@@ -4892,6 +4903,8 @@ void ata_qc_free(struct ata_queued_cmd *
  	if (likely(ata_tag_valid(tag))) {
  		qc->tag = ATA_TAG_POISON;
  		clear_bit(tag, &ap->qc_allocated);
diff --git a/target/linux/ramips/patches-3.18/0041-mtd-fix-cfi-cmdset-0002-erase-status-check.patch b/target/linux/ramips/patches-3.18/0041-mtd-fix-cfi-cmdset-0002-erase-status-check.patch
index b51756dbfa..addc9766d5 100644
--- a/target/linux/ramips/patches-3.18/0041-mtd-fix-cfi-cmdset-0002-erase-status-check.patch
+++ b/target/linux/ramips/patches-3.18/0041-mtd-fix-cfi-cmdset-0002-erase-status-check.patch
@@ -9,7 +9,7 @@ Subject: [PATCH 41/57] mtd: fix cfi cmdset 0002 erase status check
 
 --- a/drivers/mtd/chips/cfi_cmdset_0002.c
 +++ b/drivers/mtd/chips/cfi_cmdset_0002.c
-@@ -2291,7 +2291,7 @@ static int __xipram do_erase_chip(struct
+@@ -2293,7 +2293,7 @@ static int __xipram do_erase_chip(struct
  			chip->erase_suspended = 0;
  		}
  
@@ -18,7 +18,7 @@ Subject: [PATCH 41/57] mtd: fix cfi cmdset 0002 erase status check
  			break;
  
  		if (time_after(jiffies, timeo)) {
-@@ -2380,7 +2380,7 @@ static int __xipram do_erase_oneblock(st
+@@ -2383,7 +2383,7 @@ static int __xipram do_erase_oneblock(st
  			chip->erase_suspended = 0;
  		}
  
diff --git a/target/linux/ramips/patches-3.18/0042-mtd-cfi-cmdset-0002-force-word-write.patch b/target/linux/ramips/patches-3.18/0042-mtd-cfi-cmdset-0002-force-word-write.patch
index 971738c19a..e7ceba9c1f 100644
--- a/target/linux/ramips/patches-3.18/0042-mtd-cfi-cmdset-0002-force-word-write.patch
+++ b/target/linux/ramips/patches-3.18/0042-mtd-cfi-cmdset-0002-force-word-write.patch
@@ -44,7 +44,7 @@ Subject: [PATCH 42/57] mtd: cfi cmdset 0002 force word write
  
  /* Atmel chips don't use the same PRI format as AMD chips */
  static void fixup_convert_atmel_pri(struct mtd_info *mtd)
-@@ -1789,6 +1793,7 @@ static int cfi_amdstd_write_words(struct
+@@ -1790,6 +1794,7 @@ static int cfi_amdstd_write_words(struct
  /*
   * FIXME: interleaved mode not tested, and probably not supported!
   */
@@ -52,7 +52,7 @@ Subject: [PATCH 42/57] mtd: cfi cmdset 0002 force word write
  static int __xipram do_write_buffer(struct map_info *map, struct flchip *chip,
  				    unsigned long adr, const u_char *buf,
  				    int len)
-@@ -1917,7 +1922,6 @@ static int __xipram do_write_buffer(stru
+@@ -1918,7 +1923,6 @@ static int __xipram do_write_buffer(stru
  	return ret;
  }
  
@@ -60,7 +60,7 @@ Subject: [PATCH 42/57] mtd: cfi cmdset 0002 force word write
  static int cfi_amdstd_write_buffers(struct mtd_info *mtd, loff_t to, size_t len,
  				    size_t *retlen, const u_char *buf)
  {
-@@ -1992,6 +1996,7 @@ static int cfi_amdstd_write_buffers(stru
+@@ -1993,6 +1997,7 @@ static int cfi_amdstd_write_buffers(stru
  
  	return 0;
  }
diff --git a/target/linux/ramips/patches-3.18/0062-mt7621-add-ECHI-OCHI-XCHI-support.patch b/target/linux/ramips/patches-3.18/0062-mt7621-add-ECHI-OCHI-XCHI-support.patch
index 24420903d9..d746d0ded5 100644
--- a/target/linux/ramips/patches-3.18/0062-mt7621-add-ECHI-OCHI-XCHI-support.patch
+++ b/target/linux/ramips/patches-3.18/0062-mt7621-add-ECHI-OCHI-XCHI-support.patch
@@ -16,7 +16,7 @@
  		/* EHCI, OHCI */
 --- a/drivers/usb/core/hub.c
 +++ b/drivers/usb/core/hub.c
-@@ -1261,7 +1261,7 @@ static void hub_quiesce(struct usb_hub *
+@@ -1266,7 +1266,7 @@ static void hub_quiesce(struct usb_hub *
  	if (type != HUB_SUSPEND) {
  		/* Disconnect all the children */
  		for (i = 0; i < hdev->maxchild; ++i) {