From 22375a2fb87271dadcdb30f5e825c168ba73d502 Mon Sep 17 00:00:00 2001 From: Zoltan HERPAI Date: Thu, 24 May 2018 00:14:47 +0200 Subject: kernel: bump to 3.18.109 Fixes: CVE-2018-1093 CVE-2017-18255 Compile-tested: ar71xx, kirkwood, lantiq, sunxi Runtime-tested: ar71xx, sunxi Signed-off-by: Zoltan HERPAI --- include/kernel-version.mk | 4 ++-- .../403-mtd_fix_cfi_cmdset_0002_status_check.patch | 14 +++++++------- .../411-mtd-cfi_cmdset_0002-force-word-write.patch | 6 +++--- ...usb-core-make-overcurrent-messages-more-prominent.patch | 2 +- ...-mtd-cfi_cmdset_0002-add-buffer-write-cmd-timeout.patch | 2 +- target/linux/generic/patches-3.18/834-ledtrig-libata.patch | 8 ++++---- .../ixp4xx/patches-3.18/600-skb_avoid_dmabounce.patch | 2 +- .../patches-3.18/0032-USB-fix-roothub-for-IFXHCD.patch | 2 +- target/linux/oxnas/patches-3.18/999-libata-hacks.patch | 4 ++-- .../0041-mtd-fix-cfi-cmdset-0002-erase-status-check.patch | 4 ++-- .../0042-mtd-cfi-cmdset-0002-force-word-write.patch | 6 +++--- .../0062-mt7621-add-ECHI-OCHI-XCHI-support.patch | 2 +- 12 files changed, 28 insertions(+), 28 deletions(-) diff --git a/include/kernel-version.mk b/include/kernel-version.mk index 328201e686..26a48b7f8f 100644 --- a/include/kernel-version.mk +++ b/include/kernel-version.mk @@ -2,9 +2,9 @@ LINUX_RELEASE?=1 -LINUX_VERSION-3.18 = .107 +LINUX_VERSION-3.18 = .109 -LINUX_KERNEL_MD5SUM-3.18.107 = 888cd1b64db705eb8a0172eaaeef175d +LINUX_KERNEL_MD5SUM-3.18.109 = 3c24a9ec3b4ba945ae1f144167f5b521 ifdef KERNEL_PATCHVER LINUX_VERSION:=$(KERNEL_PATCHVER)$(strip $(LINUX_VERSION-$(KERNEL_PATCHVER))) diff --git a/target/linux/ar71xx/patches-3.18/403-mtd_fix_cfi_cmdset_0002_status_check.patch b/target/linux/ar71xx/patches-3.18/403-mtd_fix_cfi_cmdset_0002_status_check.patch index 1ccce4ecec..8f41d9432c 100644 --- a/target/linux/ar71xx/patches-3.18/403-mtd_fix_cfi_cmdset_0002_status_check.patch +++ b/target/linux/ar71xx/patches-3.18/403-mtd_fix_cfi_cmdset_0002_status_check.patch @@ -1,6 +1,6 @@ --- a/drivers/mtd/chips/cfi_cmdset_0002.c +++ b/drivers/mtd/chips/cfi_cmdset_0002.c -@@ -1632,8 +1632,8 @@ static int __xipram do_write_oneword(str +@@ -1633,8 +1633,8 @@ static int __xipram do_write_oneword(str break; } @@ -11,7 +11,7 @@ /* Latency issues. Drop the lock, wait a while and retry */ UDELAY(map, chip, adr, 1); -@@ -1649,6 +1649,8 @@ static int __xipram do_write_oneword(str +@@ -1650,6 +1650,8 @@ static int __xipram do_write_oneword(str ret = -EIO; } @@ -20,7 +20,7 @@ xip_enable(map, chip, adr); op_done: if (mode == FL_OTP_WRITE) -@@ -2227,7 +2229,6 @@ static int cfi_amdstd_panic_write(struct +@@ -2228,7 +2230,6 @@ static int cfi_amdstd_panic_write(struct return 0; } @@ -28,7 +28,7 @@ /* * Handle devices with one erase region, that only implement * the chip erase command. -@@ -2291,8 +2292,8 @@ static int __xipram do_erase_chip(struct +@@ -2293,8 +2294,8 @@ static int __xipram do_erase_chip(struct chip->erase_suspended = 0; } @@ -39,7 +39,7 @@ if (time_after(jiffies, timeo)) { printk(KERN_WARNING "MTD %s(): software timeout\n", -@@ -2312,6 +2313,7 @@ static int __xipram do_erase_chip(struct +@@ -2314,6 +2315,7 @@ static int __xipram do_erase_chip(struct ret = -EIO; } @@ -47,7 +47,7 @@ chip->state = FL_READY; xip_enable(map, chip, adr); DISABLE_VPP(map); -@@ -2380,9 +2382,9 @@ static int __xipram do_erase_oneblock(st +@@ -2383,9 +2385,9 @@ static int __xipram do_erase_oneblock(st chip->erase_suspended = 0; } @@ -59,7 +59,7 @@ } if (time_after(jiffies, timeo)) { -@@ -2404,6 +2406,7 @@ static int __xipram do_erase_oneblock(st +@@ -2407,6 +2409,7 @@ static int __xipram do_erase_oneblock(st ret = -EIO; } diff --git a/target/linux/ar71xx/patches-3.18/411-mtd-cfi_cmdset_0002-force-word-write.patch b/target/linux/ar71xx/patches-3.18/411-mtd-cfi_cmdset_0002-force-word-write.patch index 39c5478182..28c6ad875d 100644 --- a/target/linux/ar71xx/patches-3.18/411-mtd-cfi_cmdset_0002-force-word-write.patch +++ b/target/linux/ar71xx/patches-3.18/411-mtd-cfi_cmdset_0002-force-word-write.patch @@ -35,7 +35,7 @@ /* Atmel chips don't use the same PRI format as AMD chips */ static void fixup_convert_atmel_pri(struct mtd_info *mtd) -@@ -1791,6 +1795,7 @@ static int cfi_amdstd_write_words(struct +@@ -1792,6 +1796,7 @@ static int cfi_amdstd_write_words(struct /* * FIXME: interleaved mode not tested, and probably not supported! */ @@ -43,7 +43,7 @@ static int __xipram do_write_buffer(struct map_info *map, struct flchip *chip, unsigned long adr, const u_char *buf, int len) -@@ -1919,7 +1924,6 @@ static int __xipram do_write_buffer(stru +@@ -1920,7 +1925,6 @@ static int __xipram do_write_buffer(stru return ret; } @@ -51,7 +51,7 @@ static int cfi_amdstd_write_buffers(struct mtd_info *mtd, loff_t to, size_t len, size_t *retlen, const u_char *buf) { -@@ -1994,6 +1998,7 @@ static int cfi_amdstd_write_buffers(stru +@@ -1995,6 +1999,7 @@ static int cfi_amdstd_write_buffers(stru return 0; } diff --git a/target/linux/brcm2708/patches-3.18/0055-usb-core-make-overcurrent-messages-more-prominent.patch b/target/linux/brcm2708/patches-3.18/0055-usb-core-make-overcurrent-messages-more-prominent.patch index 6d5d421426..84cae3f269 100644 --- a/target/linux/brcm2708/patches-3.18/0055-usb-core-make-overcurrent-messages-more-prominent.patch +++ b/target/linux/brcm2708/patches-3.18/0055-usb-core-make-overcurrent-messages-more-prominent.patch @@ -10,7 +10,7 @@ Hub overcurrent messages are more serious than "debug". Increase loglevel. --- a/drivers/usb/core/hub.c +++ b/drivers/usb/core/hub.c -@@ -4945,7 +4945,7 @@ static void port_event(struct usb_hub *h +@@ -4953,7 +4953,7 @@ static void port_event(struct usb_hub *h if (portchange & USB_PORT_STAT_C_OVERCURRENT) { u16 status = 0, unused; diff --git a/target/linux/generic/patches-3.18/461-mtd-cfi_cmdset_0002-add-buffer-write-cmd-timeout.patch b/target/linux/generic/patches-3.18/461-mtd-cfi_cmdset_0002-add-buffer-write-cmd-timeout.patch index c437a140f0..382b44a939 100644 --- a/target/linux/generic/patches-3.18/461-mtd-cfi_cmdset_0002-add-buffer-write-cmd-timeout.patch +++ b/target/linux/generic/patches-3.18/461-mtd-cfi_cmdset_0002-add-buffer-write-cmd-timeout.patch @@ -8,7 +8,7 @@ Signed-off-by: George Kashperko 1 file changed, 1 insertion(+) --- a/drivers/mtd/chips/cfi_cmdset_0002.c +++ b/drivers/mtd/chips/cfi_cmdset_0002.c -@@ -1830,6 +1830,7 @@ static int __xipram do_write_buffer(stru +@@ -1831,6 +1831,7 @@ static int __xipram do_write_buffer(stru /* Write Buffer Load */ map_write(map, CMD(0x25), cmd_adr); diff --git a/target/linux/generic/patches-3.18/834-ledtrig-libata.patch b/target/linux/generic/patches-3.18/834-ledtrig-libata.patch index 766bdd2e0d..922414663a 100644 --- a/target/linux/generic/patches-3.18/834-ledtrig-libata.patch +++ b/target/linux/generic/patches-3.18/834-ledtrig-libata.patch @@ -69,7 +69,7 @@ Signed-off-by: Daniel Golle /** * ata_build_rw_tf - Build ATA taskfile for given read/write request * @tf: Target ATA taskfile -@@ -4821,6 +4834,9 @@ static struct ata_queued_cmd *ata_qc_new +@@ -4824,6 +4837,9 @@ static struct ata_queued_cmd *ata_qc_new break; } } @@ -79,7 +79,7 @@ Signed-off-by: Daniel Golle return qc; } -@@ -5730,6 +5746,9 @@ struct ata_port *ata_port_alloc(struct a +@@ -5733,6 +5749,9 @@ struct ata_port *ata_port_alloc(struct a ap->stats.unhandled_irq = 1; ap->stats.idle_irq = 1; #endif @@ -89,7 +89,7 @@ Signed-off-by: Daniel Golle ata_sff_port_init(ap); return ap; -@@ -5751,6 +5770,12 @@ static void ata_host_release(struct devi +@@ -5754,6 +5773,12 @@ static void ata_host_release(struct devi kfree(ap->pmp_link); kfree(ap->slave_link); @@ -102,7 +102,7 @@ Signed-off-by: Daniel Golle kfree(ap); host->ports[i] = NULL; } -@@ -6197,7 +6222,23 @@ int ata_host_register(struct ata_host *h +@@ -6200,7 +6225,23 @@ int ata_host_register(struct ata_host *h host->ports[i]->print_id = atomic_inc_return(&ata_print_id); host->ports[i]->local_port_no = i + 1; } diff --git a/target/linux/ixp4xx/patches-3.18/600-skb_avoid_dmabounce.patch b/target/linux/ixp4xx/patches-3.18/600-skb_avoid_dmabounce.patch index f495fbf2bf..0276ad6d2a 100644 --- a/target/linux/ixp4xx/patches-3.18/600-skb_avoid_dmabounce.patch +++ b/target/linux/ixp4xx/patches-3.18/600-skb_avoid_dmabounce.patch @@ -10,7 +10,7 @@ /* Get the HEAD */ skb = kmem_cache_alloc_node(cache, gfp_mask & ~__GFP_DMA, node); -@@ -1098,6 +1101,10 @@ int pskb_expand_head(struct sk_buff *skb +@@ -1099,6 +1102,10 @@ int pskb_expand_head(struct sk_buff *skb if (skb_shared(skb)) BUG(); diff --git a/target/linux/lantiq/patches-3.18/0032-USB-fix-roothub-for-IFXHCD.patch b/target/linux/lantiq/patches-3.18/0032-USB-fix-roothub-for-IFXHCD.patch index dcd8461a0e..912c8ddd86 100644 --- a/target/linux/lantiq/patches-3.18/0032-USB-fix-roothub-for-IFXHCD.patch +++ b/target/linux/lantiq/patches-3.18/0032-USB-fix-roothub-for-IFXHCD.patch @@ -20,7 +20,7 @@ Subject: [PATCH 32/36] USB: fix roothub for IFXHCD choice --- a/drivers/usb/core/hub.c +++ b/drivers/usb/core/hub.c -@@ -4323,7 +4323,7 @@ hub_port_init (struct usb_hub *hub, stru +@@ -4331,7 +4331,7 @@ hub_port_init (struct usb_hub *hub, stru udev->ttport = hdev->ttport; } else if (udev->speed != USB_SPEED_HIGH && hdev->speed == USB_SPEED_HIGH) { diff --git a/target/linux/oxnas/patches-3.18/999-libata-hacks.patch b/target/linux/oxnas/patches-3.18/999-libata-hacks.patch index 8a01b07b06..b801e060c2 100644 --- a/target/linux/oxnas/patches-3.18/999-libata-hacks.patch +++ b/target/linux/oxnas/patches-3.18/999-libata-hacks.patch @@ -15,7 +15,7 @@ /* initialize internal qc */ /* XXX: Tag 0 is used for drivers with legacy EH as some -@@ -4817,6 +4825,9 @@ static struct ata_queued_cmd *ata_qc_new +@@ -4820,6 +4828,9 @@ static struct ata_queued_cmd *ata_qc_new if (unlikely(ap->pflags & ATA_PFLAG_FROZEN)) return NULL; @@ -25,7 +25,7 @@ for (i = 0, tag = ap->last_tag + 1; i < max_queue; i++, tag++) { if (ap->flags & ATA_FLAG_LOWTAG) tag = i; -@@ -4889,6 +4900,8 @@ void ata_qc_free(struct ata_queued_cmd * +@@ -4892,6 +4903,8 @@ void ata_qc_free(struct ata_queued_cmd * if (likely(ata_tag_valid(tag))) { qc->tag = ATA_TAG_POISON; clear_bit(tag, &ap->qc_allocated); diff --git a/target/linux/ramips/patches-3.18/0041-mtd-fix-cfi-cmdset-0002-erase-status-check.patch b/target/linux/ramips/patches-3.18/0041-mtd-fix-cfi-cmdset-0002-erase-status-check.patch index b51756dbfa..addc9766d5 100644 --- a/target/linux/ramips/patches-3.18/0041-mtd-fix-cfi-cmdset-0002-erase-status-check.patch +++ b/target/linux/ramips/patches-3.18/0041-mtd-fix-cfi-cmdset-0002-erase-status-check.patch @@ -9,7 +9,7 @@ Subject: [PATCH 41/57] mtd: fix cfi cmdset 0002 erase status check --- a/drivers/mtd/chips/cfi_cmdset_0002.c +++ b/drivers/mtd/chips/cfi_cmdset_0002.c -@@ -2291,7 +2291,7 @@ static int __xipram do_erase_chip(struct +@@ -2293,7 +2293,7 @@ static int __xipram do_erase_chip(struct chip->erase_suspended = 0; } @@ -18,7 +18,7 @@ Subject: [PATCH 41/57] mtd: fix cfi cmdset 0002 erase status check break; if (time_after(jiffies, timeo)) { -@@ -2380,7 +2380,7 @@ static int __xipram do_erase_oneblock(st +@@ -2383,7 +2383,7 @@ static int __xipram do_erase_oneblock(st chip->erase_suspended = 0; } diff --git a/target/linux/ramips/patches-3.18/0042-mtd-cfi-cmdset-0002-force-word-write.patch b/target/linux/ramips/patches-3.18/0042-mtd-cfi-cmdset-0002-force-word-write.patch index 971738c19a..e7ceba9c1f 100644 --- a/target/linux/ramips/patches-3.18/0042-mtd-cfi-cmdset-0002-force-word-write.patch +++ b/target/linux/ramips/patches-3.18/0042-mtd-cfi-cmdset-0002-force-word-write.patch @@ -44,7 +44,7 @@ Subject: [PATCH 42/57] mtd: cfi cmdset 0002 force word write /* Atmel chips don't use the same PRI format as AMD chips */ static void fixup_convert_atmel_pri(struct mtd_info *mtd) -@@ -1789,6 +1793,7 @@ static int cfi_amdstd_write_words(struct +@@ -1790,6 +1794,7 @@ static int cfi_amdstd_write_words(struct /* * FIXME: interleaved mode not tested, and probably not supported! */ @@ -52,7 +52,7 @@ Subject: [PATCH 42/57] mtd: cfi cmdset 0002 force word write static int __xipram do_write_buffer(struct map_info *map, struct flchip *chip, unsigned long adr, const u_char *buf, int len) -@@ -1917,7 +1922,6 @@ static int __xipram do_write_buffer(stru +@@ -1918,7 +1923,6 @@ static int __xipram do_write_buffer(stru return ret; } @@ -60,7 +60,7 @@ Subject: [PATCH 42/57] mtd: cfi cmdset 0002 force word write static int cfi_amdstd_write_buffers(struct mtd_info *mtd, loff_t to, size_t len, size_t *retlen, const u_char *buf) { -@@ -1992,6 +1996,7 @@ static int cfi_amdstd_write_buffers(stru +@@ -1993,6 +1997,7 @@ static int cfi_amdstd_write_buffers(stru return 0; } diff --git a/target/linux/ramips/patches-3.18/0062-mt7621-add-ECHI-OCHI-XCHI-support.patch b/target/linux/ramips/patches-3.18/0062-mt7621-add-ECHI-OCHI-XCHI-support.patch index 24420903d9..d746d0ded5 100644 --- a/target/linux/ramips/patches-3.18/0062-mt7621-add-ECHI-OCHI-XCHI-support.patch +++ b/target/linux/ramips/patches-3.18/0062-mt7621-add-ECHI-OCHI-XCHI-support.patch @@ -16,7 +16,7 @@ /* EHCI, OHCI */ --- a/drivers/usb/core/hub.c +++ b/drivers/usb/core/hub.c -@@ -1261,7 +1261,7 @@ static void hub_quiesce(struct usb_hub * +@@ -1266,7 +1266,7 @@ static void hub_quiesce(struct usb_hub * if (type != HUB_SUSPEND) { /* Disconnect all the children */ for (i = 0; i < hdev->maxchild; ++i) { -- cgit v1.2.3