Refreshed all patches.
Altered patches:
- 0026-NET-multi-phy-support.patch
Fixes:
- CVE-2020-8647
- CVE-2020-8648 (Potentially)
- CVE-2020-8649
Compile-tested on: ar71xx
Runtime-tested on: ar71xx
Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
LINUX_RELEASE?=1
-LINUX_VERSION-4.9 = .215
+LINUX_VERSION-4.9 = .219
LINUX_VERSION-4.14 = .172
-LINUX_KERNEL_HASH-4.9.215 = 236f2f47853700f22b9925cb17917d97ff7120fcc8110ec827c5a030a8129f48
+LINUX_KERNEL_HASH-4.9.219 = 6b17238cced3e1c2753d6d5b4f662bd347d4651f07c35506b849eb10aea7bc44
LINUX_KERNEL_HASH-4.14.172 = 2318a1ab937580a079351ed20557c336a3d95b664f667b14e3ba49e3271b217a
remove_uri_prefix=$(subst git://,,$(subst http://,,$(subst https://,,$(1))))
--- a/drivers/tty/serial/8250/8250_core.c
+++ b/drivers/tty/serial/8250/8250_core.c
-@@ -509,6 +509,8 @@ static void __init serial8250_isa_init_p
+@@ -508,6 +508,8 @@ static void __init serial8250_isa_init_p
if (nr_uarts > UART_NR)
nr_uarts = UART_NR;
}
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
-@@ -5091,7 +5091,7 @@ static void port_event(struct usb_hub *h
+@@ -5095,7 +5095,7 @@ static void port_event(struct usb_hub *h
if (portchange & USB_PORT_STAT_C_OVERCURRENT) {
u16 status = 0, unused;
--- a/scripts/dtc/dtc-lexer.l
+++ b/scripts/dtc/dtc-lexer.l
-@@ -121,6 +121,11 @@ static void lexical_error(const char *fm
+@@ -120,6 +120,11 @@ static void lexical_error(const char *fm
return DT_V1;
}
} ;
static yy_state_type yy_last_accepting_state;
-@@ -662,7 +664,7 @@ static int dts_version = 1;
+@@ -661,7 +663,7 @@ static int dts_version = 1;
static void push_input_file(const char *filename);
static bool pop_input_file(void);
static void lexical_error(const char *fmt, ...);
#define INITIAL 0
#define BYTESTRING 1
-@@ -704,7 +706,7 @@ FILE *yyget_out (void );
+@@ -703,7 +705,7 @@ FILE *yyget_out (void );
void yyset_out (FILE * out_str );
char *yyget_text (void );
-@@ -853,6 +855,10 @@ YY_DECL
+@@ -852,6 +854,10 @@ YY_DECL
register char *yy_cp, *yy_bp;
register int yy_act;
if ( !(yy_init) )
{
(yy_init) = 1;
-@@ -879,11 +885,6 @@ YY_DECL
+@@ -878,11 +884,6 @@ YY_DECL
yy_load_buffer_state( );
}
while ( 1 ) /* loops until end-of-file is reached */
{
yy_cp = (yy_c_buf_p);
-@@ -901,7 +902,7 @@ YY_DECL
+@@ -900,7 +901,7 @@ YY_DECL
yy_match:
do
{
if ( yy_accept[yy_current_state] )
{
(yy_last_accepting_state) = yy_current_state;
-@@ -910,13 +911,13 @@ yy_match:
+@@ -909,13 +910,13 @@ yy_match:
while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state )
{
yy_current_state = (int) yy_def[yy_current_state];
yy_cp = (yy_last_accepting_cpos);
yy_current_state = (yy_last_accepting_state);
-@@ -951,39 +952,31 @@ case 2:
+@@ -950,39 +951,31 @@ case 2:
YY_RULE_SETUP
#line 75 "dtc-lexer.l"
{
{
if (!pop_input_file()) {
yyterminate();
-@@ -993,7 +986,7 @@ case YY_STATE_EOF(V1):
+@@ -992,7 +985,7 @@ case YY_STATE_EOF(V1):
case 3:
/* rule 3 can match eol */
YY_RULE_SETUP
{
DPRINT("String: %s\n", yytext);
yylval.data = data_copy_escape_string(yytext+1,
-@@ -1003,7 +996,7 @@ YY_RULE_SETUP
+@@ -1002,7 +995,7 @@ YY_RULE_SETUP
YY_BREAK
case 4:
YY_RULE_SETUP
{
DPRINT("Keyword: /dts-v1/\n");
dts_version = 1;
-@@ -1013,25 +1006,33 @@ YY_RULE_SETUP
+@@ -1012,25 +1005,33 @@ YY_RULE_SETUP
YY_BREAK
case 5:
YY_RULE_SETUP
{
DPRINT("Keyword: /delete-property/\n");
DPRINT("<PROPNODENAME>\n");
-@@ -1039,9 +1040,9 @@ YY_RULE_SETUP
+@@ -1038,9 +1039,9 @@ YY_RULE_SETUP
return DT_DEL_PROP;
}
YY_BREAK
{
DPRINT("Keyword: /delete-node/\n");
DPRINT("<PROPNODENAME>\n");
-@@ -1049,9 +1050,9 @@ YY_RULE_SETUP
+@@ -1048,9 +1049,9 @@ YY_RULE_SETUP
return DT_DEL_NODE;
}
YY_BREAK
{
DPRINT("Label: %s\n", yytext);
yylval.labelref = xstrdup(yytext);
-@@ -1059,9 +1060,9 @@ YY_RULE_SETUP
+@@ -1058,9 +1059,9 @@ YY_RULE_SETUP
return DT_LABEL;
}
YY_BREAK
{
char *e;
DPRINT("Integer Literal: '%s'\n", yytext);
-@@ -1069,10 +1070,7 @@ YY_RULE_SETUP
+@@ -1068,10 +1069,7 @@ YY_RULE_SETUP
errno = 0;
yylval.integer = strtoull(yytext, &e, 0);
if (errno == ERANGE)
lexical_error("Integer literal '%s' out of range",
-@@ -1084,10 +1082,10 @@ YY_RULE_SETUP
+@@ -1083,10 +1081,10 @@ YY_RULE_SETUP
return DT_LITERAL;
}
YY_BREAK
{
struct data d;
DPRINT("Character literal: %s\n", yytext);
-@@ -1109,18 +1107,18 @@ YY_RULE_SETUP
+@@ -1108,18 +1106,18 @@ YY_RULE_SETUP
return DT_CHAR_LITERAL;
}
YY_BREAK
{ /* new-style path reference */
yytext[yyleng-1] = '\0';
DPRINT("Ref: %s\n", yytext+2);
-@@ -1128,27 +1126,27 @@ YY_RULE_SETUP
+@@ -1127,27 +1125,27 @@ YY_RULE_SETUP
return DT_REF;
}
YY_BREAK
{
DPRINT("PropNodeName: %s\n", yytext);
yylval.propnodename = xstrdup((yytext[0] == '\\') ?
-@@ -1157,75 +1155,75 @@ YY_RULE_SETUP
+@@ -1156,75 +1154,75 @@ YY_RULE_SETUP
return DT_PROPNODENAME;
}
YY_BREAK
{
DPRINT("Char: %c (\\x%02x)\n", yytext[0],
(unsigned)yytext[0]);
-@@ -1241,12 +1239,12 @@ YY_RULE_SETUP
+@@ -1240,12 +1238,12 @@ YY_RULE_SETUP
return yytext[0];
}
YY_BREAK
case YY_END_OF_BUFFER:
{
-@@ -1376,7 +1374,6 @@ ECHO;
+@@ -1375,7 +1373,6 @@ ECHO;
"fatal flex scanner internal error--no action found" );
} /* end of action switch */
} /* end of scanning one token */
} /* end of yylex */
/* yy_get_next_buffer - try to read in a new buffer
-@@ -1432,21 +1429,21 @@ static int yy_get_next_buffer (void)
+@@ -1431,21 +1428,21 @@ static int yy_get_next_buffer (void)
else
{
if ( new_size <= 0 )
b->yy_buf_size += b->yy_buf_size / 8;
-@@ -1477,7 +1474,7 @@ static int yy_get_next_buffer (void)
+@@ -1476,7 +1473,7 @@ static int yy_get_next_buffer (void)
/* Read in more data. */
YY_INPUT( (&YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[number_to_move]),
YY_CURRENT_BUFFER_LVALUE->yy_n_chars = (yy_n_chars);
}
-@@ -1539,7 +1536,7 @@ static int yy_get_next_buffer (void)
+@@ -1538,7 +1535,7 @@ static int yy_get_next_buffer (void)
while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state )
{
yy_current_state = (int) yy_def[yy_current_state];
yy_c = yy_meta[(unsigned int) yy_c];
}
yy_current_state = yy_nxt[yy_base[yy_current_state] + (unsigned int) yy_c];
-@@ -1567,13 +1564,13 @@ static int yy_get_next_buffer (void)
+@@ -1566,13 +1563,13 @@ static int yy_get_next_buffer (void)
while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state )
{
yy_current_state = (int) yy_def[yy_current_state];
}
#ifndef YY_NO_INPUT
-@@ -1600,7 +1597,7 @@ static int yy_get_next_buffer (void)
+@@ -1599,7 +1596,7 @@ static int yy_get_next_buffer (void)
else
{ /* need more input */
++(yy_c_buf_p);
switch ( yy_get_next_buffer( ) )
-@@ -1874,7 +1871,7 @@ void yypop_buffer_state (void)
+@@ -1873,7 +1870,7 @@ void yypop_buffer_state (void)
*/
static void yyensure_buffer_stack (void)
{
if (!(yy_buffer_stack)) {
-@@ -1971,12 +1968,12 @@ YY_BUFFER_STATE yy_scan_string (yyconst
+@@ -1970,12 +1967,12 @@ YY_BUFFER_STATE yy_scan_string (yyconst
*
* @return the newly allocated buffer state object.
*/
/* Get memory for full buffer, including space for trailing EOB's. */
n = _yybytes_len + 2;
-@@ -2058,7 +2055,7 @@ FILE *yyget_out (void)
+@@ -2057,7 +2054,7 @@ FILE *yyget_out (void)
/** Get the length of the current token.
*
*/
{
return yyleng;
}
-@@ -2206,7 +2203,7 @@ void yyfree (void * ptr )
+@@ -2205,7 +2202,7 @@ void yyfree (void * ptr )
#define YYTABLES_NAME "yytables"
-ENDPROC(arm_copy_from_user)
+ENDPROC(__copy_from_user_std)
- .pushsection .fixup,"ax"
+ .pushsection .text.fixup,"ax"
.align 0
--- /dev/null
+++ b/arch/arm/lib/exports_rpi.c
--- a/drivers/net/ethernet/marvell/mvneta.c
+++ b/drivers/net/ethernet/marvell/mvneta.c
-@@ -2702,11 +2702,9 @@ static int mvneta_poll(struct napi_struc
+@@ -2701,11 +2701,9 @@ static int mvneta_poll(struct napi_struc
rx_done = mvneta_rx_swbm(pp, budget, &pp->rxqs[rx_queue]);
}
--- a/include/linux/phy.h
+++ b/include/linux/phy.h
-@@ -495,6 +495,12 @@ struct phy_driver {
+@@ -497,6 +497,12 @@ struct phy_driver {
/* Determines the negotiated speed and duplex */
int (*read_status)(struct phy_device *phydev);
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
-@@ -1316,6 +1316,9 @@ int genphy_update_link(struct phy_device
+@@ -1320,6 +1320,9 @@ int genphy_update_link(struct phy_device
{
int status;
phy_device_free(phydev);
--- a/include/linux/phy.h
+++ b/include/linux/phy.h
-@@ -870,6 +870,23 @@ void mdio_bus_exit(void);
+@@ -872,6 +872,23 @@ void mdio_bus_exit(void);
extern struct bus_type mdio_bus_type;
--- a/net/ipv4/Kconfig
+++ b/net/ipv4/Kconfig
-@@ -408,6 +408,7 @@ config INET_XFRM_MODE_BEET
+@@ -409,6 +409,7 @@ config INET_XFRM_MODE_BEET
config INET_DIAG
tristate "INET: socket monitoring interface"
return -ENOMEM;
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
-@@ -2727,6 +2727,8 @@ static const struct file_operations proc
+@@ -2730,6 +2730,8 @@ static const struct file_operations proc
static int __init proc_vmalloc_init(void)
{
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
-@@ -2677,10 +2677,12 @@ static const struct file_operations fib_
+@@ -2680,10 +2680,12 @@ static const struct file_operations fib_
int __net_init fib_proc_init(struct net *net)
{
&fib_triestat_fops))
goto out2;
-@@ -2690,17 +2692,21 @@ int __net_init fib_proc_init(struct net
+@@ -2693,17 +2695,21 @@ int __net_init fib_proc_init(struct net
return 0;
out3:
static void rt_fibinfo_free(struct rtable __rcu **rtp)
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
-@@ -2406,6 +2406,7 @@ static const char *const rtn_type_names[
+@@ -2409,6 +2409,7 @@ static const char *const rtn_type_names[
[RTN_THROW] = "THROW",
[RTN_NAT] = "NAT",
[RTN_XRESOLVE] = "XRESOLVE",
cfg->fc_flags |= RTF_REJECT;
if (rtm->rtm_type == RTN_LOCAL)
-@@ -3222,6 +3256,9 @@ static int rt6_fill_node(struct net *net
+@@ -3223,6 +3257,9 @@ static int rt6_fill_node(struct net *net
case -EACCES:
rtm->rtm_type = RTN_PROHIBIT;
break;
case -EAGAIN:
rtm->rtm_type = RTN_THROW;
break;
-@@ -3498,6 +3535,8 @@ static int ip6_route_dev_notify(struct n
+@@ -3499,6 +3536,8 @@ static int ip6_route_dev_notify(struct n
#ifdef CONFIG_IPV6_MULTIPLE_TABLES
net->ipv6.ip6_prohibit_entry->dst.dev = dev;
net->ipv6.ip6_prohibit_entry->rt6i_idev = in6_dev_get(dev);
net->ipv6.ip6_blk_hole_entry->dst.dev = dev;
net->ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(dev);
#endif
-@@ -3509,6 +3548,7 @@ static int ip6_route_dev_notify(struct n
+@@ -3510,6 +3549,7 @@ static int ip6_route_dev_notify(struct n
in6_dev_put(net->ipv6.ip6_null_entry->rt6i_idev);
#ifdef CONFIG_IPV6_MULTIPLE_TABLES
in6_dev_put(net->ipv6.ip6_prohibit_entry->rt6i_idev);
in6_dev_put(net->ipv6.ip6_blk_hole_entry->rt6i_idev);
#endif
}
-@@ -3724,6 +3764,17 @@ static int __net_init ip6_route_net_init
+@@ -3725,6 +3765,17 @@ static int __net_init ip6_route_net_init
net->ipv6.ip6_blk_hole_entry->dst.ops = &net->ipv6.ip6_dst_ops;
dst_init_metrics(&net->ipv6.ip6_blk_hole_entry->dst,
ip6_template_metrics, true);
#endif
net->ipv6.sysctl.flush_delay = 0;
-@@ -3742,6 +3793,8 @@ out:
+@@ -3743,6 +3794,8 @@ out:
return ret;
#ifdef CONFIG_IPV6_MULTIPLE_TABLES
out_ip6_prohibit_entry:
kfree(net->ipv6.ip6_prohibit_entry);
out_ip6_null_entry:
-@@ -3759,6 +3812,7 @@ static void __net_exit ip6_route_net_exi
+@@ -3760,6 +3813,7 @@ static void __net_exit ip6_route_net_exi
#ifdef CONFIG_IPV6_MULTIPLE_TABLES
kfree(net->ipv6.ip6_prohibit_entry);
kfree(net->ipv6.ip6_blk_hole_entry);
#endif
dst_entries_destroy(&net->ipv6.ip6_dst_ops);
}
-@@ -3832,6 +3886,9 @@ void __init ip6_route_init_special_entri
+@@ -3833,6 +3887,9 @@ void __init ip6_route_init_special_entri
init_net.ipv6.ip6_prohibit_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
init_net.ipv6.ip6_blk_hole_entry->dst.dev = init_net.loopback_dev;
init_net.ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
* @phydev: the phy_device struct
--- a/include/linux/phy.h
+++ b/include/linux/phy.h
-@@ -827,6 +827,7 @@ int phy_ethtool_ksettings_get(struct phy
+@@ -829,6 +829,7 @@ int phy_ethtool_ksettings_get(struct phy
struct ethtool_link_ksettings *cmd);
int phy_ethtool_ksettings_set(struct phy_device *phydev,
const struct ethtool_link_ksettings *cmd);
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
-@@ -1005,6 +1005,9 @@ void phy_detach(struct phy_device *phyde
+@@ -1009,6 +1009,9 @@ void phy_detach(struct phy_device *phyde
struct mii_bus *bus;
int i;
phy_suspend(phydev);
--- a/include/linux/phy.h
+++ b/include/linux/phy.h
-@@ -507,6 +507,12 @@ struct phy_driver {
+@@ -509,6 +509,12 @@ struct phy_driver {
*/
int (*did_interrupt)(struct phy_device *phydev);
--- a/drivers/tty/serial/8250/8250_core.c
+++ b/drivers/tty/serial/8250/8250_core.c
-@@ -833,6 +833,7 @@ static int serial8250_probe(struct platf
+@@ -832,6 +832,7 @@ static int serial8250_probe(struct platf
uart.port.get_mctrl = p->get_mctrl;
uart.port.pm = p->pm;
uart.port.dev = &dev->dev;
uart.port.irqflags |= irqflag;
ret = serial8250_register_8250_port(&uart);
if (ret < 0) {
-@@ -989,6 +990,7 @@ int serial8250_register_8250_port(struct
+@@ -988,6 +989,7 @@ int serial8250_register_8250_port(struct
uart->bugs = up->bugs;
uart->port.mapbase = up->port.mapbase;
uart->port.mapsize = up->port.mapsize;
case UPIO_AU:
p->serial_out(p, offset, value);
p->serial_in(p, UART_LCR); /* safe, no side-effects */
-@@ -2759,6 +2779,7 @@ static int serial8250_request_std_resour
+@@ -2763,6 +2783,7 @@ static int serial8250_request_std_resour
case UPIO_MEM32BE:
case UPIO_MEM16:
case UPIO_MEM:
if (!port->mapbase)
break;
-@@ -2797,6 +2818,7 @@ static void serial8250_release_std_resou
+@@ -2801,6 +2822,7 @@ static void serial8250_release_std_resou
case UPIO_MEM32BE:
case UPIO_MEM16:
case UPIO_MEM:
}
--- a/include/linux/phy.h
+++ b/include/linux/phy.h
-@@ -369,6 +369,7 @@ struct phy_device {
- bool is_pseudo_fixed_link;
+@@ -371,6 +371,7 @@ struct phy_device {
bool has_fixups;
bool suspended;
+ bool suspended_by_mdio_bus;
+ bool no_auto_carrier_off;
enum phy_state state;
depends on IXP4XX_ETH
--- a/drivers/rtc/Kconfig
+++ b/drivers/rtc/Kconfig
-@@ -414,6 +414,14 @@ config RTC_DRV_PCF85063
+@@ -415,6 +415,14 @@ config RTC_DRV_PCF85063
This driver can also be built as a module. If so, the module
will be called rtc-pcf85063.
EXPORT_SYMBOL(phy_ethtool_get_wol);
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
-@@ -1050,7 +1050,7 @@ int phy_suspend(struct phy_device *phyde
+@@ -1054,7 +1054,7 @@ int phy_suspend(struct phy_device *phyde
if (wol.wolopts)
return -EBUSY;
ret = phydrv->suspend(phydev);
if (ret)
-@@ -1067,7 +1067,7 @@ int phy_resume(struct phy_device *phydev
+@@ -1071,7 +1071,7 @@ int phy_resume(struct phy_device *phydev
struct phy_driver *phydrv = to_phy_driver(phydev->mdio.dev.driver);
int ret = 0;
ret = phydrv->resume(phydev);
if (ret)
-@@ -1724,7 +1724,7 @@ static int phy_remove(struct device *dev
+@@ -1728,7 +1728,7 @@ static int phy_remove(struct device *dev
phydev->state = PHY_DOWN;
mutex_unlock(&phydev->lock);
default:
return "unknown";
}
-@@ -791,6 +794,9 @@ int phy_stop_interrupts(struct phy_devic
+@@ -793,6 +796,9 @@ int phy_stop_interrupts(struct phy_devic
static inline int phy_read_status(struct phy_device *phydev)
{
};
struct dmar_atsr_unit {
-@@ -4271,27 +4272,40 @@ static inline void init_iommu_pm_ops(voi
+@@ -4272,27 +4273,40 @@ static inline void init_iommu_pm_ops(voi
int __init dmar_parse_one_rmrr(struct acpi_dmar_header *header, void *arg)
{
struct acpi_dmar_reserved_memory *rmrr;
}
static struct dmar_atsr_unit *dmar_find_atsr(struct acpi_dmar_atsr *atsr)
-@@ -4505,6 +4519,7 @@ static void intel_iommu_free_dmars(void)
+@@ -4506,6 +4520,7 @@ static void intel_iommu_free_dmars(void)
list_for_each_entry_safe(rmrru, rmrr_n, &dmar_rmrr_units, list) {
list_del(&rmrru->list);
dmar_free_dev_scope(&rmrru->devices, &rmrru->devices_cnt);
kfree(rmrru);
}
-@@ -5243,6 +5258,45 @@ static void intel_iommu_remove_device(st
+@@ -5246,6 +5261,45 @@ static void intel_iommu_remove_device(st
iommu_device_unlink(iommu->iommu_dev, dev);
}
#ifdef CONFIG_INTEL_IOMMU_SVM
#define MAX_NR_PASID_BITS (20)
static inline unsigned long intel_iommu_get_pts(struct intel_iommu *iommu)
-@@ -5373,19 +5427,21 @@ struct intel_iommu *intel_svm_device_to_
+@@ -5376,19 +5430,21 @@ struct intel_iommu *intel_svm_device_to_
#endif /* CONFIG_INTEL_IOMMU_SVM */
static const struct iommu_ops intel_iommu_ops = {
pkt_len = le32_to_cpu(rx_desc->opts1) & RX_LEN_MASK;
if (pkt_len < ETH_ZLEN)
break;
-@@ -4520,6 +4525,7 @@ static struct usb_device_id rtl8152_tabl
+@@ -4526,6 +4531,7 @@ static struct usb_device_id rtl8152_tabl
{REALTEK_USB_DEVICE(VENDOR_ID_LENOVO, 0x304f)},
{REALTEK_USB_DEVICE(VENDOR_ID_LINKSYS, 0x0041)},
{REALTEK_USB_DEVICE(VENDOR_ID_NVIDIA, 0x09ff)},
int ret;
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
-@@ -4450,6 +4450,14 @@ hub_port_init(struct usb_hub *hub, struc
+@@ -4454,6 +4454,14 @@ hub_port_init(struct usb_hub *hub, struc
else
speed = usb_speed_string(udev->speed);
struct platform_device *dwc3_pdev = to_platform_device(dwc->dev);
irq = platform_get_irq_byname(dwc3_pdev, "peripheral");
-@@ -3042,6 +3043,12 @@ int dwc3_gadget_init(struct dwc3 *dwc)
+@@ -3041,6 +3042,12 @@ int dwc3_gadget_init(struct dwc3 *dwc)
goto err5;
}