Skip to content
Snippets Groups Projects
Unverified Commit 1c3d9788 authored by Matthias Schiffer's avatar Matthias Schiffer
Browse files

Update OpenWrt base

parent 00fdc373
Branches
Tags
No related merge requests found
Showing
with 20 additions and 125 deletions
......@@ -22,7 +22,7 @@ index b41f275..0f7a415 100644
ucidef_set_gpio_switch "poe_passthrough" "PoE Passthrough" "20"
;;
diff --git a/target/linux/ar71xx/base-files/etc/uci-defaults/01_leds b/target/linux/ar71xx/base-files/etc/uci-defaults/01_leds
index 7c18346..0056520 100644
index 3d240fb..f1266d8 100644
--- a/target/linux/ar71xx/base-files/etc/uci-defaults/01_leds
+++ b/target/linux/ar71xx/base-files/etc/uci-defaults/01_leds
@@ -78,6 +78,7 @@ carambola2)
......@@ -34,10 +34,10 @@ index 7c18346..0056520 100644
ucidef_set_led_switch "lan0" "LAN0" "tp-link:green:lan0" "switch0" "0x20"
ucidef_set_led_switch "lan1" "LAN1" "tp-link:green:lan1" "switch0" "0x10"
diff --git a/target/linux/ar71xx/base-files/etc/uci-defaults/02_network b/target/linux/ar71xx/base-files/etc/uci-defaults/02_network
index d5603d7..dd6ca98 100755
index ca9c577..6c3ecf5 100755
--- a/target/linux/ar71xx/base-files/etc/uci-defaults/02_network
+++ b/target/linux/ar71xx/base-files/etc/uci-defaults/02_network
@@ -71,6 +71,7 @@ bsb)
@@ -72,6 +72,7 @@ bsb)
ucidef_set_interface_wlan
;;
......@@ -46,7 +46,7 @@ index d5603d7..dd6ca98 100755
ucidef_set_interfaces_lan_wan "eth0.1" "eth0.2"
ucidef_add_switch "switch0" "1" "1"
diff --git a/target/linux/ar71xx/base-files/lib/ar71xx.sh b/target/linux/ar71xx/base-files/lib/ar71xx.sh
index 480cf93..47ddd56 100755
index 4bf484b..51102d6 100755
--- a/target/linux/ar71xx/base-files/lib/ar71xx.sh
+++ b/target/linux/ar71xx/base-files/lib/ar71xx.sh
@@ -447,7 +447,11 @@ ar71xx_board_detect() {
......@@ -63,10 +63,10 @@ index 480cf93..47ddd56 100755
tplink_pharos_board_detect
;;
diff --git a/target/linux/ar71xx/base-files/lib/upgrade/platform.sh b/target/linux/ar71xx/base-files/lib/upgrade/platform.sh
index f50cd53..8594de6 100755
index 53284df..4003b21 100755
--- a/target/linux/ar71xx/base-files/lib/upgrade/platform.sh
+++ b/target/linux/ar71xx/base-files/lib/upgrade/platform.sh
@@ -264,6 +264,7 @@ platform_check_image() {
@@ -265,6 +265,7 @@ platform_check_image() {
return 0
;;
......@@ -126,10 +126,10 @@ index 5cb052a..74daf43 100644
+MIPS_MACHINE(ATH79_MACH_CPE510, "CPE510", "TP-LINK CPE510/520",
cpe510_setup);
diff --git a/target/linux/ar71xx/image/Makefile b/target/linux/ar71xx/image/Makefile
index f99ea2b..33a2da5 100644
index d66bd25..75083f9 100644
--- a/target/linux/ar71xx/image/Makefile
+++ b/target/linux/ar71xx/image/Makefile
@@ -2109,7 +2109,8 @@ $(eval $(call SingleProfile,TPLINK-LZMA,64kraw,TLWR1043V2,tl-wr1043nd-v2,TL-WR10
@@ -2111,7 +2111,8 @@ $(eval $(call SingleProfile,TPLINK-LZMA,64kraw,TLWR1043V2,tl-wr1043nd-v2,TL-WR10
$(eval $(call SingleProfile,TPLINK-LZMA,64kraw,TLWR1043V3,tl-wr1043nd-v3,TL-WR1043ND-v2,ttyS0,115200,0x10430003,1,8M))
$(eval $(call SingleProfile,TPLINK-LZMA,64kraw,TLWR2543,tl-wr2543-v1,TL-WR2543N,ttyS0,115200,0x25430001,1,8Mlzma,-v 3.13.99))
......@@ -139,7 +139,7 @@ index f99ea2b..33a2da5 100644
$(eval $(call SingleProfile,UAPPRO,64k,UAPPRO,ubnt-uap-pro,UAP-PRO,ttyS0,115200,BZ,BZ,ar934x))
$(eval $(call SingleProfile,UAPPRO,64k,UBNTUNIFIOUTDOORPLUS,ubnt-unifi-outdoor-plus,UBNT-UOP,ttyS0,115200,BZ,BZ,ar7240))
@@ -2173,6 +2174,7 @@ $(eval $(call MultiProfile,TLWR842,TLWR842V1))
@@ -2175,6 +2176,7 @@ $(eval $(call MultiProfile,TLWR842,TLWR842V1))
$(eval $(call MultiProfile,TLWR941,TLWR941NV2 TLWR941NV3 TLWR941NV4))
$(eval $(call MultiProfile,TLWR1043,TLWR1043V1 TLWR1043V2 TLWR1043V3))
$(eval $(call MultiProfile,TLWDR4300,TLWDR3500V1 TLWDR3600V1 TLWDR4300V1 TLWDR4300V1IL TLWDR4310V1 MW4530RV1))
......
......@@ -12,10 +12,10 @@ Signed-off-by: Alexander Couzens <lynxis@fe80.eu>
Backport of LEDE 824147960569f2c1cd22140c9074c62c3df911a5
diff --git a/target/linux/ar71xx/image/Makefile b/target/linux/ar71xx/image/Makefile
index 33a2da5..b288a1d 100644
index 75083f9..bb2bb94 100644
--- a/target/linux/ar71xx/image/Makefile
+++ b/target/linux/ar71xx/image/Makefile
@@ -2109,7 +2109,7 @@ $(eval $(call SingleProfile,TPLINK-LZMA,64kraw,TLWR1043V2,tl-wr1043nd-v2,TL-WR10
@@ -2111,7 +2111,7 @@ $(eval $(call SingleProfile,TPLINK-LZMA,64kraw,TLWR1043V2,tl-wr1043nd-v2,TL-WR10
$(eval $(call SingleProfile,TPLINK-LZMA,64kraw,TLWR1043V3,tl-wr1043nd-v3,TL-WR1043ND-v2,ttyS0,115200,0x10430003,1,8M))
$(eval $(call SingleProfile,TPLINK-LZMA,64kraw,TLWR2543,tl-wr2543-v1,TL-WR2543N,ttyS0,115200,0x25430001,1,8Mlzma,-v 3.13.99))
......
......@@ -7,10 +7,10 @@ Signed-off-by: Tiziano Bacocco <tizbac2@gmail.com>
Backport of OpenWrt r48705
diff --git a/target/linux/ar71xx/base-files/etc/uci-defaults/02_network b/target/linux/ar71xx/base-files/etc/uci-defaults/02_network
index dd6ca98..e6b129a 100755
index 6c3ecf5..027a671 100755
--- a/target/linux/ar71xx/base-files/etc/uci-defaults/02_network
+++ b/target/linux/ar71xx/base-files/etc/uci-defaults/02_network
@@ -376,6 +376,7 @@ wp543)
@@ -377,6 +377,7 @@ wp543)
ucidef_set_interface_lan "eth0"
;;
......@@ -19,10 +19,10 @@ index dd6ca98..e6b129a 100755
ucidef_set_interface_lan "eth1"
;;
diff --git a/target/linux/ar71xx/base-files/lib/ar71xx.sh b/target/linux/ar71xx/base-files/lib/ar71xx.sh
index 47ddd56..7641e63 100755
index 51102d6..83be329 100755
--- a/target/linux/ar71xx/base-files/lib/ar71xx.sh
+++ b/target/linux/ar71xx/base-files/lib/ar71xx.sh
@@ -835,6 +835,9 @@ ar71xx_board_detect() {
@@ -838,6 +838,9 @@ ar71xx_board_detect() {
*"TL-WA801ND v2")
name="tl-wa801nd-v2"
;;
......@@ -33,10 +33,10 @@ index 47ddd56..7641e63 100755
name="tl-wa901nd"
;;
diff --git a/target/linux/ar71xx/config-3.18 b/target/linux/ar71xx/config-3.18
index 0903ee9..c75833d 100644
index d4d9273..d7cbe2e 100644
--- a/target/linux/ar71xx/config-3.18
+++ b/target/linux/ar71xx/config-3.18
@@ -119,6 +119,7 @@ CONFIG_ATH79_MACH_TL_MR3020=y
@@ -120,6 +120,7 @@ CONFIG_ATH79_MACH_TL_MR3020=y
CONFIG_ATH79_MACH_TL_MR3X20=y
CONFIG_ATH79_MACH_TL_WA701ND_V2=y
CONFIG_ATH79_MACH_TL_WA7210N_V2=y
......@@ -187,7 +187,7 @@ index 0000000..39cdb10
+MIPS_MACHINE(ATH79_MACH_TL_WA801ND_V3, "TL-WA801ND-v3", "TP-LINK TL-WA801ND v3",
+ tl_wa801n_v3_setup);
diff --git a/target/linux/ar71xx/image/Makefile b/target/linux/ar71xx/image/Makefile
index b288a1d..dfc0d71 100644
index bb2bb94..868a502 100644
--- a/target/linux/ar71xx/image/Makefile
+++ b/target/linux/ar71xx/image/Makefile
@@ -691,6 +691,13 @@ define Device/tl-wa801nd-v2
......
......@@ -6,7 +6,7 @@ Generate flashable images for the Archer C7 v2 with current stock firmware
again.
diff --git a/target/linux/ar71xx/image/Makefile b/target/linux/ar71xx/image/Makefile
index dfc0d71..cbd8a49 100644
index 868a502..95f6d46 100644
--- a/target/linux/ar71xx/image/Makefile
+++ b/target/linux/ar71xx/image/Makefile
@@ -58,13 +58,14 @@ define Build/mktplinkfw
......
From: Matthias Schiffer <mschiffer@universe-factory.net>
Date: Tue, 11 Oct 2016 00:46:56 +0200
Subject: kernel: add fix for CVE-2016-7117
diff --git a/target/linux/generic/patches-3.18/010-net-Fix-use-after-free-in-the-recvmmsg-exit-path.patch b/target/linux/generic/patches-3.18/010-net-Fix-use-after-free-in-the-recvmmsg-exit-path.patch
new file mode 100644
index 0000000..98da375
--- /dev/null
+++ b/target/linux/generic/patches-3.18/010-net-Fix-use-after-free-in-the-recvmmsg-exit-path.patch
@@ -0,0 +1,95 @@
+From cdd1fd36f4b67d9fdbeb1a4d16025192d44a3e8b Mon Sep 17 00:00:00 2001
+Message-Id: <cdd1fd36f4b67d9fdbeb1a4d16025192d44a3e8b.1476139573.git.mschiffer@universe-factory.net>
+From: Arnaldo Carvalho de Melo <acme@redhat.com>
+Date: Mon, 14 Mar 2016 09:56:35 -0300
+Subject: [PATCH] net: Fix use after free in the recvmmsg exit path
+
+[ Upstream commit 34b88a68f26a75e4fded796f1a49c40f82234b7d ]
+
+The syzkaller fuzzer hit the following use-after-free:
+
+ Call Trace:
+ [<ffffffff8175ea0e>] __asan_report_load8_noabort+0x3e/0x40 mm/kasan/report.c:295
+ [<ffffffff851cc31a>] __sys_recvmmsg+0x6fa/0x7f0 net/socket.c:2261
+ [< inline >] SYSC_recvmmsg net/socket.c:2281
+ [<ffffffff851cc57f>] SyS_recvmmsg+0x16f/0x180 net/socket.c:2270
+ [<ffffffff86332bb6>] entry_SYSCALL_64_fastpath+0x16/0x7a
+ arch/x86/entry/entry_64.S:185
+
+And, as Dmitry rightly assessed, that is because we can drop the
+reference and then touch it when the underlying recvmsg calls return
+some packets and then hit an error, which will make recvmmsg to set
+sock->sk->sk_err, oops, fix it.
+
+Reported-and-Tested-by: Dmitry Vyukov <dvyukov@google.com>
+Cc: Alexander Potapenko <glider@google.com>
+Cc: Eric Dumazet <edumazet@google.com>
+Cc: Kostya Serebryany <kcc@google.com>
+Cc: Sasha Levin <sasha.levin@oracle.com>
+Fixes: a2e2725541fa ("net: Introduce recvmmsg socket syscall")
+http://lkml.kernel.org/r/20160122211644.GC2470@redhat.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
+---
+ net/socket.c | 38 +++++++++++++++++++-------------------
+ 1 file changed, 19 insertions(+), 19 deletions(-)
+
+diff --git a/net/socket.c b/net/socket.c
+index 02fc7c8..7f61789 100644
+--- a/net/socket.c
++++ b/net/socket.c
+@@ -2410,31 +2410,31 @@ int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
+ break;
+ }
+
+-out_put:
+- fput_light(sock->file, fput_needed);
+-
+ if (err == 0)
+- return datagrams;
++ goto out_put;
+
+- if (datagrams != 0) {
++ if (datagrams == 0) {
++ datagrams = err;
++ goto out_put;
++ }
++
++ /*
++ * We may return less entries than requested (vlen) if the
++ * sock is non block and there aren't enough datagrams...
++ */
++ if (err != -EAGAIN) {
+ /*
+- * We may return less entries than requested (vlen) if the
+- * sock is non block and there aren't enough datagrams...
++ * ... or if recvmsg returns an error after we
++ * received some datagrams, where we record the
++ * error to return on the next call or if the
++ * app asks about it using getsockopt(SO_ERROR).
+ */
+- if (err != -EAGAIN) {
+- /*
+- * ... or if recvmsg returns an error after we
+- * received some datagrams, where we record the
+- * error to return on the next call or if the
+- * app asks about it using getsockopt(SO_ERROR).
+- */
+- sock->sk->sk_err = -err;
+- }
+-
+- return datagrams;
++ sock->sk->sk_err = -err;
+ }
++out_put:
++ fput_light(sock->file, fput_needed);
+
+- return err;
++ return datagrams;
+ }
+
+ SYSCALL_DEFINE5(recvmmsg, int, fd, struct mmsghdr __user *, mmsg,
+--
+2.10.0
+
......@@ -16,7 +16,7 @@ Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
Backport of LEDE 83f7ec31f8f9641ef842212c45db61b72682debf
diff --git a/target/linux/ar71xx/image/Makefile b/target/linux/ar71xx/image/Makefile
index cbd8a49..ac21e71 100644
index 95f6d46..9ac1d60 100644
--- a/target/linux/ar71xx/image/Makefile
+++ b/target/linux/ar71xx/image/Makefile
@@ -736,6 +736,7 @@ define Device/tl-wa901nd-v4
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment