kernel: bump 4.4 to 4.4.112
Refresh patches. Remove upstreamed patches: target/linux/generic/patches-4.4/030-2-smsc75xx-use-skb_cow_head-to-deal-with-cloned-skbs.patch target/linux/generic/patches-4.4/030-3-cx82310_eth-use-skb_cow_head-to-deal-with-cloned-skb.patch target/linux/generic/patches-4.4/030-4-sr9700-use-skb_cow_head-to-deal-with-cloned-skbs.patch target/linux/generic/patches-4.4/030-5-lan78xx-use-skb_cow_head-to-deal-with-cloned-skbs.patch CVEs completely or partially addressed: CVE-2017-5715 CVE-2017-5753 CVE-2017-17741 CVE-2017-1000410 Compile-tested: ar71xx Archer C7 v2 Run-tested: ar71xx Archer C7 v2 Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>v19.07.3_mercusys_ac12_duma
Kevin Darbyshire-Bryant
6 years ago
committed by
Hauke Mehrtens
parent
d8565a06dc
commit
a30370bbf1
@ -1,36 +0,0 @@
|
||||
From b7c6d2675899cfff0180412c63fc9cbd5bacdb4d Mon Sep 17 00:00:00 2001
|
||||
From: Eric Dumazet <edumazet@google.com>
|
||||
Date: Wed, 19 Apr 2017 09:59:21 -0700
|
||||
Subject: [PATCH] smsc75xx: use skb_cow_head() to deal with cloned skbs
|
||||
|
||||
We need to ensure there is enough headroom to push extra header,
|
||||
but we also need to check if we are allowed to change headers.
|
||||
|
||||
skb_cow_head() is the proper helper to deal with this.
|
||||
|
||||
Fixes: d0cad871703b ("smsc75xx: SMSC LAN75xx USB gigabit ethernet adapter driver")
|
||||
Signed-off-by: Eric Dumazet <edumazet@google.com>
|
||||
Cc: James Hughes <james.hughes@raspberrypi.org>
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
---
|
||||
drivers/net/usb/smsc75xx.c | 8 ++------
|
||||
1 file changed, 2 insertions(+), 6 deletions(-)
|
||||
|
||||
--- a/drivers/net/usb/smsc75xx.c
|
||||
+++ b/drivers/net/usb/smsc75xx.c
|
||||
@@ -2193,13 +2193,9 @@ static struct sk_buff *smsc75xx_tx_fixup
|
||||
{
|
||||
u32 tx_cmd_a, tx_cmd_b;
|
||||
|
||||
- if (skb_headroom(skb) < SMSC75XX_TX_OVERHEAD) {
|
||||
- struct sk_buff *skb2 =
|
||||
- skb_copy_expand(skb, SMSC75XX_TX_OVERHEAD, 0, flags);
|
||||
+ if (skb_cow_head(skb, SMSC75XX_TX_OVERHEAD)) {
|
||||
dev_kfree_skb_any(skb);
|
||||
- skb = skb2;
|
||||
- if (!skb)
|
||||
- return NULL;
|
||||
+ return NULL;
|
||||
}
|
||||
|
||||
tx_cmd_a = (u32)(skb->len & TX_CMD_A_LEN) | TX_CMD_A_FCS;
|
||||
@ -1,35 +0,0 @@
|
||||
From a9e840a2081ed28c2b7caa6a9a0041c950b3c37d Mon Sep 17 00:00:00 2001
|
||||
From: Eric Dumazet <edumazet@google.com>
|
||||
Date: Wed, 19 Apr 2017 09:59:22 -0700
|
||||
Subject: [PATCH] cx82310_eth: use skb_cow_head() to deal with cloned skbs
|
||||
|
||||
We need to ensure there is enough headroom to push extra header,
|
||||
but we also need to check if we are allowed to change headers.
|
||||
|
||||
skb_cow_head() is the proper helper to deal with this.
|
||||
|
||||
Fixes: cc28a20e77b2 ("introduce cx82310_eth: Conexant CX82310-based ADSL router USB ethernet driver")
|
||||
Signed-off-by: Eric Dumazet <edumazet@google.com>
|
||||
Cc: James Hughes <james.hughes@raspberrypi.org>
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
---
|
||||
drivers/net/usb/cx82310_eth.c | 7 ++-----
|
||||
1 file changed, 2 insertions(+), 5 deletions(-)
|
||||
|
||||
--- a/drivers/net/usb/cx82310_eth.c
|
||||
+++ b/drivers/net/usb/cx82310_eth.c
|
||||
@@ -293,12 +293,9 @@ static struct sk_buff *cx82310_tx_fixup(
|
||||
{
|
||||
int len = skb->len;
|
||||
|
||||
- if (skb_headroom(skb) < 2) {
|
||||
- struct sk_buff *skb2 = skb_copy_expand(skb, 2, 0, flags);
|
||||
+ if (skb_cow_head(skb, 2)) {
|
||||
dev_kfree_skb_any(skb);
|
||||
- skb = skb2;
|
||||
- if (!skb)
|
||||
- return NULL;
|
||||
+ return NULL;
|
||||
}
|
||||
skb_push(skb, 2);
|
||||
|
||||
@ -1,37 +0,0 @@
|
||||
From d532c1082f68176363ed766d09bf187616e282fe Mon Sep 17 00:00:00 2001
|
||||
From: Eric Dumazet <edumazet@google.com>
|
||||
Date: Wed, 19 Apr 2017 09:59:23 -0700
|
||||
Subject: [PATCH] sr9700: use skb_cow_head() to deal with cloned skbs
|
||||
|
||||
We need to ensure there is enough headroom to push extra header,
|
||||
but we also need to check if we are allowed to change headers.
|
||||
|
||||
skb_cow_head() is the proper helper to deal with this.
|
||||
|
||||
Fixes: c9b37458e956 ("USB2NET : SR9700 : One chip USB 1.1 USB2NET SR9700Device Driver Support")
|
||||
Signed-off-by: Eric Dumazet <edumazet@google.com>
|
||||
Cc: James Hughes <james.hughes@raspberrypi.org>
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
---
|
||||
drivers/net/usb/sr9700.c | 9 ++-------
|
||||
1 file changed, 2 insertions(+), 7 deletions(-)
|
||||
|
||||
--- a/drivers/net/usb/sr9700.c
|
||||
+++ b/drivers/net/usb/sr9700.c
|
||||
@@ -456,14 +456,9 @@ static struct sk_buff *sr9700_tx_fixup(s
|
||||
|
||||
len = skb->len;
|
||||
|
||||
- if (skb_headroom(skb) < SR_TX_OVERHEAD) {
|
||||
- struct sk_buff *skb2;
|
||||
-
|
||||
- skb2 = skb_copy_expand(skb, SR_TX_OVERHEAD, 0, flags);
|
||||
+ if (skb_cow_head(skb, SR_TX_OVERHEAD)) {
|
||||
dev_kfree_skb_any(skb);
|
||||
- skb = skb2;
|
||||
- if (!skb)
|
||||
- return NULL;
|
||||
+ return NULL;
|
||||
}
|
||||
|
||||
__skb_push(skb, SR_TX_OVERHEAD);
|
||||
@ -1,38 +0,0 @@
|
||||
From d4ca73591916b760478d2b04334d5dcadc028e9c Mon Sep 17 00:00:00 2001
|
||||
From: Eric Dumazet <edumazet@google.com>
|
||||
Date: Wed, 19 Apr 2017 09:59:24 -0700
|
||||
Subject: [PATCH] lan78xx: use skb_cow_head() to deal with cloned skbs
|
||||
|
||||
We need to ensure there is enough headroom to push extra header,
|
||||
but we also need to check if we are allowed to change headers.
|
||||
|
||||
skb_cow_head() is the proper helper to deal with this.
|
||||
|
||||
Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver")
|
||||
Signed-off-by: Eric Dumazet <edumazet@google.com>
|
||||
Cc: James Hughes <james.hughes@raspberrypi.org>
|
||||
Cc: Woojung Huh <woojung.huh@microchip.com>
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
---
|
||||
drivers/net/usb/lan78xx.c | 9 ++-------
|
||||
1 file changed, 2 insertions(+), 7 deletions(-)
|
||||
|
||||
--- a/drivers/net/usb/lan78xx.c
|
||||
+++ b/drivers/net/usb/lan78xx.c
|
||||
@@ -2050,14 +2050,9 @@ static struct sk_buff *lan78xx_tx_prep(s
|
||||
{
|
||||
u32 tx_cmd_a, tx_cmd_b;
|
||||
|
||||
- if (skb_headroom(skb) < TX_OVERHEAD) {
|
||||
- struct sk_buff *skb2;
|
||||
-
|
||||
- skb2 = skb_copy_expand(skb, TX_OVERHEAD, 0, flags);
|
||||
+ if (skb_cow_head(skb, TX_OVERHEAD)) {
|
||||
dev_kfree_skb_any(skb);
|
||||
- skb = skb2;
|
||||
- if (!skb)
|
||||
- return NULL;
|
||||
+ return NULL;
|
||||
}
|
||||
|
||||
if (lan78xx_linearize(skb) < 0)
|
||||
Loading…
Reference in New Issue