This reverts commit 6b7eeb74db since it
didn't contain a reference to the CVE it addresses. The next commit
will re-add the commit including a CVE reference in its commit message.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
8d45443bb5c9 pppd: Ignore received EAP messages when not doing EAP
8d7970b8f3db pppd: Fix bounds check in EAP code
858976b1fc31 radius: Prevent buffer overflow in rc_mksid()
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit 215598fd03)
The $(space) definition in the hostapd Makefile ceased to work with
GNU Make 4.3 and later, leading to syntax errors in the generated
Kconfig files.
Drop the superfluous redefinition and reuse the working $(space)
declaration from rules.mk to fix this issue.
Fixes: GH#2713
Ref: https://github.com/openwrt/openwrt/pull/2713#issuecomment-583722469
Reported-by: Karel Kočí <cynerd@email.cz>
Suggested-by: Jonas Gorski <jonas.gorski@gmail.com>
Tested-by: Shaleen Jain <shaleen@jain.sh>
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 766e778226)
Add Netgear WNDR3700v2 to the list of supported boards.
Signed-off-by: Michal Cieslakiewicz <michal.cieslakiewicz@wp.pl>
[rebase, adjusted commit title]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
(cherry picked from commit a09408fa57)
Call skb_orphan(skb) to call the owner's destructor function and make
the skb unowned.
This is necessary to prevent sk_wmem_alloc of a socket from overflowing,
which leads to ENOBUFS errors on application level.
Signed-off-by: Martin Schiller <ms@dev.tdt.de>
(cherry picked from commit 996f02e5ba)
hostapd sets minimum values for CWmin/CWmax/AIFS and maximum for TXOP.
The code for applying those values had a few bugs leading to bogus values,
which caused significant latency and packet loss.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Add ubootenv uci config for gl-ar150, gl-domino and gl-mifi
Signed-off-by: Kimmo Vuorinen <kimmo.vuorinen@gmail.com>
[commit message/title facelift]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
(cherry picked from commit dc6dfaac80)
c7f7b6b65b82 Tag version 1.0.2
236b7a0aef21 Fix blocked entropy generation
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit 3d8edd9bb4)
* 40f939d57c67 Tag version 1.0.1
* 9e758e6e6aec jitterentropy-rngd: update to version v1.1.0 + clang compile fix
* 193586a25adc Fix wrong types in format strings used in debug build
* d474977bb611 Add initial GitLab CI support
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit ed67b137c7)
set noscan also for IBSS and remove redundant/obsolete variable.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 702c70264b)
The 'DEFAULT:=m if ALL' line prevents the phase1 buildbots from building
the package, and users from downloading it, since they use 'ALL_KMODS=y'
but 'ALL' is not set.
Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry picked from commit 9b25f833eb)
14a279411cff fix certificate blob parsing vulnerability by using blob_parse_untrusted
19a7225ac018 fix leaking memory in cert_dump_blob
9dba44ddd4f5 fix possibly garbage value returned in cert_process_revoker
4462ff9dedfa add cram based unit tests
5fe64b5606aa cmake: split usign bits into static library
5d7626a2b6d8 cmake: reindent the file
e284ed941972 cmake: enable hardening compiler flags and fix the reported issues
7e5390666347 add initial GitLab CI support
fa0bf4ef45b1 cmake: add proper include and library dependencies
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit 2544cb1ba3)
This is a backport from the dnsmasq master which should fix a bug which
could cause a crash in dnsmasq.
I saw the following crashes in my log:
[522413.117215] do_page_fault(): sending SIGSEGV to dnsmasq for invalid read access from 2a001450
[522413.124464] epc = 004197f1 in dnsmasq[400000+23000]
[522413.129459] ra = 004197ef in dnsmasq[400000+23000]
This is happening in blockdata_write() when block->next is
dereferenced, but I am not sure if this is related to this problem or if
this is a different problem. I am unable to reproduce this problem.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 414d054138)
- both packages provide ca-certs
- make ca-bundle the default provider
This should allow easy transition between these two forms of CA certificates storage
Signed-off-by: Maxim Storchak <m.storchak@gmail.com>
(cherry picked from commit dd299805ad)
In the commit f3439c4019 ("procd: update to version 2020-01-04") I've
somehow managed to add local testing symlink to the uledd package, so
removing it now.
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Contains following changes:
041c9d1c052b ubusd/libubus-io: fix socket descriptor passing
8f2292478c57 ci: enable unit testing
a1523d76b016 fix blob parsing vulnerability by using blob_parse_untrusted
c60583743ccf ubus_monitor: workaround possibly false positive uses of memory after it is freed
dac6c7c575ac ubusd_monitor: fix possible null pointer dereference
060dfbb26da3 ubus_common: remove duplicate ARRAY_SIZE and add missing include
c5f2053dfcfd workaround possibly false positive uses of memory after it is freed
72be8e93f07d lua: ubus_lua_do_subscribe: fix copy&paste error
a995b1e68129 lua: workaround false positive dereference of null pointer
08f17c87a000 add fuzzer and cram based unit tests
c413be9b376c refactor ubusd.c into reusable ubusd_library
afd47189e864 examples: remove dead increments
b2e544238672 add initial GitLab CI support
058f4e9526ed libubus: fix incompatible pointer types assigment
d2e026a33df8 iron out all extra compiler warnings
5d7ca8309d0a ubusd/libubus-io: fix variable sized struct position warning
d61282db5640 ubusd: fix comparison of integers of different signs
90fb16234c22 cmake: enable extra compiler checks
2e051f628996 ubus: Support static builds
588baa3cd784 ubusd: retry sending messages on EINTR
76ea27a62774 libubus: attempt to receive data before calling poll
4daab27d004f libubus: do not abort recv_retry before completing a message
and bumps ABI_VERSION to 20191227.
Acked-by: Hauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Contains following changes:
cd75136b1342 blobmsg: fix wrong payload len passed from blobmsg_check_array
eb7eb6393d47 blobmsg: fix array out of bounds GCC 10 warning
86f6a5b8d1f1 blobmsg: reuse blobmsg_namelen in blobmsg_data
586ce031eaa0 tests: fuzz: fuzz _len variants of checking methods
b0e21553ae8c blobmsg: add _len variants for all attribute checking methods
cd3059796a57 Replace use of blobmsg_check_attr by blobmsg_check_attr_len
143303149c8b Ensure blob_attr length check does not perform out of bounds reads
f2b2ee441adb blobmsg: fix heap buffer overflow in blobmsg_parse
4dfd24ed88c4 blobmsg: make blobmsg_len and blobmsg_data_len return unsigned value
2df6d35e3299 tests: add test cases for blobmsg parsing
8a34788b46c4 test: fuzz: add blobmsg_check_attr crashes
478597b9f9ae blob: fix OOB access in blob_check_type
325418a7a3c0 tests: use blob_parse_untrusted variant
0b24e24b93e1 blob: introduce blob_parse_untrusted
6d27336e4a8b blob: refactor attr parsing into separate function
833d25797b16 test: fuzz: add blob_parse crashes
09ee90f8d6ed tests: add test cases for blob parsing
436d6363a10b tests: add libFuzzer based tests
bf680707acfd tests: add unit tests covered with Clang sanitizers
f804578847de cmake: add more hardening compiler flags
46f8268b4b5b blobmsg/ulog: fix format string compiler warnings
eb216a952407 cmake: use extra compiler warnings only on gcc6+
07413cce72e1 tests: jshn: add more test cases
26586dae43a8 jshn: fix missing usage for -p and -o arguments
8e832a771d3a jshn: fix off by one in jshn_parse_file
cb698e35409b jshn: jshn_parse: fix leaks of memory pointed to by 'obj'
c42f11cc7c0f jshn: main: fix leak of memory pointed to by 'vars'
93848ec96dc5 jshn: refactor main into smaller pieces
9b6ede0e5312 avl: guard against theoretical null pointer dereference
c008294a8323 blobmsg_json: fix possible uninitialized struct member
0003ea9c45cc base64: fix possible null pointer dereference
8baeeea1f52d add assert.h component
b0a5cd8a28bf add cram based unit tests
1fefb7c4d7f9 add initial GitLab CI support
c955464d7a9b enable extra compiler checks
6228df9de91d iron out all extra compiler warnings
and bumps ABI_VERSION to 20191228.
Acked-by: Hauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: Petr Štetiar <ynezz@true.cz>
The factory uboot of the Turris Omnia boots with "root=b301", and we
instruct new users to sysupgrade from there (e.g. method 1, step 7).
Currently, this will fail with "Unable to determine upgrade device".
Add a new case to export_bootdevice, which parses the hex argument.
Ref: https://github.com/openwrt/openwrt/pull/2340#issuecomment-561317688
Fixes: 2e5a0b81ec ("mvebu: sysupgrade: sdcard: keep user added partitons")
Reviewed-by: Hauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: Klaus Kudielka <klaus.kudielka@gmail.com>
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit 3a4f587c46)
This update fixes many bugs, and six security vulnerabilities, including
CVE-2019-18840.
Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry picked from commit d5ede68f8b)
The mt76 driver does load the firmware for the MT7615 chip from
/lib/firmware/mediatek instead of /lib/firmware. The driver loads the
firmware from this path since mt76 commit
ea3ab68c7589 ("mt76: mt7615: fix mt7615 firmware path definitions").
Fixes: a2e2c40b5e ("mt76: update to the latest openwrt-19.07 version")
Reported-by: Stijn Segers <foss@volatilesystems.org>
Signed-off-by: David Bauer <mail@david-bauer.net>
Tested-by: Stijn Segers <foss@volatilesystems.org>
330e832 mt76: mt76x0: fix default mac address overwrite
f97c33e mt76: mt7603: fix input validation issues for powersave-filtered frames
875f6d7 mt76: mt7615: increase MCU command timeout
abd7d86 mt76: clear skb pointers from rx aggregation reorder buffer during cleanup
96c7b07 mt76: eeprom: add support for big endian eeprom partition
19c8e20 mt76: fix possible undetected invalid MAC address
df64c56 mt76: Off by one in mt76_calc_rx_airtime()
1702b24 mt76: mt7603: reset STA_CCA counter setting the channel
383a631 mt76: mt76x0u: do not reset radio on resume
2dcfbdd mt76: disable bh in mt76_dma_rx_poll
947d20d mt76: fix rx dma ring descriptor state on reset
f3348f5 mt7615: replace sta_state callback with sta_add/sta_remove
faf5e6f mt76: mt7615: read {tx,rx} mask from eeprom
db78ee0 mt76: move mt76_get_antenna in mt76_core module
7121e16 mt76: fix possible out-of-bound access in mt7615_fill_txs/mt7603_fill_txs
5dfb0ec mt76: mt7615: disable radar pattern detector during scanning
e2f90ad mt76: move interface_modes definition in mt76_core module
cfdb751 mt76: mt7615: add ibss support
e0731a8 mt76: move SUPPORTS_REORDERING_BUFFER hw property in mt76_register_device
a85c06c mt76: use mt76_dev in mt76_is_{mmio,usb}
ea19cd7 mt76: Remove set but not used variable 'idx'
3cbaf81 mt76: mt76u: rely on a dedicated stats workqueue
20f0589 mt76: mt76u: rely on usb_interface instead of usb_dev
f2be00b mt76: dma: fix buffer unmap with non-linear skbs
c14d656 mt76: mt76x2e: disable pcie_aspm by default
58e1e96 mt76: mt7615: remove unneeded semicolon
c93a2d1 mt76: mt76x02u: update ewma pkt len in mt76x02u_tx_prepare_skb
1987b74 mt76: mt76x0: remove 350ms delay in mt76x0_phy_calibrate
50b1e9b mt76: refactor cc_lock locking scheme
d868638 mt76: remove obsolete .add_buf() from struct mt76_queue_ops
dc14ac6 mt7615: remove vif sta from poll list on interface remove
2a0a191 mt7603: remove vif sta from poll list on interface remove
d3a5895 mt76: fix a-mpdu boundary detection issue for airtime reporting
391e148 mt76: add sanity check for a-mpdu rx wcid index
01642d8 mt76: mt76x02: fix use-after-free in tx status code handling airtime
c11a4ad mt76: mt76x0: eeprom: add support for MAC address from OF
d94cc81 mt76: drop rcu read lock in mt76_rx_aggr_stop
7d8764d mt76: avoid enabling interrupt if NAPI poll is still pending
5b02a07 mt76: add missing locking around ampdu action
71c2ef0 mt76: fix aggregation stop issue
6f7d0f5 mt76: fix use-after-free bug in airtime fairness code
8f22de0 mt76: do not use devm API for led classdev
e7199f9 mt76: enable airtime fairness
81f2be0 mt76: mt7615: track tx/rx airtime for airtime fairness
2579122 mt76: mt7615: introduce mt7615_mac_wtbl_update routine
d91f7c1 mt76: mt7615: fix survey channel busy time
028071d mt76: mt7615: report tx_time, bss_rx and busy time to mac80211
0e5050e mt76: mt76x02: track approximate tx airtime for airtime fairness and survey
3429cc7 mt76: mt76x02: move MT_CH_TIME_CFG init to mt76x02_mac_cc_reset
de118bb mt76: unify channel survey update code
fdf0163 mt76: mt7603: switch to a different counter for survey busy time
ee31030 mt76: mt7603: track tx airtime for airtime fairness and survey
f34b1ae mt76: track rx airtime for airtime fairness and survey
a1d6891 mt76: store current channel survey_state in struct mt76_dev
b042987 mt76: rename mt76_driver_ops txwi_flags to drv_flags and include tx aligned4
2027763 mt76: report rx a-mpdu subframe status
1ddcadb mt76: mt7603: remove q_rx field from struct mt7603_dev
ea3ab68 mt76: mt7615: fix mt7615 firmware path definitions
081926a mt76: mt7603: collect aggregation stats
696c0fc mt76: mt7615: collect aggregation stats
23e8aed mt76: move aggr_stats array in mt76_dev
1118b5e mt76: mt7615: add queue entry in debugfs
fbc59e6 mt76: move queue debugfs entry to driver specific code
0b01ace mt76: mt76x02u: move mt76x02u_mac_start in mt76x02-usb module
c394887 mt76: mt76x0u: reset counter starting the device
0355b7a mt76: mt76x2: move mt76x02_mac_reset_counters in mt76x02_mac_start
f3792b5 mt76: mt76x02: move mac_reset_counter in mt76x02_lib module
63e8152 mt76: mt7615: enable SCS by default
b140512 mt76: mt76x0e: make array mt76x0_chan_map static const, makes object smaller
a20c20b mt76: usb: add lockdep_assert_held in __mt76u_vendor_request
0308d75 mt76: remove empty flag in mt76_txq_schedule_list
0efbc5d mt76: use cancel_delayed_work_sync in mt76_rx_aggr_shutdown
9c5df3c mt76: remove aggr_work field from struct mt76_wcid
8739f87 mt76: mt7615: fix control frame rx in monitor mode
e07407a mt7603: fix build with CONFIG_KERNEL_DYNAMIC_DEBUG=y
c7f8214 mt76: mt7615: add support to read temperature from mcu
6797378 mt76: mt7615: introduce mt7615_txwi_to_txp utility routine
496c78e mt76: mt76x0: remove unneeded return value on set channel
1d2acd5 mt76: mt76x0: remove redundant chandef copy
0167bfa mt76: make mt76_rx_convert static
Signed-off-by: David Bauer <mail@david-bauer.net>
This adds a (currently missing) throughput LED trigger for the rt2x00
driver. Previously, LED triggers had to be assigned to the netdev, which
was limited to a single VAP.
Signed-off-by: David Bauer <mail@david-bauer.net>
Tested-by: Christoph Krapp <achterin@googlemail.com>
(cherry picked from commit 985ec835ae)
Only select ath10k-ct-regular when smallbuffers version was not
selected.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 80f06cb601)
According to many bugreports [0][1][2] the default ath10k-ct kernel
module is unusable on devices with just 64 MiB RAM or with 128 MiB and
dual ath10k cards. The target boards boot but eventually oom-killer
starts to interfere with normal operation, so the current state is
effectively broken.
Since the two patches in question have a performance impact (and
possibly some other unexpected side-effects) a dedicated build variant
is added so that users of the low RAM devices can still benefit from all
the ath10k-ct advantages.
According to testing [3] results, the issue can be experienced even with
"a 256MB device with three radios". Measured performance impact of
implementing small buffers was lowering "the maximum 5 GHz throughput on
an IPQ40xx device without RPS/XPS optimizations from 494/432 Mbit/s for
TCP transfers (download/upload) to 438/343 Mbit/s"
The patches were apparently inspired by QSDK tweaks used by ODMs for the
affected devices.
[0] http://lists.infradead.org/pipermail/openwrt-devel/2019-December/020573.html
[1] https://github.com/openwrt/openwrt/pull/1077
[2] https://bugs.openwrt.org/index.php?do=details&task_id=2664
[3] https://github.com/freifunk-gluon/gluon/pull/1440#issue-195607701
Signed-off-by: Paul Fertser <fercerpav@gmail.com>
[Remove double CONFIG_ATH10K-CT_LEDS entry]
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 1ac627024d)
b4e25d5 libblkid-tiny: fix symbol collision with full libblkid
Fixes: FS#2691, FS#2692
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 5f4244150f)
Petr Štetiar
Jo-Philipp Wich
Michal Cieslakiewicz
Rafał Miłecki
Hauke Mehrtens
Martin Schiller
Magnus Kroken
Felix Fietkau
Kimmo Vuorinen
Daniel Golle
Eneas U de Queiroz
Matthias Schiffer
Maxim Storchak
Klaus Kudielka
David Bauer
Paul Fertser