Fixes the following security vulnerabilities:
CVE-2017-8890
The inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c in the
Linux kernel through 4.10.15 allows attackers to cause a denial of service
(double free) or possibly have unspecified other impact by leveraging use
of the accept system call.
CVE-2017-9074
The IPv6 fragmentation implementation in the Linux kernel through 4.11.1
does not consider that the nexthdr field may be associated with an invalid
option, which allows local users to cause a denial of service (out-of-bounds
read and BUG) or possibly have unspecified other impact via crafted socket
and send system calls.
CVE-2017-9075
The sctp_v6_create_accept_sk function in net/sctp/ipv6.c in the Linux kernel
through 4.11.1 mishandles inheritance, which allows local users to cause a
denial of service or possibly have unspecified other impact via crafted
system calls, a related issue to CVE-2017-8890.
CVE-2017-9076
The dccp_v6_request_recv_sock function in net/dccp/ipv6.c in the Linux
kernel through 4.11.1 mishandles inheritance, which allows local users to
cause a denial of service or possibly have unspecified other impact via
crafted system calls, a related issue to CVE-2017-8890.
CVE-2017-9077
The tcp_v6_syn_recv_sock function in net/ipv6/tcp_ipv6.c in the Linux kernel
through 4.11.1 mishandles inheritance, which allows local users to cause a
denial of service or possibly have unspecified other impact via crafted
system calls, a related issue to CVE-2017-8890.
CVE-2017-9242
The __ip6_append_data function in net/ipv6/ip6_output.c in the Linux kernel
through 4.11.3 is too late in checking whether an overwrite of an skb data
structure may occur, which allows local users to cause a denial of service
(system crash) via crafted system calls.
Ref: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8890
Ref: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9074
Ref: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9075
Ref: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9076
Ref: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9077
Ref: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9242
Ref: https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.31
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
Fixes the following security vulnerabilities:
CVE-2017-8890
The inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c in the
Linux kernel through 4.10.15 allows attackers to cause a denial of service
(double free) or possibly have unspecified other impact by leveraging use
of the accept system call.
CVE-2017-9074
The IPv6 fragmentation implementation in the Linux kernel through 4.11.1
does not consider that the nexthdr field may be associated with an invalid
option, which allows local users to cause a denial of service (out-of-bounds
read and BUG) or possibly have unspecified other impact via crafted socket
and send system calls.
CVE-2017-9075
The sctp_v6_create_accept_sk function in net/sctp/ipv6.c in the Linux kernel
through 4.11.1 mishandles inheritance, which allows local users to cause a
denial of service or possibly have unspecified other impact via crafted
system calls, a related issue to CVE-2017-8890.
CVE-2017-9076
The dccp_v6_request_recv_sock function in net/dccp/ipv6.c in the Linux
kernel through 4.11.1 mishandles inheritance, which allows local users to
cause a denial of service or possibly have unspecified other impact via
crafted system calls, a related issue to CVE-2017-8890.
CVE-2017-9077
The tcp_v6_syn_recv_sock function in net/ipv6/tcp_ipv6.c in the Linux kernel
through 4.11.1 mishandles inheritance, which allows local users to cause a
denial of service or possibly have unspecified other impact via crafted
system calls, a related issue to CVE-2017-8890.
CVE-2017-9242
The __ip6_append_data function in net/ipv6/ip6_output.c in the Linux kernel
through 4.11.3 is too late in checking whether an overwrite of an skb data
structure may occur, which allows local users to cause a denial of service
(system crash) via crafted system calls.
Ref: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8890
Ref: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9074
Ref: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9075
Ref: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9076
Ref: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9077
Ref: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9242
Ref: https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.71
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
CONFIG_SG_POOL symbol is selected only by CONFIG_SCSI, since the last
one is disabled by default then disable CONFIG_SG_POOL by default too.
And explicitly enable it only for platforms that use CONFIG_SCSI.
Signed-off-by: Sergey Ryazanov <ryazanov.s.a@gmail.com>
Add HAVE_IRQ_EXIT_ON_IRQ_STACK kernel configuration symbol that was
missed during backporting separate IRQ stack for MIPS from upstream.
Signed-off-by: Sergey Ryazanov <ryazanov.s.a@gmail.com>
PHY core treats any positive return value as the auto-negotiation done
indication. Since we do not actually check any device register in this
callback then update it to return positive value with a neutral meaning
instead of the register flag to avoid confusing for future readers.
Signed-off-by: Sergey Ryazanov <ryazanov.s.a@gmail.com>
The Marvel 88E6060 switch has an MDIO interface, but does not emulate
regular PHY behavior for the host. The network core can not detect using
the generic code, whether the connection via the attached PHY can be
used or not. The PHY's state machine is stuck in a state of
auto-negotiation and does not go any further so the Ethernet interface
of the router stay forever in the not-runing state.
Fix this issue by implementing the aneg_done callback to be able to
inform the network core that the Ethernet interface link to which the
switch is connected can be marked as RUNNING.
Signed-off-by: Sergey Ryazanov <ryazanov.s.a@gmail.com>
Drop the own PHY polling function and switch to using the kernel PHY
state machine. This change allows driver to work correctly with devices
that do not support PHY behaviour but whose driver could emulate
autonegotiation completion (e.g. MV88E6060 and IP17xx switches).
NB: earlier this driver rely on flaws in PHY core code and could use PHY
device without really starting it. But now (at least in kernel 4.9)
this trick no more work and network interface could stuck in not-running
state.
Signed-off-by: Sergey Ryazanov <ryazanov.s.a@gmail.com>
Few tiny fixes for issues caused by changes in the upstream:
- do not touch PHY IRQ array (core code initializes it itself now)
- add missed SET_NETDEV_DEV() invocation (causes segfault during phy
connection)
- use phy API inside the MDIO probe function instead of direct field
access (consider phy structure changes in upstream and prevent
similar issues in the future)
Signed-off-by: Sergey Ryazanov <ryazanov.s.a@gmail.com>
This patch adds support for the Ubiquiti EdgeRouter X-SFP and
improves support for the EdgeRouter X (PoE-passthrough).
Specification:
- SoC: MediaTek MT7621AT
- Flash: 256 MiB
- RAM: 265 MiB
- Ethernet: 5 x LAN (1000 Mbps)
- UART: 1 x UART on PCB (3.3V, RX, TX, GND) - 57600 8N1
- EdgeRouter X:
- 1 x PoE-Passtrough (Eth4)
- powered by Wallwart or passive PoE
- EdgeRouter X-SFP:
- 5 x PoE-Out (24V, passive)
- 1 x SFP (unknown status)
- powered by Wallwart (24V)
Doesn't work:
* SoC has crypto engine but no open driver.
* SoC has nat acceleration, but no open driver.
* This router has 2MB spi flash soldered in but MT
nand/spi drivers do not support pin sharing,
so it is not accessable and disabled. Stock
firmware could read it and it was empty.
Installation
via vendor firmware:
- build an Initrd-image (> 3MiB) and upload the factory-image
- initrd can have luci-mod-failsafe
- flash final firmware via LuCI / sysupgrade on rebooted system
via TFTP:
- stop uboot into tftp-load into option "1"
- upload factory.bin image
Signed-off-by: Sven Roederer <devel-sven@geroedel.de>
This change add IPQ40xx AP-DK04.1-C1 board image support,
enables ubi image for IPQ40xx AP-DK04.1-C1 board and also
add sysupgrage support for AP-DK04.1-C1 and generates a
sysupgrade.tar image.
Testing:
*Tested on IPQ40xx AP-DK04.1-C1:
a. NAND boot
b. ubi sysupgrade
Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
x86 board.d only contains a case for the APU2, not the APU1. This
causes, for example, network configuration not to be created correctly.
Even though the APU1 seems to reaching EOL, there a still a lot of them
out there.
The APU1 and APU2 is configured in the same way and this patch should
also be considered for stable, as the error also exists there.
Signed-off-by: Kristian Evensen <kristian.evensen@gmail.com>
Now that we always provide these partitions through DT, we don't need to
pass their data through parser data from board files anymore.
Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
Allow the parser to be invoked from DT without fixed cfe/linux/nvram
partitions. This allows flash to be probed from DT also for multi
flash-size images.
Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
The patch 0008 removes the vanilla kernel gptu.c of lantiq.
But the replacement file timer.c does not work Amazon-SE and
is also protected therefore with an CONFIG_SOC_AMAZON_SE :-)
This commit will re-activate the default vanilla kernel code
in gptu.c for Amazon-SE.
Signed-off-by: Tino Reichardt <milky-lede@mcmilk.de>
[refresh patches and add same change for kernel 4.9]
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This patch adds support for the Allnet ADSL2+ Modem ALL0333CJ.
Specifications:
- SoC: Amazon-SE
- RAM: 16MB
- Storage: 4MB NOR FLash
- LEDs: Power, Ethernet, DSL (Sync)
- Buttons: 1x Reset Button (not currently supported, will be done)
- 1x Ethernet-Port: 1x RJ45 10/100BaseTX
- 1x WAN-Port: AnnexB & J, G.992.1(ADSL), G.992.3(ADSL2), G.992.5(ADSL2+)
Installation:
- can be done via telnet+tftp or serial console
- default passwords:
- via telnet (root:admin)
- via webinterface http://172.16.1.254:8235/ (admin:coolwhite)
Installation via telnet / tftp:
host: # your own host must have an tftpd daemon, then do this:
host: ifconfig eth0:172 172.16.1.1 up
host: # telnet to allnet modem, root:admin
host: telnet 172.16.1.254
modem: # kill this daemon, it spams your console
modem: killall dsl_cpe_control
modem: # change to some place in ram:
modem: cd /ramdisk/tftp_upload
modem: # load lede-lantiq-ase-ALL0333CJ-squashfs-sysupgrade.bin alias uImage
modem: tftp -g -r uImage 172.16.1.1
modem: # load these extra tools from your tftpd via:
modem: # source: https://github.com/mcmilk/uboot-utils/releases/download/0.1/mips32.tar.gz
modem: tftp -g -r flashwrite 172.16.1.1
modem: tftp -g -r fw_setenv 172.16.1.1
modem: tftp -g -r fw.conf 172.16.1.1
modem: ln -s fw_setenv fw_printenv
modem: chmod +x *
modem: ./fw_setenv disable_recovery y
modem: ./fw_setenv kernel_addr 0xb0010000
modem: ./flashwrite /dev/mtd/1 uImage 0
Installation via serial line at uboot:
uboot: # erase everything exept bootloader
uboot: protect on b0000000 +10000; protect on b03f0000 +10000
uboot: erase all
uboot: # get new firmware via tftp:
uboot: tftpboot 0x80100000 uImage; setenv kernel_addr 0xb0010000
uboot: # copy to flash:
uboot: cp.b 0x80100000 $(kernel_addr) $(filesize)
uboot: # disable proprietary image checking:
uboot: setenv disable_recovery=y; saveenv
uboot: # reboot with LEDE ;)
uboot: reset
Ethernet works as expected, DSL syncronization does not work properly
currently, I am working on this issue.
Signed-off-by: Tino Reichardt <milky-lede@mcmilk.de>
Enable the building of Netgear DGN1000B images. I have an
example device here, but it was not tested currently.
Also WLAN and USB is not ready in the moment.
This is just the proper way, so that developing on this
device is known to be done in the near future.
Signed-off-by: Tino Reichardt <milky-lede@mcmilk.de>
Add block device sd to kernel config otherwise AHCI/eSATA devices won't get enumerated in /dev
Signed-off-by: Daniel Engberg <daniel.engberg.lists@pyret.net>
Explicitely disable X2APIC support on legacy targets since the targeted
processor types do not support it anyway there.
Fixes FS#285.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
mvebu was modifying RAMFS_COPY_BIN and RAMFS_COPY_DATA from a
sysupgrade_pre_upgrade hook. As the ramfs is created from stage2, this
did not have an effect anymore after the staged sysupgrade changes.
As it doesn't really hurt to copy fw_printenv and fw_setenv
unconditionally, simply add them in /lib/upgrade/platform.sh, so stage2
will see them.
Config copying is moved to a function called by platform_copy_config, where
it belongs.
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
Fixes: FS#821
Fixes: 30f61a34b4 "base-files: always use staged sysupgrade"
Jonas Gorski