summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* kernel: mtd: parser: cmdline: Fix parsing of part-names with colonsopenwrt-18.06Sven Eckelmann2020-11-242-0/+126
| | | | | | | | | | | | | | | | | | | | | | | | Some devices (especially QCA ones) are already using hardcoded partition names with colons in it. The OpenMesh A62 for example provides following mtd relevant information via cmdline: root=31:11 mtdparts=spi0.0:256k(0:SBL1),128k(0:MIBIB),384k(0:QSEE),64k(0:CDT),64k(0:DDRPARAMS),64k(0:APPSBLENV),512k(0:APPSBL),64k(0:ART),64k(custom),64k(0:KEYS),0x002b0000(kernel),0x00c80000(rootfs),15552k(inactive) rootfsname=rootfs rootwait The change to split only on the last colon between mtd-id and partitions will cause newpart to see following string for the first partition: KEYS),0x002b0000(kernel),0x00c80000(rootfs),15552k(inactive) Such a partition list cannot be parsed and thus the device fails to boot. Avoid this behavior by making sure that the start of the first part-name ("(") will also be the last byte the mtd-id split algorithm is using for its colon search. Fixes: 5d01d0560893 ("kernel: Update kernel 4.14 to version 4.14.202") Fixes: edda06c7b41d ("kernel: Update kernel 4.9 to version 4.9.240") Signed-off-by: Sven Eckelmann <sven@narfation.org> (backported from commit 223eec7e81f8506592fc89cf79a2f14360f5c57b)
* OpenWrt v18.06.9: revert to branch defaultsHauke Mehrtens2020-11-175-11/+9
| | | | Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* OpenWrt v18.06.9: adjust config defaultsv18.06.9Hauke Mehrtens2020-11-175-9/+11
| | | | Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* mac80211: Fix brcmfmac compile on layerscape/armv8_64bHauke Mehrtens2020-11-111-0/+22
| | | | | | | DMI_PRODUCT_SKU is only available with kernel >= 4.18. Fixes: 2cd234d96bd7 ("mac80211: brcmfmac: backport important fixes from kernel 5.2") Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* layerscape: update kernel patch to fix buildAdrian Schmutzler2020-11-111-0/+18
| | | | | | | | | | | The target heavily modifies caamalg.c, so changes introduced in kernel commit 7b930def8ef6 ("crypto: caam - limit output IV to CBC to work around CTR mode DMA issue") have broken build. This adjusts the upstream changes to match the rest of our local patch. Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* kernel: Update kernel 4.9 to version 4.9.243Hauke Mehrtens2020-11-1118-56/+56
| | | | | | Compile and runtime tested on lantiq/xrx200. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* kernel: Update kernel 4.14 to version 4.14.206Hauke Mehrtens2020-11-1116-18/+18
| | | | | | Compile and runtime tested on x86/64. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* uci: Backport security fixesHauke Mehrtens2020-10-283-1/+164
| | | | | | | This packports two security fixes from master. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> (cherry picked from commit f9005d4f80dee3dcc257d4613cbc46668faad094)
* oxnas: fix qc_prep return in sata driver after kernel 4.14.200Adrian Schmutzler2020-10-191-1/+3
| | | | | | | | | | | | | | | | | | | | | | | This fixes a regression after a kernel change in 4.14.200 [1] that led to build failure on oxnas/ox820: drivers/ata/sata_oxnas.c:2238:13: error: initialization of 'enum ata_completion_errors (*)(struct ata_queued_cmd *)' from incompatible pointer type 'void (*)(struct ata_queued_cmd *)' [-Werror=incompatible-pointer-types] .qc_prep = sata_oxnas_qc_prep, ^~~~~~~~~~~~~~~~~~ drivers/ata/sata_oxnas.c:2238:13: note: (near initialization for 'sata_oxnas_ops.qc_prep') Our local driver is changed the same way as prototyped in the kernel patch, i.e. return type is changed and AC_ERR_OK return value is added. [1] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=306a1c5b5683c1d37565e575386139a64bdbec6f Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de> (cherry picked from commit f6ca57e4f40528a8a0103c9f0e9647a2e11d10c3)
* ar71xx: mikrotik: bypass id check in __rb_get_wlan_data()Thibaut VARÈNE2020-10-181-7/+1
| | | | | | | | | | | | | | | | | | | | | The id parameter in __rb_get_wlan_data() was incorrectly used on the assumption that id "0" would always be tied to ath9k with RLE encoding and positive id (in fact, only id "1" was valid) would always be tied to ("external") ath10k with LZO encoding. Newer hardware revisions of supported devices prove this assumption to be invalid, with ath9k caldata being now wrapped in MAGIC_ERD and LZO compressed, so disable this check to allow newer hardware to correctly decode caldata for ath9k. Note: this patch assumes that ath9k caldata is never stored with the new "LZOR" encoding scheme found on some ath10k devices. Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org> (cherry picked from commit 1c6990fe6d198718850b6a37998416cac69f6f53) [keep publishing ath10k caldata in sysfs: it's the way it's done on 18.06] Signed-off-by: Baptiste Jonglez <git@bitsofnetworks.org> Tested-by: Baptiste Jonglez <git@bitsofnetworks.org> [Mikrotik RB941-2nD r3]
* kernel: Update kernel 4.14 to version 4.14.202Hauke Mehrtens2020-10-1817-34/+34
| | | | | | Compile and runtime tested on x86/64. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* kernel: Update kernel 4.9 to version 4.9.240Hauke Mehrtens2020-10-1825-55/+55
| | | | | | Compile and runtime tested on ar71xx/generic. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* firewall: options: fix parsing of boolean attributesHauke Mehrtens2020-10-162-1/+39
| | | | | | | | | | | Boolean attributes were parsed the same way as string attributes, so a value of { "bool_attr": "true" } would be parsed correctly, but { "bool_attr": true } (without quotes) was parsed as false. Fixes FS#3284 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> (cherry picked from commit 7f676b5ed6a2bcd6786a0fcb6a6db3ddfeedf795)
* scripts: getver.sh: fix version based on stable branchBaptiste Jonglez2020-10-071-1/+1
| | | | | | | | | | | | | | | | | | | | When building from a local branch based off the "openwrt-18.06" branch, version computation is wrong, for instance: r6907+1154-7e15e21766 The number of local commits (1154 in this case) is wrong because it is computed against master. As a result, it wrongly counts *all* commits since the beginning of the openwrt-18.06 branch as local commits. The fix is to compare to the openwrt-18.06 branch instead, which gives the expected result such as: r8060+1-1238a22316 Signed-off-by: Baptiste Jonglez <git@bitsofnetworks.org> [shorten commit title] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* mbedtls: update to 2.16.8Magnus Kroken2020-09-283-36/+36
| | | | | | | | | | | | | | | | | | This release of Mbed TLS provides bug fixes and minor enhancements. This release includes fixes for security issues and the most notable of them are described in more detail in the security advisories. * Local side channel attack on RSA and static Diffie-Hellman * Local side channel attack on classical CBC decryption in (D)TLS * When checking X.509 CRLs, a certificate was only considered as revoked if its revocationDate was in the past according to the local clock if available. Full release announcement: https://github.com/ARMmbed/mbedtls/releases/tag/v2.16.8 Signed-off-by: Magnus Kroken <mkroken@gmail.com> (cherry picked from commit 66893063abf56b7d8c21eceed56e5d27859eaaea)
* tools/squashfs4: fix bugs of xz compress optionsLiangbin Lian2020-09-281-3/+3
| | | | | | | lzma_xz_dump_options never return NULL, should compare real options with default options Signed-off-by: Liangbin Lian <jjm2473@gmail.com>
* fstools: backport: fix ntfs uuidLiangbin Lian2020-09-282-1/+57
| | | | Signed-off-by: Liangbin Lian <jjm2473@gmail.com>
* lua: lnum: fix strtoul based number parsingLiangbin Lian2020-09-283-1/+90
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Lua's LNUM patch currently doesn't parse properly certain numbers as it's visible from the following simple tests. On x86_64 host (stock Lua 5.1.5, expected output): $ /usr/bin/lua -e 'print(0x80000000); print(0x80000000000); print(0x100000000)' 2147483648 8796093022208 4294967296 On x86_64 host: $ staging_dir/hostpkg/bin/lua -e 'print(0x80000000); print(0x80000000000); print(0x100000000)' -2147483648 0 0 On x86_64 target: $ lua -e 'print(0x80000000); print(0x80000000000); print(0x100000000)' -2147483648 0 0 On ath79 target: $ lua -e 'print(0x80000000); print(0x80000000000); print(0x100000000)' -2147483648 8796093022208 4294967296 It's caused by two issues fixed in this patch, first issue is caused by unhadled strtoul overflow and second one is caused by the cast of unsigned to signed Lua integer when parsing from hex literal. Run tested on: * Zidoo Z9S with RTD1296 CPU (aarch64_cortex-a53) * qemu/x86_64 * qemu/armvirt_64 * ath79 Signed-off-by: Liangbin Lian <jjm2473@gmail.com> [commit subject/message touches, fixed From to match SOB, fixed another unhandled case in luaO_str2i, host Lua, package bump] Signed-off-by: Petr Štetiar <ynezz@true.cz> (cherry picked from commit 4bb9af48ca36605424c57b6af27dd5e5c827395f)
* kernel: Update kernel 4.9 to version 4.9.237Hauke Mehrtens2020-09-2825-62/+62
| | | | | | Compile and runtime tested on lantiq/xrx200 + ar71xx/generic. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* kernel: Update kernel 4.14 to version 4.14.199Hauke Mehrtens2020-09-2835-187/+187
| | | | | | Compile and runtime tested on x86/64 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* mac80211: Fix potential endless loopHauke Mehrtens2020-08-311-0/+31
| | | | | | | Backport a fix from kernel 5.8.3. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> (cherry picked from commit ca5ee6eba34593ec9f8b5b195c94cf6c3f6ff914)
* mac80211: Backport fixes for Kr00k vulnerabilitiesHauke Mehrtens2020-08-314-1/+131
| | | | | | | This backports some fixes from kernel 5.6 and 4.14.175. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> Tested-By: Baptiste Jonglez <git@bitsofnetworks.org>
* mbedtls: update to 2.16.7Magnus Kroken2020-08-273-38/+38
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Mbed TLS 2.16.7 is a maintenance release of the Mbed TLS 2.16 branch, and provides bug fixes and minor enhancements. This release includes fixes for security issues and the most severe one is described in more detail in a security advisory: https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-07 * Fix a side channel vulnerability in modular exponentiation that could reveal an RSA private key used in a secure enclave. * Fix side channel in mbedtls_ecp_check_pub_priv() and mbedtls_pk_parse_key() / mbedtls_pk_parse_keyfile() (when loading a private key that didn't include the uncompressed public key), as well as mbedtls_ecp_mul() / mbedtls_ecp_mul_restartable() when called with a NULL f_rng argument. An attacker with access to precise enough timing and memory access information (typically an untrusted operating system attacking a secure enclave) could fully recover the ECC private key. * Fix issue in Lucky 13 counter-measure that could make it ineffective when hardware accelerators were used (using one of the MBEDTLS_SHAxxx_ALT macros). Due to Mbed TLS moving from ARMmbed to the Trusted Firmware project, some changes to the download URLs are required. For the time being, the ARMmbed/mbedtls Github repository is the canonical source for Mbed TLS. Signed-off-by: Magnus Kroken <mkroken@gmail.com> [Use https://codeload.github.com and new tar.gz file] Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de (cherry picked from commit 201d6776a0b5858b8ce43a2392c9fe48aa1c4dd7)
* kernel: Update kernel 4.9 to version 4.9.234Hauke Mehrtens2020-08-2718-46/+46
| | | | | | Compile and runtime tested on lantiq/xrx200. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* kernel: Update kernel 4.14 to version 4.14.195Hauke Mehrtens2020-08-2720-51/+51
| | | | | | Compile and runtime tested on x86/64. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* x86: Add CONFIG_EFI_CUSTOM_SSDT_OVERLAYSHauke Mehrtens2020-08-111-0/+1
| | | | | | | | | | The CONFIG_EFI_CUSTOM_SSDT_OVERLAYS option was added in kernel 4.14.188, set it for the x86/generic target. This fixes a build problem in the x86/generic target. Fixes: 35e9edc3dfef ("kernel: Update kernel 4.14 to version 4.14.193") Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* ar71xx: fix ZyXEL NBG6616 wifi switchChristoph Krapp2020-08-111-2/+2
| | | | | | | | The device uses a rf-kill switch instead of a button. Furthermore the GPIO is active high. Signed-off-by: Christoph Krapp <achterin@googlemail.com> (cherry picked from commit 0af656e978f1adac4061516d9d2e661e101ba64c)
* tools/cmake: fix typo in parallel make patchPiotr Stefaniak2020-08-112-1/+2
| | | | | | | | | | | | | | The variable in the case argument was mistyped, so the case always checked against an empty string and never matched. Fix the variable name. Add a PKG_RELEASE to Makefile so we can bump it. Fixes: d6de31310cc1 ("cmake: restore parallel build support for bootstrap") Signed-off-by: Piotr Stefaniak <pstef@freebsd.org> [add commit message, add PKG_RELEASE, fix commit title, add Fixes:] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de> (cherry picked from commit e27fbae63c3436ce5588ca06b78ea88c7a316fee)
* uboot-envtools: ar71xx: add ZyXEL NBG6616 uboot env supportChristoph Krapp2020-08-111-0/+1
| | | | | | | | | This adds support for ZyXEL NBG6616 uboot-env access Signed-off-by: Christoph Krapp <achterin@googlemail.com> [add "ar71xx" to commit title] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de> (cherry picked from commit eb95ca3b5c8b33e3212896f906922eba5f72abb3)
* ar71xx: change u-boot-env to read-write for ZyXEL NBG6616Christoph Krapp2020-08-111-1/+1
| | | | | | | | | | As the ath79 port of this device uses a combined kernel + root partition the uboot bootcmd variable needs to be changed. As using cli/luci is more convenient than opening up the case and using a uart connection, lets unlock the uboot-env partition for write access. Signed-off-by: Christoph Krapp <achterin@googlemail.com> (cherry picked from commit 982c1f6e42c5b3e0f23eedd825a317a2872aa37b)
* kernel: update kernel 4.9 to version 4.9.232Hauke Mehrtens2020-08-0816-109/+33
| | | | | | | | | 821-usb-Remove-annoying-warning-about-bogus-URB.patch does not apply any more and was also deleted in master and nobody complained. ;-) Compile and runtime tested on lantiq/xrx200. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* kernel: Update kernel 4.14 to version 4.14.193Hauke Mehrtens2020-08-0812-21/+21
| | | | | | Compile and runtime tested on x86/64. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* ar71xx: enable ethernet LED of Arduino YunSungbo Eo2020-08-021-2/+1
| | | | | | | | | Commit 05d73a2a7379 enabled GPIO on ethernet LED, but proper LED setup was not added then. This commit fixes it by reverting the change on the LED. Fixes: 05d73a2a7379 ("ar71xx: Arduino Yun board 'WLAN RST' button support") Signed-off-by: Sungbo Eo <mans0n@gorani.run> (cherry picked from commit a5e404d1923d135d335e4ece83f87e6e891396e2)
* ar71xx: fix sysupgrade for Arduino YunSungbo Eo2020-08-021-1/+1
| | | | | | | | | | Commit bb46b635df48 changed its partition scheme, but sysupgrade image validation still uses the old format. This commit fixes it so that force flag is not needed for sysupgrade. Fixes: bb46b635df48 ("ar71xx: move Arduino Yun to generic building code") Signed-off-by: Sungbo Eo <mans0n@gorani.run> (cherry picked from commit 58dc1d0637425cfe023192466e6212009332b677)
* ramips: add kmod-usb-dwc2 to ZyXEL Keenetic imageAlexey Dobrovolsky2020-08-021-1/+2
| | | | | | | | | | | | ZyXEL Keenetic has a USB port. Thus, DWC2 USB controller driver should be in the default image for this device. Fixes: a7cbf59e0e04 ("ramips: add new device ZyXEL Keenetic as kn") Signed-off-by: Alexey Dobrovolsky <dobrovolskiy.alexey@gmail.com> [fixed whitespace issue] Signed-off-by: Petr Štetiar <ynezz@true.cz> (backported from commit 0a182fcba6d9cb2cf74cae9114ea4770ef928f75) Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* ramips: remove patches for USB-dwc2Alexey Dobrovolsky2020-08-021-29/+0
| | | | | | | | | | | | | | | In FS#2738 we can see that patch first introduced in e8ebcff ("ramips: add a explicit reset to dwc2") breaks USB functionality since 18.06. Thus, this patch should be removed. Removed: - 0032-USB-dwc2-add-device_reset.patch Fixes: FS#2738 Fixes: FS#2964 Signed-off-by: Alexey Dobrovolsky <dobrovolskiy.alexey@gmail.com> (cherry picked from commit ab841b4393a4077a5819da1da040ab9a89e3b69d)
* firewall: backport patch for mss clamping in both directionsYousong Zhou2020-07-262-1/+34
| | | | Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* ar71xx: Fix mikrotik NAND compile problemHauke Mehrtens2020-07-071-1/+1
| | | | | | | | | | | This fixes the following compile error: drivers/mtd/nand/rb91x_nand.c: In function 'rb91x_nand_remove': drivers/mtd/nand/rb91x_nand.c:445:16: error: 'rbni' undeclared (first use in this function) nand_release(&rbni->chip); Fixes: 0f07496f520c ("kernel: Update kernel 4.9 to version 4.9.229") Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> (cherry picked from commit 66e04abbb6d0dec8642be5deb2fca4bba470f8ac)
* ar71xx: Fix mikrotik NAND compile problemHauke Mehrtens2020-07-061-1/+1
| | | | | | | | There is one closing bracket too much. Fixes: 0f07496f520c ("kernel: Update kernel 4.9 to version 4.9.229") Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> (cherry picked from commit 014d3f593acea13ee6aa002d858f182806ed43f0)
* wireguard: bump to 1.0.20200611Stijn Segers2020-07-051-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This bump fixes breakage introduced by kernel commit 8ab8786f78c3fc930f9abf6d6d85e95567de4e1f, which is part of the 4.14.181 kernel bump, and backported ip6_dst_lookup_flow to 4.14. This breaks the older WireGuard version currently in 19.07. For reference, the compilation error is the one below: build_dir/target-x86_64_musl/linux-x86_64/wireguard-linux-compat-1.0.20200506/src/compat/compat.h:104:42: error: 'const struct ipv6_stub' has no member named 'ipv6_dst_lookup'; did you mean 'ipv6_dst_lookup_flow'? #define ipv6_dst_lookup_flow(a, b, c, d) ipv6_dst_lookup(a, b, &dst, c) + (void *)0 ?: dst Changelogs below taken from the official release announcements. == Changes since v1.0.20200506 == This release aligns with the changes I sent to DaveM for 5.7-rc7 and were pushed to net.git about 45 minutes ago. * qemu: use newer iproute2 for gcc-10 * qemu: add -fcommon for compiling ping with gcc-10 These enable the test suite to compile with gcc-10. * noise: read preshared key while taking lock Matt noticed a benign data race when porting the Linux code to OpenBSD. * queueing: preserve flow hash across packet scrubbing * noise: separate receive counter from send counter WireGuard now works with fq_codel, cake, and other qdiscs that make use of skb->hash. This should significantly improve latency spikes related to buffer bloat. Here's a before and after graph from some data Toke measured: https://data.zx2c4.com/removal-of-buffer-bloat-in-wireguard.png * compat: support RHEL 8 as 8.2, drop 8.1 support * compat: support CentOS 8 explicitly * compat: RHEL7 backported the skb hash renamings The usual RHEL churn. * compat: backport renamed/missing skb hash members The new support for fq_codel and friends meant more backporting work. * compat: ip6_dst_lookup_flow was backported to 4.14, 4.9, and 4.4 == Changes since v1.0.20200611 == * qemu: always use cbuild gcc rather than system gcc * qemu: remove -Werror in order to build ancient kernels better * qemu: patch kernels that rely on ancient make * qemu: force 2MB pages for binutils 2.31 * qemu: use cbuild gcc for avx512 exclusion * qemu: add extra fill in idt handler for newer binutils * qemu: support fetching kernels for arbitrary URLs * qemu: patch in UTS_UBUNTU_RELEASE_ABI for Ubuntu detection * qemu: work around broken centos8 kernel * qemu: mark per_cpu_load_addr as static for gcc-10 Our qemu test suite can now handle more kernels and more compilers. Scroll down to the bottom of https://www.wireguard.com/build-status/ to see the expanded array of kernels we now test against, including some distro kernels. * compat: widen breadth of integer constants * compat: widen breadth of memzero_explicit backport * compat: backport skb_scrub_packet to 3.11 * compat: widen breadth of prandom_u32_max backport * compat: narrow the breadth of iptunnel_xmit backport * compat: backport iptunnel_xmit to 3.11 With the expanded qemu test suite, it was possible to expand our list of mainline kernels, so the backport compat layer is now more precise. * compat: ubuntu appears to have backported ipv6_dst_lookup_flow * compat: bionic-hwe-5.0/disco kernel backported skb_reset_redirect and ipv6 flow Ubuntu kernels changed recently, so this ensures we can compile with the latest Ubuntu releases. * compat: remove stale suse support Signed-off-by: Stijn Segers <foss@volatilesystems.org> (cherry picked from commit 1fd1f5e8cff18f97675ce303b05d411136b99fb0)
* libubox: backport additional length-checking fixesBaptiste Jonglez2020-07-055-1/+284
| | | | | | | Fixes: FS#3177 Cc: Felix Fietkau <nbd@nbd.name> Cc: Rafał Miłecki <rafal@milecki.pl> Signed-off-by: Baptiste Jonglez <git@bitsofnetworks.org>
* kernel: Update kernel 4.9 to version 4.9.229Hauke Mehrtens2020-07-0536-78/+74
| | | | | | | | | | Fixes: - CVE-2020-10757 Run tested: ar71xx Build tested: ar71xx Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* kernel: Update kernel 4.14 to version 4.14.187Hauke Mehrtens2020-07-0539-137/+80
| | | | | | | | | | Fixes: - CVE-2020-10757 Run tested: x86 Build tested: x86 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* bcm63xx: a226m-fwb: fix linux partition offsetDaniel González Cabanelas2020-06-151-4/+4
| | | | | | | | | | | | | | | | | | | The Pirelli A226M-FWB has a wrong linux partition offset, caused by a copy-paste error. As of result of this, OpenWrt is currently broken in this unit. Fix it. While at it, also use generic node names and fix the addresses there as well. Fixes: a27d59bb4274 ("brcm63xx: switch to new partition layout specification") Signed-off-by: Daniel González Cabanelas <dgcbueu@gmail.com> [also fix/update node names, extend commit message] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de> (cherry picked from commit d64d5ed1425f4397d093c8777ca03f70ff1ee90c)
* ipq40xx: essedma: Disable TCP segmentation offload for IPv6Sven Eckelmann2020-06-131-0/+46
| | | | | | | | | | | | | | | | | | | | | | | | | | | It was noticed that the the whole MAC can hang when transferring data from one ar40xx port (WAN ports) to the CPU and from the CPU back to another ar40xx port (LAN ports). The CPU was doing only NATing in that process. Usually, the problem first starts with a simple data corruption: $ wget https://cdimage.debian.org/debian-cd/current/amd64/iso-cd/debian-10.4.0-amd64-netinst.iso -O /dev/null ... Connecting to saimei.ftp.acc.umu.se (saimei.ftp.acc.umu.se)|2001:6b0:19::138|:443... connected. ... Read error at byte 48807936/352321536 (Decryption has failed.). Retrying. But after a short while, the whole MAC will stop to react. No traffic can be transported anymore from the CPU port from/to the AR40xx PHY/switch and the MAC has to be resetted. The whole problem can be avoided by disabling the TSO for IPv6 for this ethernet MAC driver. Signed-off-by: Sven Eckelmann <sven@narfation.org> Acked-by: John Crispin <john@phrozen.org> (backported from commit 678569505623e50bbbbc344c7e820fb315b79ede, with updated commit message) Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
* ca-certificates: update to version 20200601Christian Lamparter2020-06-101-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch updates the ca-certificates and ca-bundle package. This version changed the files directory again, to work/, so PKG_BUILD_DIR was brought back. A list of changes from Debian's change-log entry for 20200601 [0]: * mozilla/{certdata.txt,nssckbi.h}: Update Mozilla certificate authority bundle to version 2.40. Closes: #956411, #955038 * mozilla/blacklist.txt Add distrusted Symantec CA list to blacklist for explicit removal. Closes: #911289 Blacklist expired root certificate, "AddTrust External Root" Closes: #961907 The following certificate authorities were added (+): + "Certigna Root CA" + "emSign ECC Root CA - C3" + "emSign ECC Root CA - G3" + "emSign Root CA - C1" + "emSign Root CA - G1" + "Entrust Root Certification Authority - G4" + "GTS Root R1" + "GTS Root R2" + "GTS Root R3" + "GTS Root R4" + "Hongkong Post Root CA 3" + "UCA Extended Validation Root" + "UCA Global G2 Root" The following certificate authorities were removed (-): - "AddTrust External Root" - "Certinomis - Root CA" - "Certplus Class 2 Primary CA" - "Deutsche Telekom Root CA 2" - "GeoTrust Global CA" - "GeoTrust Primary Certification Authority" - "GeoTrust Primary Certification Authority - G2" - "GeoTrust Primary Certification Authority - G3" - "GeoTrust Universal CA" - "thawte Primary Root CA" - "thawte Primary Root CA - G2" - "thawte Primary Root CA - G3" - "VeriSign Class 3 Public Primary Certification Authority - G4" - "VeriSign Class 3 Public Primary Certification Authority - G5" - "VeriSign Universal Root Certification Authority" [0] <https://metadata.ftp-master.debian.org/changelogs//main/c/ca-certificates/ca-certificates_20200601_changelog> Signed-off-by: Christian Lamparter <chunkeey@gmail.com> (cherry picked from commit f611b014a713d82d7c7da4c171f3aa04a8984063)
* musl: fix locking synchronization bugMatthias Schiffer2020-05-261-0/+69
| | | | | | | | | | | | | | Import proposed upstream fix [2] for the critical locking synchronization bug recently found in musl [1]. This affects all programs that are temporarily multithreaded, but then return to single-threaded operation. [1] https://www.openwall.com/lists/musl/2020/05/22/3 [2] https://www.openwall.com/lists/musl/2020/05/22/10 Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net> (cherry picked from commit 10c211031ccd4703230493025a5a3b9d6fcad2f2)
* rpcd: update to latest openwrt-18.06 Git HEADJo-Philipp Wich2020-05-261-4/+4
| | | | | | | | | | | | | | | | | | | 7be1f17 file: exec: properly free memory on error 313964c file: avoid closing stdio descriptors in rpc_file_exec_run cd09c5f file: patch process stdin to /dev/null efbcedb file: remove unused members from struct rpc_file_exec_context 71b00ab file: rpc_file_exec_run: fix potential memory leak and integer overflow c7bb956 plugin: fix double free in finish callback 16de3fa plugin: do not free method name separately 29c9c11 exec: properly free memory on rpc_exec() error 5cd4f4e plugin: exec: properly free memory on parse error d80f70e plugin: fix leaking invoked method name for exec plugins 53a0952 session: deny access if password login is disabled 662d034 uci: reset uci_ptr flags when merging options during section add dd46d6d uci: free configs list memory on return abbc302 uci: reset uci_ptr flags when merging set operations Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* usign: update to latest git HEADMatthias Schiffer2020-05-241-3/+3
| | | | | | | f1f65026a941 Always pad fingerprints to 16 characters Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net> (cherry picked from commit e35e40ad824eab9d51cdd690fb747e576e01412f)
* usign: update to latest Git HEADHauke Mehrtens2020-05-241-3/+3
| | | | | | | f34a383 main: fix some resource leaks Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> (cherry picked from commit 81e93fff7d867851f2fedd966a931336d4092686)
generated by cgit v1.2.3 (git 2.25.1) at 2024-04-28 00:08:27 +0000