Fixes the following security vulnerabilities: CVE-2017-8890 The inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c in the Linux kernel through 4.10.15 allows attackers to cause a denial of service (double free) or possibly have unspecified other impact by leveraging use of the accept system call. CVE-2017-9074 The IPv6 fragmentation implementation in the Linux kernel through 4.11.1 does not consider that the nexthdr field may be associated with an invalid option, which allows local users to cause a denial of service (out-of-bounds read and BUG) or possibly have unspecified other impact via crafted socket and send system calls. CVE-2017-9075 The sctp_v6_create_accept_sk function in net/sctp/ipv6.c in the Linux kernel through 4.11.1 mishandles inheritance, which allows local users to cause a denial of service or possibly have unspecified other impact via crafted system calls, a related issue to CVE-2017-8890. CVE-2017-9076 The dccp_v6_request_recv_sock function in net/dccp/ipv6.c in the Linux kernel through 4.11.1 mishandles inheritance, which allows local users to cause a denial of service or possibly have unspecified other impact via crafted system calls, a related issue to CVE-2017-8890. CVE-2017-9077 The tcp_v6_syn_recv_sock function in net/ipv6/tcp_ipv6.c in the Linux kernel through 4.11.1 mishandles inheritance, which allows local users to cause a denial of service or possibly have unspecified other impact via crafted system calls, a related issue to CVE-2017-8890. CVE-2017-9242 The __ip6_append_data function in net/ipv6/ip6_output.c in the Linux kernel through 4.11.3 is too late in checking whether an overwrite of an skb data structure may occur, which allows local users to cause a denial of service (system crash) via crafted system calls. Ref: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8890 Ref: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9074 Ref: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9075 Ref: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9076 Ref: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9077 Ref: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9242 Ref: https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.71 Signed-off-by: Jo-Philipp Wich <jo@mein.io>
x86 board.d only contains a case for the APU2, not the APU1. This causes, for example, network configuration not to be created correctly. Even though the APU1 seems to reaching EOL, there a still a lot of them out there. The APU1 and APU2 is configured in the same way and this patch should also be considered for stable, as the error also exists there. Signed-off-by: Kristian Evensen <kristian.evensen@gmail.com>
The two phy operation mode where one phy is assigned to an interface without lantiq,* device tree property and the other phy is assigned to an interface with the lantiq,wan device property was broken with the multicast package leaks between vlans fixes. Move the multicast packages relevant portmap settings to the condition which handles multicast packages for better readability. Replace the priv->port_map based port_map only for the interface which has the lantiq,switch device tree property set, to allow tagged multicast packages in two phy mode where the lantiq,switch device tree property isn't used. Signed-off-by: Mathias Kresin <dev@kresin.me>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
The port is labeled as wan and was only used as lan port because of the "tx ring full" issues fixed with 8f02f7c. Signed-off-by: Mathias Kresin <dev@kresin.me>
Using the lantiq,wan device tree property for one interface node and the lantiq,switch device tree property for another interface node at the same time was never intended/isn't supported at the moment. The property is meant to be used in two phy operation mode where one phy is assigned to an interface without lantiq,* device tree property and the other phy is assigned to an interface with the lantiq,wan device property to have two netdevs. If both properties are used at the same time, the lantiq,wan interface is shown as independent netdev but not able to operate independent. The port needs to be managed via swconfig. These dependency is not obvious and fooled already a lot of users. Add a default WAN vlan for xrx200 devices having an ethernet WAN port and remove the lantiq,wan device tree property. Leave it up to the user to set the ethernet WAN port as default WAN interface or to use this port as additional LAN port. Signed-off-by: Mathias Kresin <dev@kresin.me>
Explicitely disable X2APIC support on legacy targets since the targeted processor types do not support it anyway there. Fixes FS#285. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
This fixes wrong GPIO numbers for LEDs and button in Wallys DR344 board and sets color of all LEDs to green as the mass production boards have only green one. Actually, DR344 has 6 GPIO-connected LEDs and one button: - GPIO11: status - GPIO12: sig1 - GPIO13: sig2 - GPIO14: sig3 - GPIO15: sig4 - GPIO16: reset button - GPIO17: lan WAN LED is connected directly with AR8035 PHY. Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
This aligns default network interfaces configuration with vendor firmware: GE (eth0) -> wan, FE (eth1) -> lan. Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
GMAC0 interface of AR9344 SOC in Wallys DR344 board is connected with AR8035, not with AR8327. Without this fix, GE interface doesn't work at all or shows high packet loss ratio. Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>