diff --git a/core/linux-am33x/0001-add-lcd-cape-for-chiliboard.patch b/core/linux-am33x/0001-add-lcd-cape-for-chiliboard.patch index 350df46b6..ff0cebd2c 100644 --- a/core/linux-am33x/0001-add-lcd-cape-for-chiliboard.patch +++ b/core/linux-am33x/0001-add-lcd-cape-for-chiliboard.patch @@ -1,7 +1,7 @@ -From 784abdd117ae0055f0a0207105ba15a5b12cf63d Mon Sep 17 00:00:00 2001 +From f137364218ea7c66b17fc391f0177afda37f21b8 Mon Sep 17 00:00:00 2001 From: Mateusz Salamon Date: Fri, 20 May 2016 14:31:51 +0200 -Subject: [PATCH 1/2] add lcd cape for chiliboard +Subject: [PATCH] add lcd cape for chiliboard --- arch/arm/boot/dts/Makefile | 1 + diff --git a/core/linux-am33x/0002-packet-fix-race-condition-in-packet_set_ring.patch b/core/linux-am33x/0002-packet-fix-race-condition-in-packet_set_ring.patch deleted file mode 100644 index f827b498e..000000000 --- a/core/linux-am33x/0002-packet-fix-race-condition-in-packet_set_ring.patch +++ /dev/null @@ -1,92 +0,0 @@ -From 1892cd7d480b4553acb4dd64691f232f49899b49 Mon Sep 17 00:00:00 2001 -From: Philip Pettersson -Date: Wed, 30 Nov 2016 14:55:36 -0800 -Subject: [PATCH 2/2] packet: fix race condition in packet_set_ring - -When packet_set_ring creates a ring buffer it will initialize a -struct timer_list if the packet version is TPACKET_V3. This value -can then be raced by a different thread calling setsockopt to -set the version to TPACKET_V1 before packet_set_ring has finished. - -This leads to a use-after-free on a function pointer in the -struct timer_list when the socket is closed as the previously -initialized timer will not be deleted. - -The bug is fixed by taking lock_sock(sk) in packet_setsockopt when -changing the packet version while also taking the lock at the start -of packet_set_ring. - -Fixes: f6fb8f100b80 ("af-packet: TPACKET_V3 flexible buffer implementation.") -Signed-off-by: Philip Pettersson -Signed-off-by: Eric Dumazet -Signed-off-by: David S. Miller ---- - net/packet/af_packet.c | 18 ++++++++++++------ - 1 file changed, 12 insertions(+), 6 deletions(-) - -diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c -index 260adb1..f6a703b 100644 ---- a/net/packet/af_packet.c -+++ b/net/packet/af_packet.c -@@ -3649,19 +3649,25 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv - - if (optlen != sizeof(val)) - return -EINVAL; -- if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) -- return -EBUSY; - if (copy_from_user(&val, optval, sizeof(val))) - return -EFAULT; - switch (val) { - case TPACKET_V1: - case TPACKET_V2: - case TPACKET_V3: -- po->tp_version = val; -- return 0; -+ break; - default: - return -EINVAL; - } -+ lock_sock(sk); -+ if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) { -+ ret = -EBUSY; -+ } else { -+ po->tp_version = val; -+ ret = 0; -+ } -+ release_sock(sk); -+ return ret; - } - case PACKET_RESERVE: - { -@@ -4165,6 +4171,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, - /* Added to avoid minimal code churn */ - struct tpacket_req *req = &req_u->req; - -+ lock_sock(sk); - /* Opening a Tx-ring is NOT supported in TPACKET_V3 */ - if (!closing && tx_ring && (po->tp_version > TPACKET_V2)) { - net_warn_ratelimited("Tx-ring is not supported.\n"); -@@ -4246,7 +4253,6 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, - goto out; - } - -- lock_sock(sk); - - /* Detach socket from network */ - spin_lock(&po->bind_lock); -@@ -4295,11 +4301,11 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, - if (!tx_ring) - prb_shutdown_retire_blk_timer(po, rb_queue); - } -- release_sock(sk); - - if (pg_vec) - free_pg_vec(pg_vec, order, req->tp_block_nr); - out: -+ release_sock(sk); - return err; - } - --- -2.10.2 - diff --git a/core/linux-am33x/PKGBUILD b/core/linux-am33x/PKGBUILD index 5044206fa..a8298244c 100644 --- a/core/linux-am33x/PKGBUILD +++ b/core/linux-am33x/PKGBUILD @@ -7,7 +7,7 @@ pkgbase=linux-am33x _srcname=linux-4.8 _kernelname=${pkgbase#linux} _desc="TI AM335x Beaglebone (Black)" -pkgver=4.8.13 +pkgver=4.8.14 pkgrel=1 rcnrel=bone2 arch=('armv7h') @@ -20,14 +20,12 @@ source=("http://www.kernel.org/pub/linux/kernel/v4.x/${_srcname}.tar.xz" "http://rcn-ee.com/deb/sid-armhf/v${pkgver}-${rcnrel}/patch-${pkgver%.0}-${rcnrel}.diff.gz" "git+https://github.com/RobertCNelson/bb.org-overlays.git" '0001-add-lcd-cape-for-chiliboard.patch' - '0002-packet-fix-race-condition-in-packet_set_ring.patch' 'config') md5sums=('c1af0afbd3df35c1ccdc7a5118cd2d07' - 'bc208ac66340464839ee61a4621d9384' - 'c69dcceeb445890cde87bba1996ad645' + 'b8001f580c4da45ee7ae8d928275cf97' + '497750564cb73746cde86e9cc76f9794' 'SKIP' - '8739df9e5a282194b1da69ce21e98934' - 'e1f71b0b82181899e1a8a73dff3695e6' + 'cae8b723f5e745c1106ab2ea75f72f20' '17a3edfc858c1d8def25e92df95be825') prepare() { @@ -41,7 +39,6 @@ prepare() { # ALARM patches git apply ../0001-add-lcd-cape-for-chiliboard.patch - git apply ../0002-packet-fix-race-condition-in-packet_set_ring.patch cat "${srcdir}/config" > ./.config