core/linux-armv7 to 4.8.12-2

core/linux-armv7/0001-ARM-atags-add-support-for-Marvell-s-u-boot.patch

@@ -1,7 +1,7 @@
-From 8537ea66c09bebc2be88c7e319b27e763842d89f Mon Sep 17 00:00:00 2001
+From a57e3555178ce90e3ec10cc1a2a10d4ed5662483 Mon Sep 17 00:00:00 2001
 From: Willy Tarreau <w@xxxxxx>
 Date: Sun, 2 Dec 2012 19:59:28 +0100
-Subject: [PATCH 01/13] ARM: atags: add support for Marvell's u-boot
+Subject: [PATCH 01/14] ARM: atags: add support for Marvell's u-boot
 
 Marvell uses a specific atag in its u-boot which includes among other
 information the MAC addresses for up to 4 network interfaces.

core/linux-armv7/0002-ARM-atags-fdt-retrieve-MAC-addresses-from-Marvell-bo.patch

@@ -1,7 +1,7 @@
-From 139fe01610d1c78c6ea9e402b9548f90e95a99bb Mon Sep 17 00:00:00 2001
+From d4b1e1b9567a0cbd568f68d3d3a2af24b5966aa7 Mon Sep 17 00:00:00 2001
 From: Willy Tarreau <w@xxxxxx>
 Date: Sun, 2 Dec 2012 19:56:58 +0100
-Subject: [PATCH 02/13] ARM: atags/fdt: retrieve MAC addresses from Marvell
+Subject: [PATCH 02/14] ARM: atags/fdt: retrieve MAC addresses from Marvell
  boot loader
 
 The atags are parsed and if a Marvell atag is found, up to 4 MAC

core/linux-armv7/0003-SMILE-Plug-device-tree-file.patch

@@ -1,7 +1,7 @@
-From 9d676096d4aa4d2cdd03c242dcb59862e6476562 Mon Sep 17 00:00:00 2001
+From 020369fee4748079122381c733ec409e1e7d99bd Mon Sep 17 00:00:00 2001
 From: Kevin Mihelich <kevin@archlinuxarm.org>
 Date: Fri, 5 Sep 2014 15:41:19 -0600
-Subject: [PATCH 03/13] SMILE Plug device tree file
+Subject: [PATCH 03/14] SMILE Plug device tree file
 
 This adds a dts file for the SMILE Plug, which only differs from the Mirabox
 dts with the LED definitions.

core/linux-armv7/0004-fix-mvsdio-eMMC-timing.patch

@@ -1,7 +1,7 @@
-From d6bde52e9ae175a59da46054f13e392481b9ca20 Mon Sep 17 00:00:00 2001
+From 5820f95d6d39f4864a3a2b70100aea4ad6e7e63e Mon Sep 17 00:00:00 2001
 From: Kevin Mihelich <kevin@archlinuxarm.org>
 Date: Fri, 5 Sep 2014 15:43:56 -0600
-Subject: [PATCH 04/13] fix mvsdio eMMC timing
+Subject: [PATCH 04/14] fix mvsdio eMMC timing
 
 These changes from Globalscale change the MMC timing to allow the eMMC versions
 of the Mirabox and SMILE Plug to work.

core/linux-armv7/0005-net-smsc95xx-Allow-mac-address-to-be-set-as-a-parame.patch

@@ -1,7 +1,7 @@
-From 82c2da591ba6285523566a5323962f5fb95b3869 Mon Sep 17 00:00:00 2001
+From bb274c7705fb5f0dee7db5d8e647107a4c887313 Mon Sep 17 00:00:00 2001
 From: popcornmix <popcornmix@gmail.com>
 Date: Tue, 18 Feb 2014 01:43:50 -0300
-Subject: [PATCH 05/13] net/smsc95xx: Allow mac address to be set as a
+Subject: [PATCH 05/14] net/smsc95xx: Allow mac address to be set as a
  parameter
 
 ---

core/linux-armv7/0006-ARM-TLV320AIC23-SoC-Audio-Codec-Fix-errors-reported-.patch

@@ -1,7 +1,7 @@
-From e888e5f96c57ea0d8e75084d4bc9e7c6c8812786 Mon Sep 17 00:00:00 2001
+From 344aa72a0e0258339d8880c0a271278fa7a4e038 Mon Sep 17 00:00:00 2001
 From: dobatog <dobatog@gmail.com>
 Date: Thu, 26 Feb 2015 12:32:27 +0100
-Subject: [PATCH 06/13] ARM: TLV320AIC23 SoC Audio Codec: Fix errors reported
+Subject: [PATCH 06/14] ARM: TLV320AIC23 SoC Audio Codec: Fix errors reported
  related to input routing signals.
 
 The following patch, based on stable v3.19,  corrects the errors that are reported in the boot trace in reference to the Input Signals of the audio codec TLV320AIC23:

core/linux-armv7/0007-set-default-cubietruck-led-triggers.patch

@@ -1,7 +1,7 @@
-From 9332f8007064d41fe06611671ba7cecffe18cb0b Mon Sep 17 00:00:00 2001
+From 32a95d6fee9947fe97e24514d678c5eca8fd1852 Mon Sep 17 00:00:00 2001
 From: Kevin Mihelich <kevin@archlinuxarm.org>
 Date: Sat, 14 Feb 2015 12:32:27 +0100
-Subject: [PATCH 07/13] set default cubietruck led triggers
+Subject: [PATCH 07/14] set default cubietruck led triggers
 
 Signed-off-by: Kevin Mihelich <kevin@archlinuxarm.org>
 ---

core/linux-armv7/0008-USB-armory-support.patch

@@ -1,7 +1,7 @@
-From 8289d8d3cdc80e9093d65d36b73eacfc75c67569 Mon Sep 17 00:00:00 2001
+From 306ad6775987fc05cf621627b60ce6de752e9441 Mon Sep 17 00:00:00 2001
 From: Kevin Mihelich <kevin@archlinuxarm.org>
 Date: Sat, 7 Feb 2015 12:32:27 +0100
-Subject: [PATCH 08/13] USB armory support
+Subject: [PATCH 08/14] USB armory support
 
 ---
  arch/arm/boot/dts/Makefile                    |   5 +

core/linux-armv7/0009-ARM-dts-imx6ul-pico-hobbit-Add-Wifi-support.patch

@@ -1,7 +1,7 @@
-From 8b1c799d72b295a039618b61f5934008b62a15bb Mon Sep 17 00:00:00 2001
+From c1262b3c0789f3038f555808ed979a613bdd91f7 Mon Sep 17 00:00:00 2001
 From: Vanessa Maegima <vanessa.maegima@nxp.com>
 Date: Mon, 1 Aug 2016 09:54:14 -0300
-Subject: [PATCH 09/13] ARM: dts: imx6ul-pico-hobbit: Add Wifi support
+Subject: [PATCH 09/14] ARM: dts: imx6ul-pico-hobbit: Add Wifi support
 
 imx6ul-pico-hobbit has a bcm4339 wifi chip connected to usdhc2 port.
 

core/linux-armv7/0010-exynos4412-odroid-set-higher-minimum-buck2-regulator.patch

@@ -1,7 +1,7 @@
-From cf306f4ec83a1f645d01e01d1d18c555e6b766e5 Mon Sep 17 00:00:00 2001
+From 7b506e952b0a50ae9bfabc08f0e4a5c46f8c6c37 Mon Sep 17 00:00:00 2001
 From: Kevin Mihelich <kevin@archlinuxarm.org>
 Date: Thu, 11 Aug 2016 00:42:37 -0600
-Subject: [PATCH 10/13] exynos4412-odroid: set higher minimum buck2 regulator
+Subject: [PATCH 10/14] exynos4412-odroid: set higher minimum buck2 regulator
  voltage
 
 Set a higher minimum voltage to help reboot issue.

core/linux-armv7/0011-usb-musb-Call-pm_runtime-from-musb_gadget_queue.patch

@@ -1,7 +1,7 @@
-From 17998b802d18651bd4bfd6ee32e10c166f484e76 Mon Sep 17 00:00:00 2001
+From 05fe3b31380ee9bf5ee6258b50980637307f7691 Mon Sep 17 00:00:00 2001
 From: Tony Lindgren <tony@atomide.com>
 Date: Fri, 30 Sep 2016 11:10:10 -0700
-Subject: [PATCH 11/13] usb: musb: Call pm_runtime from musb_gadget_queue
+Subject: [PATCH 11/14] usb: musb: Call pm_runtime from musb_gadget_queue
 
 If we're booting pandaboard using NFSroot over built-in g_ether, we
 can get the following after booting once and doing a warm reset:

core/linux-armv7/0012-phy-twl4030-usb-better-handle-musb_mailbox-failure.patch

@@ -1,7 +1,7 @@
-From d2c0d2c702b3847a0b1bf06996998c142254952e Mon Sep 17 00:00:00 2001
+From 8cbab23ba33112e37adff7ae353088738f31fac3 Mon Sep 17 00:00:00 2001
 From: Andreas Kemnade <andreas@kemnade.info>
 Date: Mon, 22 Aug 2016 21:24:22 +0200
-Subject: [PATCH 12/13] phy-twl4030-usb: better handle musb_mailbox() failure
+Subject: [PATCH 12/14] phy-twl4030-usb: better handle musb_mailbox() failure
 
 setting twl->linkstat = MUSB_UNKNOWN upon error in musb_mailbox as
 introduced in

core/linux-armv7/0013-Revert-gpu-drm-omapdrm-dss-of-add-missing-of_node_pu.patch

@@ -1,7 +1,7 @@
-From cff4d7ad9abccf3693bc4e7bf01009a5254e3175 Mon Sep 17 00:00:00 2001
+From c4a475d5c9cc9706eccd849788bd3879433ae429 Mon Sep 17 00:00:00 2001
 From: Kevin Mihelich <kevin@archlinuxarm.org>
 Date: Tue, 4 Oct 2016 22:15:41 -0600
-Subject: [PATCH 13/13] Revert "gpu: drm: omapdrm: dss-of: add missing
+Subject: [PATCH 13/14] Revert "gpu: drm: omapdrm: dss-of: add missing
  of_node_put after calling of_parse_phandle"
 
 This reverts commit 2ab9f5879162499e1c4e48613287e3f59e593c4f.

core/linux-armv7/0014-packet-fix-race-condition-in-packet_set_ring.patch

@@ -0,0 +1,92 @@
+From fb1d5a048f54529294ff1e16dae103a579450e06 Mon Sep 17 00:00:00 2001
+From: Philip Pettersson <philip.pettersson@gmail.com>
+Date: Wed, 30 Nov 2016 14:55:36 -0800
+Subject: [PATCH 14/14] packet: fix race condition in packet_set_ring
+
+When packet_set_ring creates a ring buffer it will initialize a
+struct timer_list if the packet version is TPACKET_V3. This value
+can then be raced by a different thread calling setsockopt to
+set the version to TPACKET_V1 before packet_set_ring has finished.
+
+This leads to a use-after-free on a function pointer in the
+struct timer_list when the socket is closed as the previously
+initialized timer will not be deleted.
+
+The bug is fixed by taking lock_sock(sk) in packet_setsockopt when
+changing the packet version while also taking the lock at the start
+of packet_set_ring.
+
+Fixes: f6fb8f100b80 ("af-packet: TPACKET_V3 flexible buffer implementation.")
+Signed-off-by: Philip Pettersson <philip.pettersson@gmail.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ net/packet/af_packet.c | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index d2238b2..dd23323 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -3648,19 +3648,25 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
+ 
+ 		if (optlen != sizeof(val))
+ 			return -EINVAL;
+-		if (po->rx_ring.pg_vec || po->tx_ring.pg_vec)
+-			return -EBUSY;
+ 		if (copy_from_user(&val, optval, sizeof(val)))
+ 			return -EFAULT;
+ 		switch (val) {
+ 		case TPACKET_V1:
+ 		case TPACKET_V2:
+ 		case TPACKET_V3:
+-			po->tp_version = val;
+-			return 0;
++			break;
+ 		default:
+ 			return -EINVAL;
+ 		}
++		lock_sock(sk);
++		if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) {
++			ret = -EBUSY;
++		} else {
++			po->tp_version = val;
++			ret = 0;
++		}
++		release_sock(sk);
++		return ret;
+ 	}
+ 	case PACKET_RESERVE:
+ 	{
+@@ -4164,6 +4170,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
+ 	/* Added to avoid minimal code churn */
+ 	struct tpacket_req *req = &req_u->req;
+ 
++	lock_sock(sk);
+ 	/* Opening a Tx-ring is NOT supported in TPACKET_V3 */
+ 	if (!closing && tx_ring && (po->tp_version > TPACKET_V2)) {
+ 		net_warn_ratelimited("Tx-ring is not supported.\n");
+@@ -4245,7 +4252,6 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
+ 			goto out;
+ 	}
+ 
+-	lock_sock(sk);
+ 
+ 	/* Detach socket from network */
+ 	spin_lock(&po->bind_lock);
+@@ -4294,11 +4300,11 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
+ 		if (!tx_ring)
+ 			prb_shutdown_retire_blk_timer(po, rb_queue);
+ 	}
+-	release_sock(sk);
+ 
+ 	if (pg_vec)
+ 		free_pg_vec(pg_vec, order, req->tp_block_nr);
+ out:
++	release_sock(sk);
+ 	return err;
+ }
+ 
+-- 
+2.10.2
+

core/linux-armv7/PKGBUILD

@@ -8,7 +8,7 @@ _srcname=linux-4.8
 _kernelname=${pkgbase#linux}
 _desc="ARMv7 multi-platform"
 pkgver=4.8.12
-pkgrel=1
+pkgrel=2
 rcnrel=armv7-x4
 arch=('armv7h')
 url="http://www.kernel.org/"
@@ -31,6 +31,7 @@ source=("http://www.kernel.org/pub/linux/kernel/v4.x/${_srcname}.tar.xz"
         '0011-usb-musb-Call-pm_runtime-from-musb_gadget_queue.patch'
         '0012-phy-twl4030-usb-better-handle-musb_mailbox-failure.patch'
         '0013-Revert-gpu-drm-omapdrm-dss-of-add-missing-of_node_pu.patch'
+        '0014-packet-fix-race-condition-in-packet_set_ring.patch'
         'config'
         'cmdline'
         'kernel.its'
@@ -39,19 +40,20 @@ source=("http://www.kernel.org/pub/linux/kernel/v4.x/${_srcname}.tar.xz"
 md5sums=('c1af0afbd3df35c1ccdc7a5118cd2d07'
          '9a938fd7a82d8b390f957657947fe673'
          'b847ca8f5158c933da23f9a264ec5a2a'
-         '0153cba3c01756d17d03bef3cdc308ef'
+         'a791295ff27d5033391c8a6c7dd94906'
-         '74911f2cc4df510c11bcfe3c4a2b2121'
+         'ea0de10fdeb3128b4a6105d7afc21937'
-         '30257f5d8da3945cfbe9a9ee51ce32d1'
+         '70f9b46e1edd04f15beb77c6ed9082e3'
-         '8723371954030e97e91406063c1329dc'
+         '0b8b9907d87508df0bfff93741d8612d'
-         '700e0ceca908156375634f5702050220'
+         '81ebdb182f0ebb8e49b5ddf70cfdd42a'
-         'f387621358a03cd7040b844d9beee649'
+         'ba8b72ef31241be015ba6448db992d60'
-         'd4476829ee651e20a6629cc7760ff957'
+         '731c133b688c652c66044107bbea3329'
-         'b54a2e2a00f20c8671431292ee63452f'
+         '4b8a98494dbf3d72ec9056809c8cfcb5'
-         '8775562272a11411569817ad17e08655'
+         '33678562233330cfdff3f34f2f4a3502'
-         '138a050b55fe4bdd3a5b744b114d4993'
+         'be01139e6b32750d99276c7ed7aaaaa3'
-         'f70e197338324a17f787b58884c647ff'
+         '005bef75c8d791061479856ee33c84f9'
-         '4293d874c9bd306dfbd9f37e4927a585'
+         'db1a8f4f8791ac83df1ac6630fcc5b23'
-         '75cbfa910f0f12248bb24356cfe631cb'
+         '222218184b192bebce9f605e33378417'
+         'ab8688fe323d131480f35ba4c259f63c'
          'af1eaa3304bc4776796221b1b12b6b0a'
          '1813b39074d01af6548951764a0f6444'
          '4f2379ed84258050edb858ee8d281678'
@@ -81,6 +83,7 @@ prepare() {
   git apply ../0011-usb-musb-Call-pm_runtime-from-musb_gadget_queue.patch
   git apply ../0012-phy-twl4030-usb-better-handle-musb_mailbox-failure.patch
   git apply ../0013-Revert-gpu-drm-omapdrm-dss-of-add-missing-of_node_pu.patch
+  git apply ../0014-packet-fix-race-condition-in-packet_set_ring.patch
 
   cat "${srcdir}/config" > ./.config