From d148fb1603535d70b7bc16cb6baa8d07aa892279 Mon Sep 17 00:00:00 2001 From: Hans Dedecker Date: Wed, 10 Mar 2021 20:48:02 +0100 Subject: [PATCH 1/8] glibc: update to latest 2.33 commit (BZ #27462, BZ #27318, BZ #27389) a151f2e05a nscd: Fix double free in netgroupcache [BZ #27462] ee9f98d9ca x86: Set minimum x86-64 level marker [BZ #27318] 3e880d7337 nss: Re-enable NSS module loading after chroot [BZ #27389] 71b2463f61 x86: Add CPU-specific diagnostics to ld.so --list-diagnostics a1eb3915e7 x86: Automate generation of PREFERRED_FEATURE_INDEX_1 bitfield 33dc1dd602 ld.so: Implement the --list-diagnostics option 8d4241b897 string: Work around GCC PR 98512 in rawmemchr 6efa2d44c8 S390: Add new hwcap values. Signed-off-by: Hans Dedecker (cherry picked from commit 0ef3c58ac83397dcc81ad739ffe09702bc7f58ff) --- toolchain/glibc/common.mk | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/toolchain/glibc/common.mk b/toolchain/glibc/common.mk index 40a1781412..ea521490f5 100644 --- a/toolchain/glibc/common.mk +++ b/toolchain/glibc/common.mk @@ -12,8 +12,8 @@ PKG_RELEASE:=2 PKG_SOURCE_PROTO:=git PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_VERSION) -PKG_SOURCE_VERSION:=c5e354589729c0ca63899923f18783fa6803462d -PKG_MIRROR_HASH:=f6f691f1d0f8789f2f143d9e0e785e96dc44cbf7b07bb41aff792f327a5dcb97 +PKG_SOURCE_VERSION:=a151f2e05a64727c552a297d129b8ef242ffb3b6 +PKG_MIRROR_HASH:=63802bbcbb851d08ea8e609edd2d3fc0828102c07da9cdd3639e16d07883ebae PKG_SOURCE_URL:=https://sourceware.org/git/glibc.git PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.xz From 31bca5f2566a4ab8789af89e498412b7c710e40d Mon Sep 17 00:00:00 2001 From: Hauke Mehrtens Date: Fri, 19 Mar 2021 17:59:12 +0100 Subject: [PATCH 2/8] archs38: Add CONFIG_HZ=100 This kernel config option was missing and resulted in a question when building. Signed-off-by: Hauke Mehrtens (cherry picked from commit 047b7621bb3ac266d193cf110a468e42f844be4f) --- target/linux/archs38/config-5.4 | 1 + 1 file changed, 1 insertion(+) diff --git a/target/linux/archs38/config-5.4 b/target/linux/archs38/config-5.4 index 57d708e77a..29246265ad 100644 --- a/target/linux/archs38/config-5.4 +++ b/target/linux/archs38/config-5.4 @@ -140,6 +140,7 @@ CONFIG_HAVE_NET_DSA=y CONFIG_HAVE_OPROFILE=y CONFIG_HAVE_PCI=y CONFIG_HAVE_PERF_EVENTS=y +CONFIG_HZ=100 CONFIG_HZ_PERIODIC=y CONFIG_I2C=y CONFIG_I2C_BOARDINFO=y From d52c5c081eefcc669e8e97a1ebad4d22e3637a4f Mon Sep 17 00:00:00 2001 From: Hans Dedecker Date: Sat, 20 Mar 2021 21:00:05 +0100 Subject: [PATCH 3/8] glibc: update to latest 2.33 commit db32fc27e7 test-container: Always copy test-specific support files [BZ #27537] 79c6be6a0a nptl: Remove private futex optimization [BZ #27304] f90d6b0484 pthread_once hangs when init routine throws an exception [BZ #18435] dd8023c2ac elf: ld.so --help calls _dl_init_paths without a main map [BZ #27577] ea5a537e87 elf: Always set l in _dl_init_paths (bug 23462) 64f6c287ad x86: Handle _SC_LEVEL1_ICACHE_LINESIZE [BZ #27444] 32b9280f1d io: Return EBAFD for negative file descriptor on fstat (BZ #27559) Signed-off-by: Hans Dedecker (cherry picked from commit 956490ad6abead94c8b06e55b687074fa2fd5c62) --- toolchain/glibc/common.mk | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/toolchain/glibc/common.mk b/toolchain/glibc/common.mk index ea521490f5..01b15a5cd2 100644 --- a/toolchain/glibc/common.mk +++ b/toolchain/glibc/common.mk @@ -12,8 +12,8 @@ PKG_RELEASE:=2 PKG_SOURCE_PROTO:=git PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_VERSION) -PKG_SOURCE_VERSION:=a151f2e05a64727c552a297d129b8ef242ffb3b6 -PKG_MIRROR_HASH:=63802bbcbb851d08ea8e609edd2d3fc0828102c07da9cdd3639e16d07883ebae +PKG_SOURCE_VERSION:=db32fc27e7bdfb5468200a94e9152bcc1c971d25 +PKG_MIRROR_HASH:=e02f8b7df03d675db6279b99212c8a645aa50f1ae7789fafd7bc1987145a4c92 PKG_SOURCE_URL:=https://sourceware.org/git/glibc.git PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.xz From 69b4a11aedeb799cae97807ca932875d7c938645 Mon Sep 17 00:00:00 2001 From: Magnus Kroken Date: Sun, 14 Mar 2021 19:42:33 +0100 Subject: [PATCH 4/8] mbedtls: update to 2.16.10 This release of Mbed TLS provides bug fixes and minor enhancements. This release includes fixes for security issues. Security fixes: * Fix a buffer overflow in mbedtls_mpi_sub_abs() * Fix an errorneous estimation for an internal buffer in mbedtls_pk_write_key_pem() * Fix a stack buffer overflow with mbedtls_net_poll() and mbedtls_net_recv_timeout() * Guard against strong local side channel attack against base64 tables by making access aceess to them use constant flow code Full release announcement: https://github.com/ARMmbed/mbedtls/releases/tag/v2.16.10 Signed-off-by: Magnus Kroken (cherry picked from commit dbde2bcf60b5d5f54501a4b440f25fe7d02fbe5d) --- package/libs/mbedtls/Makefile | 4 ++-- package/libs/mbedtls/patches/200-config.patch | 22 +++++++++---------- 2 files changed, 13 insertions(+), 13 deletions(-) diff --git a/package/libs/mbedtls/Makefile b/package/libs/mbedtls/Makefile index 43cc8b05b7..7f6bf4e4c0 100644 --- a/package/libs/mbedtls/Makefile +++ b/package/libs/mbedtls/Makefile @@ -8,13 +8,13 @@ include $(TOPDIR)/rules.mk PKG_NAME:=mbedtls -PKG_VERSION:=2.16.9 +PKG_VERSION:=2.16.10 PKG_RELEASE:=1 PKG_USE_MIPS16:=0 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz PKG_SOURCE_URL:=https://codeload.github.com/ARMmbed/mbedtls/tar.gz/v$(PKG_VERSION)? -PKG_HASH:=fc17ff7d8c11d08f23ae2800a18269408ad2c24ea6bb8b9363e41a01c2425697 +PKG_HASH:=96257bb03b30300b2f35f861ffe204ed957e9fd0329d80646fe57fc49f589b29 PKG_BUILD_PARALLEL:=1 PKG_LICENSE:=GPL-2.0-or-later diff --git a/package/libs/mbedtls/patches/200-config.patch b/package/libs/mbedtls/patches/200-config.patch index 4cdeed921d..1e3d41f0eb 100644 --- a/package/libs/mbedtls/patches/200-config.patch +++ b/package/libs/mbedtls/patches/200-config.patch @@ -144,7 +144,7 @@ /** * \def MBEDTLS_SSL_TRUNCATED_HMAC_COMPAT -@@ -1779,7 +1779,7 @@ +@@ -1796,7 +1796,7 @@ * * Comment this to disable run-time checking and save ROM space */ @@ -153,7 +153,7 @@ /** * \def MBEDTLS_X509_ALLOW_EXTENSIONS_NON_V3 -@@ -2109,7 +2109,7 @@ +@@ -2126,7 +2126,7 @@ * MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256 * MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256 */ @@ -162,7 +162,7 @@ /** * \def MBEDTLS_ARIA_C -@@ -2175,7 +2175,7 @@ +@@ -2192,7 +2192,7 @@ * This module enables the AES-CCM ciphersuites, if other requisites are * enabled as well. */ @@ -171,7 +171,7 @@ /** * \def MBEDTLS_CERTS_C -@@ -2187,7 +2187,7 @@ +@@ -2204,7 +2204,7 @@ * * This module is used for testing (ssl_client/server). */ @@ -180,7 +180,7 @@ /** * \def MBEDTLS_CHACHA20_C -@@ -2295,7 +2295,7 @@ +@@ -2312,7 +2312,7 @@ * \warning DES is considered a weak cipher and its use constitutes a * security risk. We recommend considering stronger ciphers instead. */ @@ -189,7 +189,7 @@ /** * \def MBEDTLS_DHM_C -@@ -2458,7 +2458,7 @@ +@@ -2475,7 +2475,7 @@ * This module adds support for the Hashed Message Authentication Code * (HMAC)-based key derivation function (HKDF). */ @@ -198,7 +198,7 @@ /** * \def MBEDTLS_HMAC_DRBG_C -@@ -2768,7 +2768,7 @@ +@@ -2785,7 +2785,7 @@ * * This module enables abstraction of common (libc) functions. */ @@ -207,7 +207,7 @@ /** * \def MBEDTLS_POLY1305_C -@@ -2789,7 +2789,7 @@ +@@ -2806,7 +2806,7 @@ * Caller: library/md.c * */ @@ -216,7 +216,7 @@ /** * \def MBEDTLS_RSA_C -@@ -2896,7 +2896,7 @@ +@@ -2913,7 +2913,7 @@ * * Requires: MBEDTLS_CIPHER_C */ @@ -225,7 +225,7 @@ /** * \def MBEDTLS_SSL_CLI_C -@@ -2996,7 +2996,7 @@ +@@ -3013,7 +3013,7 @@ * * This module provides run-time version information. */ @@ -234,7 +234,7 @@ /** * \def MBEDTLS_X509_USE_C -@@ -3106,7 +3106,7 @@ +@@ -3123,7 +3123,7 @@ * Module: library/xtea.c * Caller: */ From 97a4d27fb5707d3a0b943f2af326b04d26f98731 Mon Sep 17 00:00:00 2001 From: Hauke Mehrtens Date: Sat, 20 Mar 2021 13:19:22 +0100 Subject: [PATCH 5/8] uhttpd: Reload config after uhttpd-mod-ubus was added Without this change the config is only committed, but the uhttpd daemon is not reloaded. This reload is needed to apply the config. Without the reload of uhttpd, the ubus server is not available over http and returns a Error 404. This caused problems when installing luci on the snapshots and accessing it without reloading uhttpd. Signed-off-by: Hauke Mehrtens (cherry picked from commit d25d281fd6686bda67636f6c1df918145b6cb738) --- package/network/services/uhttpd/Makefile | 2 +- package/network/services/uhttpd/files/ubus.default | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/package/network/services/uhttpd/Makefile b/package/network/services/uhttpd/Makefile index 796eb61298..28a817d2e0 100644 --- a/package/network/services/uhttpd/Makefile +++ b/package/network/services/uhttpd/Makefile @@ -8,7 +8,7 @@ include $(TOPDIR)/rules.mk PKG_NAME:=uhttpd -PKG_RELEASE:=1 +PKG_RELEASE:=2 PKG_SOURCE_PROTO:=git PKG_SOURCE_URL=$(PROJECT_GIT)/project/uhttpd.git diff --git a/package/network/services/uhttpd/files/ubus.default b/package/network/services/uhttpd/files/ubus.default index ca9e72a315..b218d3f85d 100644 --- a/package/network/services/uhttpd/files/ubus.default +++ b/package/network/services/uhttpd/files/ubus.default @@ -3,11 +3,13 @@ if [ -z "$(uci -q get uhttpd.main.ubus_prefix)" ]; then uci set uhttpd.main.ubus_prefix=/ubus uci commit uhttpd + /etc/init.d/uhttpd reload fi [ "$(uci -q get uhttpd.main.ubus_socket)" = "/var/run/ubus.sock" ] && { uci set uhttpd.main.ubus_socket='/var/run/ubus/ubus.sock' uci commit uhttpd + /etc/init.d/uhttpd reload } exit 0 From 741260d2816c8a989553a19685988cc906f43259 Mon Sep 17 00:00:00 2001 From: Hauke Mehrtens Date: Sat, 20 Mar 2021 13:26:20 +0100 Subject: [PATCH 6/8] uhttpd: Execute uci commit and reload_config once Instead of doing uci commit and reload_config for each setting do it only once when one of these options was changed. This should make it a little faster when both conditions are taken. Signed-off-by: Hauke Mehrtens (cherry picked from commit 501221af542b5154fbf8788f8426bc7f5443764a) --- package/network/services/uhttpd/files/ubus.default | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/package/network/services/uhttpd/files/ubus.default b/package/network/services/uhttpd/files/ubus.default index b218d3f85d..474016c1c5 100644 --- a/package/network/services/uhttpd/files/ubus.default +++ b/package/network/services/uhttpd/files/ubus.default @@ -1,15 +1,17 @@ #!/bin/sh +commit=0 + if [ -z "$(uci -q get uhttpd.main.ubus_prefix)" ]; then uci set uhttpd.main.ubus_prefix=/ubus - uci commit uhttpd - /etc/init.d/uhttpd reload + commit=1 fi [ "$(uci -q get uhttpd.main.ubus_socket)" = "/var/run/ubus.sock" ] && { uci set uhttpd.main.ubus_socket='/var/run/ubus/ubus.sock' - uci commit uhttpd - /etc/init.d/uhttpd reload + commit=1 } +[ "$commit" = 1 ] && uci commit uhttpd && /etc/init.d/uhttpd reload + exit 0 From bdfd7f68d0ac30508c98b6e0bc9310c8106c134d Mon Sep 17 00:00:00 2001 From: Hauke Mehrtens Date: Sun, 21 Mar 2021 22:34:13 +0100 Subject: [PATCH 7/8] uhttpd: update to git HEAD 15346de client: Always close connection with request body in case of error Signed-off-by: Hauke Mehrtens (cherry picked from commit 1170655f8b792b34f899350cb0272ad94bb2d3e2) --- package/network/services/uhttpd/Makefile | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/package/network/services/uhttpd/Makefile b/package/network/services/uhttpd/Makefile index 28a817d2e0..87b3690515 100644 --- a/package/network/services/uhttpd/Makefile +++ b/package/network/services/uhttpd/Makefile @@ -8,13 +8,13 @@ include $(TOPDIR)/rules.mk PKG_NAME:=uhttpd -PKG_RELEASE:=2 +PKG_RELEASE:=1 PKG_SOURCE_PROTO:=git PKG_SOURCE_URL=$(PROJECT_GIT)/project/uhttpd.git -PKG_SOURCE_DATE:=2020-11-23 -PKG_SOURCE_VERSION:=f53a63999784bcb7dc513e221f3f25dd3de2f35e -PKG_MIRROR_HASH:=b2b71f91a3affd1518b2887d2786be30ae0ac5204bbf65c9a84595603847995c +PKG_SOURCE_DATE:=2021-03-21 +PKG_SOURCE_VERSION:=15346de8d3ba422002496526ee24c62a3601ab8c +PKG_MIRROR_HASH:=819424d071ed7c8888f9ca66f679907831becc59a67dd4a5ec521d5fba0a3171 PKG_MAINTAINER:=Felix Fietkau PKG_LICENSE:=ISC From cd48473bb8679937573d5761fa6d2d9cce358eb0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C3=81lvaro=20Fern=C3=A1ndez=20Rojas?= Date: Sun, 21 Mar 2021 12:39:47 +0100 Subject: [PATCH 8/8] bcm27xx: bcm2711: correctly disable HW_RANDOM_BCM2835 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit It was removed in bac74aff5e36, but it should have been disabled. More info: https://forum.openwrt.org/t/make-image-stops-at-random-number-generator-bcm27xx/91429/7 Fixes: bac74aff5e36 ("bcm27xx: bcm2711: disable HW_RANDOM_BCM2835") Signed-off-by: Álvaro Fernández Rojas (cherry picked from commit f93b544f01) --- target/linux/bcm27xx/bcm2711/config-5.4 | 1 + 1 file changed, 1 insertion(+) diff --git a/target/linux/bcm27xx/bcm2711/config-5.4 b/target/linux/bcm27xx/bcm2711/config-5.4 index 7efd1c2b07..6468a08b8f 100644 --- a/target/linux/bcm27xx/bcm2711/config-5.4 +++ b/target/linux/bcm27xx/bcm2711/config-5.4 @@ -257,6 +257,7 @@ CONFIG_HOLES_IN_ZONE=y CONFIG_HOTPLUG_CPU=y CONFIG_HW_CONSOLE=y CONFIG_HW_RANDOM=y +# CONFIG_HW_RANDOM_BCM2835 is not set CONFIG_HW_RANDOM_IPROC_RNG200=y CONFIG_HZ=250 CONFIG_HZ_250=y