From 8d995b3bd7aa1b13e7874515a8454349d240556d Mon Sep 17 00:00:00 2001 From: Hauke Mehrtens Date: Sun, 29 Jan 2023 19:05:52 +0100 Subject: [PATCH 1/4] mac80211: Update to version 5.10.168-1 This update mac80211 to version 5.10.168-1. This includes multiple bugfixes. Some of these bugfixes are fixing security relevant bugs. Signed-off-by: Hauke Mehrtens --- package/kernel/mac80211/Makefile | 6 +++--- ...rkaround-bug-with-some-inconsistent-BSSes.patch | 2 +- .../862-brcmfmac-Disable-power-management.patch | 2 +- .../kernel/mac80211/patches/brcm/998-survey.patch | 8 ++++---- .../patches/subsys/397-disable-mbssid.patch | 14 +++++++------- 5 files changed, 16 insertions(+), 16 deletions(-) diff --git a/package/kernel/mac80211/Makefile b/package/kernel/mac80211/Makefile index e2505924cf..c70e71db5b 100644 --- a/package/kernel/mac80211/Makefile +++ b/package/kernel/mac80211/Makefile @@ -10,10 +10,10 @@ include $(INCLUDE_DIR)/kernel.mk PKG_NAME:=mac80211 -PKG_VERSION:=5.10.157-1 +PKG_VERSION:=5.10.168-1 PKG_RELEASE:=1 -PKG_SOURCE_URL:=@KERNEL/linux/kernel/projects/backports/stable/v5.10.157/ -PKG_HASH:=1ce937c49f2b39be00768fba83e214aad6612d469c92ccd06dc17b14e6cf3a64 +PKG_SOURCE_URL:=@KERNEL/linux/kernel/projects/backports/stable/v5.10.168/ +PKG_HASH:=ba43215e99b367febaad507c94423b156c7af9a415d978fbc630e9e8d6641d73 PKG_SOURCE:=backports-$(PKG_VERSION).tar.xz PKG_BUILD_DIR:=$(KERNEL_BUILD_DIR)/backports-$(PKG_VERSION) diff --git a/package/kernel/mac80211/patches/brcm/861-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch b/package/kernel/mac80211/patches/brcm/861-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch index 7b4cb250f9..e832f175f8 100644 --- a/package/kernel/mac80211/patches/brcm/861-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch +++ b/package/kernel/mac80211/patches/brcm/861-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch @@ -10,7 +10,7 @@ Signed-off-by: Rafał Miłecki --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c -@@ -715,8 +715,36 @@ static struct wireless_dev *brcmf_cfg802 +@@ -718,8 +718,36 @@ static struct wireless_dev *brcmf_cfg802 struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy); struct brcmf_pub *drvr = cfg->pub; struct wireless_dev *wdev; diff --git a/package/kernel/mac80211/patches/brcm/862-brcmfmac-Disable-power-management.patch b/package/kernel/mac80211/patches/brcm/862-brcmfmac-Disable-power-management.patch index 774656f1fd..d6e2c409f9 100644 --- a/package/kernel/mac80211/patches/brcm/862-brcmfmac-Disable-power-management.patch +++ b/package/kernel/mac80211/patches/brcm/862-brcmfmac-Disable-power-management.patch @@ -14,7 +14,7 @@ Signed-off-by: Phil Elwell --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c -@@ -2961,6 +2961,10 @@ brcmf_cfg80211_set_power_mgmt(struct wip +@@ -2964,6 +2964,10 @@ brcmf_cfg80211_set_power_mgmt(struct wip * preference in cfg struct to apply this to * FW later while initializing the dongle */ diff --git a/package/kernel/mac80211/patches/brcm/998-survey.patch b/package/kernel/mac80211/patches/brcm/998-survey.patch index beaf1ac872..79a4578c21 100644 --- a/package/kernel/mac80211/patches/brcm/998-survey.patch +++ b/package/kernel/mac80211/patches/brcm/998-survey.patch @@ -1,6 +1,6 @@ --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c -@@ -2913,6 +2913,63 @@ done: +@@ -2916,6 +2916,63 @@ done: } static int @@ -64,7 +64,7 @@ brcmf_cfg80211_dump_station(struct wiphy *wiphy, struct net_device *ndev, int idx, u8 *mac, struct station_info *sinfo) { -@@ -3008,6 +3065,7 @@ static s32 brcmf_inform_single_bss(struc +@@ -3011,6 +3068,7 @@ static s32 brcmf_inform_single_bss(struc struct brcmu_chan ch; u16 channel; u32 freq; @@ -72,7 +72,7 @@ u16 notify_capability; u16 notify_interval; u8 *notify_ie; -@@ -3032,6 +3090,17 @@ static s32 brcmf_inform_single_bss(struc +@@ -3035,6 +3093,17 @@ static s32 brcmf_inform_single_bss(struc band = NL80211_BAND_5GHZ; freq = ieee80211_channel_to_frequency(channel, band); @@ -90,7 +90,7 @@ bss_data.chan = ieee80211_get_channel(wiphy, freq); bss_data.scan_width = NL80211_BSS_CHAN_WIDTH_20; bss_data.boottime_ns = ktime_to_ns(ktime_get_boottime()); -@@ -5518,6 +5587,7 @@ static struct cfg80211_ops brcmf_cfg8021 +@@ -5521,6 +5590,7 @@ static struct cfg80211_ops brcmf_cfg8021 .leave_ibss = brcmf_cfg80211_leave_ibss, .get_station = brcmf_cfg80211_get_station, .dump_station = brcmf_cfg80211_dump_station, diff --git a/package/kernel/mac80211/patches/subsys/397-disable-mbssid.patch b/package/kernel/mac80211/patches/subsys/397-disable-mbssid.patch index 1582be891b..a8f151574e 100644 --- a/package/kernel/mac80211/patches/subsys/397-disable-mbssid.patch +++ b/package/kernel/mac80211/patches/subsys/397-disable-mbssid.patch @@ -10,7 +10,7 @@ continue; --- a/net/wireless/scan.c +++ b/net/wireless/scan.c -@@ -2012,6 +2012,7 @@ static const struct element +@@ -2013,6 +2013,7 @@ static const struct element const struct element *next_mbssid; const struct element *next_sub; @@ -18,7 +18,7 @@ next_mbssid = cfg80211_find_elem(WLAN_EID_MULTIPLE_BSSID, mbssid_end, ielen - (mbssid_end - ie)); -@@ -2093,6 +2094,7 @@ static void cfg80211_parse_mbssid_data(s +@@ -2094,6 +2095,7 @@ static void cfg80211_parse_mbssid_data(s u16 capability; struct cfg80211_bss *bss; @@ -26,7 +26,7 @@ if (!non_tx_data) return; if (!cfg80211_find_ie(WLAN_EID_MULTIPLE_BSSID, ie, ielen)) -@@ -2253,6 +2255,7 @@ cfg80211_update_notlisted_nontrans(struc +@@ -2254,6 +2256,7 @@ cfg80211_update_notlisted_nontrans(struc const struct cfg80211_bss_ies *old; size_t cpy_len; @@ -34,11 +34,11 @@ lockdep_assert_held(&wiphy_to_rdev(wiphy)->bss_lock); ie = mgmt->u.probe_resp.variable; -@@ -2470,6 +2473,7 @@ cfg80211_inform_bss_frame_data(struct wi - +@@ -2472,6 +2475,7 @@ cfg80211_inform_bss_frame_data(struct wi res = cfg80211_inform_single_bss_frame_data(wiphy, data, mgmt, len, gfp); + + return res; - if (!res || !wiphy->support_mbssid || - !cfg80211_find_ie(WLAN_EID_MULTIPLE_BSSID, ie, ielen)) + /* don't do any further MBSSID handling for S1G */ + if (ieee80211_is_s1g_beacon(mgmt->frame_control)) return res; From f86f8e568461681fc85caf3c972489045367030e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= Date: Wed, 1 Mar 2023 08:52:26 +0100 Subject: [PATCH 2/4] kernel: support "linux,default-trigger" in leds-bcm63138 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This driver is backported from the v6.0 which deals with "linux,default-trigger" in leds core. For kernel 5.4 we need leds-bcm63138 to read trigger on its own. Signed-off-by: Rafał Miłecki --- ...cm63138-read-default-trigger-from-OF.patch | 26 +++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 target/linux/generic/hack-5.4/800-leds-leds-bcm63138-read-default-trigger-from-OF.patch diff --git a/target/linux/generic/hack-5.4/800-leds-leds-bcm63138-read-default-trigger-from-OF.patch b/target/linux/generic/hack-5.4/800-leds-leds-bcm63138-read-default-trigger-from-OF.patch new file mode 100644 index 0000000000..684bb9f842 --- /dev/null +++ b/target/linux/generic/hack-5.4/800-leds-leds-bcm63138-read-default-trigger-from-OF.patch @@ -0,0 +1,26 @@ +From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= +Date: Tue, 28 Feb 2023 23:38:30 +0100 +Subject: [PATCH] leds: leds-bcm63138: read default trigger from OF +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +It's needed in kernels older than 5.10 due to the missing commit +c49d6cab0d7f ("leds: parse linux,default-trigger DT property in LED +core"). + +Signed-off-by: Rafał Miłecki +--- + drivers/leds/blink/leds-bcm63138.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/leds/blink/leds-bcm63138.c ++++ b/drivers/leds/blink/leds-bcm63138.c +@@ -228,6 +228,7 @@ static void bcm63138_leds_create_led(str + led->cdev.max_brightness = BCM63138_MAX_BRIGHTNESS; + led->cdev.brightness_set = bcm63138_leds_brightness_set; + led->cdev.blink_set = bcm63138_leds_blink_set; ++ led->cdev.default_trigger = of_get_property(np, "linux,default-trigger", NULL); + + err = devm_led_classdev_register_ext(dev, &led->cdev, &init_data); + if (err) { From f67f60b809b433c42bc86dad60fbdef0fb866a0a Mon Sep 17 00:00:00 2001 From: Christian Lamparter Date: Sun, 28 Nov 2021 02:31:54 +0100 Subject: [PATCH 3/4] ca-certicficates: Update to version 20211016 Update the ca-certificates and ca-bundle package from version 20210119 to version 20211016. Debian change-log entry [1]: |[...] |[ Julien Cristau ] |* mozilla/{certdata.txt,nssckbi.h}: Update Mozilla certificate authority | bundle to version 2.50 | The following certificate authorities were added (+): | + "AC RAIZ FNMT-RCM SERVIDORES SEGUROS" | + "GlobalSign Root R46" | + "GlobalSign Root E46" | + "GLOBALTRUST 2020" | + "ANF Secure Server Root CA" | + "Certum EC-384 CA" | + "Certum Trusted Root CA" | The following certificate authorities were removed (-): | - "QuoVadis Root CA" | - "Sonera Class 2 Root CA" | - "GeoTrust Primary Certification Authority - G2" | - "VeriSign Universal Root Certification Authority" | - "Chambers of Commerce Root - 2008" | - "Global Chambersign Root - 2008" | - "Trustis FPS Root CA" | - "Staat der Nederlanden Root CA - G3" | * Blacklist expired root certificate "DST Root CA X3" (closes: #995432) |[...] [1] Signed-off-by: Christian Lamparter (cherry picked from commit 7c99085bd69742f66207d61e9f2da5ec4f8f9d2f) --- package/system/ca-certificates/Makefile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/package/system/ca-certificates/Makefile b/package/system/ca-certificates/Makefile index 2b5f96b206..ba76664339 100644 --- a/package/system/ca-certificates/Makefile +++ b/package/system/ca-certificates/Makefile @@ -7,13 +7,13 @@ include $(TOPDIR)/rules.mk PKG_NAME:=ca-certificates -PKG_VERSION:=20210119 +PKG_VERSION:=20211016 PKG_RELEASE:=1 PKG_MAINTAINER:= PKG_SOURCE:=$(PKG_NAME)_$(PKG_VERSION).tar.xz PKG_SOURCE_URL:=http://ftp.debian.org/debian/pool/main/c/ca-certificates -PKG_HASH:=daa3afae563711c30a0586ddae4336e8e3974c2b627faaca404c4e0141b64665 +PKG_HASH:=2ae9b6dc5f40c25d6d7fe55e07b54f12a8967d1955d3b7b2f42ee46266eeef88 PKG_INSTALL:=1 include $(INCLUDE_DIR)/package.mk From 23c86d44bcfa00255c32196458b0a47dfa6732d5 Mon Sep 17 00:00:00 2001 From: Christian Lamparter Date: Wed, 1 Dec 2021 15:01:23 +0100 Subject: [PATCH 4/4] ca-certificates: fix python3-cryptography woes in certdata2pem.py This patch is a revert of the upstream patch to Debian's ca-certificate commit 033d52259172 ("mozilla/certdata2pem.py: print a warning for expired certificates.") The reason is, that this change broke builds with the popular Ubuntu 20.04 LTS (focal) releases which are shipping with an older version of the python3-cryptography package that is not compatible. |Traceback (most recent call last): | File "certdata2pem.py", line 125, in | cert = x509.load_der_x509_certificate(obj['CKA_VALUE']) |TypeError: load_der_x509_certificate() missing 1 required positional argument: 'backend' |make[5]: *** [Makefile:6: all] Error 1 ...or if the python3-cryptography was missing all together: |Traceback (most recent call last): | File "/certdata2pem.py", line 31, in | from cryptography import x509 |ModuleNotFoundError: No module named 'cryptography' More concerns were raised by Jo-Philipp Wich: "We don't want the build to depend on the local system time anyway. Right now it seems to be just a warning but I could imagine that eventually certs are simply omitted of found to be expired at build time which would break reproducibility." Link: Reported-by: Chen Minqiang Reported-by: Shane Synan Signed-off-by: Christian Lamparter (cherry picked from commit 25bc66eb40ea2c062940778fba601032b2579734) --- ...fix-python3-cryptography-woes-in-cer.patch | 53 +++++++++++++++++++ 1 file changed, 53 insertions(+) create mode 100644 package/system/ca-certificates/patches/0001-ca-certificates-fix-python3-cryptography-woes-in-cer.patch diff --git a/package/system/ca-certificates/patches/0001-ca-certificates-fix-python3-cryptography-woes-in-cer.patch b/package/system/ca-certificates/patches/0001-ca-certificates-fix-python3-cryptography-woes-in-cer.patch new file mode 100644 index 0000000000..add01f42c0 --- /dev/null +++ b/package/system/ca-certificates/patches/0001-ca-certificates-fix-python3-cryptography-woes-in-cer.patch @@ -0,0 +1,53 @@ +From 3c51cb5ff1d0db41fb3288fb555c7e7055cf3e86 Mon Sep 17 00:00:00 2001 +From: Christian Lamparter +Date: Wed, 1 Dec 2021 14:41:31 +0100 +Subject: [PATCH] ca-certificates: fix python3-cryptography woes in + certdata2pem.py + +reverts the code portion of the Debian's ca-certificate +commit 033d52259172 ("mozilla/certdata2pem.py: print a warning for expired certificates.") + +It broke builds with the popular Ubuntu 20.04 (focal) releases. +This was due to them shipping with an older python3-cryptography +version which is not compatible. + +More concerns were raised by jow- as well: +"We don't want the build to depend on the local system time anyway." + +Reported-by: Chen Minqiang +Reported-by: Shane Synan +Signed-off-by: Christian Lamparter +--- +--- a/work/mozilla/certdata2pem.py ++++ b/work/mozilla/certdata2pem.py +@@ -21,16 +21,12 @@ + # USA. + + import base64 +-import datetime + import os.path + import re + import sys + import textwrap + import io + +-from cryptography import x509 +- +- + objects = [] + + # Dirty file parser. +@@ -121,13 +117,6 @@ for obj in objects: + if obj['CKA_CLASS'] == 'CKO_CERTIFICATE': + if not obj['CKA_LABEL'] in trust or not trust[obj['CKA_LABEL']]: + continue +- +- cert = x509.load_der_x509_certificate(obj['CKA_VALUE']) +- if cert.not_valid_after < datetime.datetime.now(): +- print('!'*74) +- print('Trusted but expired certificate found: %s' % obj['CKA_LABEL']) +- print('!'*74) +- + bname = obj['CKA_LABEL'][1:-1].replace('/', '_')\ + .replace(' ', '_')\ + .replace('(', '=')\