latest

5 files changed, 11 insertions, 130 deletions

diff --git a/.SRCINFO b/.SRCINFO
index d70c301733e8..931f051d47bd 100644
--- a/.SRCINFO
+++ b/.SRCINFO
@@ -1,5 +1,5 @@
 pkgbase = linux-wave
-	pkgver = 4.14.19
+	pkgver = 4.14.34
 	pkgrel = 1
 	url = https://www.kernel.org/
 	arch = x86_64
@@ -12,30 +12,26 @@ pkgbase = linux-wave
 	options = !strip
 	source = https://www.kernel.org/pub/linux/kernel/v4.x/linux-4.14.tar.xz
 	source = https://www.kernel.org/pub/linux/kernel/v4.x/linux-4.14.tar.sign
-	source = https://www.kernel.org/pub/linux/kernel/v4.x/patch-4.14.19.xz
-	source = https://www.kernel.org/pub/linux/kernel/v4.x/patch-4.14.19.sign
+	source = https://www.kernel.org/pub/linux/kernel/v4.x/patch-4.14.34.xz
+	source = https://www.kernel.org/pub/linux/kernel/v4.x/patch-4.14.34.sign
 	source = config
 	source = 60-linux.hook
 	source = 90-linux.hook
 	source = linux.preset
 	source = 0001-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch
-	source = 0002-dccp-CVE-2017-8824-use-after-free-in-DCCP-code.patch
-	source = 0003-xfrm-Fix-stack-out-of-bounds-read-on-socket-policy-l.patch
-	source = 0004-drm-i915-edp-Only-use-the-alternate-fixed-mode-if-it.patch
+	source = 0002-drm-i915-edp-Only-use-the-alternate-fixed-mode-if-it.patch
 	source = tcp_wave.patch
 	validpgpkeys = ABAF11C65A2970B130ABE3C479BE3E4300411886
 	validpgpkeys = 647F28654894E3BD457199BE38DBBDC86092693E
 	md5sums = bacdb9ffdcd922aa069a5e1520160e24
 	md5sums = SKIP
-	md5sums = 93a9e0bc01a696f55700b2b7b87b6b95
+	md5sums = d3c42f511a24629fa5ff124cf1e6c0ad
 	md5sums = SKIP
 	md5sums = 9278b7c90f4f6ecea68a4601e7a2b2b1
 	md5sums = ce6c81ad1ad1f8b333fd6077d47abdaf
 	md5sums = a85bfae59eb537b973c388ffadb281ff
 	md5sums = a329f9581060d555dc7358483de9760a
 	md5sums = 53523555d234de3b2fde749096ba9948
-	md5sums = c9feea6633f367f58ac03752509d2f1e
-	md5sums = d725e8464fd1915dc1df72d3256a4eba
 	md5sums = 0ae8549287d6a3a4b3ab37758ca1d0cf
 	md5sums = facb73764bf1c630d9d9f47775fec100
 
diff --git a/0002-dccp-CVE-2017-8824-use-after-free-in-DCCP-code.patch b/0002-dccp-CVE-2017-8824-use-after-free-in-DCCP-code.patch
deleted file mode 100644
index da886c8a50f6..000000000000
--- a/0002-dccp-CVE-2017-8824-use-after-free-in-DCCP-code.patch
+++ /dev/null
@@ -1,57 +0,0 @@
-From 8514970bf07bd1cc522f50e882e0159a51a39264 Mon Sep 17 00:00:00 2001
-Message-Id: <8514970bf07bd1cc522f50e882e0159a51a39264.1516188238.git.jan.steffens@gmail.com>
-In-Reply-To: <4e54373158caa50df5402fdd3db1794c5394026b.1516188238.git.jan.steffens@gmail.com>
-References: <4e54373158caa50df5402fdd3db1794c5394026b.1516188238.git.jan.steffens@gmail.com>
-From: Mohamed Ghannam <simo.ghannam@gmail.com>
-Date: Tue, 5 Dec 2017 20:58:35 +0000
-Subject: [PATCH 2/4] dccp: CVE-2017-8824: use-after-free in DCCP code
-
-Whenever the sock object is in DCCP_CLOSED state,
-dccp_disconnect() must free dccps_hc_tx_ccid and
-dccps_hc_rx_ccid and set to NULL.
-
-Signed-off-by: Mohamed Ghannam <simo.ghannam@gmail.com>
-Reviewed-by: Eric Dumazet <edumazet@google.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
----
- net/dccp/proto.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/net/dccp/proto.c b/net/dccp/proto.c
-index b68168fcc06a..9d43c1f40274 100644
---- a/net/dccp/proto.c
-+++ b/net/dccp/proto.c
-@@ -259,25 +259,30 @@ int dccp_disconnect(struct sock *sk, int flags)
- {
- 	struct inet_connection_sock *icsk = inet_csk(sk);
- 	struct inet_sock *inet = inet_sk(sk);
-+	struct dccp_sock *dp = dccp_sk(sk);
- 	int err = 0;
- 	const int old_state = sk->sk_state;
- 
- 	if (old_state != DCCP_CLOSED)
- 		dccp_set_state(sk, DCCP_CLOSED);
- 
- 	/*
- 	 * This corresponds to the ABORT function of RFC793, sec. 3.8
- 	 * TCP uses a RST segment, DCCP a Reset packet with Code 2, "Aborted".
- 	 */
- 	if (old_state == DCCP_LISTEN) {
- 		inet_csk_listen_stop(sk);
- 	} else if (dccp_need_reset(old_state)) {
- 		dccp_send_reset(sk, DCCP_RESET_CODE_ABORTED);
- 		sk->sk_err = ECONNRESET;
- 	} else if (old_state == DCCP_REQUESTING)
- 		sk->sk_err = ECONNRESET;
- 
- 	dccp_clear_xmit_timers(sk);
-+	ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk);
-+	ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk);
-+	dp->dccps_hc_rx_ccid = NULL;
-+	dp->dccps_hc_tx_ccid = NULL;
- 
- 	__skb_queue_purge(&sk->sk_receive_queue);
- 	__skb_queue_purge(&sk->sk_write_queue);
--- 
-2.15.1
-
diff --git a/0004-drm-i915-edp-Only-use-the-alternate-fixed-mode-if-it.patch b/0002-drm-i915-edp-Only-use-the-alternate-fixed-mode-if-it.patch
index f77c9b5c12c4..f77c9b5c12c4 100644
--- a/0004-drm-i915-edp-Only-use-the-alternate-fixed-mode-if-it.patch
+++ b/0002-drm-i915-edp-Only-use-the-alternate-fixed-mode-if-it.patch
diff --git a/0003-xfrm-Fix-stack-out-of-bounds-read-on-socket-policy-l.patch b/0003-xfrm-Fix-stack-out-of-bounds-read-on-socket-policy-l.patch
deleted file mode 100644
index 8a3ea3008a14..000000000000
--- a/0003-xfrm-Fix-stack-out-of-bounds-read-on-socket-policy-l.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From c9c8995fc83b476fdf3fc0c4b498feef2949ec75 Mon Sep 17 00:00:00 2001
-Message-Id: <c9c8995fc83b476fdf3fc0c4b498feef2949ec75.1516188238.git.jan.steffens@gmail.com>
-In-Reply-To: <4e54373158caa50df5402fdd3db1794c5394026b.1516188238.git.jan.steffens@gmail.com>
-References: <4e54373158caa50df5402fdd3db1794c5394026b.1516188238.git.jan.steffens@gmail.com>
-From: Steffen Klassert <steffen.klassert@secunet.com>
-Date: Fri, 22 Dec 2017 10:44:57 +0100
-Subject: [PATCH 3/4] xfrm: Fix stack-out-of-bounds read on socket policy
- lookup.
-
-When we do tunnel or beet mode, we pass saddr and daddr from the
-template to xfrm_state_find(), this is ok. On transport mode,
-we pass the addresses from the flowi, assuming that the IP
-addresses (and address family) don't change during transformation.
-This assumption is wrong in the IPv4 mapped IPv6 case, packet
-is IPv4 and template is IPv6.
-
-Fix this by catching address family missmatches of the policy
-and the flow already before we do the lookup.
-
-Reported-by: syzbot <syzkaller@googlegroups.com>
-Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
----
- net/xfrm/xfrm_policy.c | 8 +++++++-
- 1 file changed, 7 insertions(+), 1 deletion(-)
-
-diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
-index 6bc16bb61b55..50c5f46b5cca 100644
---- a/net/xfrm/xfrm_policy.c
-+++ b/net/xfrm/xfrm_policy.c
-@@ -1169,9 +1169,15 @@ static struct xfrm_policy *xfrm_sk_policy_lookup(const struct sock *sk, int dir,
-  again:
- 	pol = rcu_dereference(sk->sk_policy[dir]);
- 	if (pol != NULL) {
--		bool match = xfrm_selector_match(&pol->selector, fl, family);
-+		bool match;
- 		int err = 0;
- 
-+		if (pol->family != family) {
-+			pol = NULL;
-+			goto out;
-+		}
-+
-+		match = xfrm_selector_match(&pol->selector, fl, family);
- 		if (match) {
- 			if ((sk->sk_mark & pol->mark.m) != pol->mark.v) {
- 				pol = NULL;
--- 
-2.15.1
-
diff --git a/PKGBUILD b/PKGBUILD
index b7ea65582612..3b36da60a489 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -5,7 +5,7 @@
 pkgbase=linux-wave               # Build stock -ARCH kernel
 #pkgbase=linux-custom       # Build kernel with a different name
 _srcname=linux-4.14
-pkgver=4.14.19
+pkgver=4.14.34
 pkgrel=1
 arch=('x86_64')
 url="https://www.kernel.org/"
@@ -21,10 +21,8 @@ source=(
   '60-linux.hook'  # pacman hook for depmod
   '90-linux.hook'  # pacman hook for initramfs regeneration
   'linux.preset'   # standard config files for mkinitcpio ramdisk
-  0001-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch
-  0002-dccp-CVE-2017-8824-use-after-free-in-DCCP-code.patch
-  0003-xfrm-Fix-stack-out-of-bounds-read-on-socket-policy-l.patch
-  0004-drm-i915-edp-Only-use-the-alternate-fixed-mode-if-it.patch
+  '0001-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch'
+  '0002-drm-i915-edp-Only-use-the-alternate-fixed-mode-if-it.patch'
   tcp_wave.patch
 )
 validpgpkeys=(
@@ -49,15 +47,10 @@ prepare() {
   # disable USER_NS for non-root users by default
   patch -Np1 -i ../0001-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch
 
-  # https://nvd.nist.gov/vuln/detail/CVE-2017-8824
-  patch -Np1 -i ../0002-dccp-CVE-2017-8824-use-after-free-in-DCCP-code.patch
-
-  # https://bugs.archlinux.org/task/56605
-  patch -Np1 -i ../0003-xfrm-Fix-stack-out-of-bounds-read-on-socket-policy-l.patch
-
   # https://bugs.archlinux.org/task/56711
-  patch -Np1 -i ../0004-drm-i915-edp-Only-use-the-alternate-fixed-mode-if-it.patch
+  patch -Np1 -i ../0002-drm-i915-edp-Only-use-the-alternate-fixed-mode-if-it.patch
 
+  # Wave patch
   patch -Np1 -i ../tcp_wave.patch
 
   cp -Tf ../config .config
@@ -246,14 +239,12 @@ done
 # vim:set ts=8 sts=2 sw=2 et:
 md5sums=('bacdb9ffdcd922aa069a5e1520160e24'
          'SKIP'
-         '93a9e0bc01a696f55700b2b7b87b6b95'
+         'd3c42f511a24629fa5ff124cf1e6c0ad'
          'SKIP'
          '9278b7c90f4f6ecea68a4601e7a2b2b1'
          'ce6c81ad1ad1f8b333fd6077d47abdaf'
          'a85bfae59eb537b973c388ffadb281ff'
          'a329f9581060d555dc7358483de9760a'
          '53523555d234de3b2fde749096ba9948'
-         'c9feea6633f367f58ac03752509d2f1e'
-         'd725e8464fd1915dc1df72d3256a4eba'
          '0ae8549287d6a3a4b3ab37758ca1d0cf'
          'facb73764bf1c630d9d9f47775fec100')