update libre/linux-libre-hardened files

17 files changed, 197 insertions, 73 deletions

diff --git a/libre/linux-libre-hardened/0001-ARM-atags-add-support-for-Marvell-s-u-boot.patch b/libre/linux-libre-hardened/0001-ARM-atags-add-support-for-Marvell-s-u-boot.patch
index 47f149aa5..de6f5c6d6 100644
--- a/libre/linux-libre-hardened/0001-ARM-atags-add-support-for-Marvell-s-u-boot.patch
+++ b/libre/linux-libre-hardened/0001-ARM-atags-add-support-for-Marvell-s-u-boot.patch
@@ -1,4 +1,4 @@
-From 81e89a314fb1e70274c2ec72013ba0a076de55dd Mon Sep 17 00:00:00 2001
+From 043141070b13388a29ce9f73d1378db6fee9ea00 Mon Sep 17 00:00:00 2001
 From: Willy Tarreau <w@xxxxxx>
 Date: Sun, 2 Dec 2012 19:59:28 +0100
 Subject: [PATCH 1/9] ARM: atags: add support for Marvell's u-boot
@@ -47,5 +47,5 @@ index 979ff4016404..d1d0c1950fa4 100644
  };
  
 -- 
-2.13.0
+2.14.2
 
diff --git a/libre/linux-libre-hardened/0001-dccp-CVE-2017-8824-use-after-free-in-DCCP-code.patch b/libre/linux-libre-hardened/0001-dccp-CVE-2017-8824-use-after-free-in-DCCP-code.patch
new file mode 100644
index 000000000..da886c8a5
--- /dev/null
+++ b/libre/linux-libre-hardened/0001-dccp-CVE-2017-8824-use-after-free-in-DCCP-code.patch
@@ -0,0 +1,57 @@
+From 8514970bf07bd1cc522f50e882e0159a51a39264 Mon Sep 17 00:00:00 2001
+Message-Id: <8514970bf07bd1cc522f50e882e0159a51a39264.1516188238.git.jan.steffens@gmail.com>
+In-Reply-To: <4e54373158caa50df5402fdd3db1794c5394026b.1516188238.git.jan.steffens@gmail.com>
+References: <4e54373158caa50df5402fdd3db1794c5394026b.1516188238.git.jan.steffens@gmail.com>
+From: Mohamed Ghannam <simo.ghannam@gmail.com>
+Date: Tue, 5 Dec 2017 20:58:35 +0000
+Subject: [PATCH 2/4] dccp: CVE-2017-8824: use-after-free in DCCP code
+
+Whenever the sock object is in DCCP_CLOSED state,
+dccp_disconnect() must free dccps_hc_tx_ccid and
+dccps_hc_rx_ccid and set to NULL.
+
+Signed-off-by: Mohamed Ghannam <simo.ghannam@gmail.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ net/dccp/proto.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/net/dccp/proto.c b/net/dccp/proto.c
+index b68168fcc06a..9d43c1f40274 100644
+--- a/net/dccp/proto.c
++++ b/net/dccp/proto.c
+@@ -259,25 +259,30 @@ int dccp_disconnect(struct sock *sk, int flags)
+ {
+ 	struct inet_connection_sock *icsk = inet_csk(sk);
+ 	struct inet_sock *inet = inet_sk(sk);
++	struct dccp_sock *dp = dccp_sk(sk);
+ 	int err = 0;
+ 	const int old_state = sk->sk_state;
+ 
+ 	if (old_state != DCCP_CLOSED)
+ 		dccp_set_state(sk, DCCP_CLOSED);
+ 
+ 	/*
+ 	 * This corresponds to the ABORT function of RFC793, sec. 3.8
+ 	 * TCP uses a RST segment, DCCP a Reset packet with Code 2, "Aborted".
+ 	 */
+ 	if (old_state == DCCP_LISTEN) {
+ 		inet_csk_listen_stop(sk);
+ 	} else if (dccp_need_reset(old_state)) {
+ 		dccp_send_reset(sk, DCCP_RESET_CODE_ABORTED);
+ 		sk->sk_err = ECONNRESET;
+ 	} else if (old_state == DCCP_REQUESTING)
+ 		sk->sk_err = ECONNRESET;
+ 
+ 	dccp_clear_xmit_timers(sk);
++	ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk);
++	ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk);
++	dp->dccps_hc_rx_ccid = NULL;
++	dp->dccps_hc_tx_ccid = NULL;
+ 
+ 	__skb_queue_purge(&sk->sk_receive_queue);
+ 	__skb_queue_purge(&sk->sk_write_queue);
+-- 
+2.15.1
+
diff --git a/libre/linux-libre-hardened/0002-ARM-atags-fdt-retrieve-MAC-addresses-from-Marvell-bo.patch b/libre/linux-libre-hardened/0002-ARM-atags-fdt-retrieve-MAC-addresses-from-Marvell-bo.patch
index ccc42d67e..0034af55f 100644
--- a/libre/linux-libre-hardened/0002-ARM-atags-fdt-retrieve-MAC-addresses-from-Marvell-bo.patch
+++ b/libre/linux-libre-hardened/0002-ARM-atags-fdt-retrieve-MAC-addresses-from-Marvell-bo.patch
@@ -1,4 +1,4 @@
-From e62b74b84f4b146e0b82d6acf1c043dc599ea884 Mon Sep 17 00:00:00 2001
+From 278772450de941a06782c07a43e7511b6bdbf430 Mon Sep 17 00:00:00 2001
 From: Willy Tarreau <w@xxxxxx>
 Date: Sun, 2 Dec 2012 19:56:58 +0100
 Subject: [PATCH 2/9] ARM: atags/fdt: retrieve MAC addresses from Marvell boot
@@ -43,5 +43,5 @@ index 9448aa0c6686..ac7b6ae6c00f 100644
  	}
  
 -- 
-2.13.0
+2.14.2
 
diff --git a/libre/linux-libre-hardened/0002-xfrm-Fix-stack-out-of-bounds-read-on-socket-policy-l.patch b/libre/linux-libre-hardened/0002-xfrm-Fix-stack-out-of-bounds-read-on-socket-policy-l.patch
new file mode 100644
index 000000000..8a3ea3008
--- /dev/null
+++ b/libre/linux-libre-hardened/0002-xfrm-Fix-stack-out-of-bounds-read-on-socket-policy-l.patch
@@ -0,0 +1,49 @@
+From c9c8995fc83b476fdf3fc0c4b498feef2949ec75 Mon Sep 17 00:00:00 2001
+Message-Id: <c9c8995fc83b476fdf3fc0c4b498feef2949ec75.1516188238.git.jan.steffens@gmail.com>
+In-Reply-To: <4e54373158caa50df5402fdd3db1794c5394026b.1516188238.git.jan.steffens@gmail.com>
+References: <4e54373158caa50df5402fdd3db1794c5394026b.1516188238.git.jan.steffens@gmail.com>
+From: Steffen Klassert <steffen.klassert@secunet.com>
+Date: Fri, 22 Dec 2017 10:44:57 +0100
+Subject: [PATCH 3/4] xfrm: Fix stack-out-of-bounds read on socket policy
+ lookup.
+
+When we do tunnel or beet mode, we pass saddr and daddr from the
+template to xfrm_state_find(), this is ok. On transport mode,
+we pass the addresses from the flowi, assuming that the IP
+addresses (and address family) don't change during transformation.
+This assumption is wrong in the IPv4 mapped IPv6 case, packet
+is IPv4 and template is IPv6.
+
+Fix this by catching address family missmatches of the policy
+and the flow already before we do the lookup.
+
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+---
+ net/xfrm/xfrm_policy.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
+index 6bc16bb61b55..50c5f46b5cca 100644
+--- a/net/xfrm/xfrm_policy.c
++++ b/net/xfrm/xfrm_policy.c
+@@ -1169,9 +1169,15 @@ static struct xfrm_policy *xfrm_sk_policy_lookup(const struct sock *sk, int dir,
+  again:
+ 	pol = rcu_dereference(sk->sk_policy[dir]);
+ 	if (pol != NULL) {
+-		bool match = xfrm_selector_match(&pol->selector, fl, family);
++		bool match;
+ 		int err = 0;
+ 
++		if (pol->family != family) {
++			pol = NULL;
++			goto out;
++		}
++
++		match = xfrm_selector_match(&pol->selector, fl, family);
+ 		if (match) {
+ 			if ((sk->sk_mark & pol->mark.m) != pol->mark.v) {
+ 				pol = NULL;
+-- 
+2.15.1
+
diff --git a/libre/linux-libre-hardened/0003-SMILE-Plug-device-tree-file.patch b/libre/linux-libre-hardened/0003-SMILE-Plug-device-tree-file.patch
index 5976f1a80..83ee1dadc 100644
--- a/libre/linux-libre-hardened/0003-SMILE-Plug-device-tree-file.patch
+++ b/libre/linux-libre-hardened/0003-SMILE-Plug-device-tree-file.patch
@@ -1,4 +1,4 @@
-From 8a920b8030a9a677dd6d38cf0305e7bf63617a61 Mon Sep 17 00:00:00 2001
+From db678c33357f6349df02b0f4979fc8c9ee365697 Mon Sep 17 00:00:00 2001
 From: Kevin Mihelich <kevin@archlinuxarm.org>
 Date: Fri, 5 Sep 2014 15:41:19 -0600
 Subject: [PATCH 3/9] SMILE Plug device tree file
@@ -14,10 +14,10 @@ Signed-off-by: Kevin Mihelich <kevin@archlinuxarm.org>
  create mode 100644 arch/arm/boot/dts/armada-370-smileplug.dts
 
 diff --git a/arch/arm/boot/dts/Makefile b/arch/arm/boot/dts/Makefile
-index 9c5e1d944d1c..342ed08ab225 100644
+index faf46abaa4a2..aecdcfa7a67b 100644
 --- a/arch/arm/boot/dts/Makefile
 +++ b/arch/arm/boot/dts/Makefile
-@@ -985,6 +985,7 @@ dtb-$(CONFIG_MACH_ARMADA_370) += \
+@@ -1010,6 +1010,7 @@ dtb-$(CONFIG_MACH_ARMADA_370) += \
  	armada-370-db.dtb \
  	armada-370-dlink-dns327l.dtb \
  	armada-370-mirabox.dtb \
@@ -205,5 +205,5 @@ index 000000000000..d01308ab848b
 +	};
 +};
 -- 
-2.13.0
+2.14.2
 
diff --git a/libre/linux-libre-hardened/0003-drm-i915-edp-Only-use-the-alternate-fixed-mode-if-it.patch b/libre/linux-libre-hardened/0003-drm-i915-edp-Only-use-the-alternate-fixed-mode-if-it.patch
new file mode 100644
index 000000000..f77c9b5c1
--- /dev/null
+++ b/libre/linux-libre-hardened/0003-drm-i915-edp-Only-use-the-alternate-fixed-mode-if-it.patch
@@ -0,0 +1,42 @@
+From e722c8d112f0aa9621d7d4da5223cfc7aeb45e88 Mon Sep 17 00:00:00 2001
+Message-Id: <e722c8d112f0aa9621d7d4da5223cfc7aeb45e88.1516188238.git.jan.steffens@gmail.com>
+In-Reply-To: <4e54373158caa50df5402fdd3db1794c5394026b.1516188238.git.jan.steffens@gmail.com>
+References: <4e54373158caa50df5402fdd3db1794c5394026b.1516188238.git.jan.steffens@gmail.com>
+From: Jim Bride <jim.bride@linux.intel.com>
+Date: Mon, 6 Nov 2017 13:38:57 -0800
+Subject: [PATCH 4/4] drm/i915/edp: Only use the alternate fixed mode if it's
+ asked for
+
+In commit dc911f5bd8aa ("drm/i915/edp: Allow alternate fixed mode for
+eDP if available."), the patch allows for the use of an alternate fixed
+mode if it is available, but the patch was not ensuring that the only
+time the alternate mode is used is when it is specifically requested.
+This patch adds an additional comparison to intel_edp_compare_alt_mode
+to ensure that we only use the alternate mode if it is directly
+requested.
+
+Fixes: dc911f5bd8aac ("Allow alternate fixed mode for eDP if available.")
+Cc: David Weinehall <david.weinehall@linux.intel.com>
+Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Jim Bride <jim.bride@linux.intel.com>
+---
+ drivers/gpu/drm/i915/intel_dp.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
+index 09f274419eea..838cee312e8e 100644
+--- a/drivers/gpu/drm/i915/intel_dp.c
++++ b/drivers/gpu/drm/i915/intel_dp.c
+@@ -1632,7 +1632,8 @@ static bool intel_edp_compare_alt_mode(struct drm_display_mode *m1,
+ 			m1->vdisplay == m2->vdisplay &&
+ 			m1->vsync_start == m2->vsync_start &&
+ 			m1->vsync_end == m2->vsync_end &&
+-			m1->vtotal == m2->vtotal);
++			m1->vtotal == m2->vtotal &&
++			m1->vrefresh == m2->vrefresh);
+ 	return bres;
+ }
+ 
+-- 
+2.15.1
+
diff --git a/libre/linux-libre-hardened/0004-fix-mvsdio-eMMC-timing.patch b/libre/linux-libre-hardened/0004-fix-mvsdio-eMMC-timing.patch
index b9e969f7a..a0f40efa4 100644
--- a/libre/linux-libre-hardened/0004-fix-mvsdio-eMMC-timing.patch
+++ b/libre/linux-libre-hardened/0004-fix-mvsdio-eMMC-timing.patch
@@ -1,4 +1,4 @@
-From 9ef8feb3e1a701eacd6979653511e1b13b095697 Mon Sep 17 00:00:00 2001
+From 1b4696de4df2ebd2d2a0da05a284705e11427e06 Mon Sep 17 00:00:00 2001
 From: Kevin Mihelich <kevin@archlinuxarm.org>
 Date: Fri, 5 Sep 2014 15:43:56 -0600
 Subject: [PATCH 4/9] fix mvsdio eMMC timing
@@ -34,5 +34,5 @@ index 58d74b8d6c79..c9715530d676 100644
  		host->clock = ios->clock;
  		host->ns_per_clk = 1000000000 / (host->base_clock / (m+1));
 -- 
-2.13.0
+2.14.2
 
diff --git a/libre/linux-libre-hardened/0005-net-smsc95xx-Allow-mac-address-to-be-set-as-a-parame.patch b/libre/linux-libre-hardened/0005-net-smsc95xx-Allow-mac-address-to-be-set-as-a-parame.patch
index 0cbd821c5..516c66b80 100644
--- a/libre/linux-libre-hardened/0005-net-smsc95xx-Allow-mac-address-to-be-set-as-a-parame.patch
+++ b/libre/linux-libre-hardened/0005-net-smsc95xx-Allow-mac-address-to-be-set-as-a-parame.patch
@@ -1,4 +1,4 @@
-From d52a089f2564db419f6a9b4109ccda69e847793d Mon Sep 17 00:00:00 2001
+From ffd117b73c6a0185d3089ec9abee06122e88eecb Mon Sep 17 00:00:00 2001
 From: popcornmix <popcornmix@gmail.com>
 Date: Tue, 18 Feb 2014 01:43:50 -0300
 Subject: [PATCH 5/9] net/smsc95xx: Allow mac address to be set as a parameter
@@ -8,7 +8,7 @@ Subject: [PATCH 5/9] net/smsc95xx: Allow mac address to be set as a parameter
  1 file changed, 56 insertions(+)
 
 diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
-index 765400b62168..ee3212f887e3 100644
+index 309b88acd3d0..7bc9feb891a1 100644
 --- a/drivers/net/usb/smsc95xx.c
 +++ b/drivers/net/usb/smsc95xx.c
 @@ -60,6 +60,7 @@
@@ -91,5 +91,5 @@ index 765400b62168..ee3212f887e3 100644
  
  	/* maybe the boot loader passed the MAC address in devicetree */
 -- 
-2.13.0
+2.14.2
 
diff --git a/libre/linux-libre-hardened/0006-set-default-cubietruck-led-triggers.patch b/libre/linux-libre-hardened/0006-set-default-cubietruck-led-triggers.patch
index 4a8965cae..df27ce380 100644
--- a/libre/linux-libre-hardened/0006-set-default-cubietruck-led-triggers.patch
+++ b/libre/linux-libre-hardened/0006-set-default-cubietruck-led-triggers.patch
@@ -1,4 +1,4 @@
-From 6a5a573951f166fdda2d2daa235207f32d9bec92 Mon Sep 17 00:00:00 2001
+From e2567ba6352c663819406b73d4aa3aa31ad4ca06 Mon Sep 17 00:00:00 2001
 From: Kevin Mihelich <kevin@archlinuxarm.org>
 Date: Sat, 14 Feb 2015 12:32:27 +0100
 Subject: [PATCH 6/9] set default cubietruck led triggers
@@ -9,7 +9,7 @@ Signed-off-by: Kevin Mihelich <kevin@archlinuxarm.org>
  1 file changed, 2 insertions(+)
 
 diff --git a/arch/arm/boot/dts/sun7i-a20-cubietruck.dts b/arch/arm/boot/dts/sun7i-a20-cubietruck.dts
-index 102903e83bd2..40ce78704e8f 100644
+index 852a0aa24dce..82c963629a55 100644
 --- a/arch/arm/boot/dts/sun7i-a20-cubietruck.dts
 +++ b/arch/arm/boot/dts/sun7i-a20-cubietruck.dts
 @@ -69,6 +69,7 @@
@@ -29,5 +29,5 @@ index 102903e83bd2..40ce78704e8f 100644
  	};
  
 -- 
-2.13.0
+2.14.2
 
diff --git a/libre/linux-libre-hardened/0007-exynos4412-odroid-set-higher-minimum-buck2-regulator.patch b/libre/linux-libre-hardened/0007-exynos4412-odroid-set-higher-minimum-buck2-regulator.patch
index 9c3f76760..3deb7f825 100644
--- a/libre/linux-libre-hardened/0007-exynos4412-odroid-set-higher-minimum-buck2-regulator.patch
+++ b/libre/linux-libre-hardened/0007-exynos4412-odroid-set-higher-minimum-buck2-regulator.patch
@@ -1,4 +1,4 @@
-From 65265b8379903a8dd95489616fde0126d10bd4ef Mon Sep 17 00:00:00 2001
+From dc9e6fcc9675737091fb99550b361aea81a94b90 Mon Sep 17 00:00:00 2001
 From: Kevin Mihelich <kevin@archlinuxarm.org>
 Date: Thu, 11 Aug 2016 00:42:37 -0600
 Subject: [PATCH 7/9] exynos4412-odroid: set higher minimum buck2 regulator
@@ -13,7 +13,7 @@ Signed-off-by: Kevin Mihelich <kevin@archlinuxarm.org>
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/arch/arm/boot/dts/exynos4412-odroid-common.dtsi b/arch/arm/boot/dts/exynos4412-odroid-common.dtsi
-index 0f1ff792fe44..a6fc2a53522f 100644
+index 102acd78be15..5b65992e5667 100644
 --- a/arch/arm/boot/dts/exynos4412-odroid-common.dtsi
 +++ b/arch/arm/boot/dts/exynos4412-odroid-common.dtsi
 @@ -423,7 +423,7 @@
@@ -26,5 +26,5 @@ index 0f1ff792fe44..a6fc2a53522f 100644
  				regulator-always-on;
  				regulator-boot-on;
 -- 
-2.13.0
+2.14.2
 
diff --git a/libre/linux-libre-hardened/0008-disable-USB3-port-on-ODROID-XU.patch b/libre/linux-libre-hardened/0008-disable-USB3-port-on-ODROID-XU.patch
index 01a9c3f01..dec2ae607 100644
--- a/libre/linux-libre-hardened/0008-disable-USB3-port-on-ODROID-XU.patch
+++ b/libre/linux-libre-hardened/0008-disable-USB3-port-on-ODROID-XU.patch
@@ -1,4 +1,4 @@
-From 800ac49ce45ca2500e2455194d155d5d20f633e0 Mon Sep 17 00:00:00 2001
+From c5b29f6344d0e5da1d5ef64e4e7e5ed4937541be Mon Sep 17 00:00:00 2001
 From: Kevin Mihelich <kevin@archlinuxarm.org>
 Date: Sat, 25 Feb 2017 19:39:51 -0700
 Subject: [PATCH 8/9] disable USB3 port on ODROID-XU
@@ -23,5 +23,5 @@ index c4de1353e5df..f80fa58995c5 100644
  
  &usbdrd_dwc3_1 {
 -- 
-2.13.0
+2.14.2
 
diff --git a/libre/linux-libre-hardened/0009-ARM-dove-enable-ethernet-on-D3Plug.patch b/libre/linux-libre-hardened/0009-ARM-dove-enable-ethernet-on-D3Plug.patch
index eca0ffcb8..d5efc4aeb 100644
--- a/libre/linux-libre-hardened/0009-ARM-dove-enable-ethernet-on-D3Plug.patch
+++ b/libre/linux-libre-hardened/0009-ARM-dove-enable-ethernet-on-D3Plug.patch
@@ -1,4 +1,4 @@
-From 04cbef0366837832994a3dd25661d28afe0d65a4 Mon Sep 17 00:00:00 2001
+From 43fc6d48884feb1d121bef1dd64ab444b5c46169 Mon Sep 17 00:00:00 2001
 From: Kevin Mihelich <kevin@archlinuxarm.org>
 Date: Sun, 7 May 2017 13:32:25 -0600
 Subject: [PATCH 9/9] ARM: dove: enable ethernet on D3Plug
@@ -9,7 +9,7 @@ Signed-off-by: Kevin Mihelich <kevin@archlinuxarm.org>
  1 file changed, 7 insertions(+)
 
 diff --git a/arch/arm/boot/dts/dove-d3plug.dts b/arch/arm/boot/dts/dove-d3plug.dts
-index f5f59bb5a534..b0ad0bbf6818 100644
+index e88ff83f1dec..5004f09d76b7 100644
 --- a/arch/arm/boot/dts/dove-d3plug.dts
 +++ b/arch/arm/boot/dts/dove-d3plug.dts
 @@ -60,6 +60,13 @@
@@ -27,5 +27,5 @@ index f5f59bb5a534..b0ad0bbf6818 100644
  /* Samsung M8G2F eMMC */
  &sdio0 {
 -- 
-2.13.0
+2.14.2
 
diff --git a/libre/linux-libre-hardened/PKGBUILD b/libre/linux-libre-hardened/PKGBUILD
index 81533ff79..30c211350 100644
--- a/libre/linux-libre-hardened/PKGBUILD
+++ b/libre/linux-libre-hardened/PKGBUILD
@@ -12,7 +12,7 @@
 
 pkgbase=linux-libre-hardened
 _pkgbasever=4.14-gnu
-_pkgver=4.14.12-gnu
+_pkgver=4.14.15-gnu
 _hardenedver=a
 
 _replacesarchkernel=('linux%') # '%' gets replaced with _kernelname
@@ -57,17 +57,15 @@ source=(
   # other patches
   '0001-usb-serial-gadget-no-TTY-hangup-on-USB-disconnect-WI.patch'
   '0002-fix-Atmel-maXTouch-touchscreen-support.patch'
-  '0001-e1000e-Fix-e1000_check_for_copper_link_ich8lan-retur.patch'
-  '0002-dccp-CVE-2017-8824-use-after-free-in-DCCP-code.patch'
-  '0003-xfrm-Fix-stack-out-of-bounds-read-on-socket-policy-l.patch'
-  '0004-cgroup-fix-css_task_iter-crash-on-CSS_TASK_ITER_PROC.patch'
-  '0005-drm-i915-edp-Only-use-the-alternate-fixed-mode-if-it.patch'
+  '0001-dccp-CVE-2017-8824-use-after-free-in-DCCP-code.patch'
+  '0002-xfrm-Fix-stack-out-of-bounds-read-on-socket-policy-l.patch'
+  '0003-drm-i915-edp-Only-use-the-alternate-fixed-mode-if-it.patch'
   )
 sha512sums=('0d4b0b8ec1ffc39c59295adf56f6a2cccf77cad56d8a8bf8072624bbb52ba3e684147ebed91d1528d2685423dd784c5fca0f3650f874f2b93cfc6b7689b9a87f'
             'SKIP'
-            '2e8abb699328db2b156890b6ab966ba0c8cefbf64c909d13290c92ca99419b5fb06a53d3d93ed83ed6bd28edb6eeba73bd996f3cb2bc150c3b8709b2e2bbea17'
+            '1d60b4b6abb48c757c772b5c6bbefc32d525757b3841bafc277f57d7814a54468e67d7a3932fd520b89b25cfb95e76a644eab38093f151b962132d2a2194b816'
             'SKIP'
-            'ca6e9e7efbdb62ddda3ee5529ab652f334095152b137c9d52f19289d3b978ef8b9a0e296a0ed195433eaa45f3533c9e81b41b731efd6410f0c7d6a348a56f12e'
+            '3db85f6cb13acfdc86940552ae945dda17c2cb6936059515bd1fb2d980aa972904e5aac56bf5ef933dad0087a7d0090437d5a11a658cae3cfd6148a21acb19de'
             'SKIP'
             '13cb5bc42542e7b8bb104d5f68253f6609e463b6799800418af33eb0272cc269aaa36163c3e6f0aacbdaaa1d05e2827a4a7c4a08a029238439ed08b89c564bb3'
             'SKIP'
@@ -75,13 +73,13 @@ sha512sums=('0d4b0b8ec1ffc39c59295adf56f6a2cccf77cad56d8a8bf8072624bbb52ba3e6841
             'SKIP'
             '7a3716bfe3b9f546da309c7492f3e08f8f506813afeb1c737a474c83313d5c313cf4582b65215c2cfce3b74d9d1021c96e8badafe8f6e5b01fe28d2b5c61ae78'
             'SKIP'
-            '71f8c531622f189dac540808356b688bf920385b164ec0f68d9975555aec37a2a8b56198a32a74b14ed70182de09096f83f38272ccab5e32138853629a1ba222'
-            '0dcaf48ca78562e1ef77b4d4b68d1d0c98a573a234e1d9d56d9e8adf9d29ecea3fc2ab9a39cc49d5b67698b59dc3f591d603952253e8b3af8ea9c8da06db1503'
-            'a8a9631dd8813e0266f625f5b7ad8f13fea26d6fa267331adb028a2139f11da283a348e34ad6cb37c7767f228ca0663427e0212bbddf539f67f64c9bac3cc368'
+            'd8d8939fb2fbc1859fc039dcfa16ee2c0168b34bacff17f21c940fb8b01faab83b59b3b5b44cb876701ed7570ce775db3d8a5c6b454dc816c37cc2008e60d40c'
+            '96b665b7b9fc83a31976783cfd2723cd18169543ab67ac01c51d64144d2cffcad7c6072ec4b930eeb2541179021e15aa83260b8d1d6e9259812b679c8fa77afd'
+            '3ba27261cf7480c6654af65475c05923583b85246aedb96460a8435b076026b2f5ba8aa83265f2c67665cee1917670c21655a88d1d86e584768ca5e441d8beaf'
             '7ad5be75ee422dda3b80edd2eb614d8a9181e2c8228cd68b3881e2fb95953bf2dea6cbe7900ce1013c9de89b2802574b7b24869fc5d7a95d3cc3112c4d27063a'
             '4a8b324aee4cccf3a512ad04ce1a272d14e5b05c8de90feb82075f55ea3845948d817e1b0c6f298f5816834ddd3e5ce0a0e2619866289f3c1ab8fd2f35f04f44'
             '2dc6b0ba8f7dbf19d2446c5c5f1823587de89f4e28e9595937dd51a87755099656f2acec50e3e2546ea633ad1bfd1c722e0c2b91eef1d609103d8abdc0a7cbaf'
-            '6a9a290f0fa71973f40a0335017b65bac0486fe719fa79d5cab9358d03c43613f796f5cfcf68bd89964fcb71e05dcead40516b28f78cd25ab9a841c05cbd5874'
+            '02ca6d0bb935ae6f9049ba363f5f0157b4dfd0e4181c65bedb7c0009a0accb6e8d4bb663cb61dd8b095cdd6684e5cbad5966ee6bffd65f0c3d4524b3faee225e'
             'SKIP'
             '29c709ee6892a668c77945142ed9749cb8a3135575a4316f4a3cc85fbda41c09fdd65e32507b654c96aa438bd2aed08c09919bb162daee969643aafd053321c4'
             '5b35ef2c675aed00ddf82b8a96a486230fad78f05b5a69c95a57632d6c7f428f026439f3ced72cf54156ffd4fd563e68d4285ba6f42428c00b966257951039c3'
@@ -94,11 +92,9 @@ sha512sums=('0d4b0b8ec1ffc39c59295adf56f6a2cccf77cad56d8a8bf8072624bbb52ba3e6841
             'f813d51834cedc23fabbb6060709a24f29969fea5aeb963fdeddb79723014ffc0c6d34be45eea8419d5087a5a9c561a42a113d667f03625283f2f2fc68196545'
             '02af4dd2a007e41db0c63822c8ab3b80b5d25646af1906dc85d0ad9bb8bbf5236f8e381d7f91cf99ed4b0978c50aee37cb9567cdeef65b7ec3d91b882852b1af'
             'b8fe56e14006ab866970ddbd501c054ae37186ddc065bb869cf7d18db8c0d455118d5bda3255fb66a0dde38b544655cfe9040ffe46e41d19830b47959b2fb168'
-            'fd9bdc818326fa36c9f1813d0d1821de5e325b646e1c307c197ad38bada7f298d35b4bc1bbf1c2854689f3ba71144879e799a1123037caccd6e3f64edfc22d54'
-            '814517d08c35cc886fe3382619d41107d6139a703c27186d0ce58e187eaf4e84891572e58246750ac8602555794ed6f74d946565b98860787a0aa617fb946dda'
-            'e6605e923c967b5f8db619868b15ea5b0d4254c62cf12bb920f38659933d6ca25a643d3e044c4915a8309071461f5f14c55d0aa0329c113bce4780d4fa3afbb7'
-            '0dec1482efe6e5d762a3061f365e43191484f055b738112452b8ca39e162b935d99cf16b25c0b253d6b532fabc54bde2f5c09be91887156ed6ae06d1558f94b9'
-            'fcc40dc86dd432be76854e3c51889db488de0f1029ecc227b92c4f58c62ba928f7dc3b9515ac3ca0a08d6a0a72ca4a1a754d47c4fb274fe89f09a2a336088e7a')
+            'feba817e3e1595d8069ecc71cc3f3c358d1c65fd284ac4338e4d510c2322bb1c50d802fd1f48f9347323cebf469287bc24695f53b680eb1531c011f4b8452a18'
+            'edd7060b42a7bc77d720cefa65ce0fbb78e321e00c67d122ebf1efdbdba4181ef4ccb0e76ddcb4365c85db6dee21b18f26d66aad606d6c50cb68abd716cb9e69'
+            'e8229b8979ab287d9ad2cac137f2ba349bd43fd0fc09ad19239ea8e3d0d9571977a8296d3814887d7c15f61431f91194851b4a1af5c61ed416faec8283ce3206')
 validpgpkeys=(
   '474402C8C582DAFBE389C427BCB7CF877E7D47A7' # Alexandre Oliva
   '65EEFE022108E2B708CBFCF7F9E712E59AF5F22A' # Daniel Micay
@@ -113,7 +109,6 @@ _replacesgrsec=("${pkgbase/${_kernelname}/${_grsecname}}")
 _replacesoldkernels=("${_replacesoldkernels[@]/\%/${_kernelname}}")
 _replacesoldmodules=("${_replacesoldmodules[@]/\%/${_kernelname}}")
 
-
 case "${CARCH}" in
   i686|x86_64) KARCH=x86;;
   armv7h) KARCH=arm;;
@@ -159,20 +154,14 @@ prepare() {
   # add latest fixes from stable queue, if needed
   # http://git.kernel.org/?p=linux/kernel/git/stable/stable-queue.git
 
-  # https://bugs.archlinux.org/task/56575
-  patch -Np1 -i ../0001-e1000e-Fix-e1000_check_for_copper_link_ich8lan-retur.patch
-
   # https://nvd.nist.gov/vuln/detail/CVE-2017-8824
-  patch -Np1 -i ../0002-dccp-CVE-2017-8824-use-after-free-in-DCCP-code.patch
+  patch -Np1 -i ../0001-dccp-CVE-2017-8824-use-after-free-in-DCCP-code.patch
 
   # https://bugs.archlinux.org/task/56605
-  patch -Np1 -i ../0003-xfrm-Fix-stack-out-of-bounds-read-on-socket-policy-l.patch
-
-  # https://bugs.archlinux.org/task/56846
-  patch -Np1 -i ../0004-cgroup-fix-css_task_iter-crash-on-CSS_TASK_ITER_PROC.patch
+  patch -Np1 -i ../0002-xfrm-Fix-stack-out-of-bounds-read-on-socket-policy-l.patch
 
   # https://bugs.archlinux.org/task/56711
-  patch -Np1 -i ../0005-drm-i915-edp-Only-use-the-alternate-fixed-mode-if-it.patch
+  patch -Np1 -i ../0003-drm-i915-edp-Only-use-the-alternate-fixed-mode-if-it.patch
 
   # maintain the TTY over USB disconnects
   # http://www.coreboot.org/EHCI_Gadget_Debug
diff --git a/libre/linux-libre-hardened/config.armv7h b/libre/linux-libre-hardened/config.armv7h
index 9f02c29fa..7bc342696 100644
--- a/libre/linux-libre-hardened/config.armv7h
+++ b/libre/linux-libre-hardened/config.armv7h
@@ -1,6 +1,6 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/arm 4.14.12-gnu-1-hardened Kernel Configuration
+# Linux/arm 4.14.15-gnu-1-hardened Kernel Configuration
 #
 CONFIG_ARM=y
 CONFIG_ARM_HAS_SG_CHAIN=y
@@ -1914,6 +1914,7 @@ CONFIG_DEV_COREDUMP=y
 # CONFIG_SYS_HYPERVISOR is not set
 # CONFIG_GENERIC_CPU_DEVICES is not set
 CONFIG_GENERIC_CPU_AUTOPROBE=y
+CONFIG_GENERIC_CPU_VULNERABILITIES=y
 CONFIG_SOC_BUS=y
 CONFIG_REGMAP=y
 CONFIG_REGMAP_AC97=m
@@ -6930,6 +6931,7 @@ CONFIG_TYPEC_TCPM=m
 CONFIG_TYPEC_TCPCI=m
 CONFIG_TYPEC_FUSB302=m
 # CONFIG_GOLDFISH is not set
+CONFIG_RETPOLINE=y
 CONFIG_CHROME_PLATFORMS=y
 CONFIG_CROS_EC_CHARDEV=y
 CONFIG_CROS_EC_PROTO=y
diff --git a/libre/linux-libre-hardened/config.i686 b/libre/linux-libre-hardened/config.i686
index f7f1af945..4ee73cb7e 100644
--- a/libre/linux-libre-hardened/config.i686
+++ b/libre/linux-libre-hardened/config.i686
@@ -1,6 +1,6 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/x86 4.14.12-gnu-1-hardened Kernel Configuration
+# Linux/x86 4.14.15-gnu-1-hardened Kernel Configuration
 #
 # CONFIG_64BIT is not set
 CONFIG_X86_32=y
@@ -435,6 +435,7 @@ CONFIG_X86_FAST_FEATURE_TESTS=y
 CONFIG_X86_MPPARSE=y
 # CONFIG_X86_BIGSMP is not set
 # CONFIG_GOLDFISH is not set
+CONFIG_RETPOLINE=y
 CONFIG_INTEL_RDT=y
 # CONFIG_X86_EXTENDED_PLATFORM is not set
 CONFIG_X86_INTEL_LPSS=y
@@ -1734,6 +1735,7 @@ CONFIG_DEV_COREDUMP=y
 # CONFIG_SYS_HYPERVISOR is not set
 # CONFIG_GENERIC_CPU_DEVICES is not set
 CONFIG_GENERIC_CPU_AUTOPROBE=y
+CONFIG_GENERIC_CPU_VULNERABILITIES=y
 CONFIG_REGMAP=y
 CONFIG_REGMAP_I2C=y
 CONFIG_REGMAP_SPMI=m
diff --git a/libre/linux-libre-hardened/config.x86_64 b/libre/linux-libre-hardened/config.x86_64
index 4e708dcfc..83d43c952 100644
--- a/libre/linux-libre-hardened/config.x86_64
+++ b/libre/linux-libre-hardened/config.x86_64
@@ -1,6 +1,6 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/x86 4.14.12-gnu-1-hardened Kernel Configuration
+# Linux/x86 4.14.15-gnu-1-hardened Kernel Configuration
 #
 CONFIG_64BIT=y
 CONFIG_X86_64=y
@@ -456,6 +456,7 @@ CONFIG_X86_FAST_FEATURE_TESTS=y
 CONFIG_X86_X2APIC=y
 CONFIG_X86_MPPARSE=y
 # CONFIG_GOLDFISH is not set
+CONFIG_RETPOLINE=y
 CONFIG_INTEL_RDT=y
 # CONFIG_X86_EXTENDED_PLATFORM is not set
 CONFIG_X86_INTEL_LPSS=y
@@ -1849,6 +1850,7 @@ CONFIG_DEV_COREDUMP=y
 CONFIG_SYS_HYPERVISOR=y
 # CONFIG_GENERIC_CPU_DEVICES is not set
 CONFIG_GENERIC_CPU_AUTOPROBE=y
+CONFIG_GENERIC_CPU_VULNERABILITIES=y
 CONFIG_REGMAP=y
 CONFIG_REGMAP_I2C=y
 CONFIG_REGMAP_MMIO=y
diff --git a/libre/linux-libre-hardened/linux.install b/libre/linux-libre-hardened/linux.install
index d13105b4b..f1f033b4e 100644
--- a/libre/linux-libre-hardened/linux.install
+++ b/libre/linux-libre-hardened/linux.install
@@ -1,31 +1,12 @@
-post_install () {
-  # updating module dependencies
-  echo ">>> Updating module dependencies. Please wait ..."
-  depmod %KERNVER%
-  if [ "$(uname -m)" = "armv7l" ]; then
-    echo ">>> WARNING: Using this kernel requires an updated U-Boot!"
-  fi
-}
-
 post_upgrade() {
-  # updating module dependencies
-  echo ">>> Updating module dependencies. Please wait ..."
-  depmod %KERNVER%
   if [ "$(uname -m)" = "x86_64" ] || [ "$(uname -m)" = "i686" ]; then
     if findmnt --fstab -uno SOURCE /boot &>/dev/null && ! mountpoint -q /boot; then
       echo "WARNING: /boot appears to be a separate partition but is not mounted."
     fi
-
-    if [ $(vercmp $2 3.13) -lt 0 ]; then
-      echo ">>> WARNING: AT keyboard support is no longer built into the kernel."
-      echo ">>>          In order to use your keyboard during early init, you MUST"
-      echo ">>>          include the 'keyboard' hook in your mkinitcpio.conf."
-    fi
   fi
 }
 
 post_remove() {
-  # also remove the compat symlinks
   rm -f boot/initramfs-%PKGBASE%.img
   rm -f boot/initramfs-%PKGBASE%-fallback.img
 }