--- /dev/null
+From e1e84eb58eb494b77c8389fc6308b5042dcce791 Mon Sep 17 00:00:00 2001
+From: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+Date: Mon, 12 Oct 2020 10:50:14 -0400
+Subject: ipv4/icmp: l3mdev: Perform icmp error route lookup on source device routing table (v2)
+
+From: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+
+commit e1e84eb58eb494b77c8389fc6308b5042dcce791 upstream.
+
+As per RFC792, ICMP errors should be sent to the source host.
+
+However, in configurations with Virtual Routing and Forwarding tables,
+looking up which routing table to use is currently done by using the
+destination net_device.
+
+commit 9d1a6c4ea43e ("net: icmp_route_lookup should use rt dev to
+determine L3 domain") changes the interface passed to
+l3mdev_master_ifindex() and inet_addr_type_dev_table() from skb_in->dev
+to skb_dst(skb_in)->dev. This effectively uses the destination device
+rather than the source device for choosing which routing table should be
+used to lookup where to send the ICMP error.
+
+Therefore, if the source and destination interfaces are within separate
+VRFs, or one in the global routing table and the other in a VRF, looking
+up the source host in the destination interface's routing table will
+fail if the destination interface's routing table contains no route to
+the source host.
+
+One observable effect of this issue is that traceroute does not work in
+the following cases:
+
+- Route leaking between global routing table and VRF
+- Route leaking between VRFs
+
+Preferably use the source device routing table when sending ICMP error
+messages. If no source device is set, fall-back on the destination
+device routing table. Else, use the main routing table (index 0).
+
+[ It has been pointed out that a similar issue may exist with ICMP
+ errors triggered when forwarding between network namespaces. It would
+ be worthwhile to investigate, but is outside of the scope of this
+ investigation. ]
+
+[ It has also been pointed out that a similar issue exists with
+ unreachable / fragmentation needed messages, which can be triggered by
+ changing the MTU of eth1 in r1 to 1400 and running:
+
+ ip netns exec h1 ping -s 1450 -Mdo -c1 172.16.2.2
+
+ Some investigation points to raw_icmp_error() and raw_err() as being
+ involved in this last scenario. The focus of this patch is TTL expired
+ ICMP messages, which go through icmp_route_lookup.
+ Investigation of failure modes related to raw_icmp_error() is beyond
+ this investigation's scope. ]
+
+Fixes: 9d1a6c4ea43e ("net: icmp_route_lookup should use rt dev to determine L3 domain")
+Link: https://tools.ietf.org/html/rfc792
+Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+Reviewed-by: David Ahern <dsahern@gmail.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/icmp.c | 23 +++++++++++++++++++++--
+ 1 file changed, 21 insertions(+), 2 deletions(-)
+
+--- a/net/ipv4/icmp.c
++++ b/net/ipv4/icmp.c
+@@ -460,6 +460,23 @@ out_bh_enable:
+ local_bh_enable();
+ }
+
++/*
++ * The device used for looking up which routing table to use for sending an ICMP
++ * error is preferably the source whenever it is set, which should ensure the
++ * icmp error can be sent to the source host, else lookup using the routing
++ * table of the destination device, else use the main routing table (index 0).
++ */
++static struct net_device *icmp_get_route_lookup_dev(struct sk_buff *skb)
++{
++ struct net_device *route_lookup_dev = NULL;
++
++ if (skb->dev)
++ route_lookup_dev = skb->dev;
++ else if (skb_dst(skb))
++ route_lookup_dev = skb_dst(skb)->dev;
++ return route_lookup_dev;
++}
++
+ static struct rtable *icmp_route_lookup(struct net *net,
+ struct flowi4 *fl4,
+ struct sk_buff *skb_in,
+@@ -468,6 +485,7 @@ static struct rtable *icmp_route_lookup(
+ int type, int code,
+ struct icmp_bxm *param)
+ {
++ struct net_device *route_lookup_dev;
+ struct rtable *rt, *rt2;
+ struct flowi4 fl4_dec;
+ int err;
+@@ -482,7 +500,8 @@ static struct rtable *icmp_route_lookup(
+ fl4->flowi4_proto = IPPROTO_ICMP;
+ fl4->fl4_icmp_type = type;
+ fl4->fl4_icmp_code = code;
+- fl4->flowi4_oif = l3mdev_master_ifindex(skb_dst(skb_in)->dev);
++ route_lookup_dev = icmp_get_route_lookup_dev(skb_in);
++ fl4->flowi4_oif = l3mdev_master_ifindex(route_lookup_dev);
+
+ security_skb_classify_flow(skb_in, flowi4_to_flowi(fl4));
+ rt = ip_route_output_key_hash(net, fl4, skb_in);
+@@ -506,7 +525,7 @@ static struct rtable *icmp_route_lookup(
+ if (err)
+ goto relookup_failed;
+
+- if (inet_addr_type_dev_table(net, skb_dst(skb_in)->dev,
++ if (inet_addr_type_dev_table(net, route_lookup_dev,
+ fl4_dec.saddr) == RTN_LOCAL) {
+ rt2 = __ip_route_output_key(net, &fl4_dec);
+ if (IS_ERR(rt2))
--- /dev/null
+From 7ad69832f37e3cea8557db6df7c793905f1135e8 Mon Sep 17 00:00:00 2001
+From: Muchun Song <songmuchun@bytedance.com>
+Date: Mon, 14 Dec 2020 19:11:25 -0800
+Subject: mm/page_alloc: speed up the iteration of max_order
+
+From: Muchun Song <songmuchun@bytedance.com>
+
+commit 7ad69832f37e3cea8557db6df7c793905f1135e8 upstream.
+
+When we free a page whose order is very close to MAX_ORDER and greater
+than pageblock_order, it wastes some CPU cycles to increase max_order to
+MAX_ORDER one by one and check the pageblock migratetype of that page
+repeatedly especially when MAX_ORDER is much larger than pageblock_order.
+
+We also should not be checking migratetype of buddy when "order ==
+MAX_ORDER - 1" as the buddy pfn may be invalid, so adjust the condition.
+With the new check, we don't need the max_order check anymore, so we
+replace it.
+
+Also adjust max_order initialization so that it's lower by one than
+previously, which makes the code hopefully more clear.
+
+Link: https://lkml.kernel.org/r/20201204155109.55451-1-songmuchun@bytedance.com
+Fixes: d9dddbf55667 ("mm/page_alloc: prevent merging between isolated and other pageblocks")
+Signed-off-by: Muchun Song <songmuchun@bytedance.com>
+Acked-by: Vlastimil Babka <vbabka@suse.cz>
+Reviewed-by: Oscar Salvador <osalvador@suse.de>
+Reviewed-by: David Hildenbrand <david@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/page_alloc.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -906,7 +906,7 @@ static inline void __free_one_page(struc
+ unsigned int max_order;
+ struct capture_control *capc = task_capc(zone);
+
+- max_order = min_t(unsigned int, MAX_ORDER, pageblock_order + 1);
++ max_order = min_t(unsigned int, MAX_ORDER - 1, pageblock_order);
+
+ VM_BUG_ON(!zone_is_initialized(zone));
+ VM_BUG_ON_PAGE(page->flags & PAGE_FLAGS_CHECK_AT_PREP, page);
+@@ -919,7 +919,7 @@ static inline void __free_one_page(struc
+ VM_BUG_ON_PAGE(bad_range(zone, page), page);
+
+ continue_merging:
+- while (order < max_order - 1) {
++ while (order < max_order) {
+ if (compaction_capture(capc, page, order, migratetype)) {
+ __mod_zone_freepage_state(zone, -(1 << order),
+ migratetype);
+@@ -945,7 +945,7 @@ continue_merging:
+ pfn = combined_pfn;
+ order++;
+ }
+- if (max_order < MAX_ORDER) {
++ if (order < MAX_ORDER - 1) {
+ /* If we are here, it means order is >= pageblock_order.
+ * We want to prevent merge between freepages on isolate
+ * pageblock and normal pageblock. Without this, pageblock
+@@ -966,7 +966,7 @@ continue_merging:
+ is_migrate_isolate(buddy_mt)))
+ goto done_merging;
+ }
+- max_order++;
++ max_order = order + 1;
+ goto continue_merging;
+ }
+
--- /dev/null
+From ce03b94ba682a67e8233c9ee3066071656ded58f Mon Sep 17 00:00:00 2001
+From: Esben Haabendal <esben@geanix.com>
+Date: Mon, 21 Jun 2021 10:20:08 +0200
+Subject: net: ll_temac: Remove left-over debug message
+
+From: Esben Haabendal <esben@geanix.com>
+
+commit ce03b94ba682a67e8233c9ee3066071656ded58f upstream.
+
+Fixes: f63963411942 ("net: ll_temac: Avoid ndo_start_xmit returning NETDEV_TX_BUSY")
+Signed-off-by: Esben Haabendal <esben@geanix.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/xilinx/ll_temac_main.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/xilinx/ll_temac_main.c
++++ b/drivers/net/ethernet/xilinx/ll_temac_main.c
+@@ -939,10 +939,8 @@ temac_start_xmit(struct sk_buff *skb, st
+ wmb();
+ lp->dma_out(lp, TX_TAILDESC_PTR, tail_p); /* DMA start */
+
+- if (temac_check_tx_bd_space(lp, MAX_SKB_FRAGS + 1)) {
+- netdev_info(ndev, "%s -> netif_stop_queue\n", __func__);
++ if (temac_check_tx_bd_space(lp, MAX_SKB_FRAGS + 1))
+ netif_stop_queue(ndev);
+- }
+
+ return NETDEV_TX_OK;
+ }
--- /dev/null
+From 968339fad422a58312f67718691b717dac45c399 Mon Sep 17 00:00:00 2001
+From: Fangrui Song <maskray@google.com>
+Date: Wed, 25 Mar 2020 09:42:57 -0700
+Subject: powerpc/boot: Delete unneeded .globl _zimage_start
+
+From: Fangrui Song <maskray@google.com>
+
+commit 968339fad422a58312f67718691b717dac45c399 upstream.
+
+.globl sets the symbol binding to STB_GLOBAL while .weak sets the
+binding to STB_WEAK. GNU as let .weak override .globl since
+binutils-gdb 5ca547dc2399a0a5d9f20626d4bf5547c3ccfddd (1996). Clang
+integrated assembler let the last win but it may error in the future.
+
+Since it is a convention that only one binding directive is used, just
+delete .globl.
+
+Fixes: ee9d21b3b358 ("powerpc/boot: Ensure _zimage_start is a weak symbol")
+Signed-off-by: Fangrui Song <maskray@google.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20200325164257.170229-1-maskray@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/boot/crt0.S | 3 ---
+ 1 file changed, 3 deletions(-)
+
+--- a/arch/powerpc/boot/crt0.S
++++ b/arch/powerpc/boot/crt0.S
+@@ -44,9 +44,6 @@ p_end: .long _end
+ p_pstack: .long _platform_stack_top
+ #endif
+
+- .globl _zimage_start
+- /* Clang appears to require the .weak directive to be after the symbol
+- * is defined. See https://bugs.llvm.org/show_bug.cgi?id=38921 */
+ .weak _zimage_start
+ _zimage_start:
+ .globl _zimage_start_lib
arc-wireup-clone3-syscall.patch
media-stkwebcam-fix-memory-leak-in-stk_camera_probe.patch
igmp-add-ip_mc_list-lock-in-ip_check_mc_rcu.patch
+usb-serial-mos7720-improve-oom-handling-in-read_mos_reg.patch
+ipv4-icmp-l3mdev-perform-icmp-error-route-lookup-on-source-device-routing-table-v2.patch
+powerpc-boot-delete-unneeded-.globl-_zimage_start.patch
+net-ll_temac-remove-left-over-debug-message.patch
+mm-page_alloc-speed-up-the-iteration-of-max_order.patch
--- /dev/null
+From 161a582bd1d8681095f158d11bc679a58f1d026b Mon Sep 17 00:00:00 2001
+From: Tom Rix <trix@redhat.com>
+Date: Mon, 11 Jan 2021 14:09:04 -0800
+Subject: USB: serial: mos7720: improve OOM-handling in read_mos_reg()
+
+From: Tom Rix <trix@redhat.com>
+
+commit 161a582bd1d8681095f158d11bc679a58f1d026b upstream.
+
+clang static analysis reports this problem
+
+mos7720.c:352:2: warning: Undefined or garbage value returned to caller
+ return d;
+ ^~~~~~~~
+
+In the parport_mos7715_read_data()'s call to read_mos_reg(), 'd' is
+only set after the alloc block.
+
+ buf = kmalloc(1, GFP_KERNEL);
+ if (!buf)
+ return -ENOMEM;
+
+Although the problem is reported in parport_most7715_read_data(),
+none of the callee's of read_mos_reg() check the return status.
+
+Make sure to clear the return-value buffer also on allocation failures.
+
+Fixes: 0d130367abf5 ("USB: serial: mos7720: fix control-message error handling")
+Signed-off-by: Tom Rix <trix@redhat.com>
+Link: https://lore.kernel.org/r/20210111220904.1035957-1-trix@redhat.com
+[ johan: only clear the buffer on errors, amend commit message ]
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/mos7720.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/serial/mos7720.c
++++ b/drivers/usb/serial/mos7720.c
+@@ -226,8 +226,10 @@ static int read_mos_reg(struct usb_seria
+ int status;
+
+ buf = kmalloc(1, GFP_KERNEL);
+- if (!buf)
++ if (!buf) {
++ *data = 0;
+ return -ENOMEM;
++ }
+
+ status = usb_control_msg(usbdev, pipe, request, requesttype, value,
+ index, buf, 1, MOS_WDR_TIMEOUT);
projects / thirdparty / kernel / stable-queue.git / commitdiff
