From: Greg Kroah-Hartman Date: Wed, 8 Sep 2021 12:39:03 +0000 (+0200) Subject: 5.4-stable patches X-Git-Tag: v5.4.145~25 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=7dd34eb5db7635863eda1c40a7e8aa14054b50e8;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: ipv4-icmp-l3mdev-perform-icmp-error-route-lookup-on-source-device-routing-table-v2.patch mm-page_alloc-speed-up-the-iteration-of-max_order.patch net-ll_temac-remove-left-over-debug-message.patch powerpc-boot-delete-unneeded-.globl-_zimage_start.patch usb-serial-mos7720-improve-oom-handling-in-read_mos_reg.patch --- diff --git a/queue-5.4/ipv4-icmp-l3mdev-perform-icmp-error-route-lookup-on-source-device-routing-table-v2.patch b/queue-5.4/ipv4-icmp-l3mdev-perform-icmp-error-route-lookup-on-source-device-routing-table-v2.patch new file mode 100644 index 00000000000..a1a4d273de6 --- /dev/null +++ b/queue-5.4/ipv4-icmp-l3mdev-perform-icmp-error-route-lookup-on-source-device-routing-table-v2.patch @@ -0,0 +1,118 @@ +From e1e84eb58eb494b77c8389fc6308b5042dcce791 Mon Sep 17 00:00:00 2001 +From: Mathieu Desnoyers +Date: Mon, 12 Oct 2020 10:50:14 -0400 +Subject: ipv4/icmp: l3mdev: Perform icmp error route lookup on source device routing table (v2) + +From: Mathieu Desnoyers + +commit e1e84eb58eb494b77c8389fc6308b5042dcce791 upstream. + +As per RFC792, ICMP errors should be sent to the source host. + +However, in configurations with Virtual Routing and Forwarding tables, +looking up which routing table to use is currently done by using the +destination net_device. + +commit 9d1a6c4ea43e ("net: icmp_route_lookup should use rt dev to +determine L3 domain") changes the interface passed to +l3mdev_master_ifindex() and inet_addr_type_dev_table() from skb_in->dev +to skb_dst(skb_in)->dev. This effectively uses the destination device +rather than the source device for choosing which routing table should be +used to lookup where to send the ICMP error. + +Therefore, if the source and destination interfaces are within separate +VRFs, or one in the global routing table and the other in a VRF, looking +up the source host in the destination interface's routing table will +fail if the destination interface's routing table contains no route to +the source host. + +One observable effect of this issue is that traceroute does not work in +the following cases: + +- Route leaking between global routing table and VRF +- Route leaking between VRFs + +Preferably use the source device routing table when sending ICMP error +messages. If no source device is set, fall-back on the destination +device routing table. Else, use the main routing table (index 0). + +[ It has been pointed out that a similar issue may exist with ICMP + errors triggered when forwarding between network namespaces. It would + be worthwhile to investigate, but is outside of the scope of this + investigation. ] + +[ It has also been pointed out that a similar issue exists with + unreachable / fragmentation needed messages, which can be triggered by + changing the MTU of eth1 in r1 to 1400 and running: + + ip netns exec h1 ping -s 1450 -Mdo -c1 172.16.2.2 + + Some investigation points to raw_icmp_error() and raw_err() as being + involved in this last scenario. The focus of this patch is TTL expired + ICMP messages, which go through icmp_route_lookup. + Investigation of failure modes related to raw_icmp_error() is beyond + this investigation's scope. ] + +Fixes: 9d1a6c4ea43e ("net: icmp_route_lookup should use rt dev to determine L3 domain") +Link: https://tools.ietf.org/html/rfc792 +Signed-off-by: Mathieu Desnoyers +Reviewed-by: David Ahern +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/icmp.c | 23 +++++++++++++++++++++-- + 1 file changed, 21 insertions(+), 2 deletions(-) + +--- a/net/ipv4/icmp.c ++++ b/net/ipv4/icmp.c +@@ -460,6 +460,23 @@ out_bh_enable: + local_bh_enable(); + } + ++/* ++ * The device used for looking up which routing table to use for sending an ICMP ++ * error is preferably the source whenever it is set, which should ensure the ++ * icmp error can be sent to the source host, else lookup using the routing ++ * table of the destination device, else use the main routing table (index 0). ++ */ ++static struct net_device *icmp_get_route_lookup_dev(struct sk_buff *skb) ++{ ++ struct net_device *route_lookup_dev = NULL; ++ ++ if (skb->dev) ++ route_lookup_dev = skb->dev; ++ else if (skb_dst(skb)) ++ route_lookup_dev = skb_dst(skb)->dev; ++ return route_lookup_dev; ++} ++ + static struct rtable *icmp_route_lookup(struct net *net, + struct flowi4 *fl4, + struct sk_buff *skb_in, +@@ -468,6 +485,7 @@ static struct rtable *icmp_route_lookup( + int type, int code, + struct icmp_bxm *param) + { ++ struct net_device *route_lookup_dev; + struct rtable *rt, *rt2; + struct flowi4 fl4_dec; + int err; +@@ -482,7 +500,8 @@ static struct rtable *icmp_route_lookup( + fl4->flowi4_proto = IPPROTO_ICMP; + fl4->fl4_icmp_type = type; + fl4->fl4_icmp_code = code; +- fl4->flowi4_oif = l3mdev_master_ifindex(skb_dst(skb_in)->dev); ++ route_lookup_dev = icmp_get_route_lookup_dev(skb_in); ++ fl4->flowi4_oif = l3mdev_master_ifindex(route_lookup_dev); + + security_skb_classify_flow(skb_in, flowi4_to_flowi(fl4)); + rt = ip_route_output_key_hash(net, fl4, skb_in); +@@ -506,7 +525,7 @@ static struct rtable *icmp_route_lookup( + if (err) + goto relookup_failed; + +- if (inet_addr_type_dev_table(net, skb_dst(skb_in)->dev, ++ if (inet_addr_type_dev_table(net, route_lookup_dev, + fl4_dec.saddr) == RTN_LOCAL) { + rt2 = __ip_route_output_key(net, &fl4_dec); + if (IS_ERR(rt2)) diff --git a/queue-5.4/mm-page_alloc-speed-up-the-iteration-of-max_order.patch b/queue-5.4/mm-page_alloc-speed-up-the-iteration-of-max_order.patch new file mode 100644 index 00000000000..1f89ec27edb --- /dev/null +++ b/queue-5.4/mm-page_alloc-speed-up-the-iteration-of-max_order.patch @@ -0,0 +1,73 @@ +From 7ad69832f37e3cea8557db6df7c793905f1135e8 Mon Sep 17 00:00:00 2001 +From: Muchun Song +Date: Mon, 14 Dec 2020 19:11:25 -0800 +Subject: mm/page_alloc: speed up the iteration of max_order + +From: Muchun Song + +commit 7ad69832f37e3cea8557db6df7c793905f1135e8 upstream. + +When we free a page whose order is very close to MAX_ORDER and greater +than pageblock_order, it wastes some CPU cycles to increase max_order to +MAX_ORDER one by one and check the pageblock migratetype of that page +repeatedly especially when MAX_ORDER is much larger than pageblock_order. + +We also should not be checking migratetype of buddy when "order == +MAX_ORDER - 1" as the buddy pfn may be invalid, so adjust the condition. +With the new check, we don't need the max_order check anymore, so we +replace it. + +Also adjust max_order initialization so that it's lower by one than +previously, which makes the code hopefully more clear. + +Link: https://lkml.kernel.org/r/20201204155109.55451-1-songmuchun@bytedance.com +Fixes: d9dddbf55667 ("mm/page_alloc: prevent merging between isolated and other pageblocks") +Signed-off-by: Muchun Song +Acked-by: Vlastimil Babka +Reviewed-by: Oscar Salvador +Reviewed-by: David Hildenbrand +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman +--- + mm/page_alloc.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -906,7 +906,7 @@ static inline void __free_one_page(struc + unsigned int max_order; + struct capture_control *capc = task_capc(zone); + +- max_order = min_t(unsigned int, MAX_ORDER, pageblock_order + 1); ++ max_order = min_t(unsigned int, MAX_ORDER - 1, pageblock_order); + + VM_BUG_ON(!zone_is_initialized(zone)); + VM_BUG_ON_PAGE(page->flags & PAGE_FLAGS_CHECK_AT_PREP, page); +@@ -919,7 +919,7 @@ static inline void __free_one_page(struc + VM_BUG_ON_PAGE(bad_range(zone, page), page); + + continue_merging: +- while (order < max_order - 1) { ++ while (order < max_order) { + if (compaction_capture(capc, page, order, migratetype)) { + __mod_zone_freepage_state(zone, -(1 << order), + migratetype); +@@ -945,7 +945,7 @@ continue_merging: + pfn = combined_pfn; + order++; + } +- if (max_order < MAX_ORDER) { ++ if (order < MAX_ORDER - 1) { + /* If we are here, it means order is >= pageblock_order. + * We want to prevent merge between freepages on isolate + * pageblock and normal pageblock. Without this, pageblock +@@ -966,7 +966,7 @@ continue_merging: + is_migrate_isolate(buddy_mt))) + goto done_merging; + } +- max_order++; ++ max_order = order + 1; + goto continue_merging; + } + diff --git a/queue-5.4/net-ll_temac-remove-left-over-debug-message.patch b/queue-5.4/net-ll_temac-remove-left-over-debug-message.patch new file mode 100644 index 00000000000..f8ff7f0d79c --- /dev/null +++ b/queue-5.4/net-ll_temac-remove-left-over-debug-message.patch @@ -0,0 +1,31 @@ +From ce03b94ba682a67e8233c9ee3066071656ded58f Mon Sep 17 00:00:00 2001 +From: Esben Haabendal +Date: Mon, 21 Jun 2021 10:20:08 +0200 +Subject: net: ll_temac: Remove left-over debug message + +From: Esben Haabendal + +commit ce03b94ba682a67e8233c9ee3066071656ded58f upstream. + +Fixes: f63963411942 ("net: ll_temac: Avoid ndo_start_xmit returning NETDEV_TX_BUSY") +Signed-off-by: Esben Haabendal +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/xilinx/ll_temac_main.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/drivers/net/ethernet/xilinx/ll_temac_main.c ++++ b/drivers/net/ethernet/xilinx/ll_temac_main.c +@@ -939,10 +939,8 @@ temac_start_xmit(struct sk_buff *skb, st + wmb(); + lp->dma_out(lp, TX_TAILDESC_PTR, tail_p); /* DMA start */ + +- if (temac_check_tx_bd_space(lp, MAX_SKB_FRAGS + 1)) { +- netdev_info(ndev, "%s -> netif_stop_queue\n", __func__); ++ if (temac_check_tx_bd_space(lp, MAX_SKB_FRAGS + 1)) + netif_stop_queue(ndev); +- } + + return NETDEV_TX_OK; + } diff --git a/queue-5.4/powerpc-boot-delete-unneeded-.globl-_zimage_start.patch b/queue-5.4/powerpc-boot-delete-unneeded-.globl-_zimage_start.patch new file mode 100644 index 00000000000..6d3274a6688 --- /dev/null +++ b/queue-5.4/powerpc-boot-delete-unneeded-.globl-_zimage_start.patch @@ -0,0 +1,38 @@ +From 968339fad422a58312f67718691b717dac45c399 Mon Sep 17 00:00:00 2001 +From: Fangrui Song +Date: Wed, 25 Mar 2020 09:42:57 -0700 +Subject: powerpc/boot: Delete unneeded .globl _zimage_start + +From: Fangrui Song + +commit 968339fad422a58312f67718691b717dac45c399 upstream. + +.globl sets the symbol binding to STB_GLOBAL while .weak sets the +binding to STB_WEAK. GNU as let .weak override .globl since +binutils-gdb 5ca547dc2399a0a5d9f20626d4bf5547c3ccfddd (1996). Clang +integrated assembler let the last win but it may error in the future. + +Since it is a convention that only one binding directive is used, just +delete .globl. + +Fixes: ee9d21b3b358 ("powerpc/boot: Ensure _zimage_start is a weak symbol") +Signed-off-by: Fangrui Song +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20200325164257.170229-1-maskray@google.com +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/boot/crt0.S | 3 --- + 1 file changed, 3 deletions(-) + +--- a/arch/powerpc/boot/crt0.S ++++ b/arch/powerpc/boot/crt0.S +@@ -44,9 +44,6 @@ p_end: .long _end + p_pstack: .long _platform_stack_top + #endif + +- .globl _zimage_start +- /* Clang appears to require the .weak directive to be after the symbol +- * is defined. See https://bugs.llvm.org/show_bug.cgi?id=38921 */ + .weak _zimage_start + _zimage_start: + .globl _zimage_start_lib diff --git a/queue-5.4/series b/queue-5.4/series index 0931359ab58..d504f831572 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -20,3 +20,8 @@ alsa-pcm-fix-divide-error-in-snd_pcm_lib_ioctl.patch arc-wireup-clone3-syscall.patch media-stkwebcam-fix-memory-leak-in-stk_camera_probe.patch igmp-add-ip_mc_list-lock-in-ip_check_mc_rcu.patch +usb-serial-mos7720-improve-oom-handling-in-read_mos_reg.patch +ipv4-icmp-l3mdev-perform-icmp-error-route-lookup-on-source-device-routing-table-v2.patch +powerpc-boot-delete-unneeded-.globl-_zimage_start.patch +net-ll_temac-remove-left-over-debug-message.patch +mm-page_alloc-speed-up-the-iteration-of-max_order.patch diff --git a/queue-5.4/usb-serial-mos7720-improve-oom-handling-in-read_mos_reg.patch b/queue-5.4/usb-serial-mos7720-improve-oom-handling-in-read_mos_reg.patch new file mode 100644 index 00000000000..68f10782614 --- /dev/null +++ b/queue-5.4/usb-serial-mos7720-improve-oom-handling-in-read_mos_reg.patch @@ -0,0 +1,51 @@ +From 161a582bd1d8681095f158d11bc679a58f1d026b Mon Sep 17 00:00:00 2001 +From: Tom Rix +Date: Mon, 11 Jan 2021 14:09:04 -0800 +Subject: USB: serial: mos7720: improve OOM-handling in read_mos_reg() + +From: Tom Rix + +commit 161a582bd1d8681095f158d11bc679a58f1d026b upstream. + +clang static analysis reports this problem + +mos7720.c:352:2: warning: Undefined or garbage value returned to caller + return d; + ^~~~~~~~ + +In the parport_mos7715_read_data()'s call to read_mos_reg(), 'd' is +only set after the alloc block. + + buf = kmalloc(1, GFP_KERNEL); + if (!buf) + return -ENOMEM; + +Although the problem is reported in parport_most7715_read_data(), +none of the callee's of read_mos_reg() check the return status. + +Make sure to clear the return-value buffer also on allocation failures. + +Fixes: 0d130367abf5 ("USB: serial: mos7720: fix control-message error handling") +Signed-off-by: Tom Rix +Link: https://lore.kernel.org/r/20210111220904.1035957-1-trix@redhat.com +[ johan: only clear the buffer on errors, amend commit message ] +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/mos7720.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/usb/serial/mos7720.c ++++ b/drivers/usb/serial/mos7720.c +@@ -226,8 +226,10 @@ static int read_mos_reg(struct usb_seria + int status; + + buf = kmalloc(1, GFP_KERNEL); +- if (!buf) ++ if (!buf) { ++ *data = 0; + return -ENOMEM; ++ } + + status = usb_control_msg(usbdev, pipe, request, requesttype, value, + index, buf, 1, MOS_WDR_TIMEOUT);