--- /dev/null
+From e1e84eb58eb494b77c8389fc6308b5042dcce791 Mon Sep 17 00:00:00 2001
+From: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+Date: Mon, 12 Oct 2020 10:50:14 -0400
+Subject: ipv4/icmp: l3mdev: Perform icmp error route lookup on source device routing table (v2)
+
+From: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+
+commit e1e84eb58eb494b77c8389fc6308b5042dcce791 upstream.
+
+As per RFC792, ICMP errors should be sent to the source host.
+
+However, in configurations with Virtual Routing and Forwarding tables,
+looking up which routing table to use is currently done by using the
+destination net_device.
+
+commit 9d1a6c4ea43e ("net: icmp_route_lookup should use rt dev to
+determine L3 domain") changes the interface passed to
+l3mdev_master_ifindex() and inet_addr_type_dev_table() from skb_in->dev
+to skb_dst(skb_in)->dev. This effectively uses the destination device
+rather than the source device for choosing which routing table should be
+used to lookup where to send the ICMP error.
+
+Therefore, if the source and destination interfaces are within separate
+VRFs, or one in the global routing table and the other in a VRF, looking
+up the source host in the destination interface's routing table will
+fail if the destination interface's routing table contains no route to
+the source host.
+
+One observable effect of this issue is that traceroute does not work in
+the following cases:
+
+- Route leaking between global routing table and VRF
+- Route leaking between VRFs
+
+Preferably use the source device routing table when sending ICMP error
+messages. If no source device is set, fall-back on the destination
+device routing table. Else, use the main routing table (index 0).
+
+[ It has been pointed out that a similar issue may exist with ICMP
+ errors triggered when forwarding between network namespaces. It would
+ be worthwhile to investigate, but is outside of the scope of this
+ investigation. ]
+
+[ It has also been pointed out that a similar issue exists with
+ unreachable / fragmentation needed messages, which can be triggered by
+ changing the MTU of eth1 in r1 to 1400 and running:
+
+ ip netns exec h1 ping -s 1450 -Mdo -c1 172.16.2.2
+
+ Some investigation points to raw_icmp_error() and raw_err() as being
+ involved in this last scenario. The focus of this patch is TTL expired
+ ICMP messages, which go through icmp_route_lookup.
+ Investigation of failure modes related to raw_icmp_error() is beyond
+ this investigation's scope. ]
+
+Fixes: 9d1a6c4ea43e ("net: icmp_route_lookup should use rt dev to determine L3 domain")
+Link: https://tools.ietf.org/html/rfc792
+Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+Reviewed-by: David Ahern <dsahern@gmail.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/icmp.c | 23 +++++++++++++++++++++--
+ 1 file changed, 21 insertions(+), 2 deletions(-)
+
+--- a/net/ipv4/icmp.c
++++ b/net/ipv4/icmp.c
+@@ -460,6 +460,23 @@ static int icmp_multipath_hash_skb(const
+
+ #endif
+
++/*
++ * The device used for looking up which routing table to use for sending an ICMP
++ * error is preferably the source whenever it is set, which should ensure the
++ * icmp error can be sent to the source host, else lookup using the routing
++ * table of the destination device, else use the main routing table (index 0).
++ */
++static struct net_device *icmp_get_route_lookup_dev(struct sk_buff *skb)
++{
++ struct net_device *route_lookup_dev = NULL;
++
++ if (skb->dev)
++ route_lookup_dev = skb->dev;
++ else if (skb_dst(skb))
++ route_lookup_dev = skb_dst(skb)->dev;
++ return route_lookup_dev;
++}
++
+ static struct rtable *icmp_route_lookup(struct net *net,
+ struct flowi4 *fl4,
+ struct sk_buff *skb_in,
+@@ -468,6 +485,7 @@ static struct rtable *icmp_route_lookup(
+ int type, int code,
+ struct icmp_bxm *param)
+ {
++ struct net_device *route_lookup_dev;
+ struct rtable *rt, *rt2;
+ struct flowi4 fl4_dec;
+ int err;
+@@ -481,7 +499,8 @@ static struct rtable *icmp_route_lookup(
+ fl4->flowi4_proto = IPPROTO_ICMP;
+ fl4->fl4_icmp_type = type;
+ fl4->fl4_icmp_code = code;
+- fl4->flowi4_oif = l3mdev_master_ifindex(skb_dst(skb_in)->dev);
++ route_lookup_dev = icmp_get_route_lookup_dev(skb_in);
++ fl4->flowi4_oif = l3mdev_master_ifindex(route_lookup_dev);
+
+ security_skb_classify_flow(skb_in, flowi4_to_flowi(fl4));
+ rt = __ip_route_output_key_hash(net, fl4,
+@@ -506,7 +525,7 @@ static struct rtable *icmp_route_lookup(
+ if (err)
+ goto relookup_failed;
+
+- if (inet_addr_type_dev_table(net, skb_dst(skb_in)->dev,
++ if (inet_addr_type_dev_table(net, route_lookup_dev,
+ fl4_dec.saddr) == RTN_LOCAL) {
+ rt2 = __ip_route_output_key(net, &fl4_dec);
+ if (IS_ERR(rt2))
--- /dev/null
+From c84345597558349474f55be2b7d4093256e42884 Mon Sep 17 00:00:00 2001
+From: Grygorii Strashko <grygorii.strashko@ti.com>
+Date: Fri, 10 Feb 2017 14:25:00 -0800
+Subject: PM / wakeirq: Enable dedicated wakeirq for suspend
+
+From: Grygorii Strashko <grygorii.strashko@ti.com>
+
+commit c84345597558349474f55be2b7d4093256e42884 upstream.
+
+We currently rely on runtime PM to enable dedicated wakeirq for suspend.
+This assumption fails in the following two cases:
+
+1. If the consumer driver does not have runtime PM implemented, the
+ dedicated wakeirq never gets enabled for suspend
+
+2. If the consumer driver has runtime PM implemented, but does not idle
+ in suspend
+
+Let's fix the issue by always enabling the dedicated wakeirq during
+suspend.
+
+Depends-on: bed570307ed7 (PM / wakeirq: Fix dedicated wakeirq for drivers not using autosuspend)
+Fixes: 4990d4fe327b (PM / Wakeirq: Add automated device wake IRQ handling)
+Reported-by: Keerthy <j-keerthy@ti.com>
+Tested-by: Keerthy <j-keerthy@ti.com>
+Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
+[ tony@atomide.com: updated based on bed570307ed7, added description ]
+Tested-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/base/power/wakeirq.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+--- a/drivers/base/power/wakeirq.c
++++ b/drivers/base/power/wakeirq.c
+@@ -319,8 +319,12 @@ void dev_pm_arm_wake_irq(struct wake_irq
+ if (!wirq)
+ return;
+
+- if (device_may_wakeup(wirq->dev))
++ if (device_may_wakeup(wirq->dev)) {
++ if (wirq->status & WAKE_IRQ_DEDICATED_ALLOCATED)
++ enable_irq(wirq->irq);
++
+ enable_irq_wake(wirq->irq);
++ }
+ }
+
+ /**
+@@ -335,6 +339,10 @@ void dev_pm_disarm_wake_irq(struct wake_
+ if (!wirq)
+ return;
+
+- if (device_may_wakeup(wirq->dev))
++ if (device_may_wakeup(wirq->dev)) {
+ disable_irq_wake(wirq->irq);
++
++ if (wirq->status & WAKE_IRQ_DEDICATED_ALLOCATED)
++ disable_irq_nosync(wirq->irq);
++ }
+ }
ath9k-postpone-key-cache-entry-deletion-for-txq-frames-reference-it.patch
media-stkwebcam-fix-memory-leak-in-stk_camera_probe.patch
igmp-add-ip_mc_list-lock-in-ip_check_mc_rcu.patch
+usb-phy-isp1301-fix-build-warning-when-config_of-is-disabled.patch
+usb-serial-mos7720-improve-oom-handling-in-read_mos_reg.patch
+pm-wakeirq-enable-dedicated-wakeirq-for-suspend.patch
+tc358743-fix-register-i2c_rd-wr-function-fix.patch
+ipv4-icmp-l3mdev-perform-icmp-error-route-lookup-on-source-device-routing-table-v2.patch
--- /dev/null
+From 4b0755e90ae03ba40174842af6fa810355960fbc Mon Sep 17 00:00:00 2001
+From: Philipp Zabel <p.zabel@pengutronix.de>
+Date: Thu, 4 May 2017 12:20:17 -0300
+Subject: [media] tc358743: fix register i2c_rd/wr function fix
+
+From: Philipp Zabel <p.zabel@pengutronix.de>
+
+commit 4b0755e90ae03ba40174842af6fa810355960fbc upstream.
+
+The below mentioned fix contains a small but severe bug,
+fix it to make the driver work again.
+
+Fixes: 3538aa6ecfb2 ("[media] tc358743: fix register i2c_rd/wr functions")
+
+Cc: Hans Verkuil <hans.verkuil@cisco.com>
+Cc: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Acked-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Hans Verkuil <hansverk@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/i2c/tc358743.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/i2c/tc358743.c
++++ b/drivers/media/i2c/tc358743.c
+@@ -241,7 +241,7 @@ static void i2c_wr16(struct v4l2_subdev
+
+ static void i2c_wr16_and_or(struct v4l2_subdev *sd, u16 reg, u16 mask, u16 val)
+ {
+- i2c_wrreg(sd, reg, (i2c_rdreg(sd, reg, 2) & mask) | val, 2);
++ i2c_wrreg(sd, reg, (i2c_rdreg(sd, reg, 1) & mask) | val, 1);
+ }
+
+ static u32 i2c_rd32(struct v4l2_subdev *sd, u16 reg)
--- /dev/null
+From a7f12a21f6b32bdd8d76d3af81eef9e72ce41ec0 Mon Sep 17 00:00:00 2001
+From: Javier Martinez Canillas <javier@osg.samsung.com>
+Date: Tue, 28 Mar 2017 15:07:38 -0400
+Subject: usb: phy: isp1301: Fix build warning when CONFIG_OF is disabled
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Javier Martinez Canillas <javier@osg.samsung.com>
+
+commit a7f12a21f6b32bdd8d76d3af81eef9e72ce41ec0 upstream.
+
+Commit fd567653bdb9 ("usb: phy: isp1301: Add OF device ID table")
+added an OF device ID table, but used the of_match_ptr() macro
+that will lead to a build warning if CONFIG_OF symbol is disabled:
+
+drivers/usb/phy//phy-isp1301.c:36:34: warning: ‘isp1301_of_match’ defined but not used [-Wunused-const-variable=]
+ static const struct of_device_id isp1301_of_match[] = {
+ ^~~~~~~~~~~~~~~~
+
+Fixes: fd567653bdb9 ("usb: phy: isp1301: Add OF device ID table")
+Reported-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Javier Martinez Canillas <javier@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/phy/phy-isp1301.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/phy/phy-isp1301.c
++++ b/drivers/usb/phy/phy-isp1301.c
+@@ -136,7 +136,7 @@ static int isp1301_remove(struct i2c_cli
+ static struct i2c_driver isp1301_driver = {
+ .driver = {
+ .name = DRV_NAME,
+- .of_match_table = of_match_ptr(isp1301_of_match),
++ .of_match_table = isp1301_of_match,
+ },
+ .probe = isp1301_probe,
+ .remove = isp1301_remove,
--- /dev/null
+From 161a582bd1d8681095f158d11bc679a58f1d026b Mon Sep 17 00:00:00 2001
+From: Tom Rix <trix@redhat.com>
+Date: Mon, 11 Jan 2021 14:09:04 -0800
+Subject: USB: serial: mos7720: improve OOM-handling in read_mos_reg()
+
+From: Tom Rix <trix@redhat.com>
+
+commit 161a582bd1d8681095f158d11bc679a58f1d026b upstream.
+
+clang static analysis reports this problem
+
+mos7720.c:352:2: warning: Undefined or garbage value returned to caller
+ return d;
+ ^~~~~~~~
+
+In the parport_mos7715_read_data()'s call to read_mos_reg(), 'd' is
+only set after the alloc block.
+
+ buf = kmalloc(1, GFP_KERNEL);
+ if (!buf)
+ return -ENOMEM;
+
+Although the problem is reported in parport_most7715_read_data(),
+none of the callee's of read_mos_reg() check the return status.
+
+Make sure to clear the return-value buffer also on allocation failures.
+
+Fixes: 0d130367abf5 ("USB: serial: mos7720: fix control-message error handling")
+Signed-off-by: Tom Rix <trix@redhat.com>
+Link: https://lore.kernel.org/r/20210111220904.1035957-1-trix@redhat.com
+[ johan: only clear the buffer on errors, amend commit message ]
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/mos7720.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/serial/mos7720.c
++++ b/drivers/usb/serial/mos7720.c
+@@ -229,8 +229,10 @@ static int read_mos_reg(struct usb_seria
+ int status;
+
+ buf = kmalloc(1, GFP_KERNEL);
+- if (!buf)
++ if (!buf) {
++ *data = 0;
+ return -ENOMEM;
++ }
+
+ status = usb_control_msg(usbdev, pipe, request, requesttype, value,
+ index, buf, 1, MOS_WDR_TIMEOUT);
projects / thirdparty / kernel / stable-queue.git / commitdiff
