From: Greg Kroah-Hartman Date: Wed, 2 Dec 2020 11:14:44 +0000 (+0100) Subject: 4.14-stable patches X-Git-Tag: v4.14.211~18 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=509be8756d18a90b7db13522fb1b3e43863cc0b9;p=thirdparty%2Fkernel%2Fstable-queue.git 4.14-stable patches added patches: bonding-wait-for-sysfs-kobject-destruction-before-freeing-struct-slave.patch ipv6-addrlabel-fix-possible-memory-leak-in-ip6addrlbl_net_init.patch net-af_iucv-set-correct-sk_protocol-for-child-sockets.patch rose-fix-null-pointer-dereference-in-rose_send_frame.patch sock-set-sk_err-to-ee_errno-on-dequeue-from-errq.patch tcp-set-inet_ecn_xmit-configuration-in-tcp_reinit_congestion_control.patch tun-honor-iocb_nowait-flag.patch usbnet-ipheth-fix-connectivity-with-ios-14.patch --- diff --git a/queue-4.14/bonding-wait-for-sysfs-kobject-destruction-before-freeing-struct-slave.patch b/queue-4.14/bonding-wait-for-sysfs-kobject-destruction-before-freeing-struct-slave.patch new file mode 100644 index 00000000000..ce1a473150c --- /dev/null +++ b/queue-4.14/bonding-wait-for-sysfs-kobject-destruction-before-freeing-struct-slave.patch @@ -0,0 +1,271 @@ +From foo@baz Wed Dec 2 10:57:08 AM CET 2020 +From: Jamie Iles +Date: Fri, 20 Nov 2020 14:28:27 +0000 +Subject: bonding: wait for sysfs kobject destruction before freeing struct slave + +From: Jamie Iles + +[ Upstream commit b9ad3e9f5a7a760ab068e33e1f18d240ba32ce92 ] + +syzkaller found that with CONFIG_DEBUG_KOBJECT_RELEASE=y, releasing a +struct slave device could result in the following splat: + + kobject: 'bonding_slave' (00000000cecdd4fe): kobject_release, parent 0000000074ceb2b2 (delayed 1000) + bond0 (unregistering): (slave bond_slave_1): Releasing backup interface + ------------[ cut here ]------------ + ODEBUG: free active (active state 0) object type: timer_list hint: workqueue_select_cpu_near kernel/workqueue.c:1549 [inline] + ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x98 kernel/workqueue.c:1600 + WARNING: CPU: 1 PID: 842 at lib/debugobjects.c:485 debug_print_object+0x180/0x240 lib/debugobjects.c:485 + Kernel panic - not syncing: panic_on_warn set ... + CPU: 1 PID: 842 Comm: kworker/u4:4 Tainted: G S 5.9.0-rc8+ #96 + Hardware name: linux,dummy-virt (DT) + Workqueue: netns cleanup_net + Call trace: + dump_backtrace+0x0/0x4d8 include/linux/bitmap.h:239 + show_stack+0x34/0x48 arch/arm64/kernel/traps.c:142 + __dump_stack lib/dump_stack.c:77 [inline] + dump_stack+0x174/0x1f8 lib/dump_stack.c:118 + panic+0x360/0x7a0 kernel/panic.c:231 + __warn+0x244/0x2ec kernel/panic.c:600 + report_bug+0x240/0x398 lib/bug.c:198 + bug_handler+0x50/0xc0 arch/arm64/kernel/traps.c:974 + call_break_hook+0x160/0x1d8 arch/arm64/kernel/debug-monitors.c:322 + brk_handler+0x30/0xc0 arch/arm64/kernel/debug-monitors.c:329 + do_debug_exception+0x184/0x340 arch/arm64/mm/fault.c:864 + el1_dbg+0x48/0xb0 arch/arm64/kernel/entry-common.c:65 + el1_sync_handler+0x170/0x1c8 arch/arm64/kernel/entry-common.c:93 + el1_sync+0x80/0x100 arch/arm64/kernel/entry.S:594 + debug_print_object+0x180/0x240 lib/debugobjects.c:485 + __debug_check_no_obj_freed lib/debugobjects.c:967 [inline] + debug_check_no_obj_freed+0x200/0x430 lib/debugobjects.c:998 + slab_free_hook mm/slub.c:1536 [inline] + slab_free_freelist_hook+0x190/0x210 mm/slub.c:1577 + slab_free mm/slub.c:3138 [inline] + kfree+0x13c/0x460 mm/slub.c:4119 + bond_free_slave+0x8c/0xf8 drivers/net/bonding/bond_main.c:1492 + __bond_release_one+0xe0c/0xec8 drivers/net/bonding/bond_main.c:2190 + bond_slave_netdev_event drivers/net/bonding/bond_main.c:3309 [inline] + bond_netdev_event+0x8f0/0xa70 drivers/net/bonding/bond_main.c:3420 + notifier_call_chain+0xf0/0x200 kernel/notifier.c:83 + __raw_notifier_call_chain kernel/notifier.c:361 [inline] + raw_notifier_call_chain+0x44/0x58 kernel/notifier.c:368 + call_netdevice_notifiers_info+0xbc/0x150 net/core/dev.c:2033 + call_netdevice_notifiers_extack net/core/dev.c:2045 [inline] + call_netdevice_notifiers net/core/dev.c:2059 [inline] + rollback_registered_many+0x6a4/0xec0 net/core/dev.c:9347 + unregister_netdevice_many.part.0+0x2c/0x1c0 net/core/dev.c:10509 + unregister_netdevice_many net/core/dev.c:10508 [inline] + default_device_exit_batch+0x294/0x338 net/core/dev.c:10992 + ops_exit_list.isra.0+0xec/0x150 net/core/net_namespace.c:189 + cleanup_net+0x44c/0x888 net/core/net_namespace.c:603 + process_one_work+0x96c/0x18c0 kernel/workqueue.c:2269 + worker_thread+0x3f0/0xc30 kernel/workqueue.c:2415 + kthread+0x390/0x498 kernel/kthread.c:292 + ret_from_fork+0x10/0x18 arch/arm64/kernel/entry.S:925 + +This is a potential use-after-free if the sysfs nodes are being accessed +whilst removing the struct slave, so wait for the object destruction to +complete before freeing the struct slave itself. + +Fixes: 07699f9a7c8d ("bonding: add sysfs /slave dir for bond slave devices.") +Fixes: a068aab42258 ("bonding: Fix reference count leak in bond_sysfs_slave_add.") +Cc: Qiushi Wu +Cc: Jay Vosburgh +Cc: Veaceslav Falico +Cc: Andy Gospodarek +Signed-off-by: Jamie Iles +Reviewed-by: Greg Kroah-Hartman +Link: https://lore.kernel.org/r/20201120142827.879226-1-jamie@nuviainc.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/bonding/bond_main.c | 61 +++++++++++++++++++++++---------- + drivers/net/bonding/bond_sysfs_slave.c | 18 --------- + include/net/bonding.h | 8 ++++ + 3 files changed, 52 insertions(+), 35 deletions(-) + +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -1253,7 +1253,39 @@ static void bond_upper_dev_unlink(struct + rtmsg_ifinfo(RTM_NEWLINK, slave->dev, IFF_SLAVE, GFP_KERNEL); + } + +-static struct slave *bond_alloc_slave(struct bonding *bond) ++static void slave_kobj_release(struct kobject *kobj) ++{ ++ struct slave *slave = to_slave(kobj); ++ struct bonding *bond = bond_get_bond_by_slave(slave); ++ ++ cancel_delayed_work_sync(&slave->notify_work); ++ if (BOND_MODE(bond) == BOND_MODE_8023AD) ++ kfree(SLAVE_AD_INFO(slave)); ++ ++ kfree(slave); ++} ++ ++static struct kobj_type slave_ktype = { ++ .release = slave_kobj_release, ++#ifdef CONFIG_SYSFS ++ .sysfs_ops = &slave_sysfs_ops, ++#endif ++}; ++ ++static int bond_kobj_init(struct slave *slave) ++{ ++ int err; ++ ++ err = kobject_init_and_add(&slave->kobj, &slave_ktype, ++ &(slave->dev->dev.kobj), "bonding_slave"); ++ if (err) ++ kobject_put(&slave->kobj); ++ ++ return err; ++} ++ ++static struct slave *bond_alloc_slave(struct bonding *bond, ++ struct net_device *slave_dev) + { + struct slave *slave = NULL; + +@@ -1261,11 +1293,17 @@ static struct slave *bond_alloc_slave(st + if (!slave) + return NULL; + ++ slave->bond = bond; ++ slave->dev = slave_dev; ++ ++ if (bond_kobj_init(slave)) ++ return NULL; ++ + if (BOND_MODE(bond) == BOND_MODE_8023AD) { + SLAVE_AD_INFO(slave) = kzalloc(sizeof(struct ad_slave_info), + GFP_KERNEL); + if (!SLAVE_AD_INFO(slave)) { +- kfree(slave); ++ kobject_put(&slave->kobj); + return NULL; + } + } +@@ -1274,17 +1312,6 @@ static struct slave *bond_alloc_slave(st + return slave; + } + +-static void bond_free_slave(struct slave *slave) +-{ +- struct bonding *bond = bond_get_bond_by_slave(slave); +- +- cancel_delayed_work_sync(&slave->notify_work); +- if (BOND_MODE(bond) == BOND_MODE_8023AD) +- kfree(SLAVE_AD_INFO(slave)); +- +- kfree(slave); +-} +- + static void bond_fill_ifbond(struct bonding *bond, struct ifbond *info) + { + info->bond_mode = BOND_MODE(bond); +@@ -1464,14 +1491,12 @@ int bond_enslave(struct net_device *bond + bond->dev->addr_assign_type == NET_ADDR_RANDOM) + bond_set_dev_addr(bond->dev, slave_dev); + +- new_slave = bond_alloc_slave(bond); ++ new_slave = bond_alloc_slave(bond, slave_dev); + if (!new_slave) { + res = -ENOMEM; + goto err_undo_flags; + } + +- new_slave->bond = bond; +- new_slave->dev = slave_dev; + /* Set the new_slave's queue_id to be zero. Queue ID mapping + * is set via sysfs or module option if desired. + */ +@@ -1802,7 +1827,7 @@ err_restore_mtu: + dev_set_mtu(slave_dev, new_slave->original_mtu); + + err_free: +- bond_free_slave(new_slave); ++ kobject_put(&new_slave->kobj); + + err_undo_flags: + /* Enslave of first slave has failed and we need to fix master's mac */ +@@ -1990,7 +2015,7 @@ static int __bond_release_one(struct net + if (!netif_is_bond_master(slave_dev)) + slave_dev->priv_flags &= ~IFF_BONDING; + +- bond_free_slave(slave); ++ kobject_put(&slave->kobj); + + return 0; + } +--- a/drivers/net/bonding/bond_sysfs_slave.c ++++ b/drivers/net/bonding/bond_sysfs_slave.c +@@ -125,7 +125,6 @@ static const struct slave_attribute *sla + }; + + #define to_slave_attr(_at) container_of(_at, struct slave_attribute, attr) +-#define to_slave(obj) container_of(obj, struct slave, kobj) + + static ssize_t slave_show(struct kobject *kobj, + struct attribute *attr, char *buf) +@@ -136,28 +135,15 @@ static ssize_t slave_show(struct kobject + return slave_attr->show(slave, buf); + } + +-static const struct sysfs_ops slave_sysfs_ops = { ++const struct sysfs_ops slave_sysfs_ops = { + .show = slave_show, + }; + +-static struct kobj_type slave_ktype = { +-#ifdef CONFIG_SYSFS +- .sysfs_ops = &slave_sysfs_ops, +-#endif +-}; +- + int bond_sysfs_slave_add(struct slave *slave) + { + const struct slave_attribute **a; + int err; + +- err = kobject_init_and_add(&slave->kobj, &slave_ktype, +- &(slave->dev->dev.kobj), "bonding_slave"); +- if (err) { +- kobject_put(&slave->kobj); +- return err; +- } +- + for (a = slave_attrs; *a; ++a) { + err = sysfs_create_file(&slave->kobj, &((*a)->attr)); + if (err) { +@@ -175,6 +161,4 @@ void bond_sysfs_slave_del(struct slave * + + for (a = slave_attrs; *a; ++a) + sysfs_remove_file(&slave->kobj, &((*a)->attr)); +- +- kobject_put(&slave->kobj); + } +--- a/include/net/bonding.h ++++ b/include/net/bonding.h +@@ -170,6 +170,11 @@ struct slave { + struct rtnl_link_stats64 slave_stats; + }; + ++static inline struct slave *to_slave(struct kobject *kobj) ++{ ++ return container_of(kobj, struct slave, kobj); ++} ++ + struct bond_up_slave { + unsigned int count; + struct rcu_head rcu; +@@ -716,6 +721,9 @@ extern struct bond_parm_tbl ad_select_tb + /* exported from bond_netlink.c */ + extern struct rtnl_link_ops bond_link_ops; + ++/* exported from bond_sysfs_slave.c */ ++extern const struct sysfs_ops slave_sysfs_ops; ++ + static inline void bond_tx_drop(struct net_device *dev, struct sk_buff *skb) + { + atomic_long_inc(&dev->tx_dropped); diff --git a/queue-4.14/ipv6-addrlabel-fix-possible-memory-leak-in-ip6addrlbl_net_init.patch b/queue-4.14/ipv6-addrlabel-fix-possible-memory-leak-in-ip6addrlbl_net_init.patch new file mode 100644 index 00000000000..088a23a106a --- /dev/null +++ b/queue-4.14/ipv6-addrlabel-fix-possible-memory-leak-in-ip6addrlbl_net_init.patch @@ -0,0 +1,82 @@ +From foo@baz Wed Dec 2 12:09:18 PM CET 2020 +From: Wang Hai +Date: Tue, 24 Nov 2020 15:17:28 +0800 +Subject: ipv6: addrlabel: fix possible memory leak in ip6addrlbl_net_init + +From: Wang Hai + +[ Upstream commit e255e11e66da8281e337e4e352956e8a4999fca4 ] + +kmemleak report a memory leak as follows: + +unreferenced object 0xffff8880059c6a00 (size 64): + comm "ip", pid 23696, jiffies 4296590183 (age 1755.384s) + hex dump (first 32 bytes): + 20 01 00 10 00 00 00 00 00 00 00 00 00 00 00 00 ............... + 1c 00 00 00 00 00 00 00 00 00 00 00 07 00 00 00 ................ + backtrace: + [<00000000aa4e7a87>] ip6addrlbl_add+0x90/0xbb0 + [<0000000070b8d7f1>] ip6addrlbl_net_init+0x109/0x170 + [<000000006a9ca9d4>] ops_init+0xa8/0x3c0 + [<000000002da57bf2>] setup_net+0x2de/0x7e0 + [<000000004e52d573>] copy_net_ns+0x27d/0x530 + [<00000000b07ae2b4>] create_new_namespaces+0x382/0xa30 + [<000000003b76d36f>] unshare_nsproxy_namespaces+0xa1/0x1d0 + [<0000000030653721>] ksys_unshare+0x3a4/0x780 + [<0000000007e82e40>] __x64_sys_unshare+0x2d/0x40 + [<0000000031a10c08>] do_syscall_64+0x33/0x40 + [<0000000099df30e7>] entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +We should free all rules when we catch an error in ip6addrlbl_net_init(). +otherwise a memory leak will occur. + +Fixes: 2a8cc6c89039 ("[IPV6] ADDRCONF: Support RFC3484 configurable address selection policy table.") +Reported-by: Hulk Robot +Signed-off-by: Wang Hai +Link: https://lore.kernel.org/r/20201124071728.8385-1-wanghai38@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/addrlabel.c | 26 +++++++++++++++++--------- + 1 file changed, 17 insertions(+), 9 deletions(-) + +--- a/net/ipv6/addrlabel.c ++++ b/net/ipv6/addrlabel.c +@@ -350,20 +350,28 @@ static int ip6addrlbl_del(struct net *ne + /* add default label */ + static int __net_init ip6addrlbl_net_init(struct net *net) + { +- int err = 0; ++ struct ip6addrlbl_entry *p = NULL; ++ struct hlist_node *n; ++ int err; + int i; + + ADDRLABEL(KERN_DEBUG "%s\n", __func__); + + for (i = 0; i < ARRAY_SIZE(ip6addrlbl_init_table); i++) { +- int ret = ip6addrlbl_add(net, +- ip6addrlbl_init_table[i].prefix, +- ip6addrlbl_init_table[i].prefixlen, +- 0, +- ip6addrlbl_init_table[i].label, 0); +- /* XXX: should we free all rules when we catch an error? */ +- if (ret && (!err || err != -ENOMEM)) +- err = ret; ++ err = ip6addrlbl_add(net, ++ ip6addrlbl_init_table[i].prefix, ++ ip6addrlbl_init_table[i].prefixlen, ++ 0, ++ ip6addrlbl_init_table[i].label, 0); ++ if (err) ++ goto err_ip6addrlbl_add; ++ } ++ return 0; ++ ++err_ip6addrlbl_add: ++ hlist_for_each_entry_safe(p, n, &net->ipv6.ip6addrlbl_table.head, list) { ++ hlist_del_rcu(&p->list); ++ kfree_rcu(p, rcu); + } + return err; + } diff --git a/queue-4.14/net-af_iucv-set-correct-sk_protocol-for-child-sockets.patch b/queue-4.14/net-af_iucv-set-correct-sk_protocol-for-child-sockets.patch new file mode 100644 index 00000000000..e24e3d41b8a --- /dev/null +++ b/queue-4.14/net-af_iucv-set-correct-sk_protocol-for-child-sockets.patch @@ -0,0 +1,45 @@ +From foo@baz Wed Dec 2 12:09:18 PM CET 2020 +From: Julian Wiedmann +Date: Fri, 20 Nov 2020 11:06:57 +0100 +Subject: net/af_iucv: set correct sk_protocol for child sockets + +From: Julian Wiedmann + +[ Upstream commit c5dab0941fcdc9664eb0ec0d4d51433216d91336 ] + +Child sockets erroneously inherit their parent's sk_type (ie. SOCK_*), +instead of the PF_IUCV protocol that the parent was created with in +iucv_sock_create(). + +We're currently not using sk->sk_protocol ourselves, so this shouldn't +have much impact (except eg. getting the output in skb_dump() right). + +Fixes: eac3731bd04c ("[S390]: Add AF_IUCV socket support") +Signed-off-by: Julian Wiedmann +Link: https://lore.kernel.org/r/20201120100657.34407-1-jwi@linux.ibm.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/iucv/af_iucv.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/iucv/af_iucv.c ++++ b/net/iucv/af_iucv.c +@@ -1763,7 +1763,7 @@ static int iucv_callback_connreq(struct + } + + /* Create the new socket */ +- nsk = iucv_sock_alloc(NULL, sk->sk_type, GFP_ATOMIC, 0); ++ nsk = iucv_sock_alloc(NULL, sk->sk_protocol, GFP_ATOMIC, 0); + if (!nsk) { + err = pr_iucv->path_sever(path, user_data); + iucv_path_free(path); +@@ -1973,7 +1973,7 @@ static int afiucv_hs_callback_syn(struct + goto out; + } + +- nsk = iucv_sock_alloc(NULL, sk->sk_type, GFP_ATOMIC, 0); ++ nsk = iucv_sock_alloc(NULL, sk->sk_protocol, GFP_ATOMIC, 0); + bh_lock_sock(sk); + if ((sk->sk_state != IUCV_LISTEN) || + sk_acceptq_is_full(sk) || diff --git a/queue-4.14/rose-fix-null-pointer-dereference-in-rose_send_frame.patch b/queue-4.14/rose-fix-null-pointer-dereference-in-rose_send_frame.patch new file mode 100644 index 00000000000..40b4390ac5f --- /dev/null +++ b/queue-4.14/rose-fix-null-pointer-dereference-in-rose_send_frame.patch @@ -0,0 +1,64 @@ +From foo@baz Wed Dec 2 12:09:18 PM CET 2020 +From: Anmol Karn +Date: Fri, 20 Nov 2020 00:40:43 +0530 +Subject: rose: Fix Null pointer dereference in rose_send_frame() + +From: Anmol Karn + +[ Upstream commit 3b3fd068c56e3fbea30090859216a368398e39bf ] + +rose_send_frame() dereferences `neigh->dev` when called from +rose_transmit_clear_request(), and the first occurrence of the +`neigh` is in rose_loopback_timer() as `rose_loopback_neigh`, +and it is initialized in rose_add_loopback_neigh() as NULL. +i.e when `rose_loopback_neigh` used in rose_loopback_timer() +its `->dev` was still NULL and rose_loopback_timer() was calling +rose_rx_call_request() without checking for NULL. + +- net/rose/rose_link.c +This bug seems to get triggered in this line: + +rose_call = (ax25_address *)neigh->dev->dev_addr; + +Fix it by adding NULL checking for `rose_loopback_neigh->dev` +in rose_loopback_timer(). + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Suggested-by: Jakub Kicinski +Reported-by: syzbot+a1c743815982d9496393@syzkaller.appspotmail.com +Tested-by: syzbot+a1c743815982d9496393@syzkaller.appspotmail.com +Link: https://syzkaller.appspot.com/bug?id=9d2a7ca8c7f2e4b682c97578dfa3f236258300b3 +Signed-off-by: Anmol Karn +Link: https://lore.kernel.org/r/20201119191043.28813-1-anmol.karan123@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/rose/rose_loopback.c | 17 +++++++++++++---- + 1 file changed, 13 insertions(+), 4 deletions(-) + +--- a/net/rose/rose_loopback.c ++++ b/net/rose/rose_loopback.c +@@ -99,10 +99,19 @@ static void rose_loopback_timer(struct t + } + + if (frametype == ROSE_CALL_REQUEST) { +- if ((dev = rose_dev_get(dest)) != NULL) { +- if (rose_rx_call_request(skb, dev, rose_loopback_neigh, lci_o) == 0) +- kfree_skb(skb); +- } else { ++ if (!rose_loopback_neigh->dev) { ++ kfree_skb(skb); ++ continue; ++ } ++ ++ dev = rose_dev_get(dest); ++ if (!dev) { ++ kfree_skb(skb); ++ continue; ++ } ++ ++ if (rose_rx_call_request(skb, dev, rose_loopback_neigh, lci_o) == 0) { ++ dev_put(dev); + kfree_skb(skb); + } + } else { diff --git a/queue-4.14/series b/queue-4.14/series new file mode 100644 index 00000000000..85409cd0efd --- /dev/null +++ b/queue-4.14/series @@ -0,0 +1,8 @@ +ipv6-addrlabel-fix-possible-memory-leak-in-ip6addrlbl_net_init.patch +net-af_iucv-set-correct-sk_protocol-for-child-sockets.patch +rose-fix-null-pointer-dereference-in-rose_send_frame.patch +sock-set-sk_err-to-ee_errno-on-dequeue-from-errq.patch +tcp-set-inet_ecn_xmit-configuration-in-tcp_reinit_congestion_control.patch +tun-honor-iocb_nowait-flag.patch +usbnet-ipheth-fix-connectivity-with-ios-14.patch +bonding-wait-for-sysfs-kobject-destruction-before-freeing-struct-slave.patch diff --git a/queue-4.14/sock-set-sk_err-to-ee_errno-on-dequeue-from-errq.patch b/queue-4.14/sock-set-sk_err-to-ee_errno-on-dequeue-from-errq.patch new file mode 100644 index 00000000000..ec313d1c33b --- /dev/null +++ b/queue-4.14/sock-set-sk_err-to-ee_errno-on-dequeue-from-errq.patch @@ -0,0 +1,47 @@ +From foo@baz Wed Dec 2 12:09:18 PM CET 2020 +From: Willem de Bruijn +Date: Thu, 26 Nov 2020 10:12:20 -0500 +Subject: sock: set sk_err to ee_errno on dequeue from errq + +From: Willem de Bruijn + +[ Upstream commit 985f7337421a811cb354ca93882f943c8335a6f5 ] + +When setting sk_err, set it to ee_errno, not ee_origin. + +Commit f5f99309fa74 ("sock: do not set sk_err in +sock_dequeue_err_skb") disabled updating sk_err on errq dequeue, +which is correct for most error types (origins): + + - sk->sk_err = err; + +Commit 38b257938ac6 ("sock: reset sk_err when the error queue is +empty") reenabled the behavior for IMCP origins, which do require it: + + + if (icmp_next) + + sk->sk_err = SKB_EXT_ERR(skb_next)->ee.ee_origin; + +But read from ee_errno. + +Fixes: 38b257938ac6 ("sock: reset sk_err when the error queue is empty") +Reported-by: Ayush Ranjan +Signed-off-by: Willem de Bruijn +Acked-by: Soheil Hassas Yeganeh +Link: https://lore.kernel.org/r/20201126151220.2819322-1-willemdebruijn.kernel@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/core/skbuff.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -4239,7 +4239,7 @@ struct sk_buff *sock_dequeue_err_skb(str + if (skb && (skb_next = skb_peek(q))) { + icmp_next = is_icmp_err_skb(skb_next); + if (icmp_next) +- sk->sk_err = SKB_EXT_ERR(skb_next)->ee.ee_origin; ++ sk->sk_err = SKB_EXT_ERR(skb_next)->ee.ee_errno; + } + spin_unlock_irqrestore(&q->lock, flags); + diff --git a/queue-4.14/tcp-set-inet_ecn_xmit-configuration-in-tcp_reinit_congestion_control.patch b/queue-4.14/tcp-set-inet_ecn_xmit-configuration-in-tcp_reinit_congestion_control.patch new file mode 100644 index 00000000000..4969682addc --- /dev/null +++ b/queue-4.14/tcp-set-inet_ecn_xmit-configuration-in-tcp_reinit_congestion_control.patch @@ -0,0 +1,49 @@ +From foo@baz Wed Dec 2 12:09:18 PM CET 2020 +From: Alexander Duyck +Date: Thu, 19 Nov 2020 13:23:58 -0800 +Subject: tcp: Set INET_ECN_xmit configuration in tcp_reinit_congestion_control + +From: Alexander Duyck + +[ Upstream commit 55472017a4219ca965a957584affdb17549ae4a4 ] + +When setting congestion control via a BPF program it is seen that the +SYN/ACK for packets within a given flow will not include the ECT0 flag. A +bit of simple printk debugging shows that when this is configured without +BPF we will see the value INET_ECN_xmit value initialized in +tcp_assign_congestion_control however when we configure this via BPF the +socket is in the closed state and as such it isn't configured, and I do not +see it being initialized when we transition the socket into the listen +state. The result of this is that the ECT0 bit is configured based on +whatever the default state is for the socket. + +Any easy way to reproduce this is to monitor the following with tcpdump: +tools/testing/selftests/bpf/test_progs -t bpf_tcp_ca + +Without this patch the SYN/ACK will follow whatever the default is. If dctcp +all SYN/ACK packets will have the ECT0 bit set, and if it is not then ECT0 +will be cleared on all SYN/ACK packets. With this patch applied the SYN/ACK +bit matches the value seen on the other packets in the given stream. + +Fixes: 91b5b21c7c16 ("bpf: Add support for changing congestion control") +Signed-off-by: Alexander Duyck +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/tcp_cong.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/net/ipv4/tcp_cong.c ++++ b/net/ipv4/tcp_cong.c +@@ -199,6 +199,11 @@ static void tcp_reinit_congestion_contro + icsk->icsk_ca_setsockopt = 1; + memset(icsk->icsk_ca_priv, 0, sizeof(icsk->icsk_ca_priv)); + ++ if (ca->flags & TCP_CONG_NEEDS_ECN) ++ INET_ECN_xmit(sk); ++ else ++ INET_ECN_dontxmit(sk); ++ + if (!((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) + tcp_init_congestion_control(sk); + } diff --git a/queue-4.14/tun-honor-iocb_nowait-flag.patch b/queue-4.14/tun-honor-iocb_nowait-flag.patch new file mode 100644 index 00000000000..b4324d09812 --- /dev/null +++ b/queue-4.14/tun-honor-iocb_nowait-flag.patch @@ -0,0 +1,59 @@ +From foo@baz Wed Dec 2 12:09:18 PM CET 2020 +From: Jens Axboe +Date: Fri, 20 Nov 2020 07:59:54 -0700 +Subject: tun: honor IOCB_NOWAIT flag + +From: Jens Axboe + +[ Upstream commit 5aac0390a63b8718237a61dd0d24a29201d1c94a ] + +tun only checks the file O_NONBLOCK flag, but it should also be checking +the iocb IOCB_NOWAIT flag. Any fops using ->read/write_iter() should check +both, otherwise it breaks users that correctly expect O_NONBLOCK semantics +if IOCB_NOWAIT is set. + +Signed-off-by: Jens Axboe +Link: https://lore.kernel.org/r/e9451860-96cc-c7c7-47b8-fe42cadd5f4c@kernel.dk +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/tun.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +--- a/drivers/net/tun.c ++++ b/drivers/net/tun.c +@@ -1601,12 +1601,15 @@ static ssize_t tun_chr_write_iter(struct + struct tun_struct *tun = tun_get(file); + struct tun_file *tfile = file->private_data; + ssize_t result; ++ int noblock = 0; + + if (!tun) + return -EBADFD; + +- result = tun_get_user(tun, tfile, NULL, from, +- file->f_flags & O_NONBLOCK, false); ++ if ((file->f_flags & O_NONBLOCK) || (iocb->ki_flags & IOCB_NOWAIT)) ++ noblock = 1; ++ ++ result = tun_get_user(tun, tfile, NULL, from, noblock, false); + + tun_put(tun); + return result; +@@ -1789,10 +1792,15 @@ static ssize_t tun_chr_read_iter(struct + struct tun_file *tfile = file->private_data; + struct tun_struct *tun = __tun_get(tfile); + ssize_t len = iov_iter_count(to), ret; ++ int noblock = 0; + + if (!tun) + return -EBADFD; +- ret = tun_do_read(tun, tfile, to, file->f_flags & O_NONBLOCK, NULL); ++ ++ if ((file->f_flags & O_NONBLOCK) || (iocb->ki_flags & IOCB_NOWAIT)) ++ noblock = 1; ++ ++ ret = tun_do_read(tun, tfile, to, noblock, NULL); + ret = min_t(ssize_t, ret, len); + if (ret > 0) + iocb->ki_pos = ret; diff --git a/queue-4.14/usbnet-ipheth-fix-connectivity-with-ios-14.patch b/queue-4.14/usbnet-ipheth-fix-connectivity-with-ios-14.patch new file mode 100644 index 00000000000..21e30ec9adf --- /dev/null +++ b/queue-4.14/usbnet-ipheth-fix-connectivity-with-ios-14.patch @@ -0,0 +1,49 @@ +From foo@baz Wed Dec 2 12:09:18 PM CET 2020 +From: Yves-Alexis Perez +Date: Thu, 19 Nov 2020 18:24:39 +0100 +Subject: usbnet: ipheth: fix connectivity with iOS 14 + +From: Yves-Alexis Perez + +[ Upstream commit f33d9e2b48a34e1558b67a473a1fc1d6e793f93c ] + +Starting with iOS 14 released in September 2020, connectivity using the +personal hotspot USB tethering function of iOS devices is broken. + +Communication between the host and the device (for example ICMP traffic +or DNS resolution using the DNS service running in the device itself) +works fine, but communication to endpoints further away doesn't work. + +Investigation on the matter shows that no UDP and ICMP traffic from the +tethered host is reaching the Internet at all. For TCP traffic there are +exchanges between tethered host and server but packets are modified in +transit leading to impossible communication. + +After some trials Matti Vuorela discovered that reducing the URB buffer +size by two bytes restored the previous behavior. While a better +solution might exist to fix the issue, since the protocol is not +publicly documented and considering the small size of the fix, let's do +that. + +Tested-by: Matti Vuorela +Signed-off-by: Yves-Alexis Perez +Link: https://lore.kernel.org/linux-usb/CAAn0qaXmysJ9vx3ZEMkViv_B19ju-_ExN8Yn_uSefxpjS6g4Lw@mail.gmail.com/ +Link: https://github.com/libimobiledevice/libimobiledevice/issues/1038 +Link: https://lore.kernel.org/r/20201119172439.94988-1-corsac@corsac.net +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/ipheth.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/usb/ipheth.c ++++ b/drivers/net/usb/ipheth.c +@@ -70,7 +70,7 @@ + #define IPHETH_USBINTF_SUBCLASS 253 + #define IPHETH_USBINTF_PROTO 1 + +-#define IPHETH_BUF_SIZE 1516 ++#define IPHETH_BUF_SIZE 1514 + #define IPHETH_IP_ALIGN 2 /* padding at front of URB */ + #define IPHETH_TX_TIMEOUT (5 * HZ) +