From: Greg Kroah-Hartman Date: Wed, 2 Dec 2020 10:05:49 +0000 (+0100) Subject: 5.4-stable patches X-Git-Tag: v4.14.211~20 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=6a65593d28f2685c9556ec5f4aab8350ffb2e0eb;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: bonding-wait-for-sysfs-kobject-destruction-before-freeing-struct-slave.patch devlink-hold-rtnl-lock-while-reading-netdev-attributes.patch ipv6-addrlabel-fix-possible-memory-leak-in-ip6addrlbl_net_init.patch net-af_iucv-set-correct-sk_protocol-for-child-sockets.patch net-tls-missing-received-data-after-fast-remote-close.patch net-tls-protect-from-calling-tls_dev_del-for-tls-rx-twice.patch rose-fix-null-pointer-dereference-in-rose_send_frame.patch sock-set-sk_err-to-ee_errno-on-dequeue-from-errq.patch staging-octeon-fix-up-merge-error.patch tcp-set-inet_ecn_xmit-configuration-in-tcp_reinit_congestion_control.patch tun-honor-iocb_nowait-flag.patch usbnet-ipheth-fix-connectivity-with-ios-14.patch --- diff --git a/queue-5.4/bonding-wait-for-sysfs-kobject-destruction-before-freeing-struct-slave.patch b/queue-5.4/bonding-wait-for-sysfs-kobject-destruction-before-freeing-struct-slave.patch new file mode 100644 index 00000000000..a4499916bbb --- /dev/null +++ b/queue-5.4/bonding-wait-for-sysfs-kobject-destruction-before-freeing-struct-slave.patch @@ -0,0 +1,271 @@ +From foo@baz Wed Dec 2 10:57:08 AM CET 2020 +From: Jamie Iles +Date: Fri, 20 Nov 2020 14:28:27 +0000 +Subject: bonding: wait for sysfs kobject destruction before freeing struct slave + +From: Jamie Iles + +[ Upstream commit b9ad3e9f5a7a760ab068e33e1f18d240ba32ce92 ] + +syzkaller found that with CONFIG_DEBUG_KOBJECT_RELEASE=y, releasing a +struct slave device could result in the following splat: + + kobject: 'bonding_slave' (00000000cecdd4fe): kobject_release, parent 0000000074ceb2b2 (delayed 1000) + bond0 (unregistering): (slave bond_slave_1): Releasing backup interface + ------------[ cut here ]------------ + ODEBUG: free active (active state 0) object type: timer_list hint: workqueue_select_cpu_near kernel/workqueue.c:1549 [inline] + ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x98 kernel/workqueue.c:1600 + WARNING: CPU: 1 PID: 842 at lib/debugobjects.c:485 debug_print_object+0x180/0x240 lib/debugobjects.c:485 + Kernel panic - not syncing: panic_on_warn set ... + CPU: 1 PID: 842 Comm: kworker/u4:4 Tainted: G S 5.9.0-rc8+ #96 + Hardware name: linux,dummy-virt (DT) + Workqueue: netns cleanup_net + Call trace: + dump_backtrace+0x0/0x4d8 include/linux/bitmap.h:239 + show_stack+0x34/0x48 arch/arm64/kernel/traps.c:142 + __dump_stack lib/dump_stack.c:77 [inline] + dump_stack+0x174/0x1f8 lib/dump_stack.c:118 + panic+0x360/0x7a0 kernel/panic.c:231 + __warn+0x244/0x2ec kernel/panic.c:600 + report_bug+0x240/0x398 lib/bug.c:198 + bug_handler+0x50/0xc0 arch/arm64/kernel/traps.c:974 + call_break_hook+0x160/0x1d8 arch/arm64/kernel/debug-monitors.c:322 + brk_handler+0x30/0xc0 arch/arm64/kernel/debug-monitors.c:329 + do_debug_exception+0x184/0x340 arch/arm64/mm/fault.c:864 + el1_dbg+0x48/0xb0 arch/arm64/kernel/entry-common.c:65 + el1_sync_handler+0x170/0x1c8 arch/arm64/kernel/entry-common.c:93 + el1_sync+0x80/0x100 arch/arm64/kernel/entry.S:594 + debug_print_object+0x180/0x240 lib/debugobjects.c:485 + __debug_check_no_obj_freed lib/debugobjects.c:967 [inline] + debug_check_no_obj_freed+0x200/0x430 lib/debugobjects.c:998 + slab_free_hook mm/slub.c:1536 [inline] + slab_free_freelist_hook+0x190/0x210 mm/slub.c:1577 + slab_free mm/slub.c:3138 [inline] + kfree+0x13c/0x460 mm/slub.c:4119 + bond_free_slave+0x8c/0xf8 drivers/net/bonding/bond_main.c:1492 + __bond_release_one+0xe0c/0xec8 drivers/net/bonding/bond_main.c:2190 + bond_slave_netdev_event drivers/net/bonding/bond_main.c:3309 [inline] + bond_netdev_event+0x8f0/0xa70 drivers/net/bonding/bond_main.c:3420 + notifier_call_chain+0xf0/0x200 kernel/notifier.c:83 + __raw_notifier_call_chain kernel/notifier.c:361 [inline] + raw_notifier_call_chain+0x44/0x58 kernel/notifier.c:368 + call_netdevice_notifiers_info+0xbc/0x150 net/core/dev.c:2033 + call_netdevice_notifiers_extack net/core/dev.c:2045 [inline] + call_netdevice_notifiers net/core/dev.c:2059 [inline] + rollback_registered_many+0x6a4/0xec0 net/core/dev.c:9347 + unregister_netdevice_many.part.0+0x2c/0x1c0 net/core/dev.c:10509 + unregister_netdevice_many net/core/dev.c:10508 [inline] + default_device_exit_batch+0x294/0x338 net/core/dev.c:10992 + ops_exit_list.isra.0+0xec/0x150 net/core/net_namespace.c:189 + cleanup_net+0x44c/0x888 net/core/net_namespace.c:603 + process_one_work+0x96c/0x18c0 kernel/workqueue.c:2269 + worker_thread+0x3f0/0xc30 kernel/workqueue.c:2415 + kthread+0x390/0x498 kernel/kthread.c:292 + ret_from_fork+0x10/0x18 arch/arm64/kernel/entry.S:925 + +This is a potential use-after-free if the sysfs nodes are being accessed +whilst removing the struct slave, so wait for the object destruction to +complete before freeing the struct slave itself. + +Fixes: 07699f9a7c8d ("bonding: add sysfs /slave dir for bond slave devices.") +Fixes: a068aab42258 ("bonding: Fix reference count leak in bond_sysfs_slave_add.") +Cc: Qiushi Wu +Cc: Jay Vosburgh +Cc: Veaceslav Falico +Cc: Andy Gospodarek +Signed-off-by: Jamie Iles +Reviewed-by: Greg Kroah-Hartman +Link: https://lore.kernel.org/r/20201120142827.879226-1-jamie@nuviainc.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/bonding/bond_main.c | 61 +++++++++++++++++++++++---------- + drivers/net/bonding/bond_sysfs_slave.c | 18 --------- + include/net/bonding.h | 8 ++++ + 3 files changed, 52 insertions(+), 35 deletions(-) + +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -1293,7 +1293,39 @@ static void bond_upper_dev_unlink(struct + slave->dev->flags &= ~IFF_SLAVE; + } + +-static struct slave *bond_alloc_slave(struct bonding *bond) ++static void slave_kobj_release(struct kobject *kobj) ++{ ++ struct slave *slave = to_slave(kobj); ++ struct bonding *bond = bond_get_bond_by_slave(slave); ++ ++ cancel_delayed_work_sync(&slave->notify_work); ++ if (BOND_MODE(bond) == BOND_MODE_8023AD) ++ kfree(SLAVE_AD_INFO(slave)); ++ ++ kfree(slave); ++} ++ ++static struct kobj_type slave_ktype = { ++ .release = slave_kobj_release, ++#ifdef CONFIG_SYSFS ++ .sysfs_ops = &slave_sysfs_ops, ++#endif ++}; ++ ++static int bond_kobj_init(struct slave *slave) ++{ ++ int err; ++ ++ err = kobject_init_and_add(&slave->kobj, &slave_ktype, ++ &(slave->dev->dev.kobj), "bonding_slave"); ++ if (err) ++ kobject_put(&slave->kobj); ++ ++ return err; ++} ++ ++static struct slave *bond_alloc_slave(struct bonding *bond, ++ struct net_device *slave_dev) + { + struct slave *slave = NULL; + +@@ -1301,11 +1333,17 @@ static struct slave *bond_alloc_slave(st + if (!slave) + return NULL; + ++ slave->bond = bond; ++ slave->dev = slave_dev; ++ ++ if (bond_kobj_init(slave)) ++ return NULL; ++ + if (BOND_MODE(bond) == BOND_MODE_8023AD) { + SLAVE_AD_INFO(slave) = kzalloc(sizeof(struct ad_slave_info), + GFP_KERNEL); + if (!SLAVE_AD_INFO(slave)) { +- kfree(slave); ++ kobject_put(&slave->kobj); + return NULL; + } + } +@@ -1314,17 +1352,6 @@ static struct slave *bond_alloc_slave(st + return slave; + } + +-static void bond_free_slave(struct slave *slave) +-{ +- struct bonding *bond = bond_get_bond_by_slave(slave); +- +- cancel_delayed_work_sync(&slave->notify_work); +- if (BOND_MODE(bond) == BOND_MODE_8023AD) +- kfree(SLAVE_AD_INFO(slave)); +- +- kfree(slave); +-} +- + static void bond_fill_ifbond(struct bonding *bond, struct ifbond *info) + { + info->bond_mode = BOND_MODE(bond); +@@ -1508,14 +1535,12 @@ int bond_enslave(struct net_device *bond + goto err_undo_flags; + } + +- new_slave = bond_alloc_slave(bond); ++ new_slave = bond_alloc_slave(bond, slave_dev); + if (!new_slave) { + res = -ENOMEM; + goto err_undo_flags; + } + +- new_slave->bond = bond; +- new_slave->dev = slave_dev; + /* Set the new_slave's queue_id to be zero. Queue ID mapping + * is set via sysfs or module option if desired. + */ +@@ -1837,7 +1862,7 @@ err_restore_mtu: + dev_set_mtu(slave_dev, new_slave->original_mtu); + + err_free: +- bond_free_slave(new_slave); ++ kobject_put(&new_slave->kobj); + + err_undo_flags: + /* Enslave of first slave has failed and we need to fix master's mac */ +@@ -2017,7 +2042,7 @@ static int __bond_release_one(struct net + if (!netif_is_bond_master(slave_dev)) + slave_dev->priv_flags &= ~IFF_BONDING; + +- bond_free_slave(slave); ++ kobject_put(&slave->kobj); + + return 0; + } +--- a/drivers/net/bonding/bond_sysfs_slave.c ++++ b/drivers/net/bonding/bond_sysfs_slave.c +@@ -121,7 +121,6 @@ static const struct slave_attribute *sla + }; + + #define to_slave_attr(_at) container_of(_at, struct slave_attribute, attr) +-#define to_slave(obj) container_of(obj, struct slave, kobj) + + static ssize_t slave_show(struct kobject *kobj, + struct attribute *attr, char *buf) +@@ -132,28 +131,15 @@ static ssize_t slave_show(struct kobject + return slave_attr->show(slave, buf); + } + +-static const struct sysfs_ops slave_sysfs_ops = { ++const struct sysfs_ops slave_sysfs_ops = { + .show = slave_show, + }; + +-static struct kobj_type slave_ktype = { +-#ifdef CONFIG_SYSFS +- .sysfs_ops = &slave_sysfs_ops, +-#endif +-}; +- + int bond_sysfs_slave_add(struct slave *slave) + { + const struct slave_attribute **a; + int err; + +- err = kobject_init_and_add(&slave->kobj, &slave_ktype, +- &(slave->dev->dev.kobj), "bonding_slave"); +- if (err) { +- kobject_put(&slave->kobj); +- return err; +- } +- + for (a = slave_attrs; *a; ++a) { + err = sysfs_create_file(&slave->kobj, &((*a)->attr)); + if (err) { +@@ -171,6 +157,4 @@ void bond_sysfs_slave_del(struct slave * + + for (a = slave_attrs; *a; ++a) + sysfs_remove_file(&slave->kobj, &((*a)->attr)); +- +- kobject_put(&slave->kobj); + } +--- a/include/net/bonding.h ++++ b/include/net/bonding.h +@@ -180,6 +180,11 @@ struct slave { + struct rtnl_link_stats64 slave_stats; + }; + ++static inline struct slave *to_slave(struct kobject *kobj) ++{ ++ return container_of(kobj, struct slave, kobj); ++} ++ + struct bond_up_slave { + unsigned int count; + struct rcu_head rcu; +@@ -743,6 +748,9 @@ extern struct bond_parm_tbl ad_select_tb + /* exported from bond_netlink.c */ + extern struct rtnl_link_ops bond_link_ops; + ++/* exported from bond_sysfs_slave.c */ ++extern const struct sysfs_ops slave_sysfs_ops; ++ + static inline void bond_tx_drop(struct net_device *dev, struct sk_buff *skb) + { + atomic_long_inc(&dev->tx_dropped); diff --git a/queue-5.4/devlink-hold-rtnl-lock-while-reading-netdev-attributes.patch b/queue-5.4/devlink-hold-rtnl-lock-while-reading-netdev-attributes.patch new file mode 100644 index 00000000000..4872b17624b --- /dev/null +++ b/queue-5.4/devlink-hold-rtnl-lock-while-reading-netdev-attributes.patch @@ -0,0 +1,55 @@ +From foo@baz Wed Dec 2 10:57:08 AM CET 2020 +From: Parav Pandit +Date: Wed, 25 Nov 2020 11:16:19 +0200 +Subject: devlink: Hold rtnl lock while reading netdev attributes + +From: Parav Pandit + +[ Upstream commit b187c9b4178b87954dbc94e78a7094715794714f ] + +A netdevice of a devlink port can be moved to different net namespace +than its parent devlink instance. +This scenario occurs when devlink reload is not used. + +When netdevice is undergoing migration to net namespace, its ifindex +and name may change. + +In such use case, devlink port query may read stale netdev attributes. + +Fix it by reading them under rtnl lock. + +Fixes: bfcd3a466172 ("Introduce devlink infrastructure") +Signed-off-by: Parav Pandit +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/core/devlink.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/net/core/devlink.c ++++ b/net/core/devlink.c +@@ -562,6 +562,8 @@ static int devlink_nl_port_fill(struct s + if (nla_put_u32(msg, DEVLINK_ATTR_PORT_INDEX, devlink_port->index)) + goto nla_put_failure; + ++ /* Hold rtnl lock while accessing port's netdev attributes. */ ++ rtnl_lock(); + spin_lock_bh(&devlink_port->type_lock); + if (nla_put_u16(msg, DEVLINK_ATTR_PORT_TYPE, devlink_port->type)) + goto nla_put_failure_type_locked; +@@ -588,6 +590,7 @@ static int devlink_nl_port_fill(struct s + goto nla_put_failure_type_locked; + } + spin_unlock_bh(&devlink_port->type_lock); ++ rtnl_unlock(); + if (devlink_nl_port_attrs_put(msg, devlink_port)) + goto nla_put_failure; + +@@ -596,6 +599,7 @@ static int devlink_nl_port_fill(struct s + + nla_put_failure_type_locked: + spin_unlock_bh(&devlink_port->type_lock); ++ rtnl_unlock(); + nla_put_failure: + genlmsg_cancel(msg, hdr); + return -EMSGSIZE; diff --git a/queue-5.4/ipv6-addrlabel-fix-possible-memory-leak-in-ip6addrlbl_net_init.patch b/queue-5.4/ipv6-addrlabel-fix-possible-memory-leak-in-ip6addrlbl_net_init.patch new file mode 100644 index 00000000000..f643c0a3a2a --- /dev/null +++ b/queue-5.4/ipv6-addrlabel-fix-possible-memory-leak-in-ip6addrlbl_net_init.patch @@ -0,0 +1,84 @@ +From foo@baz Wed Dec 2 10:57:08 AM CET 2020 +From: Wang Hai +Date: Tue, 24 Nov 2020 15:17:28 +0800 +Subject: ipv6: addrlabel: fix possible memory leak in ip6addrlbl_net_init + +From: Wang Hai + +[ Upstream commit e255e11e66da8281e337e4e352956e8a4999fca4 ] + +kmemleak report a memory leak as follows: + +unreferenced object 0xffff8880059c6a00 (size 64): + comm "ip", pid 23696, jiffies 4296590183 (age 1755.384s) + hex dump (first 32 bytes): + 20 01 00 10 00 00 00 00 00 00 00 00 00 00 00 00 ............... + 1c 00 00 00 00 00 00 00 00 00 00 00 07 00 00 00 ................ + backtrace: + [<00000000aa4e7a87>] ip6addrlbl_add+0x90/0xbb0 + [<0000000070b8d7f1>] ip6addrlbl_net_init+0x109/0x170 + [<000000006a9ca9d4>] ops_init+0xa8/0x3c0 + [<000000002da57bf2>] setup_net+0x2de/0x7e0 + [<000000004e52d573>] copy_net_ns+0x27d/0x530 + [<00000000b07ae2b4>] create_new_namespaces+0x382/0xa30 + [<000000003b76d36f>] unshare_nsproxy_namespaces+0xa1/0x1d0 + [<0000000030653721>] ksys_unshare+0x3a4/0x780 + [<0000000007e82e40>] __x64_sys_unshare+0x2d/0x40 + [<0000000031a10c08>] do_syscall_64+0x33/0x40 + [<0000000099df30e7>] entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +We should free all rules when we catch an error in ip6addrlbl_net_init(). +otherwise a memory leak will occur. + +Fixes: 2a8cc6c89039 ("[IPV6] ADDRCONF: Support RFC3484 configurable address selection policy table.") +Reported-by: Hulk Robot +Signed-off-by: Wang Hai +Link: https://lore.kernel.org/r/20201124071728.8385-1-wanghai38@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/addrlabel.c | 26 +++++++++++++++++--------- + 1 file changed, 17 insertions(+), 9 deletions(-) + +--- a/net/ipv6/addrlabel.c ++++ b/net/ipv6/addrlabel.c +@@ -306,7 +306,9 @@ static int ip6addrlbl_del(struct net *ne + /* add default label */ + static int __net_init ip6addrlbl_net_init(struct net *net) + { +- int err = 0; ++ struct ip6addrlbl_entry *p = NULL; ++ struct hlist_node *n; ++ int err; + int i; + + ADDRLABEL(KERN_DEBUG "%s\n", __func__); +@@ -315,14 +317,20 @@ static int __net_init ip6addrlbl_net_ini + INIT_HLIST_HEAD(&net->ipv6.ip6addrlbl_table.head); + + for (i = 0; i < ARRAY_SIZE(ip6addrlbl_init_table); i++) { +- int ret = ip6addrlbl_add(net, +- ip6addrlbl_init_table[i].prefix, +- ip6addrlbl_init_table[i].prefixlen, +- 0, +- ip6addrlbl_init_table[i].label, 0); +- /* XXX: should we free all rules when we catch an error? */ +- if (ret && (!err || err != -ENOMEM)) +- err = ret; ++ err = ip6addrlbl_add(net, ++ ip6addrlbl_init_table[i].prefix, ++ ip6addrlbl_init_table[i].prefixlen, ++ 0, ++ ip6addrlbl_init_table[i].label, 0); ++ if (err) ++ goto err_ip6addrlbl_add; ++ } ++ return 0; ++ ++err_ip6addrlbl_add: ++ hlist_for_each_entry_safe(p, n, &net->ipv6.ip6addrlbl_table.head, list) { ++ hlist_del_rcu(&p->list); ++ kfree_rcu(p, rcu); + } + return err; + } diff --git a/queue-5.4/net-af_iucv-set-correct-sk_protocol-for-child-sockets.patch b/queue-5.4/net-af_iucv-set-correct-sk_protocol-for-child-sockets.patch new file mode 100644 index 00000000000..b0f21f395d6 --- /dev/null +++ b/queue-5.4/net-af_iucv-set-correct-sk_protocol-for-child-sockets.patch @@ -0,0 +1,45 @@ +From foo@baz Wed Dec 2 10:57:08 AM CET 2020 +From: Julian Wiedmann +Date: Fri, 20 Nov 2020 11:06:57 +0100 +Subject: net/af_iucv: set correct sk_protocol for child sockets + +From: Julian Wiedmann + +[ Upstream commit c5dab0941fcdc9664eb0ec0d4d51433216d91336 ] + +Child sockets erroneously inherit their parent's sk_type (ie. SOCK_*), +instead of the PF_IUCV protocol that the parent was created with in +iucv_sock_create(). + +We're currently not using sk->sk_protocol ourselves, so this shouldn't +have much impact (except eg. getting the output in skb_dump() right). + +Fixes: eac3731bd04c ("[S390]: Add AF_IUCV socket support") +Signed-off-by: Julian Wiedmann +Link: https://lore.kernel.org/r/20201120100657.34407-1-jwi@linux.ibm.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/iucv/af_iucv.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/iucv/af_iucv.c ++++ b/net/iucv/af_iucv.c +@@ -1785,7 +1785,7 @@ static int iucv_callback_connreq(struct + } + + /* Create the new socket */ +- nsk = iucv_sock_alloc(NULL, sk->sk_type, GFP_ATOMIC, 0); ++ nsk = iucv_sock_alloc(NULL, sk->sk_protocol, GFP_ATOMIC, 0); + if (!nsk) { + err = pr_iucv->path_sever(path, user_data); + iucv_path_free(path); +@@ -1991,7 +1991,7 @@ static int afiucv_hs_callback_syn(struct + goto out; + } + +- nsk = iucv_sock_alloc(NULL, sk->sk_type, GFP_ATOMIC, 0); ++ nsk = iucv_sock_alloc(NULL, sk->sk_protocol, GFP_ATOMIC, 0); + bh_lock_sock(sk); + if ((sk->sk_state != IUCV_LISTEN) || + sk_acceptq_is_full(sk) || diff --git a/queue-5.4/net-tls-missing-received-data-after-fast-remote-close.patch b/queue-5.4/net-tls-missing-received-data-after-fast-remote-close.patch new file mode 100644 index 00000000000..5ad9f1ff5a2 --- /dev/null +++ b/queue-5.4/net-tls-missing-received-data-after-fast-remote-close.patch @@ -0,0 +1,50 @@ +From foo@baz Wed Dec 2 10:57:08 AM CET 2020 +From: Vadim Fedorenko +Date: Thu, 19 Nov 2020 18:59:48 +0300 +Subject: net/tls: missing received data after fast remote close + +From: Vadim Fedorenko + +[ Upstream commit 20ffc7adf53a5fd3d19751fbff7895bcca66686e ] + +In case when tcp socket received FIN after some data and the +parser haven't started before reading data caller will receive +an empty buffer. This behavior differs from plain TCP socket and +leads to special treating in user-space. +The flow that triggers the race is simple. Server sends small +amount of data right after the connection is configured to use TLS +and closes the connection. In this case receiver sees TLS Handshake +data, configures TLS socket right after Change Cipher Spec record. +While the configuration is in process, TCP socket receives small +Application Data record, Encrypted Alert record and FIN packet. So +the TCP socket changes sk_shutdown to RCV_SHUTDOWN and sk_flag with +SK_DONE bit set. The received data is not parsed upon arrival and is +never sent to user-space. + +Patch unpauses parser directly if we have unparsed data in tcp +receive queue. + +Fixes: fcf4793e278e ("tls: check RCV_SHUTDOWN in tls_wait_data") +Signed-off-by: Vadim Fedorenko +Link: https://lore.kernel.org/r/1605801588-12236-1-git-send-email-vfedorenko@novek.ru +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/tls/tls_sw.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/net/tls/tls_sw.c ++++ b/net/tls/tls_sw.c +@@ -1291,6 +1291,12 @@ static struct sk_buff *tls_wait_data(str + return NULL; + } + ++ if (!skb_queue_empty(&sk->sk_receive_queue)) { ++ __strp_unpause(&ctx->strp); ++ if (ctx->recv_pkt) ++ return ctx->recv_pkt; ++ } ++ + if (sk->sk_shutdown & RCV_SHUTDOWN) + return NULL; + diff --git a/queue-5.4/net-tls-protect-from-calling-tls_dev_del-for-tls-rx-twice.patch b/queue-5.4/net-tls-protect-from-calling-tls_dev_del-for-tls-rx-twice.patch new file mode 100644 index 00000000000..ea40b5a98b9 --- /dev/null +++ b/queue-5.4/net-tls-protect-from-calling-tls_dev_del-for-tls-rx-twice.patch @@ -0,0 +1,65 @@ +From foo@baz Wed Dec 2 10:57:08 AM CET 2020 +From: Maxim Mikityanskiy +Date: Wed, 25 Nov 2020 14:18:10 -0800 +Subject: net/tls: Protect from calling tls_dev_del for TLS RX twice + +From: Maxim Mikityanskiy + +[ Upstream commit 025cc2fb6a4e84e9a0552c0017dcd1c24b7ac7da ] + +tls_device_offload_cleanup_rx doesn't clear tls_ctx->netdev after +calling tls_dev_del if TLX TX offload is also enabled. Clearing +tls_ctx->netdev gets postponed until tls_device_gc_task. It leaves a +time frame when tls_device_down may get called and call tls_dev_del for +RX one extra time, confusing the driver, which may lead to a crash. + +This patch corrects this racy behavior by adding a flag to prevent +tls_device_down from calling tls_dev_del the second time. + +Fixes: e8f69799810c ("net/tls: Add generic NIC offload infrastructure") +Signed-off-by: Maxim Mikityanskiy +Signed-off-by: Saeed Mahameed +Link: https://lore.kernel.org/r/20201125221810.69870-1-saeedm@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + include/net/tls.h | 6 ++++++ + net/tls/tls_device.c | 5 ++++- + 2 files changed, 10 insertions(+), 1 deletion(-) + +--- a/include/net/tls.h ++++ b/include/net/tls.h +@@ -221,6 +221,12 @@ enum tls_context_flags { + * to be atomic. + */ + TLS_TX_SYNC_SCHED = 1, ++ /* tls_dev_del was called for the RX side, device state was released, ++ * but tls_ctx->netdev might still be kept, because TX-side driver ++ * resources might not be released yet. Used to prevent the second ++ * tls_dev_del call in tls_device_down if it happens simultaneously. ++ */ ++ TLS_RX_DEV_CLOSED = 2, + }; + + struct cipher_context { +--- a/net/tls/tls_device.c ++++ b/net/tls/tls_device.c +@@ -1163,6 +1163,8 @@ void tls_device_offload_cleanup_rx(struc + if (tls_ctx->tx_conf != TLS_HW) { + dev_put(netdev); + tls_ctx->netdev = NULL; ++ } else { ++ set_bit(TLS_RX_DEV_CLOSED, &tls_ctx->flags); + } + out: + up_read(&device_offload_lock); +@@ -1192,7 +1194,8 @@ static int tls_device_down(struct net_de + if (ctx->tx_conf == TLS_HW) + netdev->tlsdev_ops->tls_dev_del(netdev, ctx, + TLS_OFFLOAD_CTX_DIR_TX); +- if (ctx->rx_conf == TLS_HW) ++ if (ctx->rx_conf == TLS_HW && ++ !test_bit(TLS_RX_DEV_CLOSED, &ctx->flags)) + netdev->tlsdev_ops->tls_dev_del(netdev, ctx, + TLS_OFFLOAD_CTX_DIR_RX); + WRITE_ONCE(ctx->netdev, NULL); diff --git a/queue-5.4/rose-fix-null-pointer-dereference-in-rose_send_frame.patch b/queue-5.4/rose-fix-null-pointer-dereference-in-rose_send_frame.patch new file mode 100644 index 00000000000..6916c0d93ae --- /dev/null +++ b/queue-5.4/rose-fix-null-pointer-dereference-in-rose_send_frame.patch @@ -0,0 +1,64 @@ +From foo@baz Wed Dec 2 10:57:08 AM CET 2020 +From: Anmol Karn +Date: Fri, 20 Nov 2020 00:40:43 +0530 +Subject: rose: Fix Null pointer dereference in rose_send_frame() + +From: Anmol Karn + +[ Upstream commit 3b3fd068c56e3fbea30090859216a368398e39bf ] + +rose_send_frame() dereferences `neigh->dev` when called from +rose_transmit_clear_request(), and the first occurrence of the +`neigh` is in rose_loopback_timer() as `rose_loopback_neigh`, +and it is initialized in rose_add_loopback_neigh() as NULL. +i.e when `rose_loopback_neigh` used in rose_loopback_timer() +its `->dev` was still NULL and rose_loopback_timer() was calling +rose_rx_call_request() without checking for NULL. + +- net/rose/rose_link.c +This bug seems to get triggered in this line: + +rose_call = (ax25_address *)neigh->dev->dev_addr; + +Fix it by adding NULL checking for `rose_loopback_neigh->dev` +in rose_loopback_timer(). + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Suggested-by: Jakub Kicinski +Reported-by: syzbot+a1c743815982d9496393@syzkaller.appspotmail.com +Tested-by: syzbot+a1c743815982d9496393@syzkaller.appspotmail.com +Link: https://syzkaller.appspot.com/bug?id=9d2a7ca8c7f2e4b682c97578dfa3f236258300b3 +Signed-off-by: Anmol Karn +Link: https://lore.kernel.org/r/20201119191043.28813-1-anmol.karan123@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/rose/rose_loopback.c | 17 +++++++++++++---- + 1 file changed, 13 insertions(+), 4 deletions(-) + +--- a/net/rose/rose_loopback.c ++++ b/net/rose/rose_loopback.c +@@ -96,10 +96,19 @@ static void rose_loopback_timer(struct t + } + + if (frametype == ROSE_CALL_REQUEST) { +- if ((dev = rose_dev_get(dest)) != NULL) { +- if (rose_rx_call_request(skb, dev, rose_loopback_neigh, lci_o) == 0) +- kfree_skb(skb); +- } else { ++ if (!rose_loopback_neigh->dev) { ++ kfree_skb(skb); ++ continue; ++ } ++ ++ dev = rose_dev_get(dest); ++ if (!dev) { ++ kfree_skb(skb); ++ continue; ++ } ++ ++ if (rose_rx_call_request(skb, dev, rose_loopback_neigh, lci_o) == 0) { ++ dev_put(dev); + kfree_skb(skb); + } + } else { diff --git a/queue-5.4/series b/queue-5.4/series new file mode 100644 index 00000000000..32b2bdd1c45 --- /dev/null +++ b/queue-5.4/series @@ -0,0 +1,12 @@ +devlink-hold-rtnl-lock-while-reading-netdev-attributes.patch +ipv6-addrlabel-fix-possible-memory-leak-in-ip6addrlbl_net_init.patch +net-af_iucv-set-correct-sk_protocol-for-child-sockets.patch +net-tls-missing-received-data-after-fast-remote-close.patch +net-tls-protect-from-calling-tls_dev_del-for-tls-rx-twice.patch +rose-fix-null-pointer-dereference-in-rose_send_frame.patch +sock-set-sk_err-to-ee_errno-on-dequeue-from-errq.patch +tcp-set-inet_ecn_xmit-configuration-in-tcp_reinit_congestion_control.patch +tun-honor-iocb_nowait-flag.patch +usbnet-ipheth-fix-connectivity-with-ios-14.patch +bonding-wait-for-sysfs-kobject-destruction-before-freeing-struct-slave.patch +staging-octeon-fix-up-merge-error.patch diff --git a/queue-5.4/sock-set-sk_err-to-ee_errno-on-dequeue-from-errq.patch b/queue-5.4/sock-set-sk_err-to-ee_errno-on-dequeue-from-errq.patch new file mode 100644 index 00000000000..0bc8b29dd2c --- /dev/null +++ b/queue-5.4/sock-set-sk_err-to-ee_errno-on-dequeue-from-errq.patch @@ -0,0 +1,47 @@ +From foo@baz Wed Dec 2 10:57:08 AM CET 2020 +From: Willem de Bruijn +Date: Thu, 26 Nov 2020 10:12:20 -0500 +Subject: sock: set sk_err to ee_errno on dequeue from errq + +From: Willem de Bruijn + +[ Upstream commit 985f7337421a811cb354ca93882f943c8335a6f5 ] + +When setting sk_err, set it to ee_errno, not ee_origin. + +Commit f5f99309fa74 ("sock: do not set sk_err in +sock_dequeue_err_skb") disabled updating sk_err on errq dequeue, +which is correct for most error types (origins): + + - sk->sk_err = err; + +Commit 38b257938ac6 ("sock: reset sk_err when the error queue is +empty") reenabled the behavior for IMCP origins, which do require it: + + + if (icmp_next) + + sk->sk_err = SKB_EXT_ERR(skb_next)->ee.ee_origin; + +But read from ee_errno. + +Fixes: 38b257938ac6 ("sock: reset sk_err when the error queue is empty") +Reported-by: Ayush Ranjan +Signed-off-by: Willem de Bruijn +Acked-by: Soheil Hassas Yeganeh +Link: https://lore.kernel.org/r/20201126151220.2819322-1-willemdebruijn.kernel@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/core/skbuff.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -4452,7 +4452,7 @@ struct sk_buff *sock_dequeue_err_skb(str + if (skb && (skb_next = skb_peek(q))) { + icmp_next = is_icmp_err_skb(skb_next); + if (icmp_next) +- sk->sk_err = SKB_EXT_ERR(skb_next)->ee.ee_origin; ++ sk->sk_err = SKB_EXT_ERR(skb_next)->ee.ee_errno; + } + spin_unlock_irqrestore(&q->lock, flags); + diff --git a/queue-5.4/staging-octeon-fix-up-merge-error.patch b/queue-5.4/staging-octeon-fix-up-merge-error.patch new file mode 100644 index 00000000000..727e3e81939 --- /dev/null +++ b/queue-5.4/staging-octeon-fix-up-merge-error.patch @@ -0,0 +1,46 @@ +From 673b41e04a035d760bc0aff83fa9ee24fd9c2779 Mon Sep 17 00:00:00 2001 +From: Randy Dunlap +Date: Sun, 29 Mar 2020 09:12:31 -0700 +Subject: staging/octeon: fix up merge error + +From: Randy Dunlap + +commit 673b41e04a035d760bc0aff83fa9ee24fd9c2779 upstream. + +There's a semantic conflict in the Octeon staging network driver, which +used the skb_reset_tc() function to reset skb state when re-using an +skb. But that inline helper function was removed in mainline by commit +2c64605b590e ("net: Fix CONFIG_NET_CLS_ACT=n and +CONFIG_NFT_FWD_NETDEV={y, m} build"). + +Fix it by using skb_reset_redirect() instead. Also move it out of the + +This code path only ends up triggering if REUSE_SKBUFFS_WITHOUT_FREE is +enabled, which in turn only happens if you don't have CONFIG_NETFILTER +configured. Which was how this wasn't caught by the usual allmodconfig +builds. + +Signed-off-by: Randy Dunlap +Reported-by: Stephen Rothwell +Signed-off-by: Linus Torvalds +Cc: Pablo Neira Ayuso +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/octeon/ethernet-tx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/staging/octeon/ethernet-tx.c ++++ b/drivers/staging/octeon/ethernet-tx.c +@@ -352,10 +352,10 @@ int cvm_oct_xmit(struct sk_buff *skb, st + skb_dst_set(skb, NULL); + skb_ext_reset(skb); + nf_reset_ct(skb); ++ skb_reset_redirect(skb); + + #ifdef CONFIG_NET_SCHED + skb->tc_index = 0; +- skb_reset_tc(skb); + #endif /* CONFIG_NET_SCHED */ + #endif /* REUSE_SKBUFFS_WITHOUT_FREE */ + diff --git a/queue-5.4/tcp-set-inet_ecn_xmit-configuration-in-tcp_reinit_congestion_control.patch b/queue-5.4/tcp-set-inet_ecn_xmit-configuration-in-tcp_reinit_congestion_control.patch new file mode 100644 index 00000000000..8c1104136d0 --- /dev/null +++ b/queue-5.4/tcp-set-inet_ecn_xmit-configuration-in-tcp_reinit_congestion_control.patch @@ -0,0 +1,49 @@ +From foo@baz Wed Dec 2 10:57:08 AM CET 2020 +From: Alexander Duyck +Date: Thu, 19 Nov 2020 13:23:58 -0800 +Subject: tcp: Set INET_ECN_xmit configuration in tcp_reinit_congestion_control + +From: Alexander Duyck + +[ Upstream commit 55472017a4219ca965a957584affdb17549ae4a4 ] + +When setting congestion control via a BPF program it is seen that the +SYN/ACK for packets within a given flow will not include the ECT0 flag. A +bit of simple printk debugging shows that when this is configured without +BPF we will see the value INET_ECN_xmit value initialized in +tcp_assign_congestion_control however when we configure this via BPF the +socket is in the closed state and as such it isn't configured, and I do not +see it being initialized when we transition the socket into the listen +state. The result of this is that the ECT0 bit is configured based on +whatever the default state is for the socket. + +Any easy way to reproduce this is to monitor the following with tcpdump: +tools/testing/selftests/bpf/test_progs -t bpf_tcp_ca + +Without this patch the SYN/ACK will follow whatever the default is. If dctcp +all SYN/ACK packets will have the ECT0 bit set, and if it is not then ECT0 +will be cleared on all SYN/ACK packets. With this patch applied the SYN/ACK +bit matches the value seen on the other packets in the given stream. + +Fixes: 91b5b21c7c16 ("bpf: Add support for changing congestion control") +Signed-off-by: Alexander Duyck +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/tcp_cong.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/net/ipv4/tcp_cong.c ++++ b/net/ipv4/tcp_cong.c +@@ -197,6 +197,11 @@ static void tcp_reinit_congestion_contro + icsk->icsk_ca_setsockopt = 1; + memset(icsk->icsk_ca_priv, 0, sizeof(icsk->icsk_ca_priv)); + ++ if (ca->flags & TCP_CONG_NEEDS_ECN) ++ INET_ECN_xmit(sk); ++ else ++ INET_ECN_dontxmit(sk); ++ + if (!((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) + tcp_init_congestion_control(sk); + } diff --git a/queue-5.4/tun-honor-iocb_nowait-flag.patch b/queue-5.4/tun-honor-iocb_nowait-flag.patch new file mode 100644 index 00000000000..9a28c588a67 --- /dev/null +++ b/queue-5.4/tun-honor-iocb_nowait-flag.patch @@ -0,0 +1,59 @@ +From foo@baz Wed Dec 2 10:57:08 AM CET 2020 +From: Jens Axboe +Date: Fri, 20 Nov 2020 07:59:54 -0700 +Subject: tun: honor IOCB_NOWAIT flag + +From: Jens Axboe + +[ Upstream commit 5aac0390a63b8718237a61dd0d24a29201d1c94a ] + +tun only checks the file O_NONBLOCK flag, but it should also be checking +the iocb IOCB_NOWAIT flag. Any fops using ->read/write_iter() should check +both, otherwise it breaks users that correctly expect O_NONBLOCK semantics +if IOCB_NOWAIT is set. + +Signed-off-by: Jens Axboe +Link: https://lore.kernel.org/r/e9451860-96cc-c7c7-47b8-fe42cadd5f4c@kernel.dk +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/tun.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +--- a/drivers/net/tun.c ++++ b/drivers/net/tun.c +@@ -2028,12 +2028,15 @@ static ssize_t tun_chr_write_iter(struct + struct tun_file *tfile = file->private_data; + struct tun_struct *tun = tun_get(tfile); + ssize_t result; ++ int noblock = 0; + + if (!tun) + return -EBADFD; + +- result = tun_get_user(tun, tfile, NULL, from, +- file->f_flags & O_NONBLOCK, false); ++ if ((file->f_flags & O_NONBLOCK) || (iocb->ki_flags & IOCB_NOWAIT)) ++ noblock = 1; ++ ++ result = tun_get_user(tun, tfile, NULL, from, noblock, false); + + tun_put(tun); + return result; +@@ -2254,10 +2257,15 @@ static ssize_t tun_chr_read_iter(struct + struct tun_file *tfile = file->private_data; + struct tun_struct *tun = tun_get(tfile); + ssize_t len = iov_iter_count(to), ret; ++ int noblock = 0; + + if (!tun) + return -EBADFD; +- ret = tun_do_read(tun, tfile, to, file->f_flags & O_NONBLOCK, NULL); ++ ++ if ((file->f_flags & O_NONBLOCK) || (iocb->ki_flags & IOCB_NOWAIT)) ++ noblock = 1; ++ ++ ret = tun_do_read(tun, tfile, to, noblock, NULL); + ret = min_t(ssize_t, ret, len); + if (ret > 0) + iocb->ki_pos = ret; diff --git a/queue-5.4/usbnet-ipheth-fix-connectivity-with-ios-14.patch b/queue-5.4/usbnet-ipheth-fix-connectivity-with-ios-14.patch new file mode 100644 index 00000000000..1a9fe314b3e --- /dev/null +++ b/queue-5.4/usbnet-ipheth-fix-connectivity-with-ios-14.patch @@ -0,0 +1,49 @@ +From foo@baz Wed Dec 2 10:57:08 AM CET 2020 +From: Yves-Alexis Perez +Date: Thu, 19 Nov 2020 18:24:39 +0100 +Subject: usbnet: ipheth: fix connectivity with iOS 14 + +From: Yves-Alexis Perez + +[ Upstream commit f33d9e2b48a34e1558b67a473a1fc1d6e793f93c ] + +Starting with iOS 14 released in September 2020, connectivity using the +personal hotspot USB tethering function of iOS devices is broken. + +Communication between the host and the device (for example ICMP traffic +or DNS resolution using the DNS service running in the device itself) +works fine, but communication to endpoints further away doesn't work. + +Investigation on the matter shows that no UDP and ICMP traffic from the +tethered host is reaching the Internet at all. For TCP traffic there are +exchanges between tethered host and server but packets are modified in +transit leading to impossible communication. + +After some trials Matti Vuorela discovered that reducing the URB buffer +size by two bytes restored the previous behavior. While a better +solution might exist to fix the issue, since the protocol is not +publicly documented and considering the small size of the fix, let's do +that. + +Tested-by: Matti Vuorela +Signed-off-by: Yves-Alexis Perez +Link: https://lore.kernel.org/linux-usb/CAAn0qaXmysJ9vx3ZEMkViv_B19ju-_ExN8Yn_uSefxpjS6g4Lw@mail.gmail.com/ +Link: https://github.com/libimobiledevice/libimobiledevice/issues/1038 +Link: https://lore.kernel.org/r/20201119172439.94988-1-corsac@corsac.net +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/ipheth.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/usb/ipheth.c ++++ b/drivers/net/usb/ipheth.c +@@ -59,7 +59,7 @@ + #define IPHETH_USBINTF_SUBCLASS 253 + #define IPHETH_USBINTF_PROTO 1 + +-#define IPHETH_BUF_SIZE 1516 ++#define IPHETH_BUF_SIZE 1514 + #define IPHETH_IP_ALIGN 2 /* padding at front of URB */ + #define IPHETH_TX_TIMEOUT (5 * HZ) +