From: Greg Kroah-Hartman Date: Wed, 2 Dec 2020 10:33:45 +0000 (+0100) Subject: 4.19-stable patches X-Git-Tag: v4.14.211~19 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=81d384ed6a665edaf6745a7c8ce0cf4b075aad90;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: bonding-wait-for-sysfs-kobject-destruction-before-freeing-struct-slave.patch i40e-fix-removing-driver-while-bare-metal-vfs-pass-traffic.patch ibmvnic-fix-call_netdevice_notifiers-in-do_reset.patch ibmvnic-notify-peers-when-failover-and-migration-happen.patch ipv6-addrlabel-fix-possible-memory-leak-in-ip6addrlbl_net_init.patch net-af_iucv-set-correct-sk_protocol-for-child-sockets.patch net-tls-missing-received-data-after-fast-remote-close.patch net-tls-protect-from-calling-tls_dev_del-for-tls-rx-twice.patch rose-fix-null-pointer-dereference-in-rose_send_frame.patch sock-set-sk_err-to-ee_errno-on-dequeue-from-errq.patch tcp-set-inet_ecn_xmit-configuration-in-tcp_reinit_congestion_control.patch tun-honor-iocb_nowait-flag.patch usbnet-ipheth-fix-connectivity-with-ios-14.patch --- diff --git a/queue-4.19/bonding-wait-for-sysfs-kobject-destruction-before-freeing-struct-slave.patch b/queue-4.19/bonding-wait-for-sysfs-kobject-destruction-before-freeing-struct-slave.patch new file mode 100644 index 00000000000..06d4928aaaf --- /dev/null +++ b/queue-4.19/bonding-wait-for-sysfs-kobject-destruction-before-freeing-struct-slave.patch @@ -0,0 +1,271 @@ +From foo@baz Wed Dec 2 10:57:08 AM CET 2020 +From: Jamie Iles +Date: Fri, 20 Nov 2020 14:28:27 +0000 +Subject: bonding: wait for sysfs kobject destruction before freeing struct slave + +From: Jamie Iles + +[ Upstream commit b9ad3e9f5a7a760ab068e33e1f18d240ba32ce92 ] + +syzkaller found that with CONFIG_DEBUG_KOBJECT_RELEASE=y, releasing a +struct slave device could result in the following splat: + + kobject: 'bonding_slave' (00000000cecdd4fe): kobject_release, parent 0000000074ceb2b2 (delayed 1000) + bond0 (unregistering): (slave bond_slave_1): Releasing backup interface + ------------[ cut here ]------------ + ODEBUG: free active (active state 0) object type: timer_list hint: workqueue_select_cpu_near kernel/workqueue.c:1549 [inline] + ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x98 kernel/workqueue.c:1600 + WARNING: CPU: 1 PID: 842 at lib/debugobjects.c:485 debug_print_object+0x180/0x240 lib/debugobjects.c:485 + Kernel panic - not syncing: panic_on_warn set ... + CPU: 1 PID: 842 Comm: kworker/u4:4 Tainted: G S 5.9.0-rc8+ #96 + Hardware name: linux,dummy-virt (DT) + Workqueue: netns cleanup_net + Call trace: + dump_backtrace+0x0/0x4d8 include/linux/bitmap.h:239 + show_stack+0x34/0x48 arch/arm64/kernel/traps.c:142 + __dump_stack lib/dump_stack.c:77 [inline] + dump_stack+0x174/0x1f8 lib/dump_stack.c:118 + panic+0x360/0x7a0 kernel/panic.c:231 + __warn+0x244/0x2ec kernel/panic.c:600 + report_bug+0x240/0x398 lib/bug.c:198 + bug_handler+0x50/0xc0 arch/arm64/kernel/traps.c:974 + call_break_hook+0x160/0x1d8 arch/arm64/kernel/debug-monitors.c:322 + brk_handler+0x30/0xc0 arch/arm64/kernel/debug-monitors.c:329 + do_debug_exception+0x184/0x340 arch/arm64/mm/fault.c:864 + el1_dbg+0x48/0xb0 arch/arm64/kernel/entry-common.c:65 + el1_sync_handler+0x170/0x1c8 arch/arm64/kernel/entry-common.c:93 + el1_sync+0x80/0x100 arch/arm64/kernel/entry.S:594 + debug_print_object+0x180/0x240 lib/debugobjects.c:485 + __debug_check_no_obj_freed lib/debugobjects.c:967 [inline] + debug_check_no_obj_freed+0x200/0x430 lib/debugobjects.c:998 + slab_free_hook mm/slub.c:1536 [inline] + slab_free_freelist_hook+0x190/0x210 mm/slub.c:1577 + slab_free mm/slub.c:3138 [inline] + kfree+0x13c/0x460 mm/slub.c:4119 + bond_free_slave+0x8c/0xf8 drivers/net/bonding/bond_main.c:1492 + __bond_release_one+0xe0c/0xec8 drivers/net/bonding/bond_main.c:2190 + bond_slave_netdev_event drivers/net/bonding/bond_main.c:3309 [inline] + bond_netdev_event+0x8f0/0xa70 drivers/net/bonding/bond_main.c:3420 + notifier_call_chain+0xf0/0x200 kernel/notifier.c:83 + __raw_notifier_call_chain kernel/notifier.c:361 [inline] + raw_notifier_call_chain+0x44/0x58 kernel/notifier.c:368 + call_netdevice_notifiers_info+0xbc/0x150 net/core/dev.c:2033 + call_netdevice_notifiers_extack net/core/dev.c:2045 [inline] + call_netdevice_notifiers net/core/dev.c:2059 [inline] + rollback_registered_many+0x6a4/0xec0 net/core/dev.c:9347 + unregister_netdevice_many.part.0+0x2c/0x1c0 net/core/dev.c:10509 + unregister_netdevice_many net/core/dev.c:10508 [inline] + default_device_exit_batch+0x294/0x338 net/core/dev.c:10992 + ops_exit_list.isra.0+0xec/0x150 net/core/net_namespace.c:189 + cleanup_net+0x44c/0x888 net/core/net_namespace.c:603 + process_one_work+0x96c/0x18c0 kernel/workqueue.c:2269 + worker_thread+0x3f0/0xc30 kernel/workqueue.c:2415 + kthread+0x390/0x498 kernel/kthread.c:292 + ret_from_fork+0x10/0x18 arch/arm64/kernel/entry.S:925 + +This is a potential use-after-free if the sysfs nodes are being accessed +whilst removing the struct slave, so wait for the object destruction to +complete before freeing the struct slave itself. + +Fixes: 07699f9a7c8d ("bonding: add sysfs /slave dir for bond slave devices.") +Fixes: a068aab42258 ("bonding: Fix reference count leak in bond_sysfs_slave_add.") +Cc: Qiushi Wu +Cc: Jay Vosburgh +Cc: Veaceslav Falico +Cc: Andy Gospodarek +Signed-off-by: Jamie Iles +Reviewed-by: Greg Kroah-Hartman +Link: https://lore.kernel.org/r/20201120142827.879226-1-jamie@nuviainc.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/bonding/bond_main.c | 61 +++++++++++++++++++++++---------- + drivers/net/bonding/bond_sysfs_slave.c | 18 --------- + include/net/bonding.h | 8 ++++ + 3 files changed, 52 insertions(+), 35 deletions(-) + +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -1268,7 +1268,39 @@ static void bond_upper_dev_unlink(struct + slave->dev->flags &= ~IFF_SLAVE; + } + +-static struct slave *bond_alloc_slave(struct bonding *bond) ++static void slave_kobj_release(struct kobject *kobj) ++{ ++ struct slave *slave = to_slave(kobj); ++ struct bonding *bond = bond_get_bond_by_slave(slave); ++ ++ cancel_delayed_work_sync(&slave->notify_work); ++ if (BOND_MODE(bond) == BOND_MODE_8023AD) ++ kfree(SLAVE_AD_INFO(slave)); ++ ++ kfree(slave); ++} ++ ++static struct kobj_type slave_ktype = { ++ .release = slave_kobj_release, ++#ifdef CONFIG_SYSFS ++ .sysfs_ops = &slave_sysfs_ops, ++#endif ++}; ++ ++static int bond_kobj_init(struct slave *slave) ++{ ++ int err; ++ ++ err = kobject_init_and_add(&slave->kobj, &slave_ktype, ++ &(slave->dev->dev.kobj), "bonding_slave"); ++ if (err) ++ kobject_put(&slave->kobj); ++ ++ return err; ++} ++ ++static struct slave *bond_alloc_slave(struct bonding *bond, ++ struct net_device *slave_dev) + { + struct slave *slave = NULL; + +@@ -1276,11 +1308,17 @@ static struct slave *bond_alloc_slave(st + if (!slave) + return NULL; + ++ slave->bond = bond; ++ slave->dev = slave_dev; ++ ++ if (bond_kobj_init(slave)) ++ return NULL; ++ + if (BOND_MODE(bond) == BOND_MODE_8023AD) { + SLAVE_AD_INFO(slave) = kzalloc(sizeof(struct ad_slave_info), + GFP_KERNEL); + if (!SLAVE_AD_INFO(slave)) { +- kfree(slave); ++ kobject_put(&slave->kobj); + return NULL; + } + } +@@ -1289,17 +1327,6 @@ static struct slave *bond_alloc_slave(st + return slave; + } + +-static void bond_free_slave(struct slave *slave) +-{ +- struct bonding *bond = bond_get_bond_by_slave(slave); +- +- cancel_delayed_work_sync(&slave->notify_work); +- if (BOND_MODE(bond) == BOND_MODE_8023AD) +- kfree(SLAVE_AD_INFO(slave)); +- +- kfree(slave); +-} +- + static void bond_fill_ifbond(struct bonding *bond, struct ifbond *info) + { + info->bond_mode = BOND_MODE(bond); +@@ -1487,14 +1514,12 @@ int bond_enslave(struct net_device *bond + bond->dev->addr_assign_type == NET_ADDR_RANDOM) + bond_set_dev_addr(bond->dev, slave_dev); + +- new_slave = bond_alloc_slave(bond); ++ new_slave = bond_alloc_slave(bond, slave_dev); + if (!new_slave) { + res = -ENOMEM; + goto err_undo_flags; + } + +- new_slave->bond = bond; +- new_slave->dev = slave_dev; + /* Set the new_slave's queue_id to be zero. Queue ID mapping + * is set via sysfs or module option if desired. + */ +@@ -1821,7 +1846,7 @@ err_restore_mtu: + dev_set_mtu(slave_dev, new_slave->original_mtu); + + err_free: +- bond_free_slave(new_slave); ++ kobject_put(&new_slave->kobj); + + err_undo_flags: + /* Enslave of first slave has failed and we need to fix master's mac */ +@@ -2009,7 +2034,7 @@ static int __bond_release_one(struct net + if (!netif_is_bond_master(slave_dev)) + slave_dev->priv_flags &= ~IFF_BONDING; + +- bond_free_slave(slave); ++ kobject_put(&slave->kobj); + + return 0; + } +--- a/drivers/net/bonding/bond_sysfs_slave.c ++++ b/drivers/net/bonding/bond_sysfs_slave.c +@@ -125,7 +125,6 @@ static const struct slave_attribute *sla + }; + + #define to_slave_attr(_at) container_of(_at, struct slave_attribute, attr) +-#define to_slave(obj) container_of(obj, struct slave, kobj) + + static ssize_t slave_show(struct kobject *kobj, + struct attribute *attr, char *buf) +@@ -136,28 +135,15 @@ static ssize_t slave_show(struct kobject + return slave_attr->show(slave, buf); + } + +-static const struct sysfs_ops slave_sysfs_ops = { ++const struct sysfs_ops slave_sysfs_ops = { + .show = slave_show, + }; + +-static struct kobj_type slave_ktype = { +-#ifdef CONFIG_SYSFS +- .sysfs_ops = &slave_sysfs_ops, +-#endif +-}; +- + int bond_sysfs_slave_add(struct slave *slave) + { + const struct slave_attribute **a; + int err; + +- err = kobject_init_and_add(&slave->kobj, &slave_ktype, +- &(slave->dev->dev.kobj), "bonding_slave"); +- if (err) { +- kobject_put(&slave->kobj); +- return err; +- } +- + for (a = slave_attrs; *a; ++a) { + err = sysfs_create_file(&slave->kobj, &((*a)->attr)); + if (err) { +@@ -175,6 +161,4 @@ void bond_sysfs_slave_del(struct slave * + + for (a = slave_attrs; *a; ++a) + sysfs_remove_file(&slave->kobj, &((*a)->attr)); +- +- kobject_put(&slave->kobj); + } +--- a/include/net/bonding.h ++++ b/include/net/bonding.h +@@ -170,6 +170,11 @@ struct slave { + struct rtnl_link_stats64 slave_stats; + }; + ++static inline struct slave *to_slave(struct kobject *kobj) ++{ ++ return container_of(kobj, struct slave, kobj); ++} ++ + struct bond_up_slave { + unsigned int count; + struct rcu_head rcu; +@@ -733,6 +738,9 @@ extern struct bond_parm_tbl ad_select_tb + /* exported from bond_netlink.c */ + extern struct rtnl_link_ops bond_link_ops; + ++/* exported from bond_sysfs_slave.c */ ++extern const struct sysfs_ops slave_sysfs_ops; ++ + static inline void bond_tx_drop(struct net_device *dev, struct sk_buff *skb) + { + atomic_long_inc(&dev->tx_dropped); diff --git a/queue-4.19/i40e-fix-removing-driver-while-bare-metal-vfs-pass-traffic.patch b/queue-4.19/i40e-fix-removing-driver-while-bare-metal-vfs-pass-traffic.patch new file mode 100644 index 00000000000..fa0337dda9d --- /dev/null +++ b/queue-4.19/i40e-fix-removing-driver-while-bare-metal-vfs-pass-traffic.patch @@ -0,0 +1,153 @@ +From foo@baz Wed Dec 2 11:19:34 AM CET 2020 +From: Sylwester Dziedziuch +Date: Fri, 20 Nov 2020 10:06:40 -0800 +Subject: i40e: Fix removing driver while bare-metal VFs pass traffic + +From: Sylwester Dziedziuch + +[ Upstream commit 2980cbd4dce7b1e9bf57df3ced43a7b184986f50 ] + +Prevent VFs from resetting when PF driver is being unloaded: +- introduce new pf state: __I40E_VF_RESETS_DISABLED; +- check if pf state has __I40E_VF_RESETS_DISABLED state set, + if so, disable any further VFLR event notifications; +- when i40e_remove (rmmod i40e) is called, disable any resets on + the VFs; + +Previously if there were bare-metal VFs passing traffic and PF +driver was removed, there was a possibility of VFs triggering a Tx +timeout right before iavf_remove. This was causing iavf_close to +not be called because there is a check in the beginning of iavf_remove +that bails out early if adapter->state < IAVF_DOWN_PENDING. This +makes it so some resources do not get cleaned up. + +Fixes: 6a9ddb36eeb8 ("i40e: disable IOV before freeing resources") +Signed-off-by: Slawomir Laba +Signed-off-by: Brett Creeley +Signed-off-by: Sylwester Dziedziuch +Tested-by: Konrad Jankowski +Signed-off-by: Tony Nguyen +Link: https://lore.kernel.org/r/20201120180640.3654474-1-anthony.l.nguyen@intel.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/i40e/i40e.h | 1 + drivers/net/ethernet/intel/i40e/i40e_main.c | 22 ++++++++++++----- + drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 26 ++++++++++++--------- + 3 files changed, 31 insertions(+), 18 deletions(-) + +--- a/drivers/net/ethernet/intel/i40e/i40e.h ++++ b/drivers/net/ethernet/intel/i40e/i40e.h +@@ -147,6 +147,7 @@ enum i40e_state_t { + __I40E_CLIENT_SERVICE_REQUESTED, + __I40E_CLIENT_L2_CHANGE, + __I40E_CLIENT_RESET, ++ __I40E_VF_RESETS_DISABLED, /* disable resets during i40e_remove */ + /* This must be last as it determines the size of the BITMAP */ + __I40E_STATE_SIZE__, + }; +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -3895,8 +3895,16 @@ static irqreturn_t i40e_intr(int irq, vo + } + + if (icr0 & I40E_PFINT_ICR0_VFLR_MASK) { +- ena_mask &= ~I40E_PFINT_ICR0_ENA_VFLR_MASK; +- set_bit(__I40E_VFLR_EVENT_PENDING, pf->state); ++ /* disable any further VFLR event notifications */ ++ if (test_bit(__I40E_VF_RESETS_DISABLED, pf->state)) { ++ u32 reg = rd32(hw, I40E_PFINT_ICR0_ENA); ++ ++ reg &= ~I40E_PFINT_ICR0_VFLR_MASK; ++ wr32(hw, I40E_PFINT_ICR0_ENA, reg); ++ } else { ++ ena_mask &= ~I40E_PFINT_ICR0_ENA_VFLR_MASK; ++ set_bit(__I40E_VFLR_EVENT_PENDING, pf->state); ++ } + } + + if (icr0 & I40E_PFINT_ICR0_GRST_MASK) { +@@ -14155,6 +14163,11 @@ static void i40e_remove(struct pci_dev * + while (test_bit(__I40E_RESET_RECOVERY_PENDING, pf->state)) + usleep_range(1000, 2000); + ++ if (pf->flags & I40E_FLAG_SRIOV_ENABLED) { ++ set_bit(__I40E_VF_RESETS_DISABLED, pf->state); ++ i40e_free_vfs(pf); ++ pf->flags &= ~I40E_FLAG_SRIOV_ENABLED; ++ } + /* no more scheduling of any task */ + set_bit(__I40E_SUSPENDED, pf->state); + set_bit(__I40E_DOWN, pf->state); +@@ -14168,11 +14181,6 @@ static void i40e_remove(struct pci_dev * + */ + i40e_notify_client_of_netdev_close(pf->vsi[pf->lan_vsi], false); + +- if (pf->flags & I40E_FLAG_SRIOV_ENABLED) { +- i40e_free_vfs(pf); +- pf->flags &= ~I40E_FLAG_SRIOV_ENABLED; +- } +- + i40e_fdir_teardown(pf); + + /* If there is a switch structure or any orphans, remove them. +--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +@@ -1204,7 +1204,8 @@ static void i40e_cleanup_reset_vf(struct + * @vf: pointer to the VF structure + * @flr: VFLR was issued or not + * +- * Returns true if the VF is reset, false otherwise. ++ * Returns true if the VF is in reset, resets successfully, or resets ++ * are disabled and false otherwise. + **/ + bool i40e_reset_vf(struct i40e_vf *vf, bool flr) + { +@@ -1214,11 +1215,14 @@ bool i40e_reset_vf(struct i40e_vf *vf, b + u32 reg; + int i; + ++ if (test_bit(__I40E_VF_RESETS_DISABLED, pf->state)) ++ return true; ++ + /* If the VFs have been disabled, this means something else is + * resetting the VF, so we shouldn't continue. + */ + if (test_and_set_bit(__I40E_VF_DISABLE, pf->state)) +- return false; ++ return true; + + i40e_trigger_vf_reset(vf, flr); + +@@ -1382,6 +1386,15 @@ void i40e_free_vfs(struct i40e_pf *pf) + + i40e_notify_client_of_vf_enable(pf, 0); + ++ /* Disable IOV before freeing resources. This lets any VF drivers ++ * running in the host get themselves cleaned up before we yank ++ * the carpet out from underneath their feet. ++ */ ++ if (!pci_vfs_assigned(pf->pdev)) ++ pci_disable_sriov(pf->pdev); ++ else ++ dev_warn(&pf->pdev->dev, "VFs are assigned - not disabling SR-IOV\n"); ++ + /* Amortize wait time by stopping all VFs at the same time */ + for (i = 0; i < pf->num_alloc_vfs; i++) { + if (test_bit(I40E_VF_STATE_INIT, &pf->vf[i].vf_states)) +@@ -1397,15 +1410,6 @@ void i40e_free_vfs(struct i40e_pf *pf) + i40e_vsi_wait_queues_disabled(pf->vsi[pf->vf[i].lan_vsi_idx]); + } + +- /* Disable IOV before freeing resources. This lets any VF drivers +- * running in the host get themselves cleaned up before we yank +- * the carpet out from underneath their feet. +- */ +- if (!pci_vfs_assigned(pf->pdev)) +- pci_disable_sriov(pf->pdev); +- else +- dev_warn(&pf->pdev->dev, "VFs are assigned - not disabling SR-IOV\n"); +- + /* free up VF resources */ + tmp = pf->num_alloc_vfs; + pf->num_alloc_vfs = 0; diff --git a/queue-4.19/ibmvnic-fix-call_netdevice_notifiers-in-do_reset.patch b/queue-4.19/ibmvnic-fix-call_netdevice_notifiers-in-do_reset.patch new file mode 100644 index 00000000000..8ce82fbc759 --- /dev/null +++ b/queue-4.19/ibmvnic-fix-call_netdevice_notifiers-in-do_reset.patch @@ -0,0 +1,37 @@ +From foo@baz Wed Dec 2 11:19:34 AM CET 2020 +From: Lijun Pan +Date: Fri, 20 Nov 2020 16:40:11 -0600 +Subject: ibmvnic: fix call_netdevice_notifiers in do_reset + +From: Lijun Pan + +[ Upstream commit 8393597579f5250636f1cff157ea73f402b6501e ] + +When netdev_notify_peers was substituted in +commit 986103e7920c ("net/ibmvnic: Fix RTNL deadlock during device reset"), +call_netdevice_notifiers(NETDEV_RESEND_IGMP, dev) was missed. +Fix it now. + +Fixes: 986103e7920c ("net/ibmvnic: Fix RTNL deadlock during device reset") +Signed-off-by: Lijun Pan +Reviewed-by: Dany Madden +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/ibm/ibmvnic.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -1878,8 +1878,10 @@ static int do_reset(struct ibmvnic_adapt + napi_schedule(&adapter->napi[i]); + + if (adapter->reset_reason != VNIC_RESET_FAILOVER && +- adapter->reset_reason != VNIC_RESET_CHANGE_PARAM) ++ adapter->reset_reason != VNIC_RESET_CHANGE_PARAM) { + call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, netdev); ++ call_netdevice_notifiers(NETDEV_RESEND_IGMP, netdev); ++ } + + netif_carrier_on(netdev); + diff --git a/queue-4.19/ibmvnic-notify-peers-when-failover-and-migration-happen.patch b/queue-4.19/ibmvnic-notify-peers-when-failover-and-migration-happen.patch new file mode 100644 index 00000000000..86ff6a7db9b --- /dev/null +++ b/queue-4.19/ibmvnic-notify-peers-when-failover-and-migration-happen.patch @@ -0,0 +1,58 @@ +From foo@baz Wed Dec 2 11:19:34 AM CET 2020 +From: Lijun Pan +Date: Fri, 20 Nov 2020 16:40:12 -0600 +Subject: ibmvnic: notify peers when failover and migration happen + +From: Lijun Pan + +[ Upstream commit 98025bce3a6200a0c4637272a33b5913928ba5b8 ] + +Commit 61d3e1d9bc2a ("ibmvnic: Remove netdev notify for failover resets") +excluded the failover case for notify call because it said +netdev_notify_peers() can cause network traffic to stall or halt. +Current testing does not show network traffic stall +or halt because of the notify call for failover event. +netdev_notify_peers may be used when a device wants to inform the +rest of the network about some sort of a reconfiguration +such as failover or migration. + +It is unnecessary to call that in other events like +FATAL, NON_FATAL, CHANGE_PARAM, and TIMEOUT resets +since in those scenarios the hardware does not change. +If the driver must do a hard reset, it is necessary to notify peers. + +Fixes: 61d3e1d9bc2a ("ibmvnic: Remove netdev notify for failover resets") +Suggested-by: Brian King +Suggested-by: Pradeep Satyanarayana +Signed-off-by: Dany Madden +Signed-off-by: Lijun Pan +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/ibm/ibmvnic.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -1877,8 +1877,9 @@ static int do_reset(struct ibmvnic_adapt + for (i = 0; i < adapter->req_rx_queues; i++) + napi_schedule(&adapter->napi[i]); + +- if (adapter->reset_reason != VNIC_RESET_FAILOVER && +- adapter->reset_reason != VNIC_RESET_CHANGE_PARAM) { ++ if ((adapter->reset_reason != VNIC_RESET_FAILOVER && ++ adapter->reset_reason != VNIC_RESET_CHANGE_PARAM) || ++ adapter->reset_reason == VNIC_RESET_MOBILITY) { + call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, netdev); + call_netdevice_notifiers(NETDEV_RESEND_IGMP, netdev); + } +@@ -2106,6 +2107,9 @@ static int ibmvnic_reset(struct ibmvnic_ + netdev_dbg(adapter->netdev, "Scheduling reset (reason %d)\n", reason); + schedule_work(&adapter->ibmvnic_reset); + ++ call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, netdev); ++ call_netdevice_notifiers(NETDEV_RESEND_IGMP, netdev); ++ + return 0; + err: + if (adapter->wait_for_reset) diff --git a/queue-4.19/ipv6-addrlabel-fix-possible-memory-leak-in-ip6addrlbl_net_init.patch b/queue-4.19/ipv6-addrlabel-fix-possible-memory-leak-in-ip6addrlbl_net_init.patch new file mode 100644 index 00000000000..eed9f941749 --- /dev/null +++ b/queue-4.19/ipv6-addrlabel-fix-possible-memory-leak-in-ip6addrlbl_net_init.patch @@ -0,0 +1,84 @@ +From foo@baz Wed Dec 2 11:19:34 AM CET 2020 +From: Wang Hai +Date: Tue, 24 Nov 2020 15:17:28 +0800 +Subject: ipv6: addrlabel: fix possible memory leak in ip6addrlbl_net_init + +From: Wang Hai + +[ Upstream commit e255e11e66da8281e337e4e352956e8a4999fca4 ] + +kmemleak report a memory leak as follows: + +unreferenced object 0xffff8880059c6a00 (size 64): + comm "ip", pid 23696, jiffies 4296590183 (age 1755.384s) + hex dump (first 32 bytes): + 20 01 00 10 00 00 00 00 00 00 00 00 00 00 00 00 ............... + 1c 00 00 00 00 00 00 00 00 00 00 00 07 00 00 00 ................ + backtrace: + [<00000000aa4e7a87>] ip6addrlbl_add+0x90/0xbb0 + [<0000000070b8d7f1>] ip6addrlbl_net_init+0x109/0x170 + [<000000006a9ca9d4>] ops_init+0xa8/0x3c0 + [<000000002da57bf2>] setup_net+0x2de/0x7e0 + [<000000004e52d573>] copy_net_ns+0x27d/0x530 + [<00000000b07ae2b4>] create_new_namespaces+0x382/0xa30 + [<000000003b76d36f>] unshare_nsproxy_namespaces+0xa1/0x1d0 + [<0000000030653721>] ksys_unshare+0x3a4/0x780 + [<0000000007e82e40>] __x64_sys_unshare+0x2d/0x40 + [<0000000031a10c08>] do_syscall_64+0x33/0x40 + [<0000000099df30e7>] entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +We should free all rules when we catch an error in ip6addrlbl_net_init(). +otherwise a memory leak will occur. + +Fixes: 2a8cc6c89039 ("[IPV6] ADDRCONF: Support RFC3484 configurable address selection policy table.") +Reported-by: Hulk Robot +Signed-off-by: Wang Hai +Link: https://lore.kernel.org/r/20201124071728.8385-1-wanghai38@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/addrlabel.c | 26 +++++++++++++++++--------- + 1 file changed, 17 insertions(+), 9 deletions(-) + +--- a/net/ipv6/addrlabel.c ++++ b/net/ipv6/addrlabel.c +@@ -306,7 +306,9 @@ static int ip6addrlbl_del(struct net *ne + /* add default label */ + static int __net_init ip6addrlbl_net_init(struct net *net) + { +- int err = 0; ++ struct ip6addrlbl_entry *p = NULL; ++ struct hlist_node *n; ++ int err; + int i; + + ADDRLABEL(KERN_DEBUG "%s\n", __func__); +@@ -315,14 +317,20 @@ static int __net_init ip6addrlbl_net_ini + INIT_HLIST_HEAD(&net->ipv6.ip6addrlbl_table.head); + + for (i = 0; i < ARRAY_SIZE(ip6addrlbl_init_table); i++) { +- int ret = ip6addrlbl_add(net, +- ip6addrlbl_init_table[i].prefix, +- ip6addrlbl_init_table[i].prefixlen, +- 0, +- ip6addrlbl_init_table[i].label, 0); +- /* XXX: should we free all rules when we catch an error? */ +- if (ret && (!err || err != -ENOMEM)) +- err = ret; ++ err = ip6addrlbl_add(net, ++ ip6addrlbl_init_table[i].prefix, ++ ip6addrlbl_init_table[i].prefixlen, ++ 0, ++ ip6addrlbl_init_table[i].label, 0); ++ if (err) ++ goto err_ip6addrlbl_add; ++ } ++ return 0; ++ ++err_ip6addrlbl_add: ++ hlist_for_each_entry_safe(p, n, &net->ipv6.ip6addrlbl_table.head, list) { ++ hlist_del_rcu(&p->list); ++ kfree_rcu(p, rcu); + } + return err; + } diff --git a/queue-4.19/net-af_iucv-set-correct-sk_protocol-for-child-sockets.patch b/queue-4.19/net-af_iucv-set-correct-sk_protocol-for-child-sockets.patch new file mode 100644 index 00000000000..932e6fbeab1 --- /dev/null +++ b/queue-4.19/net-af_iucv-set-correct-sk_protocol-for-child-sockets.patch @@ -0,0 +1,45 @@ +From foo@baz Wed Dec 2 11:19:34 AM CET 2020 +From: Julian Wiedmann +Date: Fri, 20 Nov 2020 11:06:57 +0100 +Subject: net/af_iucv: set correct sk_protocol for child sockets + +From: Julian Wiedmann + +[ Upstream commit c5dab0941fcdc9664eb0ec0d4d51433216d91336 ] + +Child sockets erroneously inherit their parent's sk_type (ie. SOCK_*), +instead of the PF_IUCV protocol that the parent was created with in +iucv_sock_create(). + +We're currently not using sk->sk_protocol ourselves, so this shouldn't +have much impact (except eg. getting the output in skb_dump() right). + +Fixes: eac3731bd04c ("[S390]: Add AF_IUCV socket support") +Signed-off-by: Julian Wiedmann +Link: https://lore.kernel.org/r/20201120100657.34407-1-jwi@linux.ibm.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/iucv/af_iucv.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/iucv/af_iucv.c ++++ b/net/iucv/af_iucv.c +@@ -1782,7 +1782,7 @@ static int iucv_callback_connreq(struct + } + + /* Create the new socket */ +- nsk = iucv_sock_alloc(NULL, sk->sk_type, GFP_ATOMIC, 0); ++ nsk = iucv_sock_alloc(NULL, sk->sk_protocol, GFP_ATOMIC, 0); + if (!nsk) { + err = pr_iucv->path_sever(path, user_data); + iucv_path_free(path); +@@ -1992,7 +1992,7 @@ static int afiucv_hs_callback_syn(struct + goto out; + } + +- nsk = iucv_sock_alloc(NULL, sk->sk_type, GFP_ATOMIC, 0); ++ nsk = iucv_sock_alloc(NULL, sk->sk_protocol, GFP_ATOMIC, 0); + bh_lock_sock(sk); + if ((sk->sk_state != IUCV_LISTEN) || + sk_acceptq_is_full(sk) || diff --git a/queue-4.19/net-tls-missing-received-data-after-fast-remote-close.patch b/queue-4.19/net-tls-missing-received-data-after-fast-remote-close.patch new file mode 100644 index 00000000000..be7bedf47ab --- /dev/null +++ b/queue-4.19/net-tls-missing-received-data-after-fast-remote-close.patch @@ -0,0 +1,50 @@ +From foo@baz Wed Dec 2 11:19:34 AM CET 2020 +From: Vadim Fedorenko +Date: Thu, 19 Nov 2020 18:59:48 +0300 +Subject: net/tls: missing received data after fast remote close + +From: Vadim Fedorenko + +[ Upstream commit 20ffc7adf53a5fd3d19751fbff7895bcca66686e ] + +In case when tcp socket received FIN after some data and the +parser haven't started before reading data caller will receive +an empty buffer. This behavior differs from plain TCP socket and +leads to special treating in user-space. +The flow that triggers the race is simple. Server sends small +amount of data right after the connection is configured to use TLS +and closes the connection. In this case receiver sees TLS Handshake +data, configures TLS socket right after Change Cipher Spec record. +While the configuration is in process, TCP socket receives small +Application Data record, Encrypted Alert record and FIN packet. So +the TCP socket changes sk_shutdown to RCV_SHUTDOWN and sk_flag with +SK_DONE bit set. The received data is not parsed upon arrival and is +never sent to user-space. + +Patch unpauses parser directly if we have unparsed data in tcp +receive queue. + +Fixes: fcf4793e278e ("tls: check RCV_SHUTDOWN in tls_wait_data") +Signed-off-by: Vadim Fedorenko +Link: https://lore.kernel.org/r/1605801588-12236-1-git-send-email-vfedorenko@novek.ru +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/tls/tls_sw.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/net/tls/tls_sw.c ++++ b/net/tls/tls_sw.c +@@ -630,6 +630,12 @@ static struct sk_buff *tls_wait_data(str + return NULL; + } + ++ if (!skb_queue_empty(&sk->sk_receive_queue)) { ++ __strp_unpause(&ctx->strp); ++ if (ctx->recv_pkt) ++ return ctx->recv_pkt; ++ } ++ + if (sk->sk_shutdown & RCV_SHUTDOWN) + return NULL; + diff --git a/queue-4.19/net-tls-protect-from-calling-tls_dev_del-for-tls-rx-twice.patch b/queue-4.19/net-tls-protect-from-calling-tls_dev_del-for-tls-rx-twice.patch new file mode 100644 index 00000000000..de5883541c8 --- /dev/null +++ b/queue-4.19/net-tls-protect-from-calling-tls_dev_del-for-tls-rx-twice.patch @@ -0,0 +1,65 @@ +From foo@baz Wed Dec 2 11:19:34 AM CET 2020 +From: Maxim Mikityanskiy +Date: Wed, 25 Nov 2020 14:18:10 -0800 +Subject: net/tls: Protect from calling tls_dev_del for TLS RX twice + +From: Maxim Mikityanskiy + +[ Upstream commit 025cc2fb6a4e84e9a0552c0017dcd1c24b7ac7da ] + +tls_device_offload_cleanup_rx doesn't clear tls_ctx->netdev after +calling tls_dev_del if TLX TX offload is also enabled. Clearing +tls_ctx->netdev gets postponed until tls_device_gc_task. It leaves a +time frame when tls_device_down may get called and call tls_dev_del for +RX one extra time, confusing the driver, which may lead to a crash. + +This patch corrects this racy behavior by adding a flag to prevent +tls_device_down from calling tls_dev_del the second time. + +Fixes: e8f69799810c ("net/tls: Add generic NIC offload infrastructure") +Signed-off-by: Maxim Mikityanskiy +Signed-off-by: Saeed Mahameed +Link: https://lore.kernel.org/r/20201125221810.69870-1-saeedm@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + include/net/tls.h | 6 ++++++ + net/tls/tls_device.c | 5 ++++- + 2 files changed, 10 insertions(+), 1 deletion(-) + +--- a/include/net/tls.h ++++ b/include/net/tls.h +@@ -163,6 +163,12 @@ enum { + + enum tls_context_flags { + TLS_RX_SYNC_RUNNING = 0, ++ /* tls_dev_del was called for the RX side, device state was released, ++ * but tls_ctx->netdev might still be kept, because TX-side driver ++ * resources might not be released yet. Used to prevent the second ++ * tls_dev_del call in tls_device_down if it happens simultaneously. ++ */ ++ TLS_RX_DEV_CLOSED = 2, + }; + + struct cipher_context { +--- a/net/tls/tls_device.c ++++ b/net/tls/tls_device.c +@@ -955,6 +955,8 @@ void tls_device_offload_cleanup_rx(struc + if (tls_ctx->tx_conf != TLS_HW) { + dev_put(netdev); + tls_ctx->netdev = NULL; ++ } else { ++ set_bit(TLS_RX_DEV_CLOSED, &tls_ctx->flags); + } + out: + up_read(&device_offload_lock); +@@ -984,7 +986,8 @@ static int tls_device_down(struct net_de + if (ctx->tx_conf == TLS_HW) + netdev->tlsdev_ops->tls_dev_del(netdev, ctx, + TLS_OFFLOAD_CTX_DIR_TX); +- if (ctx->rx_conf == TLS_HW) ++ if (ctx->rx_conf == TLS_HW && ++ !test_bit(TLS_RX_DEV_CLOSED, &ctx->flags)) + netdev->tlsdev_ops->tls_dev_del(netdev, ctx, + TLS_OFFLOAD_CTX_DIR_RX); + WRITE_ONCE(ctx->netdev, NULL); diff --git a/queue-4.19/rose-fix-null-pointer-dereference-in-rose_send_frame.patch b/queue-4.19/rose-fix-null-pointer-dereference-in-rose_send_frame.patch new file mode 100644 index 00000000000..074cffbddbf --- /dev/null +++ b/queue-4.19/rose-fix-null-pointer-dereference-in-rose_send_frame.patch @@ -0,0 +1,64 @@ +From foo@baz Wed Dec 2 11:19:34 AM CET 2020 +From: Anmol Karn +Date: Fri, 20 Nov 2020 00:40:43 +0530 +Subject: rose: Fix Null pointer dereference in rose_send_frame() + +From: Anmol Karn + +[ Upstream commit 3b3fd068c56e3fbea30090859216a368398e39bf ] + +rose_send_frame() dereferences `neigh->dev` when called from +rose_transmit_clear_request(), and the first occurrence of the +`neigh` is in rose_loopback_timer() as `rose_loopback_neigh`, +and it is initialized in rose_add_loopback_neigh() as NULL. +i.e when `rose_loopback_neigh` used in rose_loopback_timer() +its `->dev` was still NULL and rose_loopback_timer() was calling +rose_rx_call_request() without checking for NULL. + +- net/rose/rose_link.c +This bug seems to get triggered in this line: + +rose_call = (ax25_address *)neigh->dev->dev_addr; + +Fix it by adding NULL checking for `rose_loopback_neigh->dev` +in rose_loopback_timer(). + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Suggested-by: Jakub Kicinski +Reported-by: syzbot+a1c743815982d9496393@syzkaller.appspotmail.com +Tested-by: syzbot+a1c743815982d9496393@syzkaller.appspotmail.com +Link: https://syzkaller.appspot.com/bug?id=9d2a7ca8c7f2e4b682c97578dfa3f236258300b3 +Signed-off-by: Anmol Karn +Link: https://lore.kernel.org/r/20201119191043.28813-1-anmol.karan123@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/rose/rose_loopback.c | 17 +++++++++++++---- + 1 file changed, 13 insertions(+), 4 deletions(-) + +--- a/net/rose/rose_loopback.c ++++ b/net/rose/rose_loopback.c +@@ -99,10 +99,19 @@ static void rose_loopback_timer(struct t + } + + if (frametype == ROSE_CALL_REQUEST) { +- if ((dev = rose_dev_get(dest)) != NULL) { +- if (rose_rx_call_request(skb, dev, rose_loopback_neigh, lci_o) == 0) +- kfree_skb(skb); +- } else { ++ if (!rose_loopback_neigh->dev) { ++ kfree_skb(skb); ++ continue; ++ } ++ ++ dev = rose_dev_get(dest); ++ if (!dev) { ++ kfree_skb(skb); ++ continue; ++ } ++ ++ if (rose_rx_call_request(skb, dev, rose_loopback_neigh, lci_o) == 0) { ++ dev_put(dev); + kfree_skb(skb); + } + } else { diff --git a/queue-4.19/series b/queue-4.19/series new file mode 100644 index 00000000000..66f00ca3518 --- /dev/null +++ b/queue-4.19/series @@ -0,0 +1,13 @@ +ipv6-addrlabel-fix-possible-memory-leak-in-ip6addrlbl_net_init.patch +net-af_iucv-set-correct-sk_protocol-for-child-sockets.patch +net-tls-missing-received-data-after-fast-remote-close.patch +rose-fix-null-pointer-dereference-in-rose_send_frame.patch +sock-set-sk_err-to-ee_errno-on-dequeue-from-errq.patch +tcp-set-inet_ecn_xmit-configuration-in-tcp_reinit_congestion_control.patch +tun-honor-iocb_nowait-flag.patch +usbnet-ipheth-fix-connectivity-with-ios-14.patch +net-tls-protect-from-calling-tls_dev_del-for-tls-rx-twice.patch +ibmvnic-fix-call_netdevice_notifiers-in-do_reset.patch +ibmvnic-notify-peers-when-failover-and-migration-happen.patch +i40e-fix-removing-driver-while-bare-metal-vfs-pass-traffic.patch +bonding-wait-for-sysfs-kobject-destruction-before-freeing-struct-slave.patch diff --git a/queue-4.19/sock-set-sk_err-to-ee_errno-on-dequeue-from-errq.patch b/queue-4.19/sock-set-sk_err-to-ee_errno-on-dequeue-from-errq.patch new file mode 100644 index 00000000000..1f853f6d4b2 --- /dev/null +++ b/queue-4.19/sock-set-sk_err-to-ee_errno-on-dequeue-from-errq.patch @@ -0,0 +1,47 @@ +From foo@baz Wed Dec 2 11:19:34 AM CET 2020 +From: Willem de Bruijn +Date: Thu, 26 Nov 2020 10:12:20 -0500 +Subject: sock: set sk_err to ee_errno on dequeue from errq + +From: Willem de Bruijn + +[ Upstream commit 985f7337421a811cb354ca93882f943c8335a6f5 ] + +When setting sk_err, set it to ee_errno, not ee_origin. + +Commit f5f99309fa74 ("sock: do not set sk_err in +sock_dequeue_err_skb") disabled updating sk_err on errq dequeue, +which is correct for most error types (origins): + + - sk->sk_err = err; + +Commit 38b257938ac6 ("sock: reset sk_err when the error queue is +empty") reenabled the behavior for IMCP origins, which do require it: + + + if (icmp_next) + + sk->sk_err = SKB_EXT_ERR(skb_next)->ee.ee_origin; + +But read from ee_errno. + +Fixes: 38b257938ac6 ("sock: reset sk_err when the error queue is empty") +Reported-by: Ayush Ranjan +Signed-off-by: Willem de Bruijn +Acked-by: Soheil Hassas Yeganeh +Link: https://lore.kernel.org/r/20201126151220.2819322-1-willemdebruijn.kernel@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/core/skbuff.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -4265,7 +4265,7 @@ struct sk_buff *sock_dequeue_err_skb(str + if (skb && (skb_next = skb_peek(q))) { + icmp_next = is_icmp_err_skb(skb_next); + if (icmp_next) +- sk->sk_err = SKB_EXT_ERR(skb_next)->ee.ee_origin; ++ sk->sk_err = SKB_EXT_ERR(skb_next)->ee.ee_errno; + } + spin_unlock_irqrestore(&q->lock, flags); + diff --git a/queue-4.19/tcp-set-inet_ecn_xmit-configuration-in-tcp_reinit_congestion_control.patch b/queue-4.19/tcp-set-inet_ecn_xmit-configuration-in-tcp_reinit_congestion_control.patch new file mode 100644 index 00000000000..0fb94c82b3c --- /dev/null +++ b/queue-4.19/tcp-set-inet_ecn_xmit-configuration-in-tcp_reinit_congestion_control.patch @@ -0,0 +1,49 @@ +From foo@baz Wed Dec 2 11:19:34 AM CET 2020 +From: Alexander Duyck +Date: Thu, 19 Nov 2020 13:23:58 -0800 +Subject: tcp: Set INET_ECN_xmit configuration in tcp_reinit_congestion_control + +From: Alexander Duyck + +[ Upstream commit 55472017a4219ca965a957584affdb17549ae4a4 ] + +When setting congestion control via a BPF program it is seen that the +SYN/ACK for packets within a given flow will not include the ECT0 flag. A +bit of simple printk debugging shows that when this is configured without +BPF we will see the value INET_ECN_xmit value initialized in +tcp_assign_congestion_control however when we configure this via BPF the +socket is in the closed state and as such it isn't configured, and I do not +see it being initialized when we transition the socket into the listen +state. The result of this is that the ECT0 bit is configured based on +whatever the default state is for the socket. + +Any easy way to reproduce this is to monitor the following with tcpdump: +tools/testing/selftests/bpf/test_progs -t bpf_tcp_ca + +Without this patch the SYN/ACK will follow whatever the default is. If dctcp +all SYN/ACK packets will have the ECT0 bit set, and if it is not then ECT0 +will be cleared on all SYN/ACK packets. With this patch applied the SYN/ACK +bit matches the value seen on the other packets in the given stream. + +Fixes: 91b5b21c7c16 ("bpf: Add support for changing congestion control") +Signed-off-by: Alexander Duyck +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/tcp_cong.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/net/ipv4/tcp_cong.c ++++ b/net/ipv4/tcp_cong.c +@@ -196,6 +196,11 @@ static void tcp_reinit_congestion_contro + icsk->icsk_ca_setsockopt = 1; + memset(icsk->icsk_ca_priv, 0, sizeof(icsk->icsk_ca_priv)); + ++ if (ca->flags & TCP_CONG_NEEDS_ECN) ++ INET_ECN_xmit(sk); ++ else ++ INET_ECN_dontxmit(sk); ++ + if (!((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) + tcp_init_congestion_control(sk); + } diff --git a/queue-4.19/tun-honor-iocb_nowait-flag.patch b/queue-4.19/tun-honor-iocb_nowait-flag.patch new file mode 100644 index 00000000000..6957076aba2 --- /dev/null +++ b/queue-4.19/tun-honor-iocb_nowait-flag.patch @@ -0,0 +1,59 @@ +From foo@baz Wed Dec 2 11:19:34 AM CET 2020 +From: Jens Axboe +Date: Fri, 20 Nov 2020 07:59:54 -0700 +Subject: tun: honor IOCB_NOWAIT flag + +From: Jens Axboe + +[ Upstream commit 5aac0390a63b8718237a61dd0d24a29201d1c94a ] + +tun only checks the file O_NONBLOCK flag, but it should also be checking +the iocb IOCB_NOWAIT flag. Any fops using ->read/write_iter() should check +both, otherwise it breaks users that correctly expect O_NONBLOCK semantics +if IOCB_NOWAIT is set. + +Signed-off-by: Jens Axboe +Link: https://lore.kernel.org/r/e9451860-96cc-c7c7-47b8-fe42cadd5f4c@kernel.dk +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/tun.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +--- a/drivers/net/tun.c ++++ b/drivers/net/tun.c +@@ -1988,12 +1988,15 @@ static ssize_t tun_chr_write_iter(struct + struct tun_file *tfile = file->private_data; + struct tun_struct *tun = tun_get(tfile); + ssize_t result; ++ int noblock = 0; + + if (!tun) + return -EBADFD; + +- result = tun_get_user(tun, tfile, NULL, from, +- file->f_flags & O_NONBLOCK, false); ++ if ((file->f_flags & O_NONBLOCK) || (iocb->ki_flags & IOCB_NOWAIT)) ++ noblock = 1; ++ ++ result = tun_get_user(tun, tfile, NULL, from, noblock, false); + + tun_put(tun); + return result; +@@ -2214,10 +2217,15 @@ static ssize_t tun_chr_read_iter(struct + struct tun_file *tfile = file->private_data; + struct tun_struct *tun = tun_get(tfile); + ssize_t len = iov_iter_count(to), ret; ++ int noblock = 0; + + if (!tun) + return -EBADFD; +- ret = tun_do_read(tun, tfile, to, file->f_flags & O_NONBLOCK, NULL); ++ ++ if ((file->f_flags & O_NONBLOCK) || (iocb->ki_flags & IOCB_NOWAIT)) ++ noblock = 1; ++ ++ ret = tun_do_read(tun, tfile, to, noblock, NULL); + ret = min_t(ssize_t, ret, len); + if (ret > 0) + iocb->ki_pos = ret; diff --git a/queue-4.19/usbnet-ipheth-fix-connectivity-with-ios-14.patch b/queue-4.19/usbnet-ipheth-fix-connectivity-with-ios-14.patch new file mode 100644 index 00000000000..9f1800a88d5 --- /dev/null +++ b/queue-4.19/usbnet-ipheth-fix-connectivity-with-ios-14.patch @@ -0,0 +1,49 @@ +From foo@baz Wed Dec 2 11:19:34 AM CET 2020 +From: Yves-Alexis Perez +Date: Thu, 19 Nov 2020 18:24:39 +0100 +Subject: usbnet: ipheth: fix connectivity with iOS 14 + +From: Yves-Alexis Perez + +[ Upstream commit f33d9e2b48a34e1558b67a473a1fc1d6e793f93c ] + +Starting with iOS 14 released in September 2020, connectivity using the +personal hotspot USB tethering function of iOS devices is broken. + +Communication between the host and the device (for example ICMP traffic +or DNS resolution using the DNS service running in the device itself) +works fine, but communication to endpoints further away doesn't work. + +Investigation on the matter shows that no UDP and ICMP traffic from the +tethered host is reaching the Internet at all. For TCP traffic there are +exchanges between tethered host and server but packets are modified in +transit leading to impossible communication. + +After some trials Matti Vuorela discovered that reducing the URB buffer +size by two bytes restored the previous behavior. While a better +solution might exist to fix the issue, since the protocol is not +publicly documented and considering the small size of the fix, let's do +that. + +Tested-by: Matti Vuorela +Signed-off-by: Yves-Alexis Perez +Link: https://lore.kernel.org/linux-usb/CAAn0qaXmysJ9vx3ZEMkViv_B19ju-_ExN8Yn_uSefxpjS6g4Lw@mail.gmail.com/ +Link: https://github.com/libimobiledevice/libimobiledevice/issues/1038 +Link: https://lore.kernel.org/r/20201119172439.94988-1-corsac@corsac.net +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/ipheth.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/usb/ipheth.c ++++ b/drivers/net/usb/ipheth.c +@@ -70,7 +70,7 @@ + #define IPHETH_USBINTF_SUBCLASS 253 + #define IPHETH_USBINTF_PROTO 1 + +-#define IPHETH_BUF_SIZE 1516 ++#define IPHETH_BUF_SIZE 1514 + #define IPHETH_IP_ALIGN 2 /* padding at front of URB */ + #define IPHETH_TX_TIMEOUT (5 * HZ) +