From: Greg Kroah-Hartman Date: Wed, 8 Sep 2021 12:08:37 +0000 (+0200) Subject: 4.4-stable patches X-Git-Tag: v5.4.145~30 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=a2f34f21604217b21db582af14b14c0094537a4a;p=thirdparty%2Fkernel%2Fstable-queue.git 4.4-stable patches added patches: ipv4-icmp-l3mdev-perform-icmp-error-route-lookup-on-source-device-routing-table-v2.patch pm-wakeirq-enable-dedicated-wakeirq-for-suspend.patch tc358743-fix-register-i2c_rd-wr-function-fix.patch usb-phy-isp1301-fix-build-warning-when-config_of-is-disabled.patch usb-serial-mos7720-improve-oom-handling-in-read_mos_reg.patch --- diff --git a/queue-4.4/ipv4-icmp-l3mdev-perform-icmp-error-route-lookup-on-source-device-routing-table-v2.patch b/queue-4.4/ipv4-icmp-l3mdev-perform-icmp-error-route-lookup-on-source-device-routing-table-v2.patch new file mode 100644 index 00000000000..8d3c526dba9 --- /dev/null +++ b/queue-4.4/ipv4-icmp-l3mdev-perform-icmp-error-route-lookup-on-source-device-routing-table-v2.patch @@ -0,0 +1,118 @@ +From e1e84eb58eb494b77c8389fc6308b5042dcce791 Mon Sep 17 00:00:00 2001 +From: Mathieu Desnoyers +Date: Mon, 12 Oct 2020 10:50:14 -0400 +Subject: ipv4/icmp: l3mdev: Perform icmp error route lookup on source device routing table (v2) + +From: Mathieu Desnoyers + +commit e1e84eb58eb494b77c8389fc6308b5042dcce791 upstream. + +As per RFC792, ICMP errors should be sent to the source host. + +However, in configurations with Virtual Routing and Forwarding tables, +looking up which routing table to use is currently done by using the +destination net_device. + +commit 9d1a6c4ea43e ("net: icmp_route_lookup should use rt dev to +determine L3 domain") changes the interface passed to +l3mdev_master_ifindex() and inet_addr_type_dev_table() from skb_in->dev +to skb_dst(skb_in)->dev. This effectively uses the destination device +rather than the source device for choosing which routing table should be +used to lookup where to send the ICMP error. + +Therefore, if the source and destination interfaces are within separate +VRFs, or one in the global routing table and the other in a VRF, looking +up the source host in the destination interface's routing table will +fail if the destination interface's routing table contains no route to +the source host. + +One observable effect of this issue is that traceroute does not work in +the following cases: + +- Route leaking between global routing table and VRF +- Route leaking between VRFs + +Preferably use the source device routing table when sending ICMP error +messages. If no source device is set, fall-back on the destination +device routing table. Else, use the main routing table (index 0). + +[ It has been pointed out that a similar issue may exist with ICMP + errors triggered when forwarding between network namespaces. It would + be worthwhile to investigate, but is outside of the scope of this + investigation. ] + +[ It has also been pointed out that a similar issue exists with + unreachable / fragmentation needed messages, which can be triggered by + changing the MTU of eth1 in r1 to 1400 and running: + + ip netns exec h1 ping -s 1450 -Mdo -c1 172.16.2.2 + + Some investigation points to raw_icmp_error() and raw_err() as being + involved in this last scenario. The focus of this patch is TTL expired + ICMP messages, which go through icmp_route_lookup. + Investigation of failure modes related to raw_icmp_error() is beyond + this investigation's scope. ] + +Fixes: 9d1a6c4ea43e ("net: icmp_route_lookup should use rt dev to determine L3 domain") +Link: https://tools.ietf.org/html/rfc792 +Signed-off-by: Mathieu Desnoyers +Reviewed-by: David Ahern +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/icmp.c | 23 +++++++++++++++++++++-- + 1 file changed, 21 insertions(+), 2 deletions(-) + +--- a/net/ipv4/icmp.c ++++ b/net/ipv4/icmp.c +@@ -460,6 +460,23 @@ static int icmp_multipath_hash_skb(const + + #endif + ++/* ++ * The device used for looking up which routing table to use for sending an ICMP ++ * error is preferably the source whenever it is set, which should ensure the ++ * icmp error can be sent to the source host, else lookup using the routing ++ * table of the destination device, else use the main routing table (index 0). ++ */ ++static struct net_device *icmp_get_route_lookup_dev(struct sk_buff *skb) ++{ ++ struct net_device *route_lookup_dev = NULL; ++ ++ if (skb->dev) ++ route_lookup_dev = skb->dev; ++ else if (skb_dst(skb)) ++ route_lookup_dev = skb_dst(skb)->dev; ++ return route_lookup_dev; ++} ++ + static struct rtable *icmp_route_lookup(struct net *net, + struct flowi4 *fl4, + struct sk_buff *skb_in, +@@ -468,6 +485,7 @@ static struct rtable *icmp_route_lookup( + int type, int code, + struct icmp_bxm *param) + { ++ struct net_device *route_lookup_dev; + struct rtable *rt, *rt2; + struct flowi4 fl4_dec; + int err; +@@ -481,7 +499,8 @@ static struct rtable *icmp_route_lookup( + fl4->flowi4_proto = IPPROTO_ICMP; + fl4->fl4_icmp_type = type; + fl4->fl4_icmp_code = code; +- fl4->flowi4_oif = l3mdev_master_ifindex(skb_dst(skb_in)->dev); ++ route_lookup_dev = icmp_get_route_lookup_dev(skb_in); ++ fl4->flowi4_oif = l3mdev_master_ifindex(route_lookup_dev); + + security_skb_classify_flow(skb_in, flowi4_to_flowi(fl4)); + rt = __ip_route_output_key_hash(net, fl4, +@@ -506,7 +525,7 @@ static struct rtable *icmp_route_lookup( + if (err) + goto relookup_failed; + +- if (inet_addr_type_dev_table(net, skb_dst(skb_in)->dev, ++ if (inet_addr_type_dev_table(net, route_lookup_dev, + fl4_dec.saddr) == RTN_LOCAL) { + rt2 = __ip_route_output_key(net, &fl4_dec); + if (IS_ERR(rt2)) diff --git a/queue-4.4/pm-wakeirq-enable-dedicated-wakeirq-for-suspend.patch b/queue-4.4/pm-wakeirq-enable-dedicated-wakeirq-for-suspend.patch new file mode 100644 index 00000000000..8cf0d6d6ab8 --- /dev/null +++ b/queue-4.4/pm-wakeirq-enable-dedicated-wakeirq-for-suspend.patch @@ -0,0 +1,63 @@ +From c84345597558349474f55be2b7d4093256e42884 Mon Sep 17 00:00:00 2001 +From: Grygorii Strashko +Date: Fri, 10 Feb 2017 14:25:00 -0800 +Subject: PM / wakeirq: Enable dedicated wakeirq for suspend + +From: Grygorii Strashko + +commit c84345597558349474f55be2b7d4093256e42884 upstream. + +We currently rely on runtime PM to enable dedicated wakeirq for suspend. +This assumption fails in the following two cases: + +1. If the consumer driver does not have runtime PM implemented, the + dedicated wakeirq never gets enabled for suspend + +2. If the consumer driver has runtime PM implemented, but does not idle + in suspend + +Let's fix the issue by always enabling the dedicated wakeirq during +suspend. + +Depends-on: bed570307ed7 (PM / wakeirq: Fix dedicated wakeirq for drivers not using autosuspend) +Fixes: 4990d4fe327b (PM / Wakeirq: Add automated device wake IRQ handling) +Reported-by: Keerthy +Tested-by: Keerthy +Signed-off-by: Grygorii Strashko +[ tony@atomide.com: updated based on bed570307ed7, added description ] +Tested-by: Tony Lindgren +Signed-off-by: Tony Lindgren +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman +--- + drivers/base/power/wakeirq.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +--- a/drivers/base/power/wakeirq.c ++++ b/drivers/base/power/wakeirq.c +@@ -319,8 +319,12 @@ void dev_pm_arm_wake_irq(struct wake_irq + if (!wirq) + return; + +- if (device_may_wakeup(wirq->dev)) ++ if (device_may_wakeup(wirq->dev)) { ++ if (wirq->status & WAKE_IRQ_DEDICATED_ALLOCATED) ++ enable_irq(wirq->irq); ++ + enable_irq_wake(wirq->irq); ++ } + } + + /** +@@ -335,6 +339,10 @@ void dev_pm_disarm_wake_irq(struct wake_ + if (!wirq) + return; + +- if (device_may_wakeup(wirq->dev)) ++ if (device_may_wakeup(wirq->dev)) { + disable_irq_wake(wirq->irq); ++ ++ if (wirq->status & WAKE_IRQ_DEDICATED_ALLOCATED) ++ disable_irq_nosync(wirq->irq); ++ } + } diff --git a/queue-4.4/series b/queue-4.4/series index 2e6acbed570..aeef3f332d8 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -12,3 +12,8 @@ ath-modify-ath_key_delete-to-not-need-full-key-entry.patch ath9k-postpone-key-cache-entry-deletion-for-txq-frames-reference-it.patch media-stkwebcam-fix-memory-leak-in-stk_camera_probe.patch igmp-add-ip_mc_list-lock-in-ip_check_mc_rcu.patch +usb-phy-isp1301-fix-build-warning-when-config_of-is-disabled.patch +usb-serial-mos7720-improve-oom-handling-in-read_mos_reg.patch +pm-wakeirq-enable-dedicated-wakeirq-for-suspend.patch +tc358743-fix-register-i2c_rd-wr-function-fix.patch +ipv4-icmp-l3mdev-perform-icmp-error-route-lookup-on-source-device-routing-table-v2.patch diff --git a/queue-4.4/tc358743-fix-register-i2c_rd-wr-function-fix.patch b/queue-4.4/tc358743-fix-register-i2c_rd-wr-function-fix.patch new file mode 100644 index 00000000000..14eedd61ab7 --- /dev/null +++ b/queue-4.4/tc358743-fix-register-i2c_rd-wr-function-fix.patch @@ -0,0 +1,36 @@ +From 4b0755e90ae03ba40174842af6fa810355960fbc Mon Sep 17 00:00:00 2001 +From: Philipp Zabel +Date: Thu, 4 May 2017 12:20:17 -0300 +Subject: [media] tc358743: fix register i2c_rd/wr function fix + +From: Philipp Zabel + +commit 4b0755e90ae03ba40174842af6fa810355960fbc upstream. + +The below mentioned fix contains a small but severe bug, +fix it to make the driver work again. + +Fixes: 3538aa6ecfb2 ("[media] tc358743: fix register i2c_rd/wr functions") + +Cc: Hans Verkuil +Cc: Mauro Carvalho Chehab +Signed-off-by: Philipp Zabel +Acked-by: Arnd Bergmann +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/i2c/tc358743.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/i2c/tc358743.c ++++ b/drivers/media/i2c/tc358743.c +@@ -241,7 +241,7 @@ static void i2c_wr16(struct v4l2_subdev + + static void i2c_wr16_and_or(struct v4l2_subdev *sd, u16 reg, u16 mask, u16 val) + { +- i2c_wrreg(sd, reg, (i2c_rdreg(sd, reg, 2) & mask) | val, 2); ++ i2c_wrreg(sd, reg, (i2c_rdreg(sd, reg, 1) & mask) | val, 1); + } + + static u32 i2c_rd32(struct v4l2_subdev *sd, u16 reg) diff --git a/queue-4.4/usb-phy-isp1301-fix-build-warning-when-config_of-is-disabled.patch b/queue-4.4/usb-phy-isp1301-fix-build-warning-when-config_of-is-disabled.patch new file mode 100644 index 00000000000..869d6a72d0d --- /dev/null +++ b/queue-4.4/usb-phy-isp1301-fix-build-warning-when-config_of-is-disabled.patch @@ -0,0 +1,39 @@ +From a7f12a21f6b32bdd8d76d3af81eef9e72ce41ec0 Mon Sep 17 00:00:00 2001 +From: Javier Martinez Canillas +Date: Tue, 28 Mar 2017 15:07:38 -0400 +Subject: usb: phy: isp1301: Fix build warning when CONFIG_OF is disabled +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Javier Martinez Canillas + +commit a7f12a21f6b32bdd8d76d3af81eef9e72ce41ec0 upstream. + +Commit fd567653bdb9 ("usb: phy: isp1301: Add OF device ID table") +added an OF device ID table, but used the of_match_ptr() macro +that will lead to a build warning if CONFIG_OF symbol is disabled: + +drivers/usb/phy//phy-isp1301.c:36:34: warning: ‘isp1301_of_match’ defined but not used [-Wunused-const-variable=] + static const struct of_device_id isp1301_of_match[] = { + ^~~~~~~~~~~~~~~~ + +Fixes: fd567653bdb9 ("usb: phy: isp1301: Add OF device ID table") +Reported-by: Arnd Bergmann +Signed-off-by: Javier Martinez Canillas +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/phy/phy-isp1301.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/phy/phy-isp1301.c ++++ b/drivers/usb/phy/phy-isp1301.c +@@ -136,7 +136,7 @@ static int isp1301_remove(struct i2c_cli + static struct i2c_driver isp1301_driver = { + .driver = { + .name = DRV_NAME, +- .of_match_table = of_match_ptr(isp1301_of_match), ++ .of_match_table = isp1301_of_match, + }, + .probe = isp1301_probe, + .remove = isp1301_remove, diff --git a/queue-4.4/usb-serial-mos7720-improve-oom-handling-in-read_mos_reg.patch b/queue-4.4/usb-serial-mos7720-improve-oom-handling-in-read_mos_reg.patch new file mode 100644 index 00000000000..f8b97179243 --- /dev/null +++ b/queue-4.4/usb-serial-mos7720-improve-oom-handling-in-read_mos_reg.patch @@ -0,0 +1,51 @@ +From 161a582bd1d8681095f158d11bc679a58f1d026b Mon Sep 17 00:00:00 2001 +From: Tom Rix +Date: Mon, 11 Jan 2021 14:09:04 -0800 +Subject: USB: serial: mos7720: improve OOM-handling in read_mos_reg() + +From: Tom Rix + +commit 161a582bd1d8681095f158d11bc679a58f1d026b upstream. + +clang static analysis reports this problem + +mos7720.c:352:2: warning: Undefined or garbage value returned to caller + return d; + ^~~~~~~~ + +In the parport_mos7715_read_data()'s call to read_mos_reg(), 'd' is +only set after the alloc block. + + buf = kmalloc(1, GFP_KERNEL); + if (!buf) + return -ENOMEM; + +Although the problem is reported in parport_most7715_read_data(), +none of the callee's of read_mos_reg() check the return status. + +Make sure to clear the return-value buffer also on allocation failures. + +Fixes: 0d130367abf5 ("USB: serial: mos7720: fix control-message error handling") +Signed-off-by: Tom Rix +Link: https://lore.kernel.org/r/20210111220904.1035957-1-trix@redhat.com +[ johan: only clear the buffer on errors, amend commit message ] +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/mos7720.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/usb/serial/mos7720.c ++++ b/drivers/usb/serial/mos7720.c +@@ -229,8 +229,10 @@ static int read_mos_reg(struct usb_seria + int status; + + buf = kmalloc(1, GFP_KERNEL); +- if (!buf) ++ if (!buf) { ++ *data = 0; + return -ENOMEM; ++ } + + status = usb_control_msg(usbdev, pipe, request, requesttype, value, + index, buf, 1, MOS_WDR_TIMEOUT);