Merge ~rafaeldtinoco/ubuntu/+source/iproute2:lp1913187-bionic into ubuntu/+source/iproute2:ubuntu/devel

[Rafael David Tinoco]

BUG: https://bugs.launchpad.net/ubuntu/+source/iproute2/+bug/1913187

Unmerged commits

967975d... by Rafael David Tinoco <email address hidden> on 2021-01-26

changelog

48054b6... by Rafael David Tinoco <email address hidden> on 2021-01-26

* Fix: NULL dereference when rendering without header

BugLink: https://bugs.launchpad.net/bugs/1913187

e21ddc1... by Stefan Bader on 2020-07-15

release: 4.15.0-2ubuntu1.2

Signed-off-by: Stefan Bader <email address hidden>

3ce3589... by Stefan Bader on 2020-07-15

Fix: tc filter show tcp_flags wrong mask value

BugLink: https://bugs.launchpad.net/bugs/1873961

Signed-off-by: Stefan Bader <email address hidden>

16880b4... by Leonidas S. Barbosa on 2020-05-11

4.15.0-2ubuntu1.1 (patches unapplied)

Imported using git-ubuntu import.

0ca2f6d... by Stefan Bader on 2018-02-26

4.15.0-2ubuntu1 (patches unapplied)

Imported using git-ubuntu import.

diff --git a/debian/changelog b/debian/changelog
index 04dda06..b06b572 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,4 @@
+<<<<<<< debian/changelog
 iproute2 (5.10.0-2ubuntu1) hirsute; urgency=low
 
   * Merge from Debian unstable. Remaining changes:
@@ -428,6 +429,30 @@ iproute2 (4.15.0-3) unstable; urgency=medium
     (Closes: #891511)
 
  -- Luca Boccassi <[e-mail]>  Mon, 12 Mar 2018 22:46:24 +0000
+=======
+iproute2 (4.15.0-2ubuntu1.3) bionic; urgency=medium
+
+  * Fix: NULL dereference when rendering without header (LP: #1913187)
+    - d/p/lp1913187-ss-fix-NULL-dereference-when-rendering.patch
+
+ -- Rafael David Tinoco <[e-mail]>  Tue, 26 Jan 2021 13:33:08 +0000
+
+iproute2 (4.15.0-2ubuntu1.2) bionic; urgency=medium
+
+  * tc filter show tcp_flags wrong mask value (LP: #1873961)
+    - d/p/lp1873961-tc-fix-bugs-for-tcp_flags-and-ip_attr-hex-output.patch
+
+ -- Stefan Bader <[e-mail]>  Wed, 15 Jul 2020 17:16:31 +0200
+
+iproute2 (4.15.0-2ubuntu1.1) bionic-security; urgency=medium
+
+  * SECURITY UPDATE: Use-after-free
+    - debian/patches/CVE-2019-20795.patch: fix a user-after-free in
+      ip/ipnetns.c in get_netnsid_from_name.
+    - CVE-2019-20795
+
+ -- Leonidas S. Barbosa <[e-mail]>  Mon, 11 May 2020 11:40:47 -0300
+>>>>>>> debian/changelog
 
 iproute2 (4.15.0-2ubuntu1) bionic; urgency=medium
 
@@ -1892,7 +1917,10 @@ iproute (961225-1) unstable; urgency=low
 
  -- Tom Lees <[e-mail]>  Mon, 30 Dec 1996 11:12:23 +0000
 
+<<<<<<< debian/changelog
 Local variables:
 mode: debian-changelog
 End:
 
+=======
+>>>>>>> debian/changelog
diff --git a/debian/compat b/debian/compat
new file mode 100644
index 0000000..42f1baf
--- /dev/null
+++ b/debian/compat
@@ -0,0 +1,4 @@
+<<<<<<< debian/compat
+=======
+10
+>>>>>>> debian/compat
diff --git a/debian/patches/1000-ubuntu-poc-fan-driver.patch b/debian/patches/1000-ubuntu-poc-fan-driver.patch
index 4e62c03..4f19b27 100644
--- a/debian/patches/1000-ubuntu-poc-fan-driver.patch
+++ b/debian/patches/1000-ubuntu-poc-fan-driver.patch
@@ -2,6 +2,7 @@ Description: POC fan driver support
  POC Fan driver support
 Author: Jay Vosburgh <[e-mail]>
 
+<<<<<<< debian/patches/1000-ubuntu-poc-fan-driver.patch
 Index: iproute2-5.5.0/ip/link_iptnl.c
 ===================================================================
 --- iproute2-5.5.0.orig/ip/link_iptnl.c
@@ -39,10 +40,41 @@ Index: iproute2-5.5.0/ip/link_iptnl.c
 +	if (is_addrtype_inet(&underlay))
 +		addattr_l(n, 1024, IFLA_IPTUN_FAN_UNDERLAY,
 +			  underlay.data, underlay.bytelen);
+=======
+Index: iproute2/ip/link_iptnl.c
+===================================================================
+--- iproute2.orig/ip/link_iptnl.c
++++ iproute2/ip/link_iptnl.c
+@@ -91,6 +91,7 @@ static int iptunnel_parse_opt(struct lin
+ 	__u32 link = 0;
+ 	__u32 laddr = 0;
+ 	__u32 raddr = 0;
++	__u32 underlay = 0;
+ 	__u8 ttl = 0;
+ 	__u8 tos = 0;
+ 	__u8 pmtudisc = 1;
+@@ -195,6 +196,9 @@ get_failed:
+ 		if (strcmp(*argv, "remote") == 0) {
+ 			NEXT_ARG();
+ 			raddr = get_addr32(*argv);
++		} else if (strcmp(*argv, "underlay") == 0) {
++			NEXT_ARG();
++			underlay = get_addr32(*argv);
+ 		} else if (strcmp(*argv, "local") == 0) {
+ 			NEXT_ARG();
+ 			laddr = get_addr32(*argv);
+@@ -356,6 +360,9 @@ get_failed:
+ 		}
+ 	}
+ 
++	if (underlay)
++		addattr32(n, 1024, IFLA_IPTUN_FAN_UNDERLAY, underlay);
+>>>>>>> debian/patches/1000-ubuntu-poc-fan-driver.patch
 +
  	return 0;
  }
  
+<<<<<<< debian/patches/1000-ubuntu-poc-fan-driver.patch
 @@ -391,6 +400,14 @@
  	tnl_print_endpoint("remote", tb[IFLA_IPTUN_REMOTE], AF_INET);
  	tnl_print_endpoint("local", tb[IFLA_IPTUN_LOCAL], AF_INET);
@@ -63,6 +95,28 @@ Index: iproute2-5.5.0/include/uapi/linux/if_tunnel.h
 --- iproute2-5.5.0.orig/include/uapi/linux/if_tunnel.h
 +++ iproute2-5.5.0/include/uapi/linux/if_tunnel.h
 @@ -77,6 +77,9 @@
+=======
+@@ -409,6 +416,14 @@ static void iptunnel_print_opt(struct li
+ 
+ 	print_string(PRINT_ANY, "local", "local %s ", local);
+ 
++	if (tb[IFLA_IPTUN_FAN_UNDERLAY]) {
++		unsigned addr = rta_getattr_u32(tb[IFLA_IPTUN_FAN_UNDERLAY]);
++
++		if (addr)
++			print_string(PRINT_ANY, "underlay",  "underlay %s ",
++				format_host(AF_INET, 4, &addr));
++	}
++
+ 	if (tb[IFLA_IPTUN_LINK]) {
+ 		unsigned int link = rta_getattr_u32(tb[IFLA_IPTUN_LINK]);
+ 
+Index: iproute2/include/uapi/linux/if_tunnel.h
+===================================================================
+--- iproute2.orig/include/uapi/linux/if_tunnel.h
++++ iproute2/include/uapi/linux/if_tunnel.h
+@@ -77,6 +77,9 @@ enum {
+>>>>>>> debian/patches/1000-ubuntu-poc-fan-driver.patch
  	IFLA_IPTUN_ENCAP_DPORT,
  	IFLA_IPTUN_COLLECT_METADATA,
  	IFLA_IPTUN_FWMARK,
diff --git a/debian/patches/1001-ubuntu-poc-fan-driver-v3.patch b/debian/patches/1001-ubuntu-poc-fan-driver-v3.patch
index 8c7d4c3..ff2eecf 100644
--- a/debian/patches/1001-ubuntu-poc-fan-driver-v3.patch
+++ b/debian/patches/1001-ubuntu-poc-fan-driver-v3.patch
@@ -1,11 +1,19 @@
 Description: Fan driver support v3
  Fan driver support v3
 Author: Jay Vosburgh <[e-mail]>
+<<<<<<< debian/patches/1001-ubuntu-poc-fan-driver-v3.patch
 Index: iproute2-5.5.0-1ubuntu1/include/uapi/linux/if_tunnel.h
 ===================================================================
 --- iproute2-5.5.0-1ubuntu1.orig/include/uapi/linux/if_tunnel.h
 +++ iproute2-5.5.0-1ubuntu1/include/uapi/linux/if_tunnel.h
 @@ -79,6 +79,7 @@
+=======
+Index: iproute2/include/uapi/linux/if_tunnel.h
+===================================================================
+--- iproute2.orig/include/uapi/linux/if_tunnel.h
++++ iproute2/include/uapi/linux/if_tunnel.h
+@@ -79,6 +79,7 @@ enum {
+>>>>>>> debian/patches/1001-ubuntu-poc-fan-driver-v3.patch
  	IFLA_IPTUN_FWMARK,
  
  	IFLA_IPTUN_FAN_UNDERLAY = 32,
@@ -13,10 +21,18 @@ Index: iproute2-5.5.0-1ubuntu1/include/uapi/linux/if_tunnel.h
  
  	__IFLA_IPTUN_MAX,
  };
+<<<<<<< debian/patches/1001-ubuntu-poc-fan-driver-v3.patch
 @@ -164,6 +165,21 @@
  
  #define IFLA_VTI_MAX	(__IFLA_VTI_MAX - 1)
  
+=======
+@@ -160,4 +161,20 @@ enum {
+ };
+ 
+ #define IFLA_VTI_MAX	(__IFLA_VTI_MAX - 1)
++
+>>>>>>> debian/patches/1001-ubuntu-poc-fan-driver-v3.patch
 +enum {
 +	IFLA_FAN_UNSPEC,
 +	IFLA_FAN_MAPPING,
@@ -26,6 +42,7 @@ Index: iproute2-5.5.0-1ubuntu1/include/uapi/linux/if_tunnel.h
 +#define IFLA_FAN_MAX (__IFLA_FAN_MAX - 1)
 +
 +struct ip_tunnel_fan_map {
+<<<<<<< debian/patches/1001-ubuntu-poc-fan-driver-v3.patch
 +	__be32          underlay;
 +	__be32          overlay;
 +	__u16           underlay_prefix;
@@ -42,6 +59,22 @@ Index: iproute2-5.5.0-1ubuntu1/ip/link_iptnl.c
 @@ -63,6 +63,42 @@
  		"	MARK := { 0x0..0xffffffff }\n",
  		lu->id, mode);
+=======
++	__be32		underlay;
++	__be32		overlay;
++	__u16		underlay_prefix;
++	__u16		overlay_prefix;
++};
++
+ #endif /* _IF_TUNNEL_H_ */
+Index: iproute2/ip/link_iptnl.c
+===================================================================
+--- iproute2.orig/ip/link_iptnl.c
++++ iproute2/ip/link_iptnl.c
+@@ -68,6 +68,42 @@ static void usage(int sit)
+ 	print_usage(stderr, sit);
+ 	exit(-1);
+>>>>>>> debian/patches/1001-ubuntu-poc-fan-driver-v3.patch
  }
 +static int fan_parse_map(int *argcp, char ***argvp, struct nlmsghdr *n)
 +{
@@ -82,18 +115,30 @@ Index: iproute2-5.5.0-1ubuntu1/ip/link_iptnl.c
  
  static int iptunnel_parse_opt(struct link_util *lu, int argc, char **argv,
  			      struct nlmsghdr *n)
+<<<<<<< debian/patches/1001-ubuntu-poc-fan-driver-v3.patch
 @@ -217,6 +253,10 @@
  		} else if (strcmp(*argv, "underlay") == 0) {
  			NEXT_ARG();
  			get_addr(&underlay, *argv, AF_INET);
+=======
+@@ -199,6 +235,10 @@ get_failed:
+ 		} else if (strcmp(*argv, "underlay") == 0) {
+ 			NEXT_ARG();
+ 			underlay = get_addr32(*argv);
+>>>>>>> debian/patches/1001-ubuntu-poc-fan-driver-v3.patch
 +		} else if (strcmp(*argv, "fan-map") == 0) {
 +			NEXT_ARG();
 +			if (fan_parse_map(&argc, &argv, n))
 +				invarg("invalid fan-map", *argv);
  		} else if (strcmp(*argv, "local") == 0) {
  			NEXT_ARG();
+<<<<<<< debian/patches/1001-ubuntu-poc-fan-driver-v3.patch
  			get_addr(&saddr, *argv, AF_INET);
 @@ -365,6 +405,28 @@
+=======
+ 			laddr = get_addr32(*argv);
+@@ -366,6 +406,28 @@ get_failed:
+>>>>>>> debian/patches/1001-ubuntu-poc-fan-driver-v3.patch
  	return 0;
  }
  
@@ -122,13 +167,22 @@ Index: iproute2-5.5.0-1ubuntu1/ip/link_iptnl.c
  static void iptunnel_print_opt(struct link_util *lu, FILE *f, struct rtattr *tb[])
  {
  	char s2[64];
+<<<<<<< debian/patches/1001-ubuntu-poc-fan-driver-v3.patch
 @@ -408,6 +470,9 @@
  				format_host(AF_INET, addr.bytelen, addr.data));
+=======
+@@ -424,6 +486,9 @@ static void iptunnel_print_opt(struct li
+ 				format_host(AF_INET, 4, &addr));
+>>>>>>> debian/patches/1001-ubuntu-poc-fan-driver-v3.patch
  	}
  
 +	if (tb[IFLA_IPTUN_FAN_MAP])
 +		fan_print_map(f, tb[IFLA_IPTUN_FAN_MAP]);
 +
  	if (tb[IFLA_IPTUN_LINK]) {
+<<<<<<< debian/patches/1001-ubuntu-poc-fan-driver-v3.patch
  		__u32 link = rta_getattr_u32(tb[IFLA_IPTUN_LINK]);
+=======
+ 		unsigned int link = rta_getattr_u32(tb[IFLA_IPTUN_LINK]);
+>>>>>>> debian/patches/1001-ubuntu-poc-fan-driver-v3.patch
  
diff --git a/debian/patches/1002-ubuntu-poc-fan-driver-vxlan.patch b/debian/patches/1002-ubuntu-poc-fan-driver-vxlan.patch
index 35ca391..4a473bf 100644
--- a/debian/patches/1002-ubuntu-poc-fan-driver-vxlan.patch
+++ b/debian/patches/1002-ubuntu-poc-fan-driver-vxlan.patch
@@ -1,16 +1,37 @@
 Description: Fan driver support VXLAN (p4)
  Fan driver setup support for vxlan interfaces.
 
+<<<<<<< debian/patches/1002-ubuntu-poc-fan-driver-vxlan.patch
 Index: iproute2-5.5.0/include/uapi/linux/if_tunnel.h
 ===================================================================
 --- iproute2-5.5.0.orig/include/uapi/linux/if_tunnel.h
 +++ iproute2-5.5.0/include/uapi/linux/if_tunnel.h
 @@ -173,7 +173,7 @@
+=======
+Index: iproute2/include/uapi/linux/if_link.h
+===================================================================
+--- iproute2.orig/include/uapi/linux/if_link.h
++++ iproute2/include/uapi/linux/if_link.h
+@@ -511,6 +511,7 @@ enum {
+ 	IFLA_VXLAN_COLLECT_METADATA,
+ 	IFLA_VXLAN_LABEL,
+ 	IFLA_VXLAN_GPE,
++	IFLA_VXLAN_FAN_MAP = 33,
+ 	__IFLA_VXLAN_MAX
+ };
+ #define IFLA_VXLAN_MAX	(__IFLA_VXLAN_MAX - 1)
+Index: iproute2/include/uapi/linux/if_tunnel.h
+===================================================================
+--- iproute2.orig/include/uapi/linux/if_tunnel.h
++++ iproute2/include/uapi/linux/if_tunnel.h
+@@ -170,7 +170,7 @@ enum {
+>>>>>>> debian/patches/1002-ubuntu-poc-fan-driver-vxlan.patch
  
  #define IFLA_FAN_MAX (__IFLA_FAN_MAX - 1)
  
 -struct ip_tunnel_fan_map {
 +struct ifla_fan_map {
+<<<<<<< debian/patches/1002-ubuntu-poc-fan-driver-vxlan.patch
  	__be32          underlay;
  	__be32          overlay;
  	__u16           underlay_prefix;
@@ -18,6 +39,15 @@ Index: iproute2-5.5.0/ip/iplink_vxlan.c
 ===================================================================
 --- iproute2-5.5.0.orig/ip/iplink_vxlan.c
 +++ iproute2-5.5.0/ip/iplink_vxlan.c
+=======
+ 	__be32		underlay;
+ 	__be32		overlay;
+ 	__u16		underlay_prefix;
+Index: iproute2/ip/iplink_vxlan.c
+===================================================================
+--- iproute2.orig/ip/iplink_vxlan.c
++++ iproute2/ip/iplink_vxlan.c
+>>>>>>> debian/patches/1002-ubuntu-poc-fan-driver-vxlan.patch
 @@ -15,7 +15,10 @@
  #include <net/if.h>
  #include <linux/ip.h>
@@ -29,7 +59,11 @@ Index: iproute2-5.5.0/ip/iplink_vxlan.c
  
  #include "rt_names.h"
  #include "utils.h"
+<<<<<<< debian/patches/1002-ubuntu-poc-fan-driver-vxlan.patch
 @@ -73,6 +76,45 @@
+=======
+@@ -71,6 +74,45 @@ static void check_duparg(__u64 *attrs, i
+>>>>>>> debian/patches/1002-ubuntu-poc-fan-driver-vxlan.patch
  	duparg2(key, argv);
  }
  
@@ -75,7 +109,11 @@ Index: iproute2-5.5.0/ip/iplink_vxlan.c
  static int vxlan_parse_opt(struct link_util *lu, int argc, char **argv,
  			  struct nlmsghdr *n)
  {
+<<<<<<< debian/patches/1002-ubuntu-poc-fan-driver-vxlan.patch
 @@ -330,6 +372,11 @@
+=======
+@@ -329,6 +371,11 @@ static int vxlan_parse_opt(struct link_u
+>>>>>>> debian/patches/1002-ubuntu-poc-fan-driver-vxlan.patch
  		} else if (!matches(*argv, "gpe")) {
  			check_duparg(&attrs, IFLA_VXLAN_GPE, *argv, *argv);
  			addattr_l(n, 1024, IFLA_VXLAN_GPE, NULL, 0);
@@ -87,7 +125,11 @@ Index: iproute2-5.5.0/ip/iplink_vxlan.c
  		} else if (matches(*argv, "help") == 0) {
  			explain();
  			return -1;
+<<<<<<< debian/patches/1002-ubuntu-poc-fan-driver-vxlan.patch
 @@ -406,6 +453,28 @@
+=======
+@@ -391,6 +438,28 @@ static int vxlan_parse_opt(struct link_u
+>>>>>>> debian/patches/1002-ubuntu-poc-fan-driver-vxlan.patch
  	return 0;
  }
  
@@ -116,7 +158,11 @@ Index: iproute2-5.5.0/ip/iplink_vxlan.c
  static void vxlan_print_opt(struct link_util *lu, FILE *f, struct rtattr *tb[])
  {
  	__u32 vni;
+<<<<<<< debian/patches/1002-ubuntu-poc-fan-driver-vxlan.patch
 @@ -466,6 +535,9 @@
+=======
+@@ -445,6 +514,9 @@ static void vxlan_print_opt(struct link_
+>>>>>>> debian/patches/1002-ubuntu-poc-fan-driver-vxlan.patch
  		}
  	}
  
@@ -126,6 +172,7 @@ Index: iproute2-5.5.0/ip/iplink_vxlan.c
  	if (tb[IFLA_VXLAN_LOCAL]) {
  		__be32 addr = rta_getattr_u32(tb[IFLA_VXLAN_LOCAL]);
  
+<<<<<<< debian/patches/1002-ubuntu-poc-fan-driver-vxlan.patch
 Index: iproute2-5.5.0/ip/link_iptnl.c
 ===================================================================
 --- iproute2-5.5.0.orig/ip/link_iptnl.c
@@ -133,6 +180,15 @@ Index: iproute2-5.5.0/ip/link_iptnl.c
 @@ -63,10 +63,11 @@
  		"	MARK := { 0x0..0xffffffff }\n",
  		lu->id, mode);
+=======
+Index: iproute2/ip/link_iptnl.c
+===================================================================
+--- iproute2.orig/ip/link_iptnl.c
++++ iproute2/ip/link_iptnl.c
+@@ -68,10 +68,11 @@ static void usage(int sit)
+ 	print_usage(stderr, sit);
+ 	exit(-1);
+>>>>>>> debian/patches/1002-ubuntu-poc-fan-driver-vxlan.patch
  }
 +
  static int fan_parse_map(int *argcp, char ***argvp, struct nlmsghdr *n)
@@ -143,7 +199,11 @@ Index: iproute2-5.5.0/ip/link_iptnl.c
  	struct rtattr *nest;
  	char **argv = *argvp;
  	int argc = *argcp;
+<<<<<<< debian/patches/1002-ubuntu-poc-fan-driver-vxlan.patch
 @@ -75,8 +76,10 @@
+=======
+@@ -80,8 +81,10 @@ static int fan_parse_map(int *argcp, cha
+>>>>>>> debian/patches/1002-ubuntu-poc-fan-driver-vxlan.patch
  	while (argc > 0) {
  		char *colon = strchr(*argv, ':');
  
@@ -155,7 +215,11 @@ Index: iproute2-5.5.0/ip/link_iptnl.c
  		*colon = '\0';
  
  		if (get_prefix(&overlay, *argv, AF_INET))
+<<<<<<< debian/patches/1002-ubuntu-poc-fan-driver-vxlan.patch
 @@ -408,7 +411,7 @@
+=======
+@@ -409,7 +412,7 @@ get_failed:
+>>>>>>> debian/patches/1002-ubuntu-poc-fan-driver-vxlan.patch
  static void fan_print_map(FILE *f, struct rtattr *attr)
  {
  	char b1[INET_ADDRSTRLEN], b2[INET_ADDRSTRLEN];
@@ -164,6 +228,7 @@ Index: iproute2-5.5.0/ip/link_iptnl.c
  	struct rtattr *i;
  	int rem;
  	int p;
+<<<<<<< debian/patches/1002-ubuntu-poc-fan-driver-vxlan.patch
 Index: iproute2-5.5.0/include/uapi/linux/if_link.h
 ===================================================================
 --- iproute2-5.5.0.orig/include/uapi/linux/if_link.h
@@ -176,3 +241,5 @@ Index: iproute2-5.5.0/include/uapi/linux/if_link.h
  	__IFLA_VXLAN_MAX
  };
  #define IFLA_VXLAN_MAX	(__IFLA_VXLAN_MAX - 1)
+=======
+>>>>>>> debian/patches/1002-ubuntu-poc-fan-driver-vxlan.patch
diff --git a/debian/patches/CVE-2019-20795.patch b/debian/patches/CVE-2019-20795.patch
new file mode 100644
index 0000000..2c83bb1
--- /dev/null
+++ b/debian/patches/CVE-2019-20795.patch
@@ -0,0 +1,71 @@
+From 9bf2c538a0eb10d66e2365a655bf6c52f5ba3d10 Mon Sep 17 00:00:00 2001
+From: Zhiqiang Liu <[e-mail]>
+Date: Sun, 5 May 2019 09:59:51 +0800
+Subject: ipnetns: use-after-free problem in get_netnsid_from_name func
+
+Follow the following steps:
+ # ip netns add net1
+ # export MALLOC_MMAP_THRESHOLD_=0
+ # ip netns list
+then Segmentation fault (core dumped) will occur.
+
+In get_netnsid_from_name func, answer is freed before
+rta_getattr_u32(tb[NETNSA_NSID]), where tb[] refers to answer`s
+content. If we set MALLOC_MMAP_THRESHOLD_=0, mmap will be adoped to
+malloc memory, which will be freed immediately after calling free
+func.  So reading tb[NETNSA_NSID] will access the released memory
+after free(answer).
+
+Here, we will call get_netnsid_from_name(tb[NETNSA_NSID]) before free(answer).
+
+Fixes: 86bf43c7c2f ("lib/libnetlink: update rtnl_talk to support malloc buff at run time")
+Reported-by: Huiying Kou <[e-mail]>
+Signed-off-by: Zhiqiang Liu <[e-mail]>
+Acked-by: Phil Sutter <[e-mail]>
+Signed-off-by: Stephen Hemminger <[e-mail]>
+---
+ ip/ipnetns.c | 13 ++++++-------
+ 1 file changed, 6 insertions(+), 7 deletions(-)
+
+Index: iproute2-4.15.0/ip/ipnetns.c
+===================================================================
+--- iproute2-4.15.0.orig/ip/ipnetns.c
++++ iproute2-4.15.0/ip/ipnetns.c
+@@ -105,7 +105,7 @@ static int get_netnsid_from_name(const c
+ 	struct nlmsghdr *answer;
+ 	struct rtattr *tb[NETNSA_MAX + 1];
+ 	struct rtgenmsg *rthdr;
+-	int len, fd;
++	int len, fd, ret = -1;
+ 
+ 	fd = netns_get_fd(name);
+ 	if (fd < 0)
+@@ -120,23 +120,22 @@ static int get_netnsid_from_name(const c
+ 
+ 	/* Validate message and parse attributes */
+ 	if (answer->nlmsg_type == NLMSG_ERROR)
+-		goto err_out;
++		goto out;
+ 
+ 	rthdr = NLMSG_DATA(answer);
+ 	len = answer->nlmsg_len - NLMSG_SPACE(sizeof(*rthdr));
+ 	if (len < 0)
+-		goto err_out;
++		goto out;
+ 
+ 	parse_rtattr(tb, NETNSA_MAX, NETNS_RTA(rthdr), len);
+ 
+ 	if (tb[NETNSA_NSID]) {
+-		free(answer);
+-		return rta_getattr_u32(tb[NETNSA_NSID]);
++		ret = rta_getattr_u32(tb[NETNSA_NSID]);
+ 	}
+ 
+-err_out:
++out:
+ 	free(answer);
+-	return -1;
++	return ret;
+ }
+ 
+ struct nsid_cache {
diff --git a/debian/patches/lp1873961-tc-fix-bugs-for-tcp_flags-and-ip_attr-hex-output.patch b/debian/patches/lp1873961-tc-fix-bugs-for-tcp_flags-and-ip_attr-hex-output.patch
new file mode 100644
index 0000000..9cc7daa
--- /dev/null
+++ b/debian/patches/lp1873961-tc-fix-bugs-for-tcp_flags-and-ip_attr-hex-output.patch
@@ -0,0 +1,150 @@
+From e8bd395508cead5a81c2bebd9d3705a9e41ea8bc Mon Sep 17 00:00:00 2001
+From: Keara Leibovitz <[e-mail]>
+Date: Thu, 26 Jul 2018 09:45:30 -0400
+Subject: [PATCH] tc: fix bugs for tcp_flags and ip_attr hex output
+
+Fix hex output for both the ip_attr and tcp_flags print functions.
+
+Sample usage:
+
+$ $TC qdisc add dev lo ingress
+$ $TC filter add dev lo parent ffff: prio 3 proto ip flower ip_tos 0x8/32
+$ $TC fitler add dev lo parent ffff: prio 5 proto ip flower ip_proto tcp \
+	tcp_flags 0x909/f00
+
+$ $TC filter show dev lo parent ffff:
+
+filter protocol ip pref 3 flower chain 0
+filter protocol ip pref 3 flower chain 0 handle 0x1
+  eth_type ipv4
+  ip_tos 0x8/32
+  not_in_hw
+filter protocol ip pref 5 flower chain 0
+filter protocol ip pref 5 flower chain 0 handle 0x1
+  eth_type ipv4
+  ip_proto tcp
+  tcp_flags 0x909/f00
+  not_in_hw
+
+$ $TC -j filter show dev lo parent ffff:
+
+[{
+    "protocol":"ip",
+    "pref":3,
+    "kind":"flower",
+    "chain":0
+},{
+    "protocol":"ip",
+    "pref":3,
+    "kind":"flower",
+    "chain":0,
+    "options": {
+	"handle":1,
+	"keys": {
+	    "eth_type":"ipv4",
+	    "ip_tos":"0x8/32"
+    },
+    "not_in_hw":true
+    }
+},{
+    "protocol":"ip",
+    "pref":5,
+    "kind":"flower",
+    "chain":0
+},{
+    "protocol":"ip",
+    "pref":5,
+    "kind":"flower",
+    "chain":0,
+    "options": {
+	"handle":1,
+	"keys": {
+	    "eth_type":"ipv4",
+	    "ip_proto":"tcp",
+	    "tcp_flags":"0x909/f00"
+	},
+	"not_in_hw":true
+    }
+}]
+
+Signed-off-by: Keara Leibovitz <[e-mail]>
+Signed-off-by: David Ahern <[e-mail]>
+
+BugLink: https://bugs.launchpad.net/bugs/1873961
+
+(backported from commit e8bd395508cead5a81c2bebd9d3705a9e41ea8bc
+ git://git.kernel.org/pub/scm/network/iproute2/iproute2.git)
+[smb: adjust for context in hunk #2 and additional static definition
+      of _SL_ in tc.c. This was added there for -o[oneline] support
+      which do not want to retrofit.]
+Signed-off-by: Stefan Bader <[e-mail]>
+---
+ tc/f_flower.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+Index: iproute2/tc/f_flower.c
+===================================================================
+--- iproute2.orig/tc/f_flower.c
++++ iproute2/tc/f_flower.c
+@@ -1117,7 +1117,7 @@ static void flower_print_ip_proto(__u8 *
+ 	*p_ip_proto = ip_proto;
+ }
+ 
+-static void flower_print_ip_attr(char *name, struct rtattr *key_attr,
++static void flower_print_ip_attr(const char *name, struct rtattr *key_attr,
+ 				 struct rtattr *mask_attr)
+ {
+ 	SPRINT_BUF(namefrm);
+@@ -1127,11 +1127,12 @@ static void flower_print_ip_attr(char *n
+ 	if (!key_attr)
+ 		return;
+ 
+-	done = sprintf(out, "%x", rta_getattr_u8(key_attr));
++	done = sprintf(out, "0x%x", rta_getattr_u8(key_attr));
+ 	if (mask_attr)
+ 		sprintf(out + done, "/%x", rta_getattr_u8(mask_attr));
+ 
+-	sprintf(namefrm, "\n  %s %%x", name);
++	print_string(PRINT_FP, NULL, "%s  ", _SL_);
++	sprintf(namefrm, "%s %%s", name);
+ 	print_string(PRINT_ANY, name, namefrm, out);
+ }
+ 
+@@ -1236,7 +1237,7 @@ static void flower_print_port(char *name
+ 	print_uint(PRINT_ANY, name, namefrm, rta_getattr_be16(attr));
+ }
+ 
+-static void flower_print_tcp_flags(char *name, struct rtattr *flags_attr,
++static void flower_print_tcp_flags(const char *name, struct rtattr *flags_attr,
+ 				   struct rtattr *mask_attr)
+ {
+ 	SPRINT_BUF(namefrm);
+@@ -1246,11 +1247,12 @@ static void flower_print_tcp_flags(char
+ 	if (!flags_attr)
+ 		return;
+ 
+-	done = sprintf(out, "%x", rta_getattr_be16(flags_attr));
++	done = sprintf(out, "0x%x", rta_getattr_be16(flags_attr));
+ 	if (mask_attr)
+-		sprintf(out + done, "%x", rta_getattr_be16(flags_attr));
++		sprintf(out + done, "/%x", rta_getattr_be16(mask_attr));
+ 
+-	sprintf(namefrm, "\n  %s %%s", name);
++	print_string(PRINT_FP, NULL, "%s  ", _SL_);
++	sprintf(namefrm, "%s %%s", name);
+ 	print_string(PRINT_ANY, name, namefrm, out);
+ }
+ 
+Index: iproute2/tc/tc.c
+===================================================================
+--- iproute2.orig/tc/tc.c
++++ iproute2/tc/tc.c
+@@ -43,6 +43,8 @@ int force;
+ bool use_names;
+ int json;
+ 
++const char *_SL_ = "\n";
++
+ static char *conf_file;
+ 
+ struct rtnl_handle rth;
diff --git a/debian/patches/lp1913187-ss-fix-NULL-dereference-when-rendering.patch b/debian/patches/lp1913187-ss-fix-NULL-dereference-when-rendering.patch
new file mode 100644
index 0000000..a6521a1
--- /dev/null
+++ b/debian/patches/lp1913187-ss-fix-NULL-dereference-when-rendering.patch
@@ -0,0 +1,40 @@
+Description: ss: fix NULL dereference when rendering without header
+
+fix NULL dereference when rendering without header
+
+When ss is invoked with the no-header flag, if the query doesn't return
+any result, render() is called with 'buffer' uninitialized. This
+currently leads to a segfault. Ensure that buffer is initialized before
+rendering.
+
+The bug can be triggered with: ss -H sport = 100000
+
+Signed-off-by: Jean-Philippe Brucker <[e-mail]>
+Acked-by: Stefano Brivio <[e-mail]>
+Signed-off-by: Stephen Hemminger <[e-mail]>
+
+Author: Jean-Philippe Brucker <[e-mail]>
+Origin: upstream, https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/commit/?id=eb8559eff124221bfbafe934c4dbfe30f20604c0
+Bug-Ubuntu: https://launchpad.net/bugs/1913187
+Reviewed-By: Rafael David Tinoco <[e-mail]>
+Last-Update: 2021-01-26
+
+--- iproute2-4.15.0.orig/misc/ss.c
++++ iproute2-4.15.0/misc/ss.c
+@@ -1196,10 +1196,15 @@ newline:
+ /* Render buffered output with spacing and delimiters, then free up buffers */
+ static void render(int screen_width)
+ {
+-	struct buf_token *token = (struct buf_token *)buffer.head->data;
++	struct buf_token *token;
+ 	int printed, line_started = 0;
+ 	struct column *f;
+ 
++	if (!buffer.head)
++		return;
++
++	token = (struct buf_token *)buffer.head->data;
++
+ 	/* Ensure end alignment of last token, it wasn't necessarily flushed */
+ 	buffer.tail->end += buffer.cur->len % 2;
+ 
diff --git a/debian/patches/netns-allow-negative-nsid b/debian/patches/netns-allow-negative-nsid
new file mode 100644
index 0000000..d296022
--- /dev/null
+++ b/debian/patches/netns-allow-negative-nsid
@@ -0,0 +1,65 @@
+From: Christian Brauner <[e-mail]>
+Date: Tue, 6 Feb 2018 19:39:31 +0100
+Subject: netns: allow negative nsid
+
+If the kernel receives a negative nsid it will automatically assign
+the next available nsid. In this case alloc_netid() will set min and
+max to 0 for ird_alloc(). And when max == 0 idr_alloc() will interpret
+this as the maximum range, i.e. specific to nsids it will try to find
+an id in the range [0,INT_MAX). This is intentionally supported in the
+kernel for nsids.
+
+Commit acbe9118ce80 ("ip netns: use strtol() instead of atoi()")
+regressed ip netns in that respect although previously the use-case
+was either accidentally supported or opaquely supported such that it
+triggered the original commit. From what I can gather it went as
+follows before: atoi() was called with a string indicating a negative
+value which caused it to return -1 which was passed to the
+kernel. Let's make it less opaque by introducing the keyword "auto":
+
+ip netns set <netns-name> auto
+
+will cause nsid to be set to -1 and the kernel will select an available
+nsid.
+
+Signed-off-by: Christian Brauner <[e-mail]>
+Signed-off-by: Stephen Hemminger <[e-mail]>
+
+Origin: upstream, https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/patch/?id=375d51caaaa7a381dbeab8fb622d3c6ff9597be7
+Last-Update: 2018-02-15
+---
+ ip/ipnetns.c        | 5 ++++-
+ man/man8/ip-netns.8 | 1 +
+ 2 files changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/ip/ipnetns.c b/ip/ipnetns.c
+index 059a422..631794b 100644
+--- a/ip/ipnetns.c
++++ b/ip/ipnetns.c
+@@ -718,7 +718,10 @@ static int netns_set(int argc, char **argv)
+ 		return -1;
+ 	}
+ 	name = argv[0];
+-	if (get_unsigned(&nsid, argv[1], 0))
++	/* If a negative nsid is specified the kernel will select the nsid. */
++	if (strcmp(argv[1], "auto") == 0)
++		nsid = -1;
++	else if (get_unsigned(&nsid, argv[1], 0))
+ 		invarg("Invalid \"netnsid\" value\n", argv[1]);
+ 
+ 	snprintf(netns_path, sizeof(netns_path), "%s/%s", NETNS_RUN_DIR, name);
+diff --git a/man/man8/ip-netns.8 b/man/man8/ip-netns.8
+index c5310e2..d539f18 100644
+--- a/man/man8/ip-netns.8
++++ b/man/man8/ip-netns.8
+@@ -137,6 +137,7 @@ $ ip netns del net0
+ .sp
+ This command assigns a id to a peer network namespace. This id is valid
+ only in the current network namespace.
++If the keyword "auto" is specified an available nsid will be chosen.
+ This id will be used by the kernel in some netlink messages. If no id is
+ assigned when the kernel needs it, it will be automatically assigned by
+ the kernel.
+-- 
+cgit v1.1
+
diff --git a/debian/patches/series b/debian/patches/series
index cac1fd7..3562f5a 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,4 +1,5 @@
 0004-sync-iptables-header.patch
+<<<<<<< debian/patches/series
 0005-iproute2-add-check_libbpf-and-get_libbpf_version.patch
 0006-lib-make-ipvrf-able-to-use-libbpf-and-fix-function-n.patch
 0007-lib-add-libbpf-support.patch
@@ -10,3 +11,12 @@
 1000-ubuntu-poc-fan-driver.patch
 1001-ubuntu-poc-fan-driver-v3.patch
 1002-ubuntu-poc-fan-driver-vxlan.patch
+=======
+1000-ubuntu-poc-fan-driver.patch
+1001-ubuntu-poc-fan-driver-v3.patch
+1002-ubuntu-poc-fan-driver-vxlan.patch
+netns-allow-negative-nsid
+CVE-2019-20795.patch
+lp1873961-tc-fix-bugs-for-tcp_flags-and-ip_attr-hex-output.patch
+lp1913187-ss-fix-NULL-dereference-when-rendering.patch
+>>>>>>> debian/patches/series