!192 sync 2203sp3 patches

From: @zhongxuan2 
Reviewed-by: @robertxw 
Signed-off-by: @robertxw

backport-Add-get_long-utility-and-adapt-get_integer-accordingly.patch

@@ -0,0 +1,58 @@
+From 3a463c152a9a5503f9c37362b63acd6f72ecba6c Mon Sep 17 00:00:00 2001
+From: Mathieu Schroeter <mathieu@schroetersa.ch>
+Date: Tue, 8 Aug 2023 23:42:55 +0200
+Subject: [PATCH] Add get_long utility and adapt get_integer accordingly
+
+Conflict:contaxt adapt in include/utiles.h due to ebe23249ce1eeedb3610890e4c0c0f52fb8341fe
+Reference:https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/commit?id=3a463c152a9a5503f9c37362b63acd6f72ecba6c
+
+Signed-off-by: Mathieu Schroeter <mathieu@schroetersa.ch>
+Signed-off-by: David Ahern <dsahern@kernel.org>
+---
+ include/utils.h |  1 +
+ lib/utils.c     | 13 ++++++++++++-
+ 2 files changed, 13 insertions(+), 1 deletion(-)
+
+diff --git a/include/utils.h b/include/utils.h
+index 3159dbab1..cf11174d9 100644
+--- a/include/utils.h
++++ b/include/utils.h
+@@ -142,6 +142,7 @@ int get_addr_rta(inet_prefix *dst, const struct rtattr *rta, int family);
+ 
+ int read_prop(const char *dev, char *prop, long *value);
+ int get_hex(char c);
++int get_long(long *val, const char *arg, int base);
+ int get_integer(int *val, const char *arg, int base);
+ int get_unsigned(unsigned *val, const char *arg, int base);
+ int get_time_rtt(unsigned *val, const char *arg, int *raw);
+diff --git a/lib/utils.c b/lib/utils.c
+index b1f273054..68f443038 100644
+--- a/lib/utils.c
++++ b/lib/utils.c
+@@ -108,7 +108,7 @@ static int get_hex(char c)
+ 	return -1;
+ }
+ 
+-int get_integer(int *val, const char *arg, int base)
++int get_long(long *val, const char *arg, int base)
+ {
+ 	long res;
+ 	char *ptr;
+@@ -133,6 +133,17 @@ int get_integer(int *val, const char *arg, int base)
+ 	if ((res == LONG_MAX || res == LONG_MIN) && errno == ERANGE)
+ 		return -1;
+ 
++	if (val)
++		*val = res;
++	return 0;
++}
++
++int get_integer(int *val, const char *arg, int base)
++{
++	long res;
++
++	res = get_long(NULL, arg, base);
++
+ 	/* Outside range of int */
+ 	if (res < INT_MIN || res > INT_MAX)
+ 		return -1;

backport-Add-utility-to-convert-an-unsigned-int-to-string.patch

@@ -0,0 +1,45 @@
+From db7fb3f1965751444c3b743ba0253061fd7e3b44 Mon Sep 17 00:00:00 2001
+From: Mathieu Schroeter <mathieu@schroetersa.ch>
+Date: Tue, 8 Aug 2023 23:42:56 +0200
+Subject: [PATCH] Add utility to convert an unsigned int to string
+
+Conflict:contaxt adapt in include/utiles.h due to ebe23249ce1eeedb3610890e4c0c0f52fb8341fe
+Reference:https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/commit?id=db7fb3f1965751444c3b743ba0253061fd7e3b44
+
+
+Signed-off-by: Mathieu Schroeter <mathieu@schroetersa.ch>
+Signed-off-by: David Ahern <dsahern@kernel.org>
+---
+ include/utils.h | 1 +
+ lib/utils.c     | 6 ++++++
+ 2 files changed, 7 insertions(+)
+
+diff --git a/include/utils.h b/include/utils.h
+index cf11174d9..f26ed822f 100644
+--- a/include/utils.h
++++ b/include/utils.h
+@@ -309,6 +309,7 @@ unsigned int print_name_and_link(const char *fmt,
+ int makeargs(char *line, char *argv[], int maxargs);
+ 
+ char *int_to_str(int val, char *buf);
++char *uint_to_str(unsigned int val, char *buf);
+ int get_guid(__u64 *guid, const char *arg);
+ int get_real_family(int rtm_type, int rtm_family);
+ 
+diff --git a/lib/utils.c b/lib/utils.c
+index 68f443038..efa01668d 100644
+--- a/lib/utils.c
++++ b/lib/utils.c
+@@ -1409,6 +1409,12 @@ char *int_to_str(int val, char *buf)
+ 	return buf;
+ }
+ 
++char *uint_to_str(unsigned int val, char *buf)
++{
++	sprintf(buf, "%u", val);
++	return buf;
++}
++
+ int get_guid(__u64 *guid, const char *arg)
+ {
+ 	unsigned long tmp;

backport-bridge-fix-potential-snprintf-overflow.patch

@@ -0,0 +1,40 @@
+From 4d80122ae82aea86cb740b5202f6c3fde6183538 Mon Sep 17 00:00:00 2001
+From: Stephen Hemminger <stephen@networkplumber.org>
+Date: Mon, 18 Sep 2023 11:34:42 -0700
+Subject: [PATCH] bridge: fix potential snprintf overflow
+
+There is a theoretical snprintf overflow in bridge slave bitmask
+print code found by CodeQL scan.
+
+Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
+---
+ ip/iplink_bridge_slave.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/ip/iplink_bridge_slave.c b/ip/iplink_bridge_slave.c
+index dc73c8657..3821923b5 100644
+--- a/ip/iplink_bridge_slave.c
++++ b/ip/iplink_bridge_slave.c
+@@ -100,13 +100,20 @@ static void _bitmask2str(__u16 bitmask, char *dst, size_t dst_size,
+ 	int len, i;
+ 
+ 	for (i = 0, len = 0; bitmask; i++, bitmask >>= 1) {
++		int n;
++
+ 		if (bitmask & 0x1) {
+ 			if (tbl[i])
+-				len += snprintf(dst + len, dst_size - len, "%s,",
++				n = snprintf(dst + len, dst_size - len, "%s,",
+ 						tbl[i]);
+ 			else
+-				len += snprintf(dst + len, dst_size - len, "0x%x,",
++				n = snprintf(dst + len, dst_size - len, "0x%x,",
+ 						(1 << i));
++
++			if (n < 0 || n >= dst_size - len)
++				break;
++
++			len += n;
+ 		}
+ 	}
+ 

backport-f_flower-Treat-port-0-as-valid.patch

@@ -0,0 +1,121 @@
+From 61695c493ec14a63740bbb81e0564f753bd054dd Mon Sep 17 00:00:00 2001
+From: Ido Schimmel <idosch@nvidia.com>
+Date: Tue, 11 Jul 2023 09:59:03 +0300
+Subject: f_flower: Treat port 0 as valid
+
+Conflict:NA
+Reference:https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/commit?id=61695c493ec14a63740bbb81e0564f753bd054dd
+
+It is not currently possible to add a filter matching on port 0 despite
+it being a valid port number. This is caused by cited commit which
+treats a value of 0 as an indication that the port was not specified.
+
+Instead of inferring that a port range was specified by checking that both
+the minimum and the maximum ports are non-zero, simply add a boolean
+argument to parse_range() and set it after parsing a port range.
+
+Before:
+
+ # tc filter add dev swp1 ingress pref 1 proto ip flower ip_proto udp src_port 0 action pass
+ Illegal "src_port"
+
+ # tc filter add dev swp1 ingress pref 2 proto ip flower ip_proto udp dst_port 0 action pass
+ Illegal "dst_port"
+
+ # tc filter add dev swp1 ingress pref 3 proto ip flower ip_proto udp src_port 0-100 action pass
+ Illegal "src_port"
+
+ # tc filter add dev swp1 ingress pref 4 proto ip flower ip_proto udp dst_port 0-100 action pass
+ Illegal "dst_port"
+
+After:
+
+ # tc filter add dev swp1 ingress pref 1 proto ip flower ip_proto udp src_port 0 action pass
+
+ # tc filter add dev swp1 ingress pref 2 proto ip flower ip_proto udp dst_port 0 action pass
+
+ # tc filter add dev swp1 ingress pref 3 proto ip flower ip_proto udp src_port 0-100 action pass
+
+ # tc filter add dev swp1 ingress pref 4 proto ip flower ip_proto udp dst_port 0-100 action pass
+
+ # tc filter show dev swp1 ingress | grep _port
+   src_port 0
+   dst_port 0
+   src_port 0-100
+   dst_port 0-100
+
+Fixes: 767b6fd620dd ("tc: flower: fix port value truncation")
+Signed-off-by: Ido Schimmel <idosch@nvidia.com>
+Reviewed-by: Petr Machata <petrm@nvidia.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
+---
+ tc/f_flower.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/tc/f_flower.c b/tc/f_flower.c
+index c71394f75..737df199a 100644
+--- a/tc/f_flower.c
++++ b/tc/f_flower.c
+@@ -735,7 +735,7 @@ static int flower_port_range_attr_type(__u8 ip_proto, enum flower_endpoint type,
+ }
+ 
+ /* parse range args in format 10-20 */
+-static int parse_range(char *str, __be16 *min, __be16 *max)
++static int parse_range(char *str, __be16 *min, __be16 *max, bool *p_is_range)
+ {
+ 	char *sep;
+ 
+@@ -748,6 +748,8 @@ static int parse_range(char *str, __be16 *min, __be16 *max)
+ 
+ 		if (get_be16(max, sep + 1, 10))
+ 			return -1;
++
++		*p_is_range = true;
+ 	} else {
+ 		if (get_be16(min, str, 10))
+ 			return -1;
+@@ -759,19 +761,20 @@ static int flower_parse_port(char *str, __u8 ip_proto,
+ 			     enum flower_endpoint endpoint,
+ 			     struct nlmsghdr *n)
+ {
++	bool is_range = false;
+ 	char *slash = NULL;
+ 	__be16 min = 0;
+ 	__be16 max = 0;
+ 	int ret;
+ 
+-	ret = parse_range(str, &min, &max);
++	ret = parse_range(str, &min, &max, &is_range);
+ 	if (ret) {
+ 		slash = strchr(str, '/');
+ 		if (!slash)
+ 			return -1;
+ 	}
+ 
+-	if (min && max) {
++	if (is_range) {
+ 		__be16 min_port_type, max_port_type;
+ 
+ 		if (ntohs(max) <= ntohs(min)) {
+@@ -784,7 +787,7 @@ static int flower_parse_port(char *str, __u8 ip_proto,
+ 
+ 		addattr16(n, MAX_MSG, min_port_type, min);
+ 		addattr16(n, MAX_MSG, max_port_type, max);
+-	} else if (slash || (min && !max)) {
++	} else {
+ 		int type;
+ 
+ 		type = flower_port_attr_type(ip_proto, endpoint);
+@@ -802,8 +805,6 @@ static int flower_parse_port(char *str, __u8 ip_proto,
+ 				return -1;
+ 			return flower_parse_u16(str, type, mask_type, n, true);
+ 		}
+-	} else {
+-		return -1;
+ 	}
+ 	return 0;
+ }
+-- 
+cgit 
+

backport-ila-fix-potential-snprintf-buffer-overflow.patch

@@ -0,0 +1,27 @@
+From e8a3fca81cd4b8fee14cfb14a5ce9c1b3b63e797 Mon Sep 17 00:00:00 2001
+From: Stephen Hemminger <stephen@networkplumber.org>
+Date: Mon, 18 Sep 2023 11:36:32 -0700
+Subject: [PATCH] ila: fix potential snprintf buffer overflow
+
+The code to print 64 bit address has a theoretical overflow
+of snprintf buffer found by CodeQL scan.
+Address by checking result.
+
+Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
+---
+ ip/ipila.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/ip/ipila.c b/ip/ipila.c
+index 4f6d578f2..23b19a108 100644
+--- a/ip/ipila.c
++++ b/ip/ipila.c
+@@ -60,6 +60,8 @@ static void print_addr64(__u64 addr, char *buff, size_t len)
+ 			sep = "";
+ 
+ 		ret = snprintf(&buff[written], len - written, "%x%s", v, sep);
++		if (ret < 0 || ret >= len - written)
++			break;
+ 		written += ret;
+ 	}
+ }

backport-ip-error-out-if-iplink-does-not-consume-all-options.patch

@@ -0,0 +1,48 @@
+From 84ffffeb0a2ff69e36bd972d57699f9e3bb29a48 Mon Sep 17 00:00:00 2001
+From: Jakub Kicinski <kuba@kernel.org>
+Date: Mon, 31 Jul 2023 09:19:20 -0700
+Subject: ip: error out if iplink does not consume all options
+
+Conflict:NA
+Reference:https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/commit?id=84ffffeb0a2ff69e36bd972d57699f9e3bb29a48
+
+dummy does not define .parse_opt, which make ip ignore all
+trailing arguments, for example:
+
+ # ip link add type dummy a b c d e f name cheese
+
+will work just fine (and won't call the device "cheese").
+Error out in this case with a clear error message:
+
+ # ip link add type dummy a b c d e f name cheese
+ Garbage instead of arguments "a ...". Try "ip link help".
+
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
+---
+ ip/iplink.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/ip/iplink.c b/ip/iplink.c
+index 6c5d13d53..9a548dd35 100644
+--- a/ip/iplink.c
++++ b/ip/iplink.c
+@@ -1112,13 +1112,12 @@ static int iplink_modify(int cmd, unsigned int flags, int argc, char **argv)
+ 		argc -= ret;
+ 		argv += ret;
+ 
+-		if (lu && argc) {
++		if (lu && lu->parse_opt && argc) {
+ 			struct rtattr *data;
+ 
+ 			data = addattr_nest(&req.n, sizeof(req), iflatype);
+ 
+-			if (lu->parse_opt &&
+-			    lu->parse_opt(lu, argc, argv, &req.n))
++			if (lu->parse_opt(lu, argc, argv, &req.n))
+ 				return -1;
+ 
+ 			addattr_nest_end(&req.n, data);
+-- 
+cgit 
+

backport-ip-fix-memory-leak-in-ip-maddr-show.patch

@@ -0,0 +1,44 @@
+From 575322b09c3c6bc1806f2faa31edcfb64df302bb Mon Sep 17 00:00:00 2001
+From: Maxim Petrov <mmrmaximuzz@gmail.com>
+Date: Sun, 15 Oct 2023 16:32:12 +0200
+Subject: [PATCH] ip: fix memory leak in 'ip maddr show'
+
+In `read_dev_mcast`, the list of ma_info is allocated, but not cleared
+after use. Free the list in the end to make valgrind happy.
+
+Detected by valgrind: "valgrind ./ip/ip maddr show"
+
+Signed-off-by: Maxim Petrov <mmrmaximuzz@gmail.com>
+---
+ ip/ipmaddr.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/ip/ipmaddr.c b/ip/ipmaddr.c
+index 176f6ab74..2418b3031 100644
+--- a/ip/ipmaddr.c
++++ b/ip/ipmaddr.c
+@@ -79,6 +79,16 @@ static void maddr_ins(struct ma_info **lst, struct ma_info *m)
+ 	*lst = m;
+ }
+ 
++static void maddr_clear(struct ma_info *lst)
++{
++	struct ma_info *mp;
++
++	while ((mp = lst) != NULL) {
++		lst = mp->next;
++		free(mp);
++	}
++}
++
+ static void read_dev_mcast(struct ma_info **result_p)
+ {
+ 	char buf[256];
+@@ -286,6 +296,7 @@ static int multiaddr_list(int argc, char **argv)
+ 	if (!filter.family || filter.family == AF_INET6)
+ 		read_igmp6(&list);
+ 	print_mlist(stdout, list);
++	maddr_clear(list);
+ 	return 0;
+ }
+ 

backport-iplink_bridge-fix-incorrect-root-id-dump.patch

@@ -0,0 +1,34 @@
+From 3181d4e14964d7845ca9730ec6b4d7b72f3712c5 Mon Sep 17 00:00:00 2001
+From: Hangbin Liu <liuhangbin@gmail.com>
+Date: Fri, 1 Sep 2023 16:02:26 +0800
+Subject: iplink_bridge: fix incorrect root id dump
+
+Conflict:NA
+Reference:https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/commit?id=3181d4e14964d7845ca9730ec6b4d7b72f3712c5
+
+Fix the typo when dump root_id.
+
+Fixes: 70dfb0b8836d ("iplink: bridge: export bridge_id and designated_root")
+Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
+Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
+Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
+---
+ ip/iplink_bridge.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/ip/iplink_bridge.c b/ip/iplink_bridge.c
+index 7e4e62c81..462075295 100644
+--- a/ip/iplink_bridge.c
++++ b/ip/iplink_bridge.c
+@@ -499,7 +499,7 @@ static void bridge_print_opt(struct link_util *lu, FILE *f, struct rtattr *tb[])
+ 	if (tb[IFLA_BR_ROOT_ID]) {
+ 		char root_id[32];
+ 
+-		br_dump_bridge_id(RTA_DATA(tb[IFLA_BR_BRIDGE_ID]), root_id,
++		br_dump_bridge_id(RTA_DATA(tb[IFLA_BR_ROOT_ID]), root_id,
+ 				  sizeof(root_id));
+ 		print_string(PRINT_ANY,
+ 			     "root_id",
+-- 
+cgit 
+

backport-ipmaddr-fix-dereference-of-NULL-on-malloc-failure.patch

@@ -0,0 +1,317 @@
+From 8cda7a24a971170b833009f392579cfea87711bf Mon Sep 17 00:00:00 2001
+From: Stephen Hemminger <stephen@networkplumber.org>
+Date: Mon, 8 May 2023 19:02:20 -0700
+Subject: [PATCH] ipmaddr: fix dereference of NULL on malloc() failure
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Found by -fanalyzer. This is a bug since beginning of initial
+versions of ip multicast support (pre git).
+
+ipmaddr.c: In function ‘read_dev_mcast’:
+ipmaddr.c:105:25: warning: dereference of possibly-NULL ‘ma’ [CWE-690] [-Wanalyzer-possible-null-dereference]
+  105 |                         memcpy(ma, &m, sizeof(m));
+      |                         ^~~~~~~~~~~~~~~~~~~~~~~~~
+  ‘do_multiaddr’: events 1-4
+    |
+    |  354 | int do_multiaddr(int argc, char **argv)
+    |      |     ^~~~~~~~~~~~
+    |      |     |
+    |      |     (1) entry to ‘do_multiaddr’
+    |  355 | {
+    |  356 |         if (argc < 1)
+    |      |            ~
+    |      |            |
+    |      |            (2) following ‘true’ branch (when ‘argc <= 0’)...
+    |  357 |                 return multiaddr_list(0, NULL);
+    |      |                        ~~~~~~~~~~~~~~~~~~~~~~~
+    |      |                        |
+    |      |                        (3) ...to here
+    |      |                        (4) calling ‘multiaddr_list’ from ‘do_multiaddr’
+    |
+    +--> ‘multiaddr_list’: events 5-10
+           |
+           |  255 | static int multiaddr_list(int argc, char **argv)
+           |      |            ^~~~~~~~~~~~~~
+           |      |            |
+           |      |            (5) entry to ‘multiaddr_list’
+           |......
+           |  262 |         while (argc > 0) {
+           |      |                ~~~~~~~~
+           |      |                     |
+           |      |                     (6) following ‘false’ branch (when ‘argc <= 0’)...
+           |......
+           |  275 |         if (!filter.family || filter.family == AF_PACKET)
+           |      |            ~ ~~~~~~~~~~~~~
+           |      |            |       |
+           |      |            |       (7) ...to here
+           |      |            (8) following ‘true’ branch...
+           |  276 |                 read_dev_mcast(&list);
+           |      |                 ~~~~~~~~~~~~~~~~~~~~~
+           |      |                 |
+           |      |                 (9) ...to here
+           |      |                 (10) calling ‘read_dev_mcast’ from ‘multiaddr_list’
+           |
+           +--> ‘read_dev_mcast’: events 11-12
+                  |
+                  |   82 | static void read_dev_mcast(struct ma_info **result_p)
+                  |      |             ^~~~~~~~~~~~~~
+                  |      |             |
+                  |      |             (11) entry to ‘read_dev_mcast’
+                  |......
+                  |   87 |         if (!fp)
+                  |      |            ~
+                  |      |            |
+                  |      |            (12) following ‘false’ branch (when ‘fp’ is non-NULL)...
+                  |
+                ‘read_dev_mcast’: event 13
+                  |
+                  |cc1:
+                  | (13): ...to here
+                  |
+                ‘read_dev_mcast’: events 14-17
+                  |
+                  |   90 |         while (fgets(buf, sizeof(buf), fp)) {
+                  |      |                ^~~~~
+                  |      |                |
+                  |      |                (14) following ‘true’ branch...
+                  |   91 |                 char hexa[256];
+                  |   92 |                 struct ma_info m = { .addr.family = AF_PACKET };
+                  |      |                                ~
+                  |      |                                |
+                  |      |                                (15) ...to here
+                  |......
+                  |  103 |                         struct ma_info *ma = malloc(sizeof(m));
+                  |      |                                              ~~~~~~~~~~~~~~~~~
+                  |      |                                              |
+                  |      |                                              (16) this call could return NULL
+                  |  104 |
+                  |  105 |                         memcpy(ma, &m, sizeof(m));
+                  |      |                         ~~~~~~~~~~~~~~~~~~~~~~~~~
+                  |      |                         |
+                  |      |                         (17) ‘ma’ could be NULL: unchecked value from (16)
+                  |
+ipmaddr.c: In function ‘read_igmp’:
+ipmaddr.c:152:17: warning: dereference of possibly-NULL ‘ma’ [CWE-690] [-Wanalyzer-possible-null-dereference]
+  152 |                 memcpy(ma, &m, sizeof(m));
+      |                 ^~~~~~~~~~~~~~~~~~~~~~~~~
+  ‘do_multiaddr’: events 1-4
+    |
+    |  354 | int do_multiaddr(int argc, char **argv)
+    |      |     ^~~~~~~~~~~~
+    |      |     |
+    |      |     (1) entry to ‘do_multiaddr’
+    |  355 | {
+    |  356 |         if (argc < 1)
+    |      |            ~
+    |      |            |
+    |      |            (2) following ‘true’ branch (when ‘argc <= 0’)...
+    |  357 |                 return multiaddr_list(0, NULL);
+    |      |                        ~~~~~~~~~~~~~~~~~~~~~~~
+    |      |                        |
+    |      |                        (3) ...to here
+    |      |                        (4) calling ‘multiaddr_list’ from ‘do_multiaddr’
+    |
+    +--> ‘multiaddr_list’: events 5-10
+           |
+           |  255 | static int multiaddr_list(int argc, char **argv)
+           |      |            ^~~~~~~~~~~~~~
+           |      |            |
+           |      |            (5) entry to ‘multiaddr_list’
+           |......
+           |  262 |         while (argc > 0) {
+           |      |                ~~~~~~~~
+           |      |                     |
+           |      |                     (6) following ‘false’ branch (when ‘argc <= 0’)...
+           |......
+           |  275 |         if (!filter.family || filter.family == AF_PACKET)
+           |      |              ~~~~~~~~~~~~~
+           |      |                    |
+           |      |                    (7) ...to here
+           |  276 |                 read_dev_mcast(&list);
+           |  277 |         if (!filter.family || filter.family == AF_INET)
+           |      |            ~
+           |      |            |
+           |      |            (8) following ‘true’ branch...
+           |  278 |                 read_igmp(&list);
+           |      |                 ~~~~~~~~~~~~~~~~
+           |      |                 |
+           |      |                 (9) ...to here
+           |      |                 (10) calling ‘read_igmp’ from ‘multiaddr_list’
+           |
+           +--> ‘read_igmp’: events 11-14
+                  |
+                  |  116 | static void read_igmp(struct ma_info **result_p)
+                  |      |             ^~~~~~~~~
+                  |      |             |
+                  |      |             (11) entry to ‘read_igmp’
+                  |......
+                  |  126 |         if (!fp)
+                  |      |            ~
+                  |      |            |
+                  |      |            (12) following ‘false’ branch (when ‘fp’ is non-NULL)...
+                  |  127 |                 return;
+                  |  128 |         if (!fgets(buf, sizeof(buf), fp)) {
+                  |      |            ~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~
+                  |      |            | |
+                  |      |            | (13) ...to here
+                  |      |            (14) following ‘false’ branch...
+                  |
+                ‘read_igmp’: event 15
+                  |
+                  |cc1:
+                  | (15): ...to here
+                  |
+                ‘read_igmp’: events 16-19
+                  |
+                  |  133 |         while (fgets(buf, sizeof(buf), fp)) {
+                  |      |                ^~~~~
+                  |      |                |
+                  |      |                (16) following ‘true’ branch...
+                  |......
+                  |  136 |                 if (buf[0] != '\t') {
+                  |      |                     ~~~~~~
+                  |      |                        |
+                  |      |                        (17) ...to here
+                  |......
+                  |  151 |                 ma = malloc(sizeof(m));
+                  |      |                      ~~~~~~~~~~~~~~~~~
+                  |      |                      |
+                  |      |                      (18) this call could return NULL
+                  |  152 |                 memcpy(ma, &m, sizeof(m));
+                  |      |                 ~~~~~~~~~~~~~~~~~~~~~~~~~
+                  |      |                 |
+                  |      |                 (19) ‘ma’ could be NULL: unchecked value from (18)
+                  |
+ipmaddr.c: In function ‘read_igmp6’:
+ipmaddr.c:181:25: warning: dereference of possibly-NULL ‘ma’ [CWE-690] [-Wanalyzer-possible-null-dereference]
+  181 |                         memcpy(ma, &m, sizeof(m));
+      |                         ^~~~~~~~~~~~~~~~~~~~~~~~~
+  ‘do_multiaddr’: events 1-4
+    |
+    |  354 | int do_multiaddr(int argc, char **argv)
+    |      |     ^~~~~~~~~~~~
+    |      |     |
+    |      |     (1) entry to ‘do_multiaddr’
+    |  355 | {
+    |  356 |         if (argc < 1)
+    |      |            ~
+    |      |            |
+    |      |            (2) following ‘true’ branch (when ‘argc <= 0’)...
+    |  357 |                 return multiaddr_list(0, NULL);
+    |      |                        ~~~~~~~~~~~~~~~~~~~~~~~
+    |      |                        |
+    |      |                        (3) ...to here
+    |      |                        (4) calling ‘multiaddr_list’ from ‘do_multiaddr’
+    |
+    +--> ‘multiaddr_list’: events 5-10
+           |
+           |  255 | static int multiaddr_list(int argc, char **argv)
+           |      |            ^~~~~~~~~~~~~~
+           |      |            |
+           |      |            (5) entry to ‘multiaddr_list’
+           |......
+           |  262 |         while (argc > 0) {
+           |      |                ~~~~~~~~
+           |      |                     |
+           |      |                     (6) following ‘false’ branch (when ‘argc <= 0’)...
+           |......
+           |  275 |         if (!filter.family || filter.family == AF_PACKET)
+           |      |              ~~~~~~~~~~~~~
+           |      |                    |
+           |      |                    (7) ...to here
+           |......
+           |  279 |         if (!filter.family || filter.family == AF_INET6)
+           |      |            ~
+           |      |            |
+           |      |            (8) following ‘true’ branch...
+           |  280 |                 read_igmp6(&list);
+           |      |                 ~~~~~~~~~~~~~~~~~
+           |      |                 |
+           |      |                 (9) ...to here
+           |      |                 (10) calling ‘read_igmp6’ from ‘multiaddr_list’
+           |
+           +--> ‘read_igmp6’: events 11-12
+                  |
+                  |  159 | static void read_igmp6(struct ma_info **result_p)
+                  |      |             ^~~~~~~~~~
+                  |      |             |
+                  |      |             (11) entry to ‘read_igmp6’
+                  |......
+                  |  164 |         if (!fp)
+                  |      |            ~
+                  |      |            |
+                  |      |            (12) following ‘false’ branch (when ‘fp’ is non-NULL)...
+                  |
+                ‘read_igmp6’: event 13
+                  |
+                  |cc1:
+                  | (13): ...to here
+                  |
+                ‘read_igmp6’: events 14-17
+                  |
+                  |  167 |         while (fgets(buf, sizeof(buf), fp)) {
+                  |      |                ^~~~~
+                  |      |                |
+                  |      |                (14) following ‘true’ branch...
+                  |  168 |                 char hexa[256];
+                  |  169 |                 struct ma_info m = { .addr.family = AF_INET6 };
+                  |      |                                ~
+                  |      |                                |
+                  |      |                                (15) ...to here
+                  |......
+                  |  179 |                         struct ma_info *ma = malloc(sizeof(m));
+                  |      |                                              ~~~~~~~~~~~~~~~~~
+                  |      |                                              |
+                  |      |                                              (16) this call could return NULL
+                  |  180 |
+                  |  181 |                         memcpy(ma, &m, sizeof(m));
+                  |      |                         ~~~~~~~~~~~~~~~~~~~~~~~~~
+                  |      |                         |
+                  |      |                         (17) ‘ma’ could be NULL: unchecked value from (16)
+                  |
+
+Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
+---
+ ip/ipmaddr.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/ip/ipmaddr.c b/ip/ipmaddr.c
+index f8d6b992..a8ef20ec 100644
+--- a/ip/ipmaddr.c
++++ b/ip/ipmaddr.c
+@@ -102,6 +102,8 @@ static void read_dev_mcast(struct ma_info **result_p)
+ 		if (len >= 0) {
+ 			struct ma_info *ma = malloc(sizeof(m));
+ 
++			if (ma == NULL)
++				break;
+ 			memcpy(ma, &m, sizeof(m));
+ 			ma->addr.bytelen = len;
+ 			ma->addr.bitlen = len<<3;
+@@ -149,6 +151,9 @@ static void read_igmp(struct ma_info **result_p)
+ 		sscanf(buf, "%08x%d", (__u32 *)&m.addr.data, &m.users);
+ 
+ 		ma = malloc(sizeof(m));
++		if (ma == NULL)
++			break;
++			
+ 		memcpy(ma, &m, sizeof(m));
+ 		maddr_ins(result_p, ma);
+ 	}
+@@ -178,8 +183,10 @@ static void read_igmp6(struct ma_info **result_p)
+ 		if (len >= 0) {
+ 			struct ma_info *ma = malloc(sizeof(m));
+ 
+-			memcpy(ma, &m, sizeof(m));
++			if (ma == NULL)
++				break;
+ 
++			memcpy(ma, &m, sizeof(m));
+ 			ma->addr.bytelen = len;
+ 			ma->addr.bitlen = len<<3;
+ 			maddr_ins(result_p, ma);
+-- 
+2.27.0
+

backport-ipnetns-fix-fd-leak-with-ip-netns-set.patch

@@ -0,0 +1,49 @@
+From 465e87a89c134d28a7fae540d26b27e6a2e1d6c0 Mon Sep 17 00:00:00 2001
+From: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+Date: Thu, 11 May 2023 16:42:24 +0200
+Subject: [PATCH] ipnetns: fix fd leak with 'ip netns set'
+
+There is no reason to open this netns file. set_netnsid_from_name() uses
+netns_get_fd() for this purpose and uses the returned fd.
+
+Reported-by: Stephen Hemminger <stephen@networkplumber.org>
+Fixes: d182ee1307c7 ("ipnetns: allow to get and set netns ids")
+Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
+---
+ ip/ipnetns.c | 11 +----------
+ 1 file changed, 1 insertion(+), 10 deletions(-)
+
+diff --git a/ip/ipnetns.c b/ip/ipnetns.c
+index 12035349..9d996832 100644
+--- a/ip/ipnetns.c
++++ b/ip/ipnetns.c
+@@ -967,9 +967,8 @@ int set_netnsid_from_name(const char *name, int nsid)
+ 
+ static int netns_set(int argc, char **argv)
+ {
+-	char netns_path[PATH_MAX];
+ 	const char *name;
+-	int netns, nsid;
++	int nsid;
+ 
+ 	if (argc < 1) {
+ 		fprintf(stderr, "No netns name specified\n");
+@@ -988,14 +987,6 @@ static int netns_set(int argc, char **argv)
+ 	else if (nsid < 0)
+ 		invarg("\"netnsid\" value should be >= 0", argv[1]);
+ 
+-	snprintf(netns_path, sizeof(netns_path), "%s/%s", NETNS_RUN_DIR, name);
+-	netns = open(netns_path, O_RDONLY | O_CLOEXEC);
+-	if (netns < 0) {
+-		fprintf(stderr, "Cannot open network namespace \"%s\": %s\n",
+-			name, strerror(errno));
+-		return -1;
+-	}
+-
+ 	return set_netnsid_from_name(name, nsid);
+ }
+ 
+-- 
+2.27.0
+

backport-iproute2-optimize-code-and-fix-some-mem-leak-risk.patch

@@ -0,0 +1,309 @@
+From 7e8cdfa2eac57c8c1c469681d5ee016fc432ee4d Mon Sep 17 00:00:00 2001
+From: zhaoshuang <zhaoshuang@uniontech.com>
+Date: Thu, 11 May 2023 08:37:26 +0800
+Subject: [PATCH] iproute2: optimize code and fix some mem-leak risk
+
+Conflict:contaxt adapt in devlink/devlink.c ip/ipnexthop.c,and remove modify in tc/tc_class.c because it
+does not have leak
+Reference:https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/commit?id=7e8cdfa2eac57c8c1c469681d5ee016fc432ee4d
+
+Signed-off-by: zhaoshuang <izhaoshuang@163.com>
+Reviewed-by: Pawel Chmielewski <pawel.chmielewski@intel.com>
+Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
+---
+ bridge/mdb.c      |  4 ++++
+ devlink/devlink.c | 21 +++++++++------------
+ ip/ipaddrlabel.c  |  1 +
+ ip/ipfou.c        |  1 +
+ ip/ipila.c        |  1 +
+ ip/ipnetconf.c    |  1 +
+ ip/ipnexthop.c    |  4 ++++
+ ip/iproute.c      |  6 ++++++
+ ip/iprule.c       |  1 +
+ ip/iptuntap.c     |  1 +
+ ip/tunnel.c       |  2 ++
+ tc/tc_filter.c    |  1 +
+ tc/tc_qdisc.c     |  1 +
+ 13 files changed, 33 insertions(+), 12 deletions(-)
+
+diff --git a/bridge/mdb.c b/bridge/mdb.c
+index b427d87..c5f23d0 100644
+--- a/bridge/mdb.c
++++ b/bridge/mdb.c
+@@ -423,12 +423,14 @@ static int mdb_show(int argc, char **argv)
+ 	/* get mdb entries */
+ 	if (rtnl_mdbdump_req(&rth, PF_BRIDGE) < 0) {
+ 		perror("Cannot send dump request");
++		delete_json_obj();
+ 		return -1;
+ 	}
+ 
+ 	open_json_array(PRINT_JSON, "mdb");
+ 	if (rtnl_dump_filter(&rth, print_mdbs, stdout) < 0) {
+ 		fprintf(stderr, "Dump terminated\n");
++		delete_json_obj();
+ 		return -1;
+ 	}
+ 	close_json_array(PRINT_JSON, NULL);
+@@ -436,12 +438,14 @@ static int mdb_show(int argc, char **argv)
+ 	/* get router ports */
+ 	if (rtnl_mdbdump_req(&rth, PF_BRIDGE) < 0) {
+ 		perror("Cannot send dump request");
++		delete_json_obj();
+ 		return -1;
+ 	}
+ 
+ 	open_json_object("router");
+ 	if (rtnl_dump_filter(&rth, print_rtrs, stdout) < 0) {
+ 		fprintf(stderr, "Dump terminated\n");
++		delete_json_obj();
+ 		return -1;
+ 	}
+ 	close_json_object();
+diff --git a/devlink/devlink.c b/devlink/devlink.c
+index 765e90d..9275ee5 100644
+--- a/devlink/devlink.c
++++ b/devlink/devlink.c
+@@ -209,6 +209,14 @@ struct ifname_map {
+ 	char *ifname;
+ };
+ 
++static void ifname_map_free(struct ifname_map *ifname_map)
++{
++	free(ifname_map->ifname);
++	free(ifname_map->dev_name);
++	free(ifname_map->bus_name);
++	free(ifname_map);
++}
++
+ static struct ifname_map *ifname_map_alloc(const char *bus_name,
+ 					   const char *dev_name,
+ 					   uint32_t port_index,
+@@ -225,23 +233,12 @@ static struct ifname_map *ifname_map_alloc(const char *bus_name,
+ 	ifname_map->ifname = strdup(ifname);
+ 	if (!ifname_map->bus_name || !ifname_map->dev_name ||
+ 	    !ifname_map->ifname) {
+-		free(ifname_map->ifname);
+-		free(ifname_map->dev_name);
+-		free(ifname_map->bus_name);
+-		free(ifname_map);
++		ifname_map_free(ifname_map);
+ 		return NULL;
+ 	}
+ 	return ifname_map;
+ }
+ 
+-static void ifname_map_free(struct ifname_map *ifname_map)
+-{
+-	free(ifname_map->ifname);
+-	free(ifname_map->dev_name);
+-	free(ifname_map->bus_name);
+-	free(ifname_map);
+-}
+-
+ #define DL_OPT_HANDLE		BIT(0)
+ #define DL_OPT_HANDLEP		BIT(1)
+ #define DL_OPT_PORT_TYPE	BIT(2)
+diff --git a/ip/ipaddrlabel.c b/ip/ipaddrlabel.c
+index beb08da..9e468b0 100644
+--- a/ip/ipaddrlabel.c
++++ b/ip/ipaddrlabel.c
+@@ -127,6 +127,7 @@ static int ipaddrlabel_list(int argc, char **argv)
+ 	new_json_obj(json);
+ 	if (rtnl_dump_filter(&rth, print_addrlabel, stdout) < 0) {
+ 		fprintf(stderr, "Dump terminated\n");
++		delete_json_obj();
+ 		return 1;
+ 	}
+ 	delete_json_obj();
+diff --git a/ip/ipfou.c b/ip/ipfou.c
+index 9c69777..5db137d 100644
+--- a/ip/ipfou.c
++++ b/ip/ipfou.c
+@@ -322,6 +322,7 @@ static int do_show(int argc, char **argv)
+ 	new_json_obj(json);
+ 	if (rtnl_dump_filter(&genl_rth, print_fou_mapping, stdout) < 0) {
+ 		fprintf(stderr, "Dump terminated\n");
++		delete_json_obj();
+ 		return 1;
+ 	}
+ 	delete_json_obj();
+diff --git a/ip/ipila.c b/ip/ipila.c
+index 475c35b..cbc3dd3 100644
+--- a/ip/ipila.c
++++ b/ip/ipila.c
+@@ -154,6 +154,7 @@ static int do_list(int argc, char **argv)
+ 	new_json_obj(json);
+ 	if (rtnl_dump_filter(&genl_rth, print_ila_mapping, stdout) < 0) {
+ 		fprintf(stderr, "Dump terminated\n");
++		delete_json_obj();
+ 		return 1;
+ 	}
+ 	delete_json_obj();
+diff --git a/ip/ipnetconf.c b/ip/ipnetconf.c
+index bb0ebe1..f5ebb1a 100644
+--- a/ip/ipnetconf.c
++++ b/ip/ipnetconf.c
+@@ -214,6 +214,7 @@ dump:
+ 			 */
+ 			if (errno == EOPNOTSUPP &&
+ 			    filter.family == AF_UNSPEC) {
++				delete_json_obj();
+ 				filter.family = AF_INET;
+ 				goto dump;
+ 			}
+diff --git a/ip/ipnexthop.c b/ip/ipnexthop.c
+index 9478aa5..36dafa1 100644
+--- a/ip/ipnexthop.c
++++ b/ip/ipnexthop.c
+@@ -732,6 +732,7 @@ static int ipnh_get_id(__u32 id)
+ 	new_json_obj(json);
+ 
+ 	if (print_nexthop(answer, (void *)stdout) < 0) {
++		delete_json_obj();
+ 		free(answer);
+ 		return -1;
+ 	}
+@@ -817,6 +818,7 @@ static int ipnh_list_flush(int argc, char **argv, int action)
+ 	new_json_obj(json);
+ 
+ 	if (rtnl_dump_filter(&rth, print_nexthop, stdout) < 0) {
++		delete_json_obj();
+ 		fprintf(stderr, "Dump terminated\n");
+ 		return -2;
+ 	}
+@@ -892,6 +894,7 @@ static int ipnh_bucket_list(int argc, char **argv)
+ 	new_json_obj(json);
+ 
+ 	if (rtnl_dump_filter(&rth, print_nexthop_bucket, stdout) < 0) {
++		delete_json_obj();
+ 		fprintf(stderr, "Dump terminated\n");
+ 		return -2;
+ 	}
+@@ -932,6 +935,7 @@ static int ipnh_bucket_get_id(__u32 id, __u16 bucket_index)
+ 	new_json_obj(json);
+ 
+ 	if (print_nexthop_bucket(answer, (void *)stdout) < 0) {
++		delete_json_obj();
+ 		free(answer);
+ 		return -1;
+ 	}
+diff --git a/ip/iproute.c b/ip/iproute.c
+index 9922cb0..6e359fa 100644
+--- a/ip/iproute.c
++++ b/ip/iproute.c
+@@ -1962,6 +1962,7 @@ static int iproute_list_flush_or_save(int argc, char **argv, int action)
+ 	if (rtnl_dump_filter_errhndlr(&rth, filter_fn, stdout,
+ 				      save_route_errhndlr, NULL) < 0) {
+ 		fprintf(stderr, "Dump terminated\n");
++		delete_json_obj();
+ 		return -2;
+ 	}
+ 
+@@ -2157,18 +2158,21 @@ static int iproute_get(int argc, char **argv)
+ 
+ 		if (print_route(answer, (void *)stdout) < 0) {
+ 			fprintf(stderr, "An error :-)\n");
++			delete_json_obj();
+ 			free(answer);
+ 			return -1;
+ 		}
+ 
+ 		if (answer->nlmsg_type != RTM_NEWROUTE) {
+ 			fprintf(stderr, "Not a route?\n");
++			delete_json_obj();
+ 			free(answer);
+ 			return -1;
+ 		}
+ 		len -= NLMSG_LENGTH(sizeof(*r));
+ 		if (len < 0) {
+ 			fprintf(stderr, "Wrong len %d\n", len);
++			delete_json_obj();
+ 			free(answer);
+ 			return -1;
+ 		}
+@@ -2180,6 +2184,7 @@ static int iproute_get(int argc, char **argv)
+ 			r->rtm_src_len = 8*RTA_PAYLOAD(tb[RTA_PREFSRC]);
+ 		} else if (!tb[RTA_SRC]) {
+ 			fprintf(stderr, "Failed to connect the route\n");
++			delete_json_obj();
+ 			free(answer);
+ 			return -1;
+ 		}
+@@ -2202,6 +2207,7 @@ static int iproute_get(int argc, char **argv)
+ 
+ 	if (print_route(answer, (void *)stdout) < 0) {
+ 		fprintf(stderr, "An error :-)\n");
++		delete_json_obj();
+ 		free(answer);
+ 		return -1;
+ 	}
+diff --git a/ip/iprule.c b/ip/iprule.c
+index 4166073..7307908 100644
+--- a/ip/iprule.c
++++ b/ip/iprule.c
+@@ -718,6 +718,7 @@ static int iprule_list_flush_or_save(int argc, char **argv, int action)
+ 	new_json_obj(json);
+ 	if (rtnl_dump_filter(&rth, filter_fn, stdout) < 0) {
+ 		fprintf(stderr, "Dump terminated\n");
++		delete_json_obj();
+ 		return 1;
+ 	}
+ 	delete_json_obj();
+diff --git a/ip/iptuntap.c b/ip/iptuntap.c
+index 385d2bd..ff88844 100644
+--- a/ip/iptuntap.c
++++ b/ip/iptuntap.c
+@@ -444,6 +444,7 @@ static int do_show(int argc, char **argv)
+ 
+ 	if (rtnl_dump_filter(&rth, print_tuntap, NULL) < 0) {
+ 		fprintf(stderr, "Dump terminated\n");
++		delete_json_obj();
+ 		return -1;
+ 	}
+ 
+diff --git a/ip/tunnel.c b/ip/tunnel.c
+index 88585cf..51a0016 100644
+--- a/ip/tunnel.c
++++ b/ip/tunnel.c
+@@ -439,11 +439,13 @@ int do_tunnels_list(struct tnl_print_nlmsg_info *info)
+ 	new_json_obj(json);
+ 	if (rtnl_linkdump_req(&rth, preferred_family) < 0) {
+ 		perror("Cannot send dump request\n");
++		delete_json_obj();
+ 		return -1;
+ 	}
+ 
+ 	if (rtnl_dump_filter(&rth, print_nlmsg_tunnel, info) < 0) {
+ 		fprintf(stderr, "Dump terminated\n");
++		delete_json_obj();
+ 		return -1;
+ 	}
+ 	delete_json_obj();
+diff --git a/tc/tc_filter.c b/tc/tc_filter.c
+index 71be2e8..5a2a6ba 100644
+--- a/tc/tc_filter.c
++++ b/tc/tc_filter.c
+@@ -738,6 +738,7 @@ static int tc_filter_list(int cmd, int argc, char **argv)
+ 	new_json_obj(json);
+ 	if (rtnl_dump_filter(&rth, print_filter, stdout) < 0) {
+ 		fprintf(stderr, "Dump terminated\n");
++		delete_json_obj();
+ 		return 1;
+ 	}
+ 	delete_json_obj();
+diff --git a/tc/tc_qdisc.c b/tc/tc_qdisc.c
+index b79029d..77f4d97 100644
+--- a/tc/tc_qdisc.c
++++ b/tc/tc_qdisc.c
+@@ -435,6 +435,7 @@ static int tc_qdisc_list(int argc, char **argv)
+ 	new_json_obj(json);
+ 	if (rtnl_dump_filter(&rth, print_qdisc, stdout) < 0) {
+ 		fprintf(stderr, "Dump terminated\n");
++		delete_json_obj();
+ 		return 1;
+ 	}
+ 	delete_json_obj();
+-- 
+2.27.0
+

backport-iproute2-prevent-memory-leak.patch

@@ -0,0 +1,148 @@
+From 2c3ebb2ae08a634615e56303d784ddb366e47f04 Mon Sep 17 00:00:00 2001
+From: heminhong <heminhong@kylinos.cn>
+Date: Thu, 16 Nov 2023 11:13:08 +0800
+Subject: [PATCH] iproute2: prevent memory leak
+
+When the return value of rtnl_talk() is not less than 0,
+'answer' will be allocated. The 'answer' should be free
+after using, otherwise it will cause memory leak.
+
+Fixes: a066cc6623e1 ("gre/gre6: Unify local/remote endpoint address parsing")
+Signed-off-by: heminhong <heminhong@kylinos.cn>
+Reviewed-by: Andrea Claudi <aclaudi@redhat.com>
+Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
+---
+ ip/link_gre.c    | 3 ++-
+ ip/link_gre6.c   | 3 ++-
+ ip/link_ip6tnl.c | 3 ++-
+ ip/link_iptnl.c  | 3 ++-
+ ip/link_vti.c    | 3 ++-
+ ip/link_vti6.c   | 3 ++-
+ 6 files changed, 12 insertions(+), 6 deletions(-)
+
+diff --git a/ip/link_gre.c b/ip/link_gre.c
+index 74a5b5e96..6d71864c1 100644
+--- a/ip/link_gre.c
++++ b/ip/link_gre.c
+@@ -76,7 +76,7 @@ static int gre_parse_opt(struct link_util *lu, int argc, char **argv,
+ 		.i.ifi_family = preferred_family,
+ 		.i.ifi_index = ifi->ifi_index,
+ 	};
+-	struct nlmsghdr *answer;
++	struct nlmsghdr *answer = NULL;
+ 	struct rtattr *tb[IFLA_MAX + 1];
+ 	struct rtattr *linkinfo[IFLA_INFO_MAX+1];
+ 	struct rtattr *greinfo[IFLA_GRE_MAX + 1];
+@@ -113,6 +113,7 @@ static int gre_parse_opt(struct link_util *lu, int argc, char **argv,
+ get_failed:
+ 			fprintf(stderr,
+ 				"Failed to get existing tunnel info.\n");
++			free(answer);
+ 			return -1;
+ 		}
+ 
+diff --git a/ip/link_gre6.c b/ip/link_gre6.c
+index b03bd65ad..4d1c65748 100644
+--- a/ip/link_gre6.c
++++ b/ip/link_gre6.c
+@@ -79,7 +79,7 @@ static int gre_parse_opt(struct link_util *lu, int argc, char **argv,
+ 		.i.ifi_family = preferred_family,
+ 		.i.ifi_index = ifi->ifi_index,
+ 	};
+-	struct nlmsghdr *answer;
++	struct nlmsghdr *answer = NULL;
+ 	struct rtattr *tb[IFLA_MAX + 1];
+ 	struct rtattr *linkinfo[IFLA_INFO_MAX+1];
+ 	struct rtattr *greinfo[IFLA_GRE_MAX + 1];
+@@ -115,6 +115,7 @@ static int gre_parse_opt(struct link_util *lu, int argc, char **argv,
+ get_failed:
+ 			fprintf(stderr,
+ 				"Failed to get existing tunnel info.\n");
++			free(answer);
+ 			return -1;
+ 		}
+ 
+diff --git a/ip/link_ip6tnl.c b/ip/link_ip6tnl.c
+index b27d696f5..3a30dca93 100644
+--- a/ip/link_ip6tnl.c
++++ b/ip/link_ip6tnl.c
+@@ -72,7 +72,7 @@ static int ip6tunnel_parse_opt(struct link_util *lu, int argc, char **argv,
+ 		.i.ifi_family = preferred_family,
+ 		.i.ifi_index = ifi->ifi_index,
+ 	};
+-	struct nlmsghdr *answer;
++	struct nlmsghdr *answer = NULL;
+ 	struct rtattr *tb[IFLA_MAX + 1];
+ 	struct rtattr *linkinfo[IFLA_INFO_MAX+1];
+ 	struct rtattr *iptuninfo[IFLA_IPTUN_MAX + 1];
+@@ -101,6 +101,7 @@ static int ip6tunnel_parse_opt(struct link_util *lu, int argc, char **argv,
+ get_failed:
+ 			fprintf(stderr,
+ 				"Failed to get existing tunnel info.\n");
++			free(answer);
+ 			return -1;
+ 		}
+ 
+diff --git a/ip/link_iptnl.c b/ip/link_iptnl.c
+index 1315aebe9..879202f71 100644
+--- a/ip/link_iptnl.c
++++ b/ip/link_iptnl.c
+@@ -73,7 +73,7 @@ static int iptunnel_parse_opt(struct link_util *lu, int argc, char **argv,
+ 		.i.ifi_family = preferred_family,
+ 		.i.ifi_index = ifi->ifi_index,
+ 	};
+-	struct nlmsghdr *answer;
++	struct nlmsghdr *answer = NULL;
+ 	struct rtattr *tb[IFLA_MAX + 1];
+ 	struct rtattr *linkinfo[IFLA_INFO_MAX+1];
+ 	struct rtattr *iptuninfo[IFLA_IPTUN_MAX + 1];
+@@ -105,6 +105,7 @@ static int iptunnel_parse_opt(struct link_util *lu, int argc, char **argv,
+ get_failed:
+ 			fprintf(stderr,
+ 				"Failed to get existing tunnel info.\n");
++			free(answer);
+ 			return -1;
+ 		}
+ 
+diff --git a/ip/link_vti.c b/ip/link_vti.c
+index 509432543..7a95dc02d 100644
+--- a/ip/link_vti.c
++++ b/ip/link_vti.c
+@@ -48,7 +48,7 @@ static int vti_parse_opt(struct link_util *lu, int argc, char **argv,
+ 		.i.ifi_family = preferred_family,
+ 		.i.ifi_index = ifi->ifi_index,
+ 	};
+-	struct nlmsghdr *answer;
++	struct nlmsghdr *answer = NULL;
+ 	struct rtattr *tb[IFLA_MAX + 1];
+ 	struct rtattr *linkinfo[IFLA_INFO_MAX+1];
+ 	struct rtattr *vtiinfo[IFLA_VTI_MAX + 1];
+@@ -69,6 +69,7 @@ static int vti_parse_opt(struct link_util *lu, int argc, char **argv,
+ get_failed:
+ 			fprintf(stderr,
+ 				"Failed to get existing tunnel info.\n");
++			free(answer);
+ 			return -1;
+ 		}
+ 
+diff --git a/ip/link_vti6.c b/ip/link_vti6.c
+index 5764221eb..aaf701d33 100644
+--- a/ip/link_vti6.c
++++ b/ip/link_vti6.c
+@@ -50,7 +50,7 @@ static int vti6_parse_opt(struct link_util *lu, int argc, char **argv,
+ 		.i.ifi_family = preferred_family,
+ 		.i.ifi_index = ifi->ifi_index,
+ 	};
+-	struct nlmsghdr *answer;
++	struct nlmsghdr *answer = NULL;
+ 	struct rtattr *tb[IFLA_MAX + 1];
+ 	struct rtattr *linkinfo[IFLA_INFO_MAX+1];
+ 	struct rtattr *vtiinfo[IFLA_VTI_MAX + 1];
+@@ -71,6 +71,7 @@ static int vti6_parse_opt(struct link_util *lu, int argc, char **argv,
+ get_failed:
+ 			fprintf(stderr,
+ 				"Failed to get existing tunnel info.\n");
++			free(answer);
+ 			return -1;
+ 		}
+ 

backport-iproute_lwtunnel-fix-array-boundary-check.patch

@@ -0,0 +1,34 @@
+From 1cf50a1f2723764eb53fad7c5ff8754835806df0 Mon Sep 17 00:00:00 2001
+From: Andrea Claudi <aclaudi@redhat.com>
+Date: Mon, 29 May 2023 23:42:16 +0200
+Subject: [PATCH] iproute_lwtunnel: fix array boundary check
+
+seg6_mode_types is made up of 5 elements, so ARRAY_SIZE(seg6_mode_types)
+evaluates to 5. Thus, when mode = 5, this function returns
+seg6_mode_types[5], resulting in an out-of-bound access.
+
+Fix this bailing out when mode is equal to or greater than 5.
+
+Fixes: cf87da417bb4 ("iproute: add support for seg6 l2encap mode")
+Signed-off-by: Andrea Claudi <aclaudi@redhat.com>
+Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
+---
+ ip/iproute_lwtunnel.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/ip/iproute_lwtunnel.c b/ip/iproute_lwtunnel.c
+index 96de3b20..94985972 100644
+--- a/ip/iproute_lwtunnel.c
++++ b/ip/iproute_lwtunnel.c
+@@ -140,7 +140,7 @@ static const char *seg6_mode_types[] = {
+ 
+ static const char *format_seg6mode_type(int mode)
+ {
+-	if (mode < 0 || mode > ARRAY_SIZE(seg6_mode_types))
++	if (mode < 0 || mode >= ARRAY_SIZE(seg6_mode_types))
+ 		return "<unknown>";
+ 
+ 	return seg6_mode_types[mode];
+-- 
+2.27.0
+

backport-iproute_lwtunnel-fix-possible-use-of-NULL-when-mallo.patch

@@ -0,0 +1,178 @@
+From fa44c2d6f1dab40ad615bcb16fdbdb189d617ed6 Mon Sep 17 00:00:00 2001
+From: Stephen Hemminger <stephen@networkplumber.org>
+Date: Mon, 8 May 2023 19:05:38 -0700
+Subject: [PATCH] iproute_lwtunnel: fix possible use of NULL when malloc()
+ fails
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+iproute_lwtunnel.c: In function ‘parse_srh’:
+iproute_lwtunnel.c:903:9: warning: use of possibly-NULL ‘srh’ where non-null expected [CWE-690] [-Wanalyzer-possible-null-argument]
+  903 |         memset(srh, 0, srhlen);
+      |         ^~~~~~~~~~~~~~~~~~~~~~
+  ‘parse_srh’: events 1-2
+    |
+    |  902 |         srh = malloc(srhlen);
+    |      |               ^~~~~~~~~~~~~~
+    |      |               |
+    |      |               (1) this call could return NULL
+    |  903 |         memset(srh, 0, srhlen);
+    |      |         ~~~~~~~~~~~~~~~~~~~~~~
+    |      |         |
+    |      |         (2) argument 1 (‘srh’) from (1) could be NULL where non-null expected
+    |
+In file included from iproute_lwtunnel.c:13:
+/usr/include/string.h:61:14: note: argument 1 of ‘memset’ must be non-null
+   61 | extern void *memset (void *__s, int __c, size_t __n) __THROW __nonnull ((1));
+      |              ^~~~~~
+iproute_lwtunnel.c: In function ‘parse_encap_seg6’:
+iproute_lwtunnel.c:980:9: warning: use of possibly-NULL ‘tuninfo’ where non-null expected [CWE-690] [-Wanalyzer-possible-null-argument]
+  980 |         memset(tuninfo, 0, sizeof(*tuninfo) + srhlen);
+      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+  ‘parse_encap_seg6’: events 1-2
+    |
+    |  934 | static int parse_encap_seg6(struct rtattr *rta, size_t len, int *argcp,
+    |      |            ^~~~~~~~~~~~~~~~
+    |      |            |
+    |      |            (1) entry to ‘parse_encap_seg6’
+    |......
+    |  976 |         srh = parse_srh(segbuf, hmac, encap);
+    |      |               ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+    |      |               |
+    |      |               (2) calling ‘parse_srh’ from ‘parse_encap_seg6’
+    |
+    +--> ‘parse_srh’: events 3-5
+           |
+           |  882 | static struct ipv6_sr_hdr *parse_srh(char *segbuf, int hmac, bool encap)
+           |      |                            ^~~~~~~~~
+           |      |                            |
+           |      |                            (3) entry to ‘parse_srh’
+           |......
+           |  922 |         if (hmac) {
+           |      |            ~
+           |      |            |
+           |      |            (4) following ‘false’ branch (when ‘hmac == 0’)...
+           |......
+           |  931 |         return srh;
+           |      |                ~~~
+           |      |                |
+           |      |                (5) ...to here
+           |
+    <------+
+    |
+  ‘parse_encap_seg6’: events 6-8
+    |
+    |  976 |         srh = parse_srh(segbuf, hmac, encap);
+    |      |               ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+    |      |               |
+    |      |               (6) returning to ‘parse_encap_seg6’ from ‘parse_srh’
+    |......
+    |  979 |         tuninfo = malloc(sizeof(*tuninfo) + srhlen);
+    |      |                   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+    |      |                   |
+    |      |                   (7) this call could return NULL
+    |  980 |         memset(tuninfo, 0, sizeof(*tuninfo) + srhlen);
+    |      |         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+    |      |         |
+    |      |         (8) argument 1 (‘tuninfo’) from (7) could be NULL where non-null expected
+    |
+/usr/include/string.h:61:14: note: argument 1 of ‘memset’ must be non-null
+   61 | extern void *memset (void *__s, int __c, size_t __n) __THROW __nonnull ((1));
+      |              ^~~~~~
+iproute_lwtunnel.c: In function ‘parse_rpl_srh’:
+iproute_lwtunnel.c:1018:21: warning: dereference of possibly-NULL ‘srh’ [CWE-690] [-Wanalyzer-possible-null-dereference]
+ 1018 |         srh->hdrlen = (srhlen >> 3) - 1;
+      |         ~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~
+  ‘parse_rpl_srh’: events 1-2
+    |
+    | 1016 |         srh = calloc(1, srhlen);
+    |      |               ^~~~~~~~~~~~~~~~~
+    |      |               |
+    |      |               (1) this call could return NULL
+    | 1017 |
+    | 1018 |         srh->hdrlen = (srhlen >> 3) - 1;
+    |      |         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+    |      |                     |
+    |      |                     (2) ‘srh’ could be NULL: unchecked value from (1)
+    |
+
+Fixes: 00e76d4da37f ("iproute: add helper functions for SRH processing")
+Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
+---
+ ip/iproute_lwtunnel.c | 18 +++++++++++++-----
+ 1 file changed, 13 insertions(+), 5 deletions(-)
+
+diff --git a/ip/iproute_lwtunnel.c b/ip/iproute_lwtunnel.c
+index 308178ef..96de3b20 100644
+--- a/ip/iproute_lwtunnel.c
++++ b/ip/iproute_lwtunnel.c
+@@ -900,6 +900,9 @@ static struct ipv6_sr_hdr *parse_srh(char *segbuf, int hmac, bool encap)
+ 		srhlen += 40;
+ 
+ 	srh = malloc(srhlen);
++	if (srh == NULL)
++		return NULL;
++
+ 	memset(srh, 0, srhlen);
+ 
+ 	srh->hdrlen = (srhlen >> 3) - 1;
+@@ -935,14 +938,14 @@ static int parse_encap_seg6(struct rtattr *rta, size_t len, int *argcp,
+ 			    char ***argvp)
+ {
+ 	int mode_ok = 0, segs_ok = 0, hmac_ok = 0;
+-	struct seg6_iptunnel_encap *tuninfo;
++	struct seg6_iptunnel_encap *tuninfo = NULL;
+ 	struct ipv6_sr_hdr *srh;
+ 	char **argv = *argvp;
+ 	char segbuf[1024] = "";
+ 	int argc = *argcp;
+ 	int encap = -1;
+ 	__u32 hmac = 0;
+-	int ret = 0;
++	int ret = -1;
+ 	int srhlen;
+ 
+ 	while (argc > 0) {
+@@ -974,9 +977,13 @@ static int parse_encap_seg6(struct rtattr *rta, size_t len, int *argcp,
+ 	}
+ 
+ 	srh = parse_srh(segbuf, hmac, encap);
++	if (srh == NULL)
++		goto out;
+ 	srhlen = (srh->hdrlen + 1) << 3;
+ 
+ 	tuninfo = malloc(sizeof(*tuninfo) + srhlen);
++	if (tuninfo == NULL)
++		goto out;
+ 	memset(tuninfo, 0, sizeof(*tuninfo) + srhlen);
+ 
+ 	tuninfo->mode = encap;
+@@ -984,13 +991,12 @@ static int parse_encap_seg6(struct rtattr *rta, size_t len, int *argcp,
+ 	memcpy(tuninfo->srh, srh, srhlen);
+ 
+ 	if (rta_addattr_l(rta, len, SEG6_IPTUNNEL_SRH, tuninfo,
+-			  sizeof(*tuninfo) + srhlen)) {
+-		ret = -1;
++			  sizeof(*tuninfo) + srhlen))
+ 		goto out;
+-	}
+ 
+ 	*argcp = argc + 1;
+ 	*argvp = argv - 1;
++	ret = 0;
+ 
+ out:
+ 	free(tuninfo);
+@@ -1014,6 +1020,8 @@ static struct ipv6_rpl_sr_hdr *parse_rpl_srh(char *segbuf)
+ 	srhlen = 8 + 16 * nsegs;
+ 
+ 	srh = calloc(1, srhlen);
++	if (srh == NULL)
++		return NULL;
+ 
+ 	srh->hdrlen = (srhlen >> 3) - 1;
+ 	srh->type = 3;
+-- 
+2.27.0
+

backport-iptunnel-detect-protocol-mismatch-on-tunnel-change.patch

@@ -0,0 +1,67 @@
+From 8cc2eac60d5f1f5ec2c40d02c0003731c8b610dc Mon Sep 17 00:00:00 2001
+From: Stephen Hemminger <stephen@networkplumber.org>
+Date: Mon, 10 Apr 2023 16:22:51 -0700
+Subject: [PATCH] iptunnel: detect protocol mismatch on tunnel change
+
+If attempt is made to change an IPv6 tunnel by using IPv4
+parameters, a stack overflow would happen and garbage request
+would be passed to kernel.
+
+Example:
+ip tunnel add gre1 mode ip6gre local 2001:db8::1 remote 2001:db8::2 ttl 255
+ip tunnel change gre1 mode gre local 192.168.0.0 remote 192.168.0.1 ttl 255
+
+The second command should fail because it attempting set IPv4 addresses
+on a GRE tunnel that is IPv6.
+
+Do best effort detection of this mismatch by giving a bigger buffer to get
+tunnel request, and checking that the IP header is IPv4. It is still possible
+but unlikely that byte would match in IPv6 tunnel paramater, but good enough
+to catch the obvious cases.
+
+Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1032642
+Tested-by: Luca Boccassi <bluca@debian.org>
+Reported-by: Robin <imer@imer.cc>
+Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
+---
+ ip/iptunnel.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/ip/iptunnel.c b/ip/iptunnel.c
+index 02c3670b..b6da1459 100644
+--- a/ip/iptunnel.c
++++ b/ip/iptunnel.c
+@@ -17,6 +17,7 @@
+ #include <net/if_arp.h>
+ #include <linux/ip.h>
+ #include <linux/if_tunnel.h>
++#include <linux/ip6_tunnel.h>
+ 
+ #include "rt_names.h"
+ #include "utils.h"
+@@ -172,11 +173,20 @@ static int parse_args(int argc, char **argv, int cmd, struct ip_tunnel_parm *p)
+ 			if (get_ifname(p->name, *argv))
+ 				invarg("\"name\" not a valid ifname", *argv);
+ 			if (cmd == SIOCCHGTUNNEL && count == 0) {
+-				struct ip_tunnel_parm old_p = {};
++				union {
++					struct ip_tunnel_parm ip_tnl;
++					struct ip6_tnl_parm2 ip6_tnl;
++				} old_p = {};
+ 
+ 				if (tnl_get_ioctl(*argv, &old_p))
+ 					return -1;
+-				*p = old_p;
++
++				if (old_p.ip_tnl.iph.version != 4 ||
++				    old_p.ip_tnl.iph.ihl != 5)
++					invarg("\"name\" is not an ip tunnel",
++					       *argv);
++
++				*p = old_p.ip_tnl;
+ 			}
+ 		}
+ 		count++;
+-- 
+2.27.0
+

backport-libnetlink-Fix-memory-leak-in-__rtnl_talk_iov.patch

@@ -0,0 +1,86 @@
+From 0faec4d050b607f7544b6cf9a4c2d57e191f981f Mon Sep 17 00:00:00 2001
+From: Lahav Schlesinger <lschlesinger@drivenets.com>
+Date: Mon, 5 Dec 2022 10:47:41 +0200
+Subject: [PATCH] libnetlink: Fix memory leak in __rtnl_talk_iov()
+
+If `__rtnl_talk_iov` fails then callers are not expected to free `answer`.
+
+Currently if `NLMSG_ERROR` was received with an error then the netlink
+buffer was stored in `answer`, while still returning an error
+
+This leak can be observed by running this snippet over time.
+This triggers an `NLMSG_ERROR` because for each neighbour update, `ip`
+will try to query for the name of interface 9999 in the wrong netns.
+(which in itself is a separate bug)
+
+ set -e
+
+ ip netns del test-a || true
+ ip netns add test-a
+ ip netns del test-b || true
+ ip netns add test-b
+
+ ip -n test-a netns set test-b auto
+ ip -n test-a link add veth_a index 9999 type veth \
+  peer name veth_b netns test-b
+ ip -n test-b link set veth_b up
+
+ ip -n test-a monitor link address prefix neigh nsid label all-nsid \
+  > /dev/null &
+ monitor_pid=$!
+ clean() {
+  kill $monitor_pid
+  ip netns del test-a
+  ip netns del test-b
+ }
+ trap clean EXIT
+
+ while true; do
+  ip -n test-b neigh add dev veth_b 1.2.3.4 lladdr AA:AA:AA:AA:AA:AA
+  ip -n test-b neigh del dev veth_b 1.2.3.4
+ done
+
+
+Conflict:NA
+Reference:https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/commit?id=0faec4d050b607f7544b6cf9a4c2d57e191f981f
+
+Fixes: 55870dfe7f8b ("Improve batch and dump times by caching link lookups")
+Signed-off-by: Lahav Schlesinger <lschlesinger@drivenets.com>
+Signed-off-by: Gilad Naaman <gnaaman@drivenets.com>
+Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
+---
+ lib/libnetlink.c | 17 +++++++++++------
+ 1 file changed, 11 insertions(+), 6 deletions(-)
+
+diff --git a/lib/libnetlink.c b/lib/libnetlink.c
+index 9af06232..001efc1d 100644
+--- a/lib/libnetlink.c
++++ b/lib/libnetlink.c
+@@ -1092,14 +1092,19 @@ next:
+ 						rtnl_talk_error(h, err, errfn);
+ 				}
+ 
+-				if (answer)
+-					*answer = (struct nlmsghdr *)buf;
+-				else
++				if (i < iovlen) {
+ 					free(buf);
+-
+-				if (i < iovlen)
+ 					goto next;
+-				return error ? -i : 0;
++				}
++
++				if (error) {
++					free(buf);
++					return -i;
++				}
++
++				if (answer)
++					*answer = (struct nlmsghdr *)buf;
++				return 0;
+ 			}
+ 
+ 			if (answer) {
+-- 
+2.23.0

backport-libnetlink-validate-nlmsg-header-length-first.patch

@@ -0,0 +1,39 @@
+From 78eebdbc7d2f96b01a18d7db33c1c99266efc4bc Mon Sep 17 00:00:00 2001
+From: Max Kunzelmann <maxdev@posteo.de>
+Date: Tue, 7 Nov 2023 01:20:55 +0000
+Subject: [PATCH] libnetlink: validate nlmsg header length first
+
+Validate the nlmsg header length before accessing the nlmsg payload
+length.
+
+Fixes: 892a25e286fb ("libnetlink: break up dump function")
+
+Signed-off-by: Max Kunzelmann <maxdev@posteo.de>
+Reviewed-by: Benny Baumann <BenBE@geshi.org>
+Reviewed-by: Robert Geislinger <github@crpykng.de>
+Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
+---
+ lib/libnetlink.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/lib/libnetlink.c b/lib/libnetlink.c
+index 7edcd2856..016482294 100644
+--- a/lib/libnetlink.c
++++ b/lib/libnetlink.c
+@@ -727,13 +727,15 @@ int rtnl_dump_request_n(struct rtnl_handle *rth, struct nlmsghdr *n)
+ static int rtnl_dump_done(struct nlmsghdr *h,
+ 			  const struct rtnl_dump_filter_arg *a)
+ {
+-	int len = *(int *)NLMSG_DATA(h);
++	int len;
+ 
+ 	if (h->nlmsg_len < NLMSG_LENGTH(sizeof(int))) {
+ 		fprintf(stderr, "DONE truncated\n");
+ 		return -1;
+ 	}
+ 
++	len = *(int *)NLMSG_DATA(h);
++
+ 	if (len < 0) {
+ 		errno = -len;
+ 

backport-lnstat-Fix-deref-of-null-in-print_json-function.patch

@@ -0,0 +1,32 @@
+From a193733b7a7ef1e65e1b88045c32f96ed16caeb9 Mon Sep 17 00:00:00 2001
+From: Maks Mishin <maks.mishinfz@gmail.com>
+Date: Sat, 6 Jan 2024 22:04:23 +0300
+Subject: [PATCH] lnstat: Fix deref of null in print_json() function
+
+Now pointer `jw` is being checked for NULL before using
+in function `jsonw_start_object`.
+Added exit from function when `jw==NULL`.
+
+Found by RASU JSC
+
+Signed-off-by: Maks Mishin <maks.mishinFZ@gmail.com>
+Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
+---
+ misc/lnstat.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/misc/lnstat.c b/misc/lnstat.c
+index c3f2999cc..f802a0f35 100644
+--- a/misc/lnstat.c
++++ b/misc/lnstat.c
+@@ -112,6 +112,10 @@ static void print_json(FILE *of, const struct lnstat_file *lnstat_files,
+ 	json_writer_t *jw = jsonw_new(of);
+ 	int i;
+ 
++	if (jw == NULL) {
++		fprintf(stderr, "Failed to create JSON writer\n");
++		exit(1);
++	}
+ 	jsonw_start_object(jw);
+ 	for (i = 0; i < fp->num; i++) {
+ 		const struct lnstat_field *lf = fp->params[i].lf;

backport-m_action-fix-warning-of-overwrite-of-const-string.patch

@@ -0,0 +1,162 @@
+From b134c2c344582f12d3e350168334e50b91a99c7d Mon Sep 17 00:00:00 2001
+From: Stephen Hemminger <stephen@networkplumber.org>
+Date: Mon, 8 May 2023 19:25:33 -0700
+Subject: [PATCH] m_action: fix warning of overwrite of const string
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The function get_action_kind() searches first for the given
+action, then rescans on failure for "gact". In the process,
+it would overwrite the argument.  Avoid the warning
+by using a const argument and not copying.
+
+The problem dates back to pre-git history.
+
+m_action.c: In function ‘get_action_kind’:
+m_action.c:126:17: warning: write to string literal [-Wanalyzer-write-to-string-literal]
+  126 |                 strcpy(str, "gact");
+      |                 ^~~~~~~~~~~~~~~~~~~
+  ‘do_action’: events 1-6
+    |
+    |  853 | int do_action(int argc, char **argv)
+    |      |     ^~~~~~~~~
+    |      |     |
+    |      |     (1) entry to ‘do_action’
+    |......
+    |  858 |         while (argc > 0) {
+    |      |                ~~~~~~~~
+    |      |                     |
+    |      |                     (2) following ‘true’ branch...
+    |  859 |
+    |  860 |                 if (matches(*argv, "add") == 0) {
+    |      |                    ~~~~~~~~~~~~~~~~~~~~~~
+    |      |                    ||
+    |      |                    |(3) ...to here
+    |      |                    (4) following ‘false’ branch...
+    |  861 |                         ret =  tc_action_modify(RTM_NEWACTION,
+    |      |                                ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+    |      |                                |
+    |      |                                (5) ...to here
+    |      |                                (6) calling ‘tc_action_modify’ from ‘do_action’
+    |  862 |                                                 NLM_F_EXCL | NLM_F_CREATE,
+    |      |                                                 ~~~~~~~~~~~~~~~~~~~~~~~~~~
+    |  863 |                                                 &argc, &argv);
+    |      |                                                 ~~~~~~~~~~~~~
+    |
+    +--> ‘tc_action_modify’: events 7-8
+           |
+           |  715 | static int tc_action_modify(int cmd, unsigned int flags,
+           |      |            ^~~~~~~~~~~~~~~~
+           |      |            |
+           |      |            (7) entry to ‘tc_action_modify’
+           |......
+           |  735 |         if (parse_action(&argc, &argv, TCA_ACT_TAB, &req.n)) {
+           |      |             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+           |      |             |
+           |      |             (8) calling ‘parse_action’ from ‘tc_action_modify’
+           |
+           +--> ‘parse_action’: events 9-18
+                  |
+                  |  203 | int parse_action(int *argc_p, char ***argv_p, int tca_id, struct nlmsghdr *n)
+                  |      |     ^~~~~~~~~~~~
+                  |      |     |
+                  |      |     (9) entry to ‘parse_action’
+                  |......
+                  |  217 |         if (argc <= 0)
+                  |      |            ~
+                  |      |            |
+                  |      |            (10) following ‘false’ branch...
+                  |......
+                  |  220 |         tail2 = addattr_nest(n, MAX_MSG, tca_id);
+                  |      |                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+                  |      |                 |
+                  |      |                 (11) ...to here
+                  |  221 |
+                  |  222 |         while (argc > 0) {
+                  |      |                ~~~~~~~~
+                  |      |                     |
+                  |      |                     (12) following ‘true’ branch...
+                  |  223 |
+                  |  224 |                 memset(k, 0, sizeof(k));
+                  |      |                 ~~~~~~~~~~~~~~~~~~~~~~~
+                  |      |                 |
+                  |      |                 (13) ...to here
+                  |  225 |
+                  |  226 |                 if (strcmp(*argv, "action") == 0) {
+                  |      |                    ~
+                  |      |                    |
+                  |      |                    (14) following ‘true’ branch (when the strings are equal)...
+                  |  227 |                         argc--;
+                  |      |                         ~~~~~~
+                  |      |                             |
+                  |      |                             (15) ...to here
+                  |......
+                  |  231 |                         if (!gact_ld)
+                  |      |                            ~
+                  |      |                            |
+                  |      |                            (16) following ‘true’ branch...
+                  |  232 |                                 get_action_kind("gact");
+                  |      |                                 ~~~~~~~~~~~~~~~~~~~~~~~
+                  |      |                                 |
+                  |      |                                 (17) ...to here
+                  |      |                                 (18) calling ‘get_action_kind’ from ‘parse_action’
+                  |
+                  +--> ‘get_action_kind’: events 19-24
+                         |
+                         |   86 | static struct action_util *get_action_kind(char *str)
+                         |      |                            ^~~~~~~~~~~~~~~
+                         |      |                            |
+                         |      |                            (19) entry to ‘get_action_kind’
+                         |......
+                         |  114 |         if (a == NULL)
+                         |      |            ~
+                         |      |            |
+                         |      |            (20) following ‘true’ branch (when ‘a’ is NULL)...
+                         |  115 |                 goto noexist;
+                         |      |                 ~~~~
+                         |      |                 |
+                         |      |                 (21) ...to here
+                         |......
+                         |  124 |         if (!looked4gact) {
+                         |      |            ~
+                         |      |            |
+                         |      |            (22) following ‘true’ branch (when ‘looked4gact == 0’)...
+                         |  125 |                 looked4gact = 1;
+                         |  126 |                 strcpy(str, "gact");
+                         |      |                 ~~~~~~~~~~~~~~~~~~~
+                         |      |                 |
+                         |      |                 (23) ...to here
+                         |      |                 (24) write to string literal here
+                         |
+
+Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
+---
+ tc/m_action.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tc/m_action.c b/tc/m_action.c
+index a446cabd..16474c56 100644
+--- a/tc/m_action.c
++++ b/tc/m_action.c
+@@ -83,7 +83,7 @@ static int parse_noaopt(struct action_util *au, int *argc_p,
+ 	return -1;
+ }
+ 
+-static struct action_util *get_action_kind(char *str)
++static struct action_util *get_action_kind(const char *str)
+ {
+ 	static void *aBODY;
+ 	void *dlh;
+@@ -123,7 +123,7 @@ noexist:
+ #ifdef CONFIG_GACT
+ 	if (!looked4gact) {
+ 		looked4gact = 1;
+-		strcpy(str, "gact");
++		str = "gact";
+ 		goto restart_s;
+ 	}
+ #endif
+-- 
+2.27.0
+

backport-mnl_utils-sanitize-incoming-netlink-payload-size-in-callbacks.patch

@@ -0,0 +1,47 @@
+From 1a68525f4613b4e02e83d4b8004f22ac7ecbfedf Mon Sep 17 00:00:00 2001
+From: Jiri Pirko <jiri@nvidia.com>
+Date: Thu, 7 Dec 2023 13:53:51 +0100
+Subject: [PATCH] mnl_utils: sanitize incoming netlink payload size in
+ callbacks
+
+Don't trust the kernel to send payload of certain size. Sanitize that by
+checking the payload length in mnlu_cb_stop() and mnlu_cb_error() and
+only access the payload if it is of required size.
+
+Note that for mnlu_cb_stop(), this is happening already for example
+with devlink resource. Kernel sends NLMSG_DONE with zero size payload.
+
+Fixes: 049c58539f5d ("devlink: mnlg: Add support for extended ack")
+Fixes: c934da8aaacb ("devlink: mnlg: Catch returned error value of dumpit commands")
+Signed-off-by: Jiri Pirko <jiri@nvidia.com>
+Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
+---
+ lib/mnl_utils.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/lib/mnl_utils.c b/lib/mnl_utils.c
+index 1c7822282..af5aa4f9e 100644
+--- a/lib/mnl_utils.c
++++ b/lib/mnl_utils.c
+@@ -61,6 +61,8 @@ static int mnlu_cb_error(const struct nlmsghdr *nlh, void *data)
+ {
+ 	const struct nlmsgerr *err = mnl_nlmsg_get_payload(nlh);
+ 
++	if (mnl_nlmsg_get_payload_len(nlh) < sizeof(*err))
++		return MNL_CB_STOP;
+ 	/* Netlink subsystems returns the errno value with different signess */
+ 	if (err->error < 0)
+ 		errno = -err->error;
+@@ -75,8 +77,11 @@ static int mnlu_cb_error(const struct nlmsghdr *nlh, void *data)
+ 
+ static int mnlu_cb_stop(const struct nlmsghdr *nlh, void *data)
+ {
+-	int len = *(int *)NLMSG_DATA(nlh);
++	int len;
+ 
++	if (mnl_nlmsg_get_payload_len(nlh) < sizeof(len))
++		return MNL_CB_STOP;
++	len = *(int *)mnl_nlmsg_get_payload(nlh);
+ 	if (len < 0) {
+ 		errno = -len;
+ 		nl_dump_ext_ack_done(nlh, len);

backport-netem-fix-NULL-deref-on-allocation-failure.patch

@@ -0,0 +1,197 @@
+From 6c266d7c22a8f4f631d278ba6102f1b1d2bca148 Mon Sep 17 00:00:00 2001
+From: Stephen Hemminger <stephen@networkplumber.org>
+Date: Mon, 8 May 2023 19:36:14 -0700
+Subject: [PATCH] netem: fix NULL deref on allocation failure
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+q_netem.c: In function ‘get_distribution’:
+q_netem.c:159:35: warning: dereference of possibly-NULL ‘data’ [CWE-690] [-Wanalyzer-possible-null-dereference]
+  159 |                         data[n++] = x;
+      |                         ~~~~~~~~~~^~~
+  ‘netem_parse_opt’: events 1-24
+    |
+    |  192 | static int netem_parse_opt(struct qdisc_util *qu, int argc, char **argv,
+    |      |            ^~~~~~~~~~~~~~~
+    |      |            |
+    |      |            (1) entry to ‘netem_parse_opt’
+    |......
+    |  212 |         for ( ; argc > 0; --argc, ++argv) {
+    |      |                 ~~~~~~~~
+    |      |                      |
+    |      |                      (2) following ‘true’ branch (when ‘argc > 0’)...
+    |  213 |                 if (matches(*argv, "limit") == 0) {
+    |      |                    ~~~~~~~~~~~~~~~~~~~~~~~~
+    |      |                    ||
+    |      |                    |(3) ...to here
+    |      |                    (4) following ‘true’ branch...
+    |......
+    |  219 |                 } else if (matches(*argv, "latency") == 0 ||
+    |      |                           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+    |      |                           ||                              |
+    |      |                           |(5) ...to here                 (8) following ‘true’ branch...
+    |      |                           (6) following ‘true’ branch...
+    |  220 |                            matches(*argv, "delay") == 0) {
+    |      |                            ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+    |      |                            |
+    |      |                            (7) ...to here
+    |......
+    |  243 |                 } else if (matches(*argv, "loss") == 0 ||
+    |      |                           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+    |      |                           ||                           |
+    |      |                           |(9) ...to here              (12) following ‘true’ branch...
+    |      |                           (10) following ‘true’ branch...
+    |  244 |                            matches(*argv, "drop") == 0) {
+    |      |                            ~~~~~~~~~~~~~~~~~~~~~~~~~~~
+    |      |                            |
+    |      |                            (11) ...to here
+    |......
+    |  366 |                 } else if (matches(*argv, "ecn") == 0) {
+    |      |                           ~~~~~~~~~~~~~~~~~~~~~~
+    |      |                           ||
+    |      |                           |(13) ...to here
+    |      |                           (14) following ‘true’ branch...
+    |  367 |                         present[TCA_NETEM_ECN] = 1;
+    |  368 |                 } else if (matches(*argv, "reorder") == 0) {
+    |      |                           ~~~~~~~~~~~~~~~~~~~~~~~~~~
+    |      |                           ||
+    |      |                           |(15) ...to here
+    |      |                           (16) following ‘true’ branch...
+    |......
+    |  383 |                 } else if (matches(*argv, "corrupt") == 0) {
+    |      |                           ~~~~~~~~~~~~~~~~~~~~~~~~~~
+    |      |                           ||
+    |      |                           |(17) ...to here
+    |      |                           (18) following ‘true’ branch...
+    |......
+    |  398 |                 } else if (matches(*argv, "gap") == 0) {
+    |      |                           ~~~~~~~~~~~~~~~~~~~~~~
+    |      |                           ||
+    |      |                           |(19) ...to here
+    |      |                           (20) following ‘true’ branch...
+    |......
+    |  404 |                 } else if (matches(*argv, "duplicate") == 0) {
+    |      |                           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+    |      |                           ||
+    |      |                           |(21) ...to here
+    |      |                           (22) following ‘true’ branch...
+    |......
+    |  417 |                 } else if (matches(*argv, "distribution") == 0) {
+    |      |                           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+    |      |                           ||
+    |      |                           |(23) ...to here
+    |      |                           (24) following ‘false’ branch...
+    |
+  ‘netem_parse_opt’: event 25
+    |
+    |../include/utils.h:50:29:
+    |   50 | #define NEXT_ARG() do { argv++; if (--argc <= 0) incomplete_command(); } while(0)
+    |      |                         ~~~~^~
+    |      |                             |
+    |      |                             (25) ...to here
+q_netem.c:418:25: note: in expansion of macro ‘NEXT_ARG’
+    |  418 |                         NEXT_ARG();
+    |      |                         ^~~~~~~~
+    |
+  ‘netem_parse_opt’: event 26
+    |
+    |../include/utils.h:50:36:
+    |   50 | #define NEXT_ARG() do { argv++; if (--argc <= 0) incomplete_command(); } while(0)
+    |      |                                    ^
+    |      |                                    |
+    |      |                                    (26) following ‘false’ branch (when ‘argc != 0’)...
+q_netem.c:418:25: note: in expansion of macro ‘NEXT_ARG’
+    |  418 |                         NEXT_ARG();
+    |      |                         ^~~~~~~~
+    |
+  ‘netem_parse_opt’: events 27-29
+    |
+    |  419 |                         dist_data = calloc(sizeof(dist_data[0]), MAX_DIST);
+    |      |                                     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+    |      |                                     |
+    |      |                                     (27) ...to here
+    |      |                                     (28) this call could return NULL
+    |  420 |                         dist_size = get_distribution(*argv, dist_data, MAX_DIST);
+    |      |                                     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+    |      |                                     |
+    |      |                                     (29) calling ‘get_distribution’ from ‘netem_parse_opt’
+    |
+    +--> ‘get_distribution’: events 30-31
+           |
+           |  124 | static int get_distribution(const char *type, __s16 *data, int maxdata)
+           |      |            ^~~~~~~~~~~~~~~~
+           |      |            |
+           |      |            (30) entry to ‘get_distribution’
+           |......
+           |  135 |         if (f == NULL) {
+           |      |            ~
+           |      |            |
+           |      |            (31) following ‘false’ branch (when ‘f’ is non-NULL)...
+           |
+         ‘get_distribution’: event 32
+           |
+           |cc1:
+           | (32): ...to here
+           |
+         ‘get_distribution’: events 33-35
+           |
+           |  142 |         while (getline(&line, &len, f) != -1) {
+           |      |                ~~~~~~~~~~~~~~~~~~~~~~~~^~~~~
+           |      |                                        |
+           |      |                                        (33) following ‘true’ branch...
+           |......
+           |  145 |                 if (*line == '\n' || *line == '#')
+           |      |                    ~~~~~~
+           |      |                    ||
+           |      |                    |(34) ...to here
+           |      |                    (35) following ‘false’ branch...
+           |
+         ‘get_distribution’: event 36
+           |
+           |cc1:
+           | (36): ...to here
+           |
+         ‘get_distribution’: events 37-41
+           |
+           |  150 |                         if (endp == p)
+           |      |                            ^
+           |      |                            |
+           |      |                            (37) following ‘false’ branch...
+           |......
+           |  153 |                         if (n >= maxdata) {
+           |      |                            ~
+           |      |                            |
+           |      |                            (38) ...to here
+           |      |                            (39) following ‘false’ branch (when ‘n < maxdata’)...
+           |......
+           |  159 |                         data[n++] = x;
+           |      |                         ~~~~~~~~~~~~~
+           |      |                               |   |
+           |      |                               |   (41) ‘data + (long unsigned int)n * 2’ could be NULL: unchecked value from (28)
+           |      |                               (40) ...to here
+           |
+
+Fixes: c1b81cb5fe92 ("netem potential dist table overflow")
+Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
+---
+ tc/q_netem.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/tc/q_netem.c b/tc/q_netem.c
+index 26402e9a..d1d79b0b 100644
+--- a/tc/q_netem.c
++++ b/tc/q_netem.c
+@@ -417,6 +417,9 @@ random_loss_model:
+ 		} else if (matches(*argv, "distribution") == 0) {
+ 			NEXT_ARG();
+ 			dist_data = calloc(sizeof(dist_data[0]), MAX_DIST);
++			if (dist_data == NULL)
++				return -1;
++			
+ 			dist_size = get_distribution(*argv, dist_data, MAX_DIST);
+ 			if (dist_size <= 0) {
+ 				free(dist_data);
+-- 
+2.27.0
+

backport-nstat-fix-potential-NULL-deref.patch

@@ -0,0 +1,364 @@
+From d348d1d6466a4a712b47612c1e9388161334fc7a Mon Sep 17 00:00:00 2001
+From: Stephen Hemminger <stephen@networkplumber.org>
+Date: Mon, 8 May 2023 19:42:03 -0700
+Subject: [PATCH] nstat: fix potential NULL deref
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Reported as:
+    CC       nstat
+nstat.c: In function ‘load_ugly_table’:
+nstat.c:205:24: warning: dereference of NULL ‘p’ [CWE-476] [-Wanalyzer-null-dereference]
+  205 |                 while (*p) {
+      |                        ^~
+  ‘main’: events 1-14
+    |
+    |  575 | int main(int argc, char *argv[])
+    |      |     ^~~~
+    |      |     |
+    |      |     (1) entry to ‘main’
+    |......
+    |  635 |         if (scan_interval > 0) {
+    |      |            ~
+    |      |            |
+    |      |            (2) following ‘true’ branch...
+    |  636 |                 if (time_constant == 0)
+    |      |                     ~~~~~~~~~~~~~~~~~~
+    |      |                                   |
+    |      |                                   (3) ...to here
+    |......
+    |  640 |                 if ((fd = socket(AF_UNIX, SOCK_STREAM, 0)) < 0) {
+    |      |                    ~      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+    |      |                    |      |
+    |      |                    |      (4) when ‘socket’ succeeds
+    |      |                    (5) following ‘false’ branch (when ‘fd >= 0’)...
+    |......
+    |  644 |                 if (bind(fd, (struct sockaddr *)&sun, 2+1+strlen(sun.sun_path+1)) < 0) {
+    |      |                    ~                                      ~~~~~~~~~~~~~~~~~~~~~~
+    |      |                    |                                      |
+    |      |                    (7) following ‘false’ branch...        (6) ...to here
+    |......
+    |  648 |                 if (listen(fd, 5) < 0) {
+    |      |                    ~~~~~~~~~~~~~~
+    |      |                    ||
+    |      |                    |(8) ...to here
+    |      |                    |(9) when ‘listen’ succeeds
+    |      |                    (10) following ‘false’ branch...
+    |......
+    |  652 |                 if (daemon(0, 0)) {
+    |      |                    ~~~~~~~~~~~~~
+    |      |                    ||
+    |      |                    |(11) ...to here
+    |      |                    (12) following ‘false’ branch...
+    |......
+    |  656 |                 signal(SIGPIPE, SIG_IGN);
+    |      |                 ~~~~~~~~~~~~~~~~~~~~~~~~
+    |      |                 |
+    |      |                 (13) ...to here
+    |  657 |                 signal(SIGCHLD, sigchild);
+    |  658 |                 server_loop(fd);
+    |      |                 ~~~~~~~~~~~~~~~
+    |      |                 |
+    |      |                 (14) calling ‘server_loop’ from ‘main’
+    |
+    +--> ‘server_loop’: events 15-16
+           |
+           |  472 | static void server_loop(int fd)
+           |      |             ^~~~~~~~~~~
+           |      |             |
+           |      |             (15) entry to ‘server_loop’
+           |......
+           |  483 |         load_netstat();
+           |      |         ~~~~~~~~~~~~~~
+           |      |         |
+           |      |         (16) calling ‘load_netstat’ from ‘server_loop’
+           |
+           +--> ‘load_netstat’: events 17-20
+                  |
+                  |  302 | static void load_netstat(void)
+                  |      |             ^~~~~~~~~~~~
+                  |      |             |
+                  |      |             (17) entry to ‘load_netstat’
+                  |......
+                  |  306 |         if (fp) {
+                  |      |            ~
+                  |      |            |
+                  |      |            (18) following ‘true’ branch (when ‘fp’ is non-NULL)...
+                  |  307 |                 load_ugly_table(fp);
+                  |      |                 ~~~~~~~~~~~~~~~~~~~
+                  |      |                 |
+                  |      |                 (19) ...to here
+                  |      |                 (20) calling ‘load_ugly_table’ from ‘load_netstat’
+                  |
+                  +--> ‘load_ugly_table’: events 21-26
+                         |
+                         |  178 | static void load_ugly_table(FILE *fp)
+                         |      |             ^~~~~~~~~~~~~~~
+                         |      |             |
+                         |      |             (21) entry to ‘load_ugly_table’
+                         |  179 | {
+                         |  180 |         char *buf = NULL;
+                         |      |               ~~~
+                         |      |               |
+                         |      |               (22) ‘buf’ is NULL
+                         |......
+                         |  186 |         while ((nread = getline(&buf, &buflen, fp)) != -1) {
+                         |      |                ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+                         |      |                                                     |
+                         |      |                                                     (23) following ‘true’ branch...
+                         |......
+                         |  192 |                 p = strchr(buf, ':');
+                         |      |                     ~~~~~~~~~~~~~~~~
+                         |      |                     |
+                         |      |                     (24) ...to here
+                         |      |                     (25) when ‘strchr’ returns non-NULL
+                         |  193 |                 if (!p) {
+                         |      |                    ~
+                         |      |                    |
+                         |      |                    (26) following ‘false’ branch (when ‘p’ is non-NULL)...
+                         |
+                       ‘load_ugly_table’: event 27
+                         |
+                         |cc1:
+                         | (27): ...to here
+                         |
+                       ‘load_ugly_table’: events 28-40
+                         |
+                         |  205 |                 while (*p) {
+                         |      |                        ^~
+                         |      |                        |
+                         |      |                        (28) following ‘true’ branch...
+                         |      |                        (40) dereference of NULL ‘p’
+                         |......
+                         |  208 |                         if ((next = strchr(p, ' ')) != NULL)
+                         |      |                            ~        ~~~~~~~~~~~~~~
+                         |      |                            |        |
+                         |      |                            |        (29) ...to here
+                         |      |                            |        (30) when ‘strchr’ returns NULL
+                         |      |                            (31) following ‘false’ branch (when ‘next’ is NULL)...
+                         |  209 |                                 *next++ = 0;
+                         |  210 |                         else if ((next = strchr(p, '\n')) != NULL)
+                         |      |                                 ~        ~~~~~~~~~~~~~~~
+                         |      |                                 |        |
+                         |      |                                 |        (32) ...to here
+                         |      |                                 |        (33) when ‘strchr’ returns NULL
+                         |      |                                 (34) following ‘false’ branch (when ‘next’ is NULL)...
+                         |  211 |                                 *next++ = 0;
+                         |  212 |                         if (off < sizeof(idbuf)) {
+                         |      |                            ~~~~~~~~~~~~~~~~~~~~
+                         |      |                            |    |
+                         |      |                            |    (35) ...to here
+                         |      |                            (36) following ‘false’ branch...
+                         |......
+                         |  216 |                         n = malloc(sizeof(*n));
+                         |      |                             ~~~~~~~~~~~~~~~~~~
+                         |      |                             |
+                         |      |                             (37) ...to here
+                         |  217 |                         if (!n) {
+                         |      |                            ~
+                         |      |                            |
+                         |      |                            (38) following ‘false’ branch (when ‘n’ is non-NULL)...
+                         |......
+                         |  221 |                         n->id = strdup(idbuf);
+                         |      |                                 ~~~~~~~~~~~~~
+                         |      |                                 |
+                         |      |                                 (39) ...to here
+                         |
+nstat.c:254:35: warning: dereference of NULL ‘n’ [CWE-476] [-Wanalyzer-null-dereference]
+  254 |                                 n = n->next;
+      |                                 ~~^~~~~~~~~
+  ‘main’: events 1-14
+    |
+    |  575 | int main(int argc, char *argv[])
+    |      |     ^~~~
+    |      |     |
+    |      |     (1) entry to ‘main’
+    |......
+    |  635 |         if (scan_interval > 0) {
+    |      |            ~
+    |      |            |
+    |      |            (2) following ‘true’ branch...
+    |  636 |                 if (time_constant == 0)
+    |      |                     ~~~~~~~~~~~~~~~~~~
+    |      |                                   |
+    |      |                                   (3) ...to here
+    |......
+    |  640 |                 if ((fd = socket(AF_UNIX, SOCK_STREAM, 0)) < 0) {
+    |      |                    ~      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+    |      |                    |      |
+    |      |                    |      (4) when ‘socket’ succeeds
+    |      |                    (5) following ‘false’ branch (when ‘fd >= 0’)...
+    |......
+    |  644 |                 if (bind(fd, (struct sockaddr *)&sun, 2+1+strlen(sun.sun_path+1)) < 0) {
+    |      |                    ~                                      ~~~~~~~~~~~~~~~~~~~~~~
+    |      |                    |                                      |
+    |      |                    (7) following ‘false’ branch...        (6) ...to here
+    |......
+    |  648 |                 if (listen(fd, 5) < 0) {
+    |      |                    ~~~~~~~~~~~~~~
+    |      |                    ||
+    |      |                    |(8) ...to here
+    |      |                    |(9) when ‘listen’ succeeds
+    |      |                    (10) following ‘false’ branch...
+    |......
+    |  652 |                 if (daemon(0, 0)) {
+    |      |                    ~~~~~~~~~~~~~
+    |      |                    ||
+    |      |                    |(11) ...to here
+    |      |                    (12) following ‘false’ branch...
+    |......
+    |  656 |                 signal(SIGPIPE, SIG_IGN);
+    |      |                 ~~~~~~~~~~~~~~~~~~~~~~~~
+    |      |                 |
+    |      |                 (13) ...to here
+    |  657 |                 signal(SIGCHLD, sigchild);
+    |  658 |                 server_loop(fd);
+    |      |                 ~~~~~~~~~~~~~~~
+    |      |                 |
+    |      |                 (14) calling ‘server_loop’ from ‘main’
+    |
+    +--> ‘server_loop’: events 15-16
+           |
+           |  472 | static void server_loop(int fd)
+           |      |             ^~~~~~~~~~~
+           |      |             |
+           |      |             (15) entry to ‘server_loop’
+           |......
+           |  483 |         load_netstat();
+           |      |         ~~~~~~~~~~~~~~
+           |      |         |
+           |      |         (16) calling ‘load_netstat’ from ‘server_loop’
+           |
+           +--> ‘load_netstat’: events 17-20
+                  |
+                  |  302 | static void load_netstat(void)
+                  |      |             ^~~~~~~~~~~~
+                  |      |             |
+                  |      |             (17) entry to ‘load_netstat’
+                  |......
+                  |  306 |         if (fp) {
+                  |      |            ~
+                  |      |            |
+                  |      |            (18) following ‘true’ branch (when ‘fp’ is non-NULL)...
+                  |  307 |                 load_ugly_table(fp);
+                  |      |                 ~~~~~~~~~~~~~~~~~~~
+                  |      |                 |
+                  |      |                 (19) ...to here
+                  |      |                 (20) calling ‘load_ugly_table’ from ‘load_netstat’
+                  |
+                  +--> ‘load_ugly_table’: events 21-25
+                         |
+                         |  178 | static void load_ugly_table(FILE *fp)
+                         |      |             ^~~~~~~~~~~~~~~
+                         |      |             |
+                         |      |             (21) entry to ‘load_ugly_table’
+                         |......
+                         |  186 |         while ((nread = getline(&buf, &buflen, fp)) != -1) {
+                         |      |                ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+                         |      |                                                     |
+                         |      |                                                     (22) following ‘true’ branch...
+                         |......
+                         |  192 |                 p = strchr(buf, ':');
+                         |      |                     ~~~~~~~~~~~~~~~~
+                         |      |                     |
+                         |      |                     (23) ...to here
+                         |      |                     (24) when ‘strchr’ returns non-NULL
+                         |  193 |                 if (!p) {
+                         |      |                    ~
+                         |      |                    |
+                         |      |                    (25) following ‘false’ branch (when ‘p’ is non-NULL)...
+                         |
+                       ‘load_ugly_table’: event 26
+                         |
+                         |cc1:
+                         | (26): ...to here
+                         |
+                       ‘load_ugly_table’: events 27-28
+                         |
+                         |  205 |                 while (*p) {
+                         |      |                        ^
+                         |      |                        |
+                         |      |                        (27) following ‘false’ branch...
+                         |......
+                         |  228 |                 nread = getline(&buf, &buflen, fp);
+                         |      |                         ~
+                         |      |                         |
+                         |      |                         (28) inlined call to ‘getline’ from ‘load_ugly_table’
+                         |
+                         +--> ‘getline’: event 29
+                                |
+                                |/usr/include/bits/stdio.h:120:10:
+                                |  120 |   return __getdelim (__lineptr, __n, '\n', __stream);
+                                |      |          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+                                |      |          |
+                                |      |          (29) ...to here
+                                |
+                         <------+
+                         |
+                       ‘load_ugly_table’: events 30-36
+                         |
+                         |nstat.c:229:20:
+                         |  229 |                 if (nread == -1) {
+                         |      |                    ^
+                         |      |                    |
+                         |      |                    (30) following ‘false’ branch...
+                         |......
+                         |  234 |                 count2 = count_spaces(buf);
+                         |      |                          ~~~~~~~~~~~~~~~~~
+                         |      |                          |
+                         |      |                          (31) ...to here
+                         |......
+                         |  239 |                         if (!p) {
+                         |      |                            ~
+                         |      |                            |
+                         |      |                            (32) following ‘false’ branch (when ‘p’ is non-NULL)...
+                         |......
+                         |  244 |                         *p = 0;
+                         |      |                         ~~~~~~
+                         |      |                            |
+                         |      |                            (33) ...to here
+                         |  245 |                         if (sscanf(p+1, "%llu", &n->val) != 1) {
+                         |      |                            ~
+                         |      |                            |
+                         |      |                            (34) following ‘false’ branch...
+                         |......
+                         |  251 |                         if (skip)
+                         |      |                            ~
+                         |      |                            |
+                         |      |                            (35) ...to here
+                         |......
+                         |  254 |                                 n = n->next;
+                         |      |                                 ~~~~~~~~~~~
+                         |      |                                   |
+                         |      |                                   (36) dereference of NULL ‘n’
+                         |
+
+Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
+---
+ misc/nstat.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/misc/nstat.c b/misc/nstat.c
+index 0ab92ecb..2c10feaa 100644
+--- a/misc/nstat.c
++++ b/misc/nstat.c
+@@ -219,9 +219,15 @@ static void load_ugly_table(FILE *fp)
+ 				exit(-1);
+ 			}
+ 			n->id = strdup(idbuf);
++			if (n->id == NULL) {
++				perror("nstat: strdup");
++				exit(-1);
++			}
+ 			n->rate = 0;
+ 			n->next = db;
+ 			db = n;
++			if (next == NULL)
++				break;
+ 			p = next;
+ 		}
+ 		n = db;
+-- 
+2.27.0
+

backport-rdma-utils-fix-some-analyzer-warnings.patch

@@ -0,0 +1,87 @@
+From 33722349feb9ac8ea77cf658f79940a42261f44d Mon Sep 17 00:00:00 2001
+From: Stephen Hemminger <stephen@networkplumber.org>
+Date: Mon, 8 May 2023 20:15:52 -0700
+Subject: [PATCH] rdma/utils: fix some analyzer warnings
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Add error checks for cases where analyzer thinks it is possible
+to us a possibly NULL value.
+
+utils.c: In function ‘get_port_from_argv’:
+utils.c:76:17: warning: use of NULL where non-null expected [CWE-476] [-Wanalyzer-null-argument]
+   76 |         slash = strchr(rd_argv(rd), '/');
+      |                 ^~~~~~~~~~~~~~~~~~~~~~~~
+  ‘get_port_from_argv’: events 1-2
+    |
+    |   68 | static int get_port_from_argv(struct rd *rd, uint32_t *port,
+    |      |            ^~~~~~~~~~~~~~~~~~
+    |      |            |
+    |      |            (1) entry to ‘get_port_from_argv’
+    |......
+    |   76 |         slash = strchr(rd_argv(rd), '/');
+    |      |                        ~
+    |      |                        |
+    |      |                        (2) inlined call to ‘rd_argv’ from ‘get_port_from_argv’
+    |
+    +--> ‘rd_argv’: event 3
+           |
+           |   18 |         if (!rd_argc(rd))
+           |      |            ^
+           |      |            |
+           |      |            (3) following ‘true’ branch...
+           |
+    <------+
+    |
+  ‘get_port_from_argv’: events 4-5
+    |
+    |   76 |         slash = strchr(rd_argv(rd), '/');
+    |      |                 ^~~~~~~~~~~~~~~~~~~~~~~~
+    |      |                 |
+    |      |                 (4) ...to here
+    |      |                 (5) argument 1 (‘<unknown>’) NULL where non-null expected
+    |
+In file included from rdma.h:10,
+                 from utils.c:7:
+/usr/include/string.h:246:14: note: argument 1 of ‘strchr’ must be non-null
+  246 | extern char *strchr (const char *__s, int __c)
+      |              ^~~~~~
+
+Fixes: 40df8263a0f0 ("rdma: Add dev object")
+Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
+---
+ rdma/utils.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/rdma/utils.c b/rdma/utils.c
+index 21177b56..a33ff420 100644
+--- a/rdma/utils.c
++++ b/rdma/utils.c
+@@ -75,6 +75,13 @@ static int get_port_from_argv(struct rd *rd, uint32_t *port,
+ 
+ 	slash = strchr(rd_argv(rd), '/');
+ 	/* if no port found, return 0 */
++	if (slash == NULL) {
++		if (strict_port)
++			return -EINVAL;
++		else
++			return 0;
++	}
++
+ 	if (slash++) {
+ 		if (*slash == '-') {
+ 			if (strict_port)
+@@ -747,6 +754,9 @@ struct dev_map *dev_map_lookup(struct rd *rd, bool allow_port_index)
+ 		return NULL;
+ 
+ 	dev_name = strdup(rd_argv(rd));
++	if (!dev_name)
++		return NULL;
++
+ 	if (allow_port_index) {
+ 		slash = strrchr(dev_name, '/');
+ 		if (slash)
+-- 
+2.27.0
+

backport-rt_names-check-for-malloc-failure.patch

@@ -0,0 +1,30 @@
+From 507fe042181c8e481e4463ab66b3f7af897a5500 Mon Sep 17 00:00:00 2001
+From: Stephen Hemminger <stephen@networkplumber.org>
+Date: Wed, 7 Jun 2023 18:33:49 -0700
+Subject: [PATCH] rt_names: check for malloc() failure
+
+Fixes issue reported by Gcc 13 analayzer.
+
+Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
+---
+ lib/rt_names.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/lib/rt_names.c b/lib/rt_names.c
+index b441e98f..68db74e3 100644
+--- a/lib/rt_names.c
++++ b/lib/rt_names.c
+@@ -81,6 +81,10 @@ rtnl_hash_initialize(const char *file, struct rtnl_hash_entry **hash, int size)
+ 			continue;
+ 
+ 		entry = malloc(sizeof(*entry));
++		if (entry == NULL) {
++			fprintf(stderr, "malloc error: for entry\n");
++			break;
++		}
+ 		entry->id   = id;
+ 		entry->name = strdup(namebuf);
+ 		entry->next = hash[id & (size - 1)];
+-- 
+2.27.0
+

backport-ss-Fix-socket-type-check-in-packet_show_line.patch

@@ -0,0 +1,37 @@
+From 92e9915c36b7d4820f004fa74e0d93be99b8272a Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Tue, 22 Aug 2023 14:19:16 +0200
+Subject: ss: Fix socket type check in packet_show_line()
+
+Conflict:NA
+Reference:https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/commit?id=92e9915c36b7d4820f004fa74e0d93be99b8272a
+
+The field is accessed before being assigned a meaningful value,
+effectively disabling the checks.
+
+Fixes: 4a0053b606a34 ("ss: Unify packet stats output from netlink and proc")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
+---
+ misc/ss.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/misc/ss.c b/misc/ss.c
+index c71b08f98..653b1512c 100644
+--- a/misc/ss.c
++++ b/misc/ss.c
+@@ -4535,9 +4535,9 @@ static int packet_show_line(char *buf, const struct filter *f, int fam)
+ 			&type, &prot, &iface, &state,
+ 			&rq, &uid, &ino);
+ 
+-	if (stat.type == SOCK_RAW && !(f->dbs&(1<<PACKET_R_DB)))
++	if (type == SOCK_RAW && !(f->dbs & (1<<PACKET_R_DB)))
+ 		return 0;
+-	if (stat.type == SOCK_DGRAM && !(f->dbs&(1<<PACKET_DG_DB)))
++	if (type == SOCK_DGRAM && !(f->dbs & (1<<PACKET_DG_DB)))
+ 		return 0;
+ 
+ 	stat.type  = type;
+-- 
+cgit 
+

backport-ss-change-aafilter-port-from-int-to-long-inode-support.patch

@@ -0,0 +1,68 @@
+From 012cb5152d05122299384c9159ea82d059c80873 Mon Sep 17 00:00:00 2001
+From: Mathieu Schroeter <mathieu@schroetersa.ch>
+Date: Tue, 8 Aug 2023 23:42:57 +0200
+Subject: ss: change aafilter port from int to long (inode support)
+
+Conflict:NA
+Reference:https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/commit?id=012cb5152d05122299384c9159ea82d059c80873
+
+The aafilter struct considers the port as (usually) 32 bit signed
+integer. In case of a unix socket, the port is used with an inode
+number which is an unsigned int. In this case, the 'ss' command
+fails because it assumes that the value does not look like a port
+(<0).
+
+Here an example of command call where the inode is passed and
+is larger than a signed integer:
+
+ss -H -A unix_stream src :2259952798
+
+Signed-off-by: Mathieu Schroeter <mathieu@schroetersa.ch>
+Signed-off-by: David Ahern <dsahern@kernel.org>
+---
+ misc/ss.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/misc/ss.c b/misc/ss.c
+index e9d813596..baa835149 100644
+--- a/misc/ss.c
++++ b/misc/ss.c
+@@ -1733,7 +1733,7 @@ static void inet_addr_print(const inet_prefix *a, int port,
+ 
+ struct aafilter {
+ 	inet_prefix	addr;
+-	int		port;
++	long		port;
+ 	unsigned int	iface;
+ 	__u32		mark;
+ 	__u32		mask;
+@@ -2256,7 +2256,7 @@ void *parse_hostcond(char *addr, bool is_port)
+ 		port = find_port(addr, is_port);
+ 		if (port) {
+ 			if (*port && strcmp(port, "*")) {
+-				if (get_integer(&a.port, port, 0)) {
++				if (get_long(&a.port, port, 0)) {
+ 					if ((a.port = xll_name_to_index(port)) <= 0)
+ 						return NULL;
+ 				}
+@@ -2279,7 +2279,7 @@ void *parse_hostcond(char *addr, bool is_port)
+ 		port = find_port(addr, is_port);
+ 		if (port) {
+ 			if (*port && strcmp(port, "*")) {
+-				if (get_integer(&a.port, port, 0)) {
++				if (get_long(&a.port, port, 0)) {
+ 					if (strcmp(port, "kernel") == 0)
+ 						a.port = 0;
+ 					else
+@@ -2335,7 +2335,7 @@ void *parse_hostcond(char *addr, bool is_port)
+ 			*port++ = 0;
+ 
+ 		if (*port && *port != '*') {
+-			if (get_integer(&a.port, port, 0)) {
++			if (get_long(&a.port, port, 0)) {
+ 				struct servent *se1 = NULL;
+ 				struct servent *se2 = NULL;
+ 
+-- 
+cgit 
+

backport-ss-print-unix-socket-ports-as-unsigned-int-inode.patch

@@ -0,0 +1,33 @@
+From e12d0c929cf5f4266f745063696dd291cb6f06a4 Mon Sep 17 00:00:00 2001
+From: Mathieu Schroeter <mathieu@schroetersa.ch>
+Date: Tue, 8 Aug 2023 23:42:58 +0200
+Subject: ss: print unix socket "ports" as unsigned int (inode)
+
+Conflict:NA
+Reference:https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/commit?id=e12d0c929cf5f4266f745063696dd291cb6f06a4
+
+Signed-off-by: Mathieu Schroeter <mathieu@schroetersa.ch>
+Signed-off-by: David Ahern <dsahern@kernel.org>
+---
+ misc/ss.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/misc/ss.c b/misc/ss.c
+index baa835149..13b2523f4 100644
+--- a/misc/ss.c
++++ b/misc/ss.c
+@@ -4073,9 +4073,9 @@ static void unix_stats_print(struct sockstat *s, struct filter *f)
+ 	sock_state_print(s);
+ 
+ 	sock_addr_print(s->name ?: "*", " ",
+-			int_to_str(s->lport, port_name), NULL);
++			uint_to_str(s->lport, port_name), NULL);
+ 	sock_addr_print(s->peer_name ?: "*", " ",
+-			int_to_str(s->rport, port_name), NULL);
++			uint_to_str(s->rport, port_name), NULL);
+ 
+ 	proc_ctx_print(s);
+ }
+-- 
+cgit 
+

backport-tc-ct-Fix-invalid-pointer-dereference.patch

@@ -0,0 +1,35 @@
+From 4de59102f49ff9128378568cf967d6c7aabea6f2 Mon Sep 17 00:00:00 2001
+From: Roi Dayan <roid@nvidia.com>
+Date: Wed, 7 Dec 2022 10:22:13 +0200
+Subject: [PATCH] tc: ct: Fix invalid pointer dereference
+
+Using macro NEXT_ARG_FWD does not validate argc.
+Use macro NEXT_ARG which validates argc while parsing args
+in the same loop iteration.
+
+Conflict:NA
+Reference:https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/commit?id=4de59102f49ff9128378568cf967d6c7aabea6f2
+
+Fixes: c8a494314c40 ("tc: Introduce tc ct action")
+Signed-off-by: Roi Dayan <roid@nvidia.com>
+Reviewed-by: Paul Blakey <paulb@nvidia.com>
+Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
+---
+ tc/m_ct.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tc/m_ct.c b/tc/m_ct.c
+index a02bf0cc..54d64867 100644
+--- a/tc/m_ct.c
++++ b/tc/m_ct.c
+@@ -243,7 +243,7 @@ parse_ct(struct action_util *a, int *argc_p, char ***argv_p, int tca_id,
+ 				return -1;
+ 			}
+ 
+-			NEXT_ARG_FWD();
++			NEXT_ARG();
+ 			if (matches(*argv, "port") != 0)
+ 				continue;
+ 
+-- 
+2.23.0

backport-tc-prio-handle-possible-truncated-kernel-response.patch

@@ -0,0 +1,74 @@
+From c90d25e96b010c5837b5db9eaa57f5063f0c2aeb Mon Sep 17 00:00:00 2001
+From: Stephen Hemminger <stephen@networkplumber.org>
+Date: Mon, 8 May 2023 20:17:50 -0700
+Subject: [PATCH] tc/prio: handle possible truncated kernel response
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Reported by -fanalyzer. If kernel did not send full qdisc
+info, then uninitialized or null data could be referenced.
+
+q_prio.c: In function ‘prio_print_opt’:
+q_prio.c:105:57: warning: dereference of NULL ‘0’ [CWE-476] [-Wanalyzer-null-dereference]
+  105 |         print_uint(PRINT_ANY, "bands", "bands %u ", qopt->bands);
+      |                                                     ~~~~^~~~~~~
+  ‘prio_print_opt’: event 1
+    |
+    |   98 |         if (opt == NULL)
+    |      |            ^
+    |      |            |
+    |      |            (1) following ‘false’ branch (when ‘opt’ is non-NULL)...
+    |
+  ‘prio_print_opt’: event 2
+    |
+    |../include/uapi/linux/rtnetlink.h:228:38:
+    |  228 | #define RTA_PAYLOAD(rta) ((int)((rta)->rta_len) - RTA_LENGTH(0))
+    |      |                                ~~~~~~^~~~~~~~~~
+    |      |                                      |
+    |      |                                      (2) ...to here
+../include/libnetlink.h:236:19: note: in expansion of macro ‘RTA_PAYLOAD’
+    |  236 |         ({ data = RTA_PAYLOAD(rta) >= len ? RTA_DATA(rta) : NULL;       \
+    |      |                   ^~~~~~~~~~~
+q_prio.c:101:13: note: in expansion of macro ‘parse_rtattr_nested_compat’
+    |  101 |         if (parse_rtattr_nested_compat(tb, TCA_PRIO_MAX, opt, qopt,
+    |      |             ^~~~~~~~~~~~~~~~~~~~~~~~~~
+    |
+  ‘prio_print_opt’: event 3
+    |
+    |../include/libnetlink.h:236:59:
+    |  236 |         ({ data = RTA_PAYLOAD(rta) >= len ? RTA_DATA(rta) : NULL;       \
+q_prio.c:101:13: note: in expansion of macro ‘parse_rtattr_nested_compat’
+    |  101 |         if (parse_rtattr_nested_compat(tb, TCA_PRIO_MAX, opt, qopt,
+    |      |             ^~~~~~~~~~~~~~~~~~~~~~~~~~
+    |
+  ‘prio_print_opt’: events 4-5
+    |
+    |  105 |         print_uint(PRINT_ANY, "bands", "bands %u ", qopt->bands);
+    |      |                                                     ~~~~^~~~~~~
+    |      |                                                         |
+    |      |                                                         (4) ...to here
+    |      |                                                         (5) dereference of NULL ‘<unknown>’
+    |
+
+Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
+---
+ tc/q_prio.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tc/q_prio.c b/tc/q_prio.c
+index c8c6477e..a3781ffe 100644
+--- a/tc/q_prio.c
++++ b/tc/q_prio.c
+@@ -101,6 +101,8 @@ int prio_print_opt(struct qdisc_util *qu, FILE *f, struct rtattr *opt)
+ 	if (parse_rtattr_nested_compat(tb, TCA_PRIO_MAX, opt, qopt,
+ 					sizeof(*qopt)))
+ 		return -1;
++	if (qopt == NULL)
++		return -1;	/* missing data from kernel */
+ 
+ 	print_uint(PRINT_ANY, "bands", "bands %u ", qopt->bands);
+ 	open_json_array(PRINT_ANY, "priomap");
+-- 
+2.27.0
+

backport-tc-remove-tcindex-classifier.patch

@@ -0,0 +1,336 @@
+From bc0c1661eb229b77a65f8c5f305fd6fa56e9667f Mon Sep 17 00:00:00 2001
+From: Stephen Hemminger <stephen@networkplumber.org>
+Date: Mon, 30 Oct 2023 11:26:33 -0700
+Subject: [PATCH] tc: remove tcindex classifier
+
+Support for tcindex classifier was removed by upstream commit
+8c710f75256b (net/sched: Retire tcindex classifier, 2023-02-14)
+
+Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
+---
+ bash-completion/tc    |   7 +-
+ man/man8/tc-tcindex.8 |  58 -------------
+ man/man8/tc.8         |   7 +-
+ tc/Makefile           |   1 -
+ tc/f_tcindex.c        | 185 ------------------------------------------
+ 5 files changed, 2 insertions(+), 256 deletions(-)
+ delete mode 100644 man/man8/tc-tcindex.8
+ delete mode 100644 tc/f_tcindex.c
+
+diff --git a/bash-completion/tc b/bash-completion/tc
+index 6af3b7998..db5558ab6 100644
+--- a/bash-completion/tc
++++ b/bash-completion/tc
+@@ -5,7 +5,7 @@
+ QDISC_KIND=' choke codel bfifo pfifo pfifo_head_drop fq fq_codel gred hhf \
+             mqprio multiq netem pfifo_fast pie fq_pie red rr sfb sfq tbf atm \
+             cbq drr dsmark hfsc htb prio qfq '
+-FILTER_KIND=' basic bpf cgroup flow flower fw route rsvp tcindex u32 matchall '
++FILTER_KIND=' basic bpf cgroup flow flower fw route rsvp u32 matchall '
+ ACTION_KIND=' gact mirred bpf sample '
+ 
+ # Takes a list of words in argument; each one of them is added to COMPREPLY if
+@@ -487,11 +487,6 @@ _tc_filter_options()
+                     COMPREPLY+=( $( compgen -W 'at' -- "$cur" ) )
+             return 0
+             ;;
+-        tcindex)
+-            _tc_once_attr 'hash mask shift classid action'
+-            _tc_one_of_list 'pass_on fall_through'
+-            return 0
+-            ;;
+         u32)
+             _tc_once_attr 'match link classid action offset ht hashkey sample'
+             COMPREPLY+=( $( compgen -W 'ip ip6 udp tcp icmp u8 u16 u32 mark \
+diff --git a/man/man8/tc-tcindex.8 b/man/man8/tc-tcindex.8
+deleted file mode 100644
+index ccf2c5e81..000000000
+--- a/man/man8/tc-tcindex.8
++++ /dev/null
+@@ -1,58 +0,0 @@
+-.TH "Traffic control index filter" 8 "21 Oct 2015" "iproute2" "Linux"
+-
+-.SH NAME
+-tcindex \- traffic control index filter
+-.SH SYNOPSIS
+-.in +8
+-.ti -8
+-.BR tc " " filter " ... " tcindex " [ " hash
+-.IR SIZE " ] [ "
+-.B mask
+-.IR MASK " ] [ "
+-.B shift
+-.IR SHIFT " ] [ "
+-.BR pass_on " | " fall_through " ] [ " classid
+-.IR CLASSID " ] [ "
+-.B action
+-.BR ACTION_SPEC " ]"
+-.SH DESCRIPTION
+-This filter allows to match packets based on their
+-.B tcindex
+-field value, i.e. the combination of the DSCP and ECN fields as present in IPv4
+-and IPv6 headers.
+-.SH OPTIONS
+-.TP
+-.BI action " ACTION_SPEC"
+-Apply an action from the generic actions framework on matching packets.
+-.TP
+-.BI classid " CLASSID"
+-Push matching packets into the class identified by
+-.IR CLASSID .
+-.TP
+-.BI hash " SIZE"
+-Hash table size in entries to use. Defaults to 64.
+-.TP
+-.BI mask " MASK"
+-An optional bitmask to binary
+-.BR AND " to the packet's " tcindex
+-field before use.
+-.TP
+-.BI shift " SHIFT"
+-The number of bits to right-shift a packet's
+-.B tcindex
+-value before use. If a
+-.B mask
+-has been set, masking is done before shifting.
+-.TP
+-.B pass_on
+-If this flag is set, failure to find a class for the resulting ID will make the
+-filter fail and lead to the next filter being consulted.
+-.TP
+-.B fall_through
+-This is the opposite of
+-.B pass_on
+-and the default. The filter will classify the packet even if there is no class
+-present for the resulting class ID.
+-
+-.SH SEE ALSO
+-.BR tc (8)
+diff --git a/man/man8/tc.8 b/man/man8/tc.8
+index 59cc7b17d..ae6de397f 100644
+--- a/man/man8/tc.8
++++ b/man/man8/tc.8
+@@ -244,10 +244,6 @@ for details.
+ rsvp
+ Match Resource Reservation Protocol (RSVP) packets.
+ .TP
+-tcindex
+-Filter packets based on traffic control index. See
+-.BR tc-tcindex (8).
+-.TP
+ u32
+ Generic filtering on arbitrary packet data, assisted by syntax to abstract common operations. See
+ .BR tc-u32 (8)
+@@ -906,8 +902,7 @@ was written by Alexey N. Kuznetsov and added in Linux 2.2.
+ .BR tc-sfq (8),
+ .BR tc-stab (8),
+ .BR tc-tbf (8),
+-.BR tc-tcindex (8),
+-.BR tc-u32 (8),
++.BR tc-u32 (8)
+ .br
+ .RB "User documentation at " http://lartc.org/ ", but please direct bugreports and patches to: " <netdev@vger.kernel.org>
+ 
+diff --git a/tc/Makefile b/tc/Makefile
+index 82e611257..ab6ad2f5d 100644
+--- a/tc/Makefile
++++ b/tc/Makefile
+@@ -31,7 +31,6 @@ TCMODULES += f_cgroup.o
+ TCMODULES += f_flower.o
+ TCMODULES += q_dsmark.o
+ TCMODULES += q_gred.o
+-TCMODULES += f_tcindex.o
+ TCMODULES += q_ingress.o
+ TCMODULES += q_hfsc.o
+ TCMODULES += q_htb.o
+diff --git a/tc/f_tcindex.c b/tc/f_tcindex.c
+deleted file mode 100644
+index ae4cbf118..000000000
+--- a/tc/f_tcindex.c
++++ /dev/null
+@@ -1,185 +0,0 @@
+-/* SPDX-License-Identifier: GPL-2.0 */
+-/*
+- * f_tcindex.c		Traffic control index filter
+- *
+- * Written 1998,1999 by Werner Almesberger
+- */
+-
+-#include <stdio.h>
+-#include <stdlib.h>
+-#include <unistd.h>
+-#include <fcntl.h>
+-#include <string.h>
+-#include <netinet/in.h>
+-
+-#include "utils.h"
+-#include "tc_util.h"
+-
+-static void explain(void)
+-{
+-	fprintf(stderr,
+-		" Usage: ... tcindex	[ hash SIZE ] [ mask MASK ] [ shift SHIFT ]\n"
+-		"			[ pass_on | fall_through ]\n"
+-		"			[ classid CLASSID ] [ action ACTION_SPEC ]\n");
+-}
+-
+-static int tcindex_parse_opt(struct filter_util *qu, char *handle, int argc,
+-			     char **argv, struct nlmsghdr *n)
+-{
+-	struct tcmsg *t = NLMSG_DATA(n);
+-	struct rtattr *tail;
+-	char *end;
+-
+-	if (handle) {
+-		t->tcm_handle = strtoul(handle, &end, 0);
+-		if (*end) {
+-			fprintf(stderr, "Illegal filter ID\n");
+-			return -1;
+-		}
+-	}
+-	if (!argc) return 0;
+-	tail = addattr_nest(n, 4096, TCA_OPTIONS);
+-	while (argc) {
+-		if (!strcmp(*argv, "hash")) {
+-			int hash;
+-
+-			NEXT_ARG();
+-			hash = strtoul(*argv, &end, 0);
+-			if (*end || !hash || hash > 0x10000) {
+-				explain();
+-				return -1;
+-			}
+-			addattr_l(n, 4096, TCA_TCINDEX_HASH, &hash,
+-				  sizeof(hash));
+-		} else if (!strcmp(*argv,"mask")) {
+-			__u16 mask;
+-
+-			NEXT_ARG();
+-			mask = strtoul(*argv, &end, 0);
+-			if (*end) {
+-				explain();
+-				return -1;
+-			}
+-			addattr_l(n, 4096, TCA_TCINDEX_MASK, &mask,
+-				  sizeof(mask));
+-		} else if (!strcmp(*argv,"shift")) {
+-			int shift;
+-
+-			NEXT_ARG();
+-			shift = strtoul(*argv, &end, 0);
+-			if (*end) {
+-				explain();
+-				return -1;
+-			}
+-			addattr_l(n, 4096, TCA_TCINDEX_SHIFT, &shift,
+-			    sizeof(shift));
+-		} else if (!strcmp(*argv,"fall_through")) {
+-			int value = 1;
+-
+-			addattr_l(n, 4096, TCA_TCINDEX_FALL_THROUGH, &value,
+-			    sizeof(value));
+-		} else if (!strcmp(*argv,"pass_on")) {
+-			int value = 0;
+-
+-			addattr_l(n, 4096, TCA_TCINDEX_FALL_THROUGH, &value,
+-			    sizeof(value));
+-		} else if (!strcmp(*argv,"classid")) {
+-			__u32 handle;
+-
+-			NEXT_ARG();
+-			if (get_tc_classid(&handle, *argv)) {
+-				fprintf(stderr, "Illegal \"classid\"\n");
+-				return -1;
+-			}
+-			addattr_l(n, 4096, TCA_TCINDEX_CLASSID, &handle, 4);
+-		} else if (!strcmp(*argv,"police")) {
+-			NEXT_ARG();
+-			if (parse_police(&argc, &argv, TCA_TCINDEX_POLICE, n)) {
+-				fprintf(stderr, "Illegal \"police\"\n");
+-				return -1;
+-			}
+-			continue;
+-		} else if (!strcmp(*argv,"action")) {
+-			NEXT_ARG();
+-			if (parse_action(&argc, &argv, TCA_TCINDEX_ACT, n)) {
+-				fprintf(stderr, "Illegal \"action\"\n");
+-				return -1;
+-			}
+-			continue;
+-		} else {
+-			explain();
+-			return -1;
+-		}
+-		argc--;
+-		argv++;
+-	}
+-	addattr_nest_end(n, tail);
+-	return 0;
+-}
+-
+-
+-static int tcindex_print_opt(struct filter_util *qu, FILE *f,
+-			     struct rtattr *opt, __u32 handle)
+-{
+-	struct rtattr *tb[TCA_TCINDEX_MAX+1];
+-
+-	if (opt == NULL)
+-		return 0;
+-
+-	parse_rtattr_nested(tb, TCA_TCINDEX_MAX, opt);
+-
+-	if (handle != ~0) fprintf(f, "handle 0x%04x ", handle);
+-	if (tb[TCA_TCINDEX_HASH]) {
+-		__u16 hash;
+-
+-		if (RTA_PAYLOAD(tb[TCA_TCINDEX_HASH]) < sizeof(hash))
+-			return -1;
+-		hash = rta_getattr_u16(tb[TCA_TCINDEX_HASH]);
+-		fprintf(f, "hash %d ", hash);
+-	}
+-	if (tb[TCA_TCINDEX_MASK]) {
+-		__u16 mask;
+-
+-		if (RTA_PAYLOAD(tb[TCA_TCINDEX_MASK]) < sizeof(mask))
+-			return -1;
+-		mask = rta_getattr_u16(tb[TCA_TCINDEX_MASK]);
+-		fprintf(f, "mask 0x%04x ", mask);
+-	}
+-	if (tb[TCA_TCINDEX_SHIFT]) {
+-		int shift;
+-
+-		if (RTA_PAYLOAD(tb[TCA_TCINDEX_SHIFT]) < sizeof(shift))
+-			return -1;
+-		shift = rta_getattr_u32(tb[TCA_TCINDEX_SHIFT]);
+-		fprintf(f, "shift %d ", shift);
+-	}
+-	if (tb[TCA_TCINDEX_FALL_THROUGH]) {
+-		int fall_through;
+-
+-		if (RTA_PAYLOAD(tb[TCA_TCINDEX_FALL_THROUGH]) <
+-		    sizeof(fall_through))
+-			return -1;
+-		fall_through = rta_getattr_u32(tb[TCA_TCINDEX_FALL_THROUGH]);
+-		fprintf(f, fall_through ? "fall_through " : "pass_on ");
+-	}
+-	if (tb[TCA_TCINDEX_CLASSID]) {
+-		SPRINT_BUF(b1);
+-		fprintf(f, "classid %s ", sprint_tc_classid(*(__u32 *)
+-		    RTA_DATA(tb[TCA_TCINDEX_CLASSID]), b1));
+-	}
+-	if (tb[TCA_TCINDEX_POLICE]) {
+-		fprintf(f, "\n");
+-		tc_print_police(f, tb[TCA_TCINDEX_POLICE]);
+-	}
+-	if (tb[TCA_TCINDEX_ACT]) {
+-		fprintf(f, "\n");
+-		tc_print_action(f, tb[TCA_TCINDEX_ACT], 0);
+-	}
+-	return 0;
+-}
+-
+-struct filter_util tcindex_filter_util = {
+-	.id = "tcindex",
+-	.parse_fopt = tcindex_parse_opt,
+-	.print_fopt = tcindex_print_opt,
+-};

backport-tc_exec-don-t-dereference-NULL-on-calloc-failure.patch

@@ -0,0 +1,106 @@
+From 0b9b9d659880a3084ec0a5b49f07f387de7b0f0c Mon Sep 17 00:00:00 2001
+From: Stephen Hemminger <stephen@networkplumber.org>
+Date: Mon, 8 May 2023 19:21:27 -0700
+Subject: [PATCH] tc_exec: don't dereference NULL on calloc failure
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Reported as:
+tc_exec.c: In function ‘do_exec’:
+tc_exec.c:103:18: warning: dereference of NULL ‘eu’ [CWE-476] [-Wanalyzer-null-dereference]
+  103 |         return eu->parse_eopt(eu, argc, argv);
+      |                ~~^~~~~~~~~~~~
+  ‘do_exec’: events 1-6
+    |
+    |   81 | int do_exec(int argc, char **argv)
+    |      |     ^~~~~~~
+    |      |     |
+    |      |     (1) entry to ‘do_exec’
+    |......
+    |   86 |         if (argc < 1) {
+    |      |            ~
+    |      |            |
+    |      |            (2) following ‘false’ branch (when ‘argc > 0’)...
+    |......
+    |   91 |         if (matches(*argv, "help") == 0) {
+    |      |            ~~~~~~~~~~~~~~~~~~~~~~~
+    |      |            ||
+    |      |            |(3) ...to here
+    |      |            (4) following ‘true’ branch...
+    |......
+    |   96 |         strncpy(kind, *argv, sizeof(kind) - 1);
+    |      |         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+    |      |         |
+    |      |         (5) ...to here
+    |   97 |
+    |   98 |         eu = get_exec_kind(kind);
+    |      |              ~~~~~~~~~~~~~~~~~~~
+    |      |              |
+    |      |              (6) calling ‘get_exec_kind’ from ‘do_exec’
+    |
+    +--> ‘get_exec_kind’: events 7-10
+           |
+           |   40 | static struct exec_util *get_exec_kind(const char *name)
+           |      |                          ^~~~~~~~~~~~~
+           |      |                          |
+           |      |                          (7) entry to ‘get_exec_kind’
+           |......
+           |   63 |         if (eu == NULL)
+           |      |            ~
+           |      |            |
+           |      |            (8) following ‘true’ branch (when ‘eu’ is NULL)...
+           |   64 |                 goto noexist;
+           |      |                 ~~~~
+           |      |                 |
+           |      |                 (9) ...to here
+           |......
+           |   72 |         if (eu) {
+           |      |            ~
+           |      |            |
+           |      |            (10) following ‘false’ branch (when ‘eu’ is NULL)...
+           |
+         ‘get_exec_kind’: event 11
+           |
+           |cc1:
+           | (11): ...to here
+           |
+    <------+
+    |
+  ‘do_exec’: events 12-13
+    |
+    |   98 |         eu = get_exec_kind(kind);
+    |      |              ^~~~~~~~~~~~~~~~~~~
+    |      |              |
+    |      |              (12) return of NULL to ‘do_exec’ from ‘get_exec_kind’
+    |......
+    |  103 |         return eu->parse_eopt(eu, argc, argv);
+    |      |                ~~~~~~~~~~~~~~
+    |      |                  |
+    |      |                  (13) dereference of NULL ‘eu’
+    |
+
+Fixes: 4bd624467bc6 ("tc: built-in eBPF exec proxy")
+Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
+---
+ tc/tc_exec.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/tc/tc_exec.c b/tc/tc_exec.c
+index 5d883402..182fbb4c 100644
+--- a/tc/tc_exec.c
++++ b/tc/tc_exec.c
+@@ -96,6 +96,10 @@ int do_exec(int argc, char **argv)
+ 	strncpy(kind, *argv, sizeof(kind) - 1);
+ 
+ 	eu = get_exec_kind(kind);
++	if (eu == NULL) {
++		fprintf(stderr, "Allocation failed finding exec\n");
++		return -1;
++	}
+ 
+ 	argc--;
+ 	argv++;
+-- 
+2.27.0
+

backport-tc_util-Change-datatype-for-maj-to-avoid-overflow-issue.patch

@@ -0,0 +1,33 @@
+From 455fa8295298a68a2dedabf9dd4c1dbf847b128b Mon Sep 17 00:00:00 2001
+From: Lai Peter Jun Ann <jun.ann.lai@intel.com>
+Date: Mon, 21 Nov 2022 10:29:09 +0800
+Subject: [PATCH] tc_util: Change datatype for maj to avoid overflow issue
+
+The return value by stroul() is unsigned long int. Hence the datatype
+for maj should defined as unsigned long to avoid overflow issue.
+
+Conflict:NA
+Reference:https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/commit?id=455fa8295298a68a2dedabf9dd4c1dbf847b128b
+
+Signed-off-by: Muhammad Husaini Zulkifli <muhammad.husaini.zulkifli@intel.com>
+Signed-off-by: Lai Peter Jun Ann <jun.ann.lai@intel.com>
+Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
+---
+ tc/tc_util.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tc/tc_util.c b/tc/tc_util.c
+index 334334db..8cd3c035 100644
+--- a/tc/tc_util.c
++++ b/tc/tc_util.c
+@@ -74,7 +74,7 @@ const char *get_tc_lib(void)
+ 
+ int get_qdisc_handle(__u32 *h, const char *str)
+ {
+-	__u32 maj;
++	unsigned long maj;
+ 	char *p;
+ 
+ 	maj = TC_H_UNSPEC;
+-- 
+2.23.0

backport-tc_util-Fix-no-error-return-when-large-parent-id-used.patch

@@ -0,0 +1,35 @@
+From e0ecee3a33af57e01fe5d15f1a436216412f2d96 Mon Sep 17 00:00:00 2001
+From: Lai Peter Jun Ann <jun.ann.lai@intel.com>
+Date: Thu, 17 Nov 2022 13:33:17 +0800
+Subject: [PATCH] tc_util: Fix no error return when large parent id used
+
+This patch is to fix the issue where there is no error return
+when large value of parent ID is being used. The return value by
+stroul() is unsigned long int. Hence the datatype for maj and min
+should defined as unsigned long to avoid overflow issue.
+
+Conflict:NA
+Reference:https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/commit?id=e0ecee3a33af57e01fe5d15f1a436216412f2d96
+
+Signed-off-by: Muhammad Husaini Zulkifli <muhammad.husaini.zulkifli@intel.com>
+Signed-off-by: Lai Peter Jun Ann <jun.ann.lai@intel.com>
+Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
+---
+ tc/tc_util.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tc/tc_util.c b/tc/tc_util.c
+index 44137adb..334334db 100644
+--- a/tc/tc_util.c
++++ b/tc/tc_util.c
+@@ -93,7 +93,7 @@ ok:
+ 
+ int get_tc_classid(__u32 *h, const char *str)
+ {
+-	__u32 maj, min;
++	unsigned long maj, min;
+ 	char *p;
+ 
+ 	maj = TC_H_ROOT;
+-- 
+2.23.0

backport-tc_util-fix-unitialized-warning.patch

@@ -0,0 +1,318 @@
+From c9c1c9d59a6cfe52f380805a3e91a13ab1a28482 Mon Sep 17 00:00:00 2001
+From: Stephen Hemminger <stephen@networkplumber.org>
+Date: Mon, 8 May 2023 19:15:43 -0700
+Subject: [PATCH] tc_util fix unitialized warning
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+tc_util.c: In function ‘parse_action_control_slash_spaces’:
+tc_util.c:488:28: warning: use of uninitialized value ‘result2’ [CWE-457] [-Wanalyzer-use-of-uninitialized-value]
+  488 |                 *result2_p = result2;
+      |                 ~~~~~~~~~~~^~~~~~~~~
+  ‘parse_action_control_slash_spaces’: events 1-5
+    |
+    |  455 | static int parse_action_control_slash_spaces(int *argc_p, char ***argv_p,
+    |      |            ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+    |      |            |
+    |      |            (1) entry to ‘parse_action_control_slash_spaces’
+    |......
+    |  461 |         int result1 = -1, result2;
+    |      |                           ~~~~~~~
+    |      |                           |
+    |      |                           (2) region created on stack here
+    |      |                           (3) capacity: 4 bytes
+    |......
+    |  467 |                 switch (ok) {
+    |      |                 ~~~~~~
+    |      |                 |
+    |      |                 (4) following ‘case 0:’ branch...
+    |......
+    |  475 |                         ret = parse_action_control(&argc, &argv,
+    |      |                               ~
+    |      |                               |
+    |      |                               (5) inlined call to ‘parse_action_control’ from ‘parse_action_control_slash_spaces’
+    |
+    +--> ‘parse_action_control’: events 6-7
+           |
+           |  432 |         return __parse_action_control(argc_p, argv_p, result_p,
+           |      |                ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+           |      |                |
+           |      |                (6) ...to here
+           |      |                (7) calling ‘__parse_action_control’ from ‘parse_action_control_slash_spaces’
+           |  433 |                                       allow_num, false);
+           |      |                                       ~~~~~~~~~~~~~~~~~
+           |
+         ‘__parse_action_control’: events 8-11
+           |
+           |  371 | static int __parse_action_control(int *argc_p, char ***argv_p, int *result_p,
+           |      |            ^~~~~~~~~~~~~~~~~~~~~~
+           |      |            |
+           |      |            (8) entry to ‘__parse_action_control’
+           |......
+           |  378 |         if (!argc)
+           |      |            ~
+           |      |            |
+           |      |            (9) following ‘false’ branch (when ‘argc != 0’)...
+           |  379 |                 return -1;
+           |  380 |         if (action_a2n(*argv, &result, allow_num) == -1) {
+           |      |             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+           |      |             |
+           |      |             (10) ...to here
+           |      |             (11) calling ‘action_a2n’ from ‘__parse_action_control’
+           |
+           +--> ‘action_a2n’: events 12-16
+                  |
+                  |  335 | int action_a2n(char *arg, int *result, bool allow_num)
+                  |      |     ^~~~~~~~~~
+                  |      |     |
+                  |      |     (12) entry to ‘action_a2n’
+                  |......
+                  |  356 |         for (iter = a2n; iter->a; iter++) {
+                  |      |                          ~~~~
+                  |      |                          |
+                  |      |                          (13) following ‘true’ branch...
+                  |  357 |                 if (matches(arg, iter->a) != 0)
+                  |      |                     ~~~~~~~~~~~~~~~~~~~~~
+                  |      |                     |
+                  |      |                     (14) ...to here
+                  |......
+                  |  366 |         if (result)
+                  |      |            ~
+                  |      |            |
+                  |      |            (15) following ‘true’ branch (when ‘result’ is non-NULL)...
+                  |  367 |                 *result = n;
+                  |      |                 ~~~~~~~~~~~
+                  |      |                         |
+                  |      |                         (16) ...to here
+                  |
+           <------+
+           |
+         ‘__parse_action_control’: event 17
+           |
+           |  380 |         if (action_a2n(*argv, &result, allow_num) == -1) {
+           |      |             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+           |      |             |
+           |      |             (17) returning to ‘__parse_action_control’ from ‘action_a2n’
+           |
+    <------+
+    |
+  ‘parse_action_control_slash_spaces’: event 18
+    |
+    |  475 |                         ret = parse_action_control(&argc, &argv,
+    |      |                               ^
+    |      |                               |
+    |      |                               (18) inlined call to ‘parse_action_control’ from ‘parse_action_control_slash_spaces’
+    |
+    +--> ‘parse_action_control’: event 19
+           |
+           |  432 |         return __parse_action_control(argc_p, argv_p, result_p,
+           |      |                ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+           |      |                |
+           |      |                (19) returning to ‘parse_action_control_slash_spaces’ from ‘__parse_action_control’
+           |  433 |                                       allow_num, false);
+           |      |                                       ~~~~~~~~~~~~~~~~~
+           |
+    <------+
+    |
+  ‘parse_action_control_slash_spaces’: events 20-24
+    |
+    |  477 |                         if (ret)
+    |      |                            ^
+    |      |                            |
+    |      |                            (20) following ‘false’ branch...
+    |  478 |                                 return ret;
+    |  479 |                         ok++;
+    |      |                         ~~~~
+    |      |                           |
+    |      |                           (21) ...to here
+    |......
+    |  487 |         if (ok == 2)
+    |      |            ~
+    |      |            |
+    |      |            (22) following ‘true’ branch (when ‘ok == 2’)...
+    |  488 |                 *result2_p = result2;
+    |      |                 ~~~~~~~~~~~~~~~~~~~~
+    |      |                            |
+    |      |                            (23) ...to here
+    |      |                            (24) use of uninitialized value ‘result2’ here
+    |
+tc_util.c:488:28: warning: use of uninitialized value ‘result2’ [CWE-457] [-Wanalyzer-use-of-uninitialized-value]
+  488 |                 *result2_p = result2;
+      |                 ~~~~~~~~~~~^~~~~~~~~
+  ‘parse_action_control_slash’: events 1-5
+    |
+    |  505 | int parse_action_control_slash(int *argc_p, char ***argv_p,
+    |      |     ^~~~~~~~~~~~~~~~~~~~~~~~~~
+    |      |     |
+    |      |     (1) entry to ‘parse_action_control_slash’
+    |......
+    |  510 |         char *p = strchr(*argv, '/');
+    |      |                   ~~~~~~~~~~~~~~~~~~
+    |      |                   |
+    |      |                   (2) when ‘strchr’ returns NULL
+    |  511 |
+    |  512 |         if (!p)
+    |      |            ~
+    |      |            |
+    |      |            (3) following ‘true’ branch (when ‘p’ is NULL)...
+    |  513 |                 return parse_action_control_slash_spaces(argc_p, argv_p,
+    |      |                        ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+    |      |                        |
+    |      |                        (4) ...to here
+    |      |                        (5) calling ‘parse_action_control_slash_spaces’ from ‘parse_action_control_slash’
+    |  514 |                                                          result1_p, result2_p,
+    |      |                                                          ~~~~~~~~~~~~~~~~~~~~~
+    |  515 |                                                          allow_num);
+    |      |                                                          ~~~~~~~~~~
+    |
+    +--> ‘parse_action_control_slash_spaces’: events 6-10
+           |
+           |  455 | static int parse_action_control_slash_spaces(int *argc_p, char ***argv_p,
+           |      |            ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+           |      |            |
+           |      |            (6) entry to ‘parse_action_control_slash_spaces’
+           |......
+           |  461 |         int result1 = -1, result2;
+           |      |                           ~~~~~~~
+           |      |                           |
+           |      |                           (7) region created on stack here
+           |      |                           (8) capacity: 4 bytes
+           |......
+           |  467 |                 switch (ok) {
+           |      |                 ~~~~~~
+           |      |                 |
+           |      |                 (9) following ‘case 0:’ branch...
+           |......
+           |  475 |                         ret = parse_action_control(&argc, &argv,
+           |      |                               ~
+           |      |                               |
+           |      |                               (10) inlined call to ‘parse_action_control’ from ‘parse_action_control_slash_spaces’
+           |
+           +--> ‘parse_action_control’: events 11-12
+                  |
+                  |  432 |         return __parse_action_control(argc_p, argv_p, result_p,
+                  |      |                ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+                  |      |                |
+                  |      |                (11) ...to here
+                  |      |                (12) calling ‘__parse_action_control’ from ‘parse_action_control_slash_spaces’
+                  |  433 |                                       allow_num, false);
+                  |      |                                       ~~~~~~~~~~~~~~~~~
+                  |
+                ‘__parse_action_control’: events 13-16
+                  |
+                  |  371 | static int __parse_action_control(int *argc_p, char ***argv_p, int *result_p,
+                  |      |            ^~~~~~~~~~~~~~~~~~~~~~
+                  |      |            |
+                  |      |            (13) entry to ‘__parse_action_control’
+                  |......
+                  |  378 |         if (!argc)
+                  |      |            ~
+                  |      |            |
+                  |      |            (14) following ‘false’ branch (when ‘argc != 0’)...
+                  |  379 |                 return -1;
+                  |  380 |         if (action_a2n(*argv, &result, allow_num) == -1) {
+                  |      |             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+                  |      |             |
+                  |      |             (15) ...to here
+                  |      |             (16) calling ‘action_a2n’ from ‘__parse_action_control’
+                  |
+                  +--> ‘action_a2n’: events 17-21
+                         |
+                         |  335 | int action_a2n(char *arg, int *result, bool allow_num)
+                         |      |     ^~~~~~~~~~
+                         |      |     |
+                         |      |     (17) entry to ‘action_a2n’
+                         |......
+                         |  356 |         for (iter = a2n; iter->a; iter++) {
+                         |      |                          ~~~~
+                         |      |                          |
+                         |      |                          (18) following ‘true’ branch...
+                         |  357 |                 if (matches(arg, iter->a) != 0)
+                         |      |                     ~~~~~~~~~~~~~~~~~~~~~
+                         |      |                     |
+                         |      |                     (19) ...to here
+                         |......
+                         |  366 |         if (result)
+                         |      |            ~
+                         |      |            |
+                         |      |            (20) following ‘true’ branch (when ‘result’ is non-NULL)...
+                         |  367 |                 *result = n;
+                         |      |                 ~~~~~~~~~~~
+                         |      |                         |
+                         |      |                         (21) ...to here
+                         |
+                  <------+
+                  |
+                ‘__parse_action_control’: event 22
+                  |
+                  |  380 |         if (action_a2n(*argv, &result, allow_num) == -1) {
+                  |      |             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+                  |      |             |
+                  |      |             (22) returning to ‘__parse_action_control’ from ‘action_a2n’
+                  |
+           <------+
+           |
+         ‘parse_action_control_slash_spaces’: event 23
+           |
+           |  475 |                         ret = parse_action_control(&argc, &argv,
+           |      |                               ^
+           |      |                               |
+           |      |                               (23) inlined call to ‘parse_action_control’ from ‘parse_action_control_slash_spaces’
+           |
+           +--> ‘parse_action_control’: event 24
+                  |
+                  |  432 |         return __parse_action_control(argc_p, argv_p, result_p,
+                  |      |                ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+                  |      |                |
+                  |      |                (24) returning to ‘parse_action_control_slash_spaces’ from ‘__parse_action_control’
+                  |  433 |                                       allow_num, false);
+                  |      |                                       ~~~~~~~~~~~~~~~~~
+                  |
+           <------+
+           |
+         ‘parse_action_control_slash_spaces’: events 25-29
+           |
+           |  477 |                         if (ret)
+           |      |                            ^
+           |      |                            |
+           |      |                            (25) following ‘false’ branch...
+           |  478 |                                 return ret;
+           |  479 |                         ok++;
+           |      |                         ~~~~
+           |      |                           |
+           |      |                           (26) ...to here
+           |......
+           |  487 |         if (ok == 2)
+           |      |            ~
+           |      |            |
+           |      |            (27) following ‘true’ branch (when ‘ok == 2’)...
+           |  488 |                 *result2_p = result2;
+           |      |                 ~~~~~~~~~~~~~~~~~~~~
+           |      |                            |
+           |      |                            (28) ...to here
+           |      |                            (29) use of uninitialized value ‘result2’ here
+           |
+
+Fixes: e67aba559581 ("tc: actions: add helpers to parse and print control actions")
+Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
+---
+ tc/tc_util.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tc/tc_util.c b/tc/tc_util.c
+index 0714134e..ed9efa70 100644
+--- a/tc/tc_util.c
++++ b/tc/tc_util.c
+@@ -458,7 +458,7 @@ static int parse_action_control_slash_spaces(int *argc_p, char ***argv_p,
+ {
+ 	int argc = *argc_p;
+ 	char **argv = *argv_p;
+-	int result1 = -1, result2;
++	int result1 = -1, result2 = -1;
+ 	int *result_p = &result1;
+ 	int ok = 0;
+ 	int ret;
+-- 
+2.27.0
+

backport-utils-fix-get_integer-logic.patch

@@ -0,0 +1,33 @@
+From 877f8149d2ed94b6ab412fabaab9fe8d15193db7 Mon Sep 17 00:00:00 2001
+From: Pedro Tammela <pctammela@mojatatu.com>
+Date: Sat, 19 Aug 2023 17:54:48 -0300
+Subject: [PATCH] utils: fix get_integer() logic
+
+Conflict:NA
+Reference:https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/commit?id=877f8149d2ed94b6ab412fabaab9fe8d15193db7
+
+After 3a463c15, get_integer() doesn't return the converted value and
+always writes 0 in 'val' in case of success.
+Fix the logic so it writes the converted value in 'val'.
+
+Fixes: 3a463c15 ("Add get_long utility and adapt get_integer accordingly"
+Signed-off-by: Pedro Tammela <pctammela@mojatatu.com>
+Signed-off-by: David Ahern <dsahern@kernel.org>
+---
+ lib/utils.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/lib/utils.c b/lib/utils.c
+index efa01668d..99ba7a233 100644
+--- a/lib/utils.c
++++ b/lib/utils.c
+@@ -142,7 +142,8 @@ int get_integer(int *val, const char *arg, int base)
+ {
+ 	long res;
+ 
+-	res = get_long(NULL, arg, base);
++	if (get_long(&res, arg, base) < 0)
++		return -1;
+ 
+ 	/* Outside range of int */
+ 	if (res < INT_MIN || res > INT_MAX)

backport-xfrm-prepare-state-offload-logic-to-set-mode.patch

@@ -0,0 +1,117 @@
+From bdd19b1edec44c00c968950301074734cee54cab Mon Sep 17 00:00:00 2001
+From: Leon Romanovsky <leonro@nvidia.com>
+Date: Mon, 12 Dec 2022 09:54:04 +0200
+Subject: [PATCH] xfrm: prepare state offload logic to set mode
+
+The offload in xfrm state requires to provide device and direction
+in order to activate it. However, in the help section, device and
+direction were displayed as an optional.
+
+As a preparation to addition of packet offload, let's fix the help
+section and refactor the code to be more clear.
+
+Conflict:NA
+Reference:https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/commit?id=bdd19b1edec44c00c968950301074734cee54cab
+
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: David Ahern <dsahern@kernel.org>
+---
+ ip/xfrm_state.c    | 35 +++++++++++++++++++----------------
+ man/man8/ip-xfrm.8 |  5 +++++
+ 2 files changed, 24 insertions(+), 16 deletions(-)
+
+diff --git a/ip/xfrm_state.c b/ip/xfrm_state.c
+index b2294d9f..6de2d28d 100644
+--- a/ip/xfrm_state.c
++++ b/ip/xfrm_state.c
+@@ -61,7 +61,7 @@ static void usage(void)
+ 		"        [ replay-seq-hi SEQ ] [ replay-oseq-hi SEQ ]\n"
+ 		"        [ flag FLAG-LIST ] [ sel SELECTOR ] [ LIMIT-LIST ] [ encap ENCAP ]\n"
+ 		"        [ coa ADDR[/PLEN] ] [ ctx CTX ] [ extra-flag EXTRA-FLAG-LIST ]\n"
+-		"        [ offload [dev DEV] dir DIR ]\n"
++		"        [ offload dev DEV dir DIR ]\n"
+ 		"        [ output-mark OUTPUT-MARK [ mask MASK ] ]\n"
+ 		"        [ if_id IF_ID ] [ tfcpad LENGTH ]\n"
+ 		"Usage: ip xfrm state allocspi ID [ mode MODE ] [ mark MARK [ mask MASK ] ]\n"
+@@ -267,7 +267,7 @@ static int xfrm_state_extra_flag_parse(__u32 *extra_flags, int *argcp, char ***a
+ 	return 0;
+ }
+ 
+-static int xfrm_offload_dir_parse(__u8 *dir, int *argcp, char ***argvp)
++static bool xfrm_offload_dir_parse(__u8 *dir, int *argcp, char ***argvp)
+ {
+ 	int argc = *argcp;
+ 	char **argv = *argvp;
+@@ -277,12 +277,12 @@ static int xfrm_offload_dir_parse(__u8 *dir, int *argcp, char ***argvp)
+ 	else if (strcmp(*argv, "out") == 0)
+ 		*dir = 0;
+ 	else
+-		invarg("DIR value is invalid", *argv);
++		return false;
+ 
+ 	*argcp = argc;
+ 	*argvp = argv;
+ 
+-	return 0;
++	return true;
+ }
+ 
+ static int xfrm_state_modify(int cmd, unsigned int flags, int argc, char **argv)
+@@ -424,24 +424,27 @@ static int xfrm_state_modify(int cmd, unsigned int flags, int argc, char **argv)
+ 			addattr_l(&req.n, sizeof(req.buf), XFRMA_SEC_CTX,
+ 				  (void *)&ctx, ctx.sctx.len);
+ 		} else if (strcmp(*argv, "offload") == 0) {
+-			is_offload = true;
+ 			NEXT_ARG();
+ 			if (strcmp(*argv, "dev") == 0) {
+ 				NEXT_ARG();
+ 				ifindex = ll_name_to_index(*argv);
+-				if (!ifindex) {
+-					invarg("value after \"offload dev\" is invalid", *argv);
+-					is_offload = false;
+-				}
+-				NEXT_ARG();
+-			}
++				if (!ifindex)
++					invarg("Invalid device name", *argv);
++			} else
++				invarg("Missing dev keyword", *argv);
++
++			NEXT_ARG();
+ 			if (strcmp(*argv, "dir") == 0) {
++				bool is_dir;
++
+ 				NEXT_ARG();
+-				xfrm_offload_dir_parse(&dir, &argc, &argv);
+-			} else {
+-				invarg("value after \"offload dir\" is invalid", *argv);
+-				is_offload = false;
+-			}
++				is_dir = xfrm_offload_dir_parse(&dir, &argc,
++								&argv);
++				if (!is_dir)
++					invarg("DIR value is invalid", *argv);
++			} else
++				invarg("Missing DIR keyword", *argv);
++			is_offload = true;
+ 		} else if (strcmp(*argv, "output-mark") == 0) {
+ 			NEXT_ARG();
+ 			if (get_u32(&output_mark.v, *argv, 0))
+diff --git a/man/man8/ip-xfrm.8 b/man/man8/ip-xfrm.8
+index bf725cab..4243a023 100644
+--- a/man/man8/ip-xfrm.8
++++ b/man/man8/ip-xfrm.8
+@@ -65,6 +65,11 @@ ip-xfrm \- transform configuration
+ .IR MASK " ] ]"
+ .RB "[ " if_id
+ .IR IF-ID " ]"
++.RB "[ " offload
++.RB dev
++.IR DEV "
++.RB dir
++.IR DIR " ]"
+ .RB "[ " tfcpad
+ .IR LENGTH " ]"
+ 
+-- 
+2.23.0

bugfix-iproute2-change-proc-to-ipnetnsproc-which-is-private.patch

@@ -116,20 +116,18 @@ index fc58a04..fedc3db 100644
  	netns = open(net_path, O_RDONLY);
  	if (netns < 0) {
  		fprintf(stderr, "Cannot open network namespace: %s\n",
-@@ -917,9 +972,11 @@ static int netns_add(int argc, char **argv, bool create)
+@@ -911,9 +965,9 @@ static int netns_add(int argc, char **argv, bool create)
+ 			goto out_delete;
+ 		}
+ 
+-		strcpy(proc_path, "/proc/self/ns/net");
++		snprintf(proc_path, sizeof(proc_path), "/%s/self/ns/net", get_proc_string());
+ 	} else {
+-		snprintf(proc_path, sizeof(proc_path), "/proc/%d/ns/net", pid);
++		snprintf(proc_path, sizeof(proc_path), "/%s/%d/ns/net", get_proc_string(), pid);
  	}
  
  	/* Bind the netns last so I can watch for it */
--	if (mount(proc_path, netns_path, "none", MS_BIND, NULL) < 0) {
-+	char pid_net_path[MAXPATHLEN];
-+	snprintf(pid_net_path, sizeof(pid_net_path), "%s/self/ns/net", get_proc_string());
-+	if (mount(pid_net_path, netns_path, "none", MS_BIND, NULL) < 0) {
- 		fprintf(stderr, "Bind %s -> %s failed: %s\n",
--			proc_path, netns_path, strerror(errno));
-+			pid_net_path, netns_path, strerror(errno));
- 		goto out_delete;
- 	}
- 	netns_restore();
 -- 
 1.8.3.1
 

feature-iproute2-supports-to-parse-UB-device-and-related-display-of-vf-address.patch

@@ -0,0 +1,199 @@
+From fc8d86356ef55fc4716e9bfb643592c1e1aef9a6 Mon Sep 17 00:00:00 2001
+From: Fengyan Mu <mufengyan@hisilicon.com>
+Date: Sat, 25 Nov 2023 12:10:29 +0800
+Subject: [PATCH] [feature]iproute2 supports to parse UB device and related
+ display of vf address
+
+tool inclusion
+category: feature
+bugzilla: https://gitee.com/src-openeuler/iproute/issues/I8EZGI
+CVE: NA
+
+-----------------------------------------------------
+
+This patch adds ARPHRD_UB for iproute2 and support name parse for it.
+The pf in the ub does not manage the addresses of VFs and the address
+information of the VF cannot be obtained.
+This patch deletes the display of vf address information in the pf.
+
+Signed-off-by: Junxin Chen <chenjunxin1@huawei.com>
+Signed-off-by: Fengyan Mu <mufengyan@hisilicon.com>
+---
+ configure                   | 23 +++++++++++++
+ include/uapi/linux/if_arp.h |  4 +++
+ ip/ipaddress.c              | 68 ++++++++++++++++++++++++++-----------
+ lib/ll_types.c              |  3 ++
+ 4 files changed, 79 insertions(+), 19 deletions(-)
+
+diff --git a/configure b/configure
+index 7f4f3bd..094582b 100755
+--- a/configure
++++ b/configure
+@@ -265,6 +265,17 @@ check_elf()
+     fi
+ }
+ 
++check_support_ub()
++{
++    if [ "$SUPPORT_UB" = on ]; then
++	echo "yes"
++	echo 'CFLAGS += -DSUPPORT_UB' >> $CONFIG
++    else
++	echo "no"
++	return
++    fi
++}
++
+ have_libbpf_basic()
+ {
+     cat >$TMPDIR/libbpf_test.c <<EOF
+@@ -490,6 +501,9 @@ Usage: $0 [OPTIONS]
+ 	--libbpf_force		Enable/disable libbpf by force. Available options:
+ 				  on: require link against libbpf, quit config if no libbpf support
+ 				  off: disable libbpf probing
++	--support_ub		Enable supportting to parse ub device. Available options:
++				  on: enable supportting ub
++				  off: disable supportting ub
+ 	-h | --help		Show this usage info
+ EOF
+ 	exit $1
+@@ -513,6 +527,12 @@ else
+ 				fi
+ 				LIBBPF_FORCE=$2
+ 				shift 2 ;;
++			--support_ub)
++				if [ "$2" != 'on' ] && [ "$2" != 'off' ]; then
++					usage 1
++				fi
++				SUPPORT_UB=$2
++				shift 2 ;;
+ 			-h | --help)
+ 				usage 0 ;;
+ 			"")
+@@ -578,6 +598,9 @@ check_strlcpy
+ echo -n "libcap support: "
+ check_cap
+ 
++echo -n "support parse ub device: "
++check_support_ub
++
+ echo >> $CONFIG
+ echo "%.o: %.c" >> $CONFIG
+ echo '	$(QUIET_CC)$(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(CPPFLAGS) -c -o $@ $<' >> $CONFIG
+diff --git a/include/uapi/linux/if_arp.h b/include/uapi/linux/if_arp.h
+index 12d06bb..b7111a5 100644
+--- a/include/uapi/linux/if_arp.h
++++ b/include/uapi/linux/if_arp.h
+@@ -43,6 +43,10 @@
+ #define ARPHRD_EUI64	27		/* EUI-64                       */
+ #define ARPHRD_INFINIBAND 32		/* InfiniBand			*/
+ 
++#ifdef SUPPORT_UB
++#define ARPHRD_UB	38		/* Unified bus			*/
++#endif
++
+ /* Dummy types for non ARP hardware */
+ #define ARPHRD_SLIP	256
+ #define ARPHRD_CSLIP	257
+diff --git a/ip/ipaddress.c b/ip/ipaddress.c
+index 85534aa..463b8fd 100644
+--- a/ip/ipaddress.c
++++ b/ip/ipaddress.c
+@@ -374,31 +374,61 @@ static void print_vfinfo(FILE *fp, struct ifinfomsg *ifi, struct rtattr *vfinfo)
+ 		     "link_type",
+ 		     "    link/%s ",
+ 		     ll_type_n2a(ifi->ifi_type, b1, sizeof(b1)));
+-
+-	print_color_string(PRINT_ANY, COLOR_MAC,
+-			   "address", "%s",
+-			   ll_addr_n2a((unsigned char *) &vf_mac->mac,
+-				       ifi->ifi_type == ARPHRD_ETHER ?
+-				       ETH_ALEN : INFINIBAND_ALEN,
+-				       ifi->ifi_type,
+-				       b1, sizeof(b1)));
+-
+-	if (vf[IFLA_VF_BROADCAST]) {
+-		if (ifi->ifi_flags&IFF_POINTOPOINT) {
+-			print_string(PRINT_FP, NULL, " peer ", NULL);
+-			print_bool(PRINT_JSON,
+-				   "link_pointtopoint", NULL, true);
+-		} else
+-			print_string(PRINT_FP, NULL, " brd ", NULL);
+-
++#ifdef SUPPORT_UB
++	if (ifi->ifi_type == ARPHRD_UB) {
++		print_string(PRINT_FP, NULL, "pointtopoint", NULL);
++	} else {
+ 		print_color_string(PRINT_ANY, COLOR_MAC,
+-				   "broadcast", "%s",
+-				   ll_addr_n2a((unsigned char *) &vf_broadcast->broadcast,
++				   "address", "%s",
++				   ll_addr_n2a((unsigned char *) &vf_mac->mac,
+ 					       ifi->ifi_type == ARPHRD_ETHER ?
+ 					       ETH_ALEN : INFINIBAND_ALEN,
+ 					       ifi->ifi_type,
+ 					       b1, sizeof(b1)));
++
++		if (vf[IFLA_VF_BROADCAST]) {
++			if (ifi->ifi_flags&IFF_POINTOPOINT) {
++				print_string(PRINT_FP, NULL, " peer ", NULL);
++				print_bool(PRINT_JSON,
++					   "link_pointtopoint", NULL, true);
++			} else
++				print_string(PRINT_FP, NULL, " brd ", NULL);
++
++			print_color_string(PRINT_ANY, COLOR_MAC,
++					   "broadcast", "%s",
++					   ll_addr_n2a((unsigned char *) &vf_broadcast->broadcast,
++						       ifi->ifi_type == ARPHRD_ETHER ?
++						       ETH_ALEN : INFINIBAND_ALEN,
++						       ifi->ifi_type,
++						       b1, sizeof(b1)));
++		}
+ 	}
++#else
++	print_color_string(PRINT_ANY, COLOR_MAC,
++				   "address", "%s",
++				   ll_addr_n2a((unsigned char *) &vf_mac->mac,
++					       ifi->ifi_type == ARPHRD_ETHER ?
++					       ETH_ALEN : INFINIBAND_ALEN,
++					       ifi->ifi_type,
++					       b1, sizeof(b1)));
++
++		if (vf[IFLA_VF_BROADCAST]) {
++			if (ifi->ifi_flags&IFF_POINTOPOINT) {
++				print_string(PRINT_FP, NULL, " peer ", NULL);
++				print_bool(PRINT_JSON,
++					   "link_pointtopoint", NULL, true);
++			} else
++				print_string(PRINT_FP, NULL, " brd ", NULL);
++
++			print_color_string(PRINT_ANY, COLOR_MAC,
++					   "broadcast", "%s",
++					   ll_addr_n2a((unsigned char *) &vf_broadcast->broadcast,
++						       ifi->ifi_type == ARPHRD_ETHER ?
++						       ETH_ALEN : INFINIBAND_ALEN,
++						       ifi->ifi_type,
++						       b1, sizeof(b1)));
++		}
++#endif
+ 
+ 	if (vf[IFLA_VF_VLAN_LIST]) {
+ 		struct rtattr *i, *vfvlanlist = vf[IFLA_VF_VLAN_LIST];
+diff --git a/lib/ll_types.c b/lib/ll_types.c
+index 49da15d..2dc8140 100644
+--- a/lib/ll_types.c
++++ b/lib/ll_types.c
+@@ -106,6 +106,9 @@ __PF(CAIF, caif)
+ __PF(IP6GRE, gre6)
+ __PF(NETLINK, netlink)
+ __PF(6LOWPAN, 6lowpan)
++#ifdef SUPPORT_UB
++__PF(UB, ub)
++#endif
+ 
+ __PF(NONE, none)
+ __PF(VOID,void)
+-- 
+2.33.0
+

iproute.spec

@@ -2,7 +2,7 @@
 Name:		iproute
 Version:	5.15.0
 Epoch:      1
-Release:	11
+Release:	19
 Summary:	Linux network configuration utilities
 License:	GPLv2+ and Public Domain
 URL:		https://kernel.org/pub/linux/utils/net/iproute2/
@@ -29,12 +29,52 @@ Patch6013:      backport-ip-address-Fix-memory-leak-when-specifying-device.patch
 Patch6014:      backport-ip-neigh-Fix-memory-leak-when-doing-get.patch
 Patch6015:      backport-mptcp-Fix-memory-leak-when-doing-endpoint-show.patch
 Patch6016:      backport-mptcp-Fix-memory-leak-when-getting-limits.patch
+Patch6017:      backport-iptunnel-detect-protocol-mismatch-on-tunnel-change.patch
+Patch6018:      backport-ipnetns-fix-fd-leak-with-ip-netns-set.patch
+Patch6019:      backport-iproute2-optimize-code-and-fix-some-mem-leak-risk.patch
+Patch6020:      backport-ipmaddr-fix-dereference-of-NULL-on-malloc-failure.patch
+Patch6021:      backport-iproute_lwtunnel-fix-possible-use-of-NULL-when-mallo.patch
+Patch6022:      backport-tc_util-fix-unitialized-warning.patch
+Patch6023:      backport-tc_exec-don-t-dereference-NULL-on-calloc-failure.patch
+Patch6024:      backport-m_action-fix-warning-of-overwrite-of-const-string.patch
+Patch6025:      backport-netem-fix-NULL-deref-on-allocation-failure.patch
+Patch6026:      backport-nstat-fix-potential-NULL-deref.patch
+Patch6027:      backport-rdma-utils-fix-some-analyzer-warnings.patch
+Patch6028:      backport-tc-prio-handle-possible-truncated-kernel-response.patch
+Patch6029:      backport-iproute_lwtunnel-fix-array-boundary-check.patch
+Patch6030:      backport-rt_names-check-for-malloc-failure.patch
+Patch6031:      backport-tc_util-Fix-no-error-return-when-large-parent-id-used.patch
+Patch6032:      backport-tc_util-Change-datatype-for-maj-to-avoid-overflow-issue.patch
+Patch6033:      backport-tc-ct-Fix-invalid-pointer-dereference.patch
+Patch6034:      backport-libnetlink-Fix-memory-leak-in-__rtnl_talk_iov.patch
+Patch6035:      backport-xfrm-prepare-state-offload-logic-to-set-mode.patch
+
+Patch6036:      backport-Add-get_long-utility-and-adapt-get_integer-accordingly.patch
+Patch6037:      backport-Add-utility-to-convert-an-unsigned-int-to-string.patch
+Patch6038:      backport-f_flower-Treat-port-0-as-valid.patch
+Patch6039:      backport-ip-error-out-if-iplink-does-not-consume-all-options.patch
+Patch6040:      backport-iplink_bridge-fix-incorrect-root-id-dump.patch
+Patch6041:      backport-ss-change-aafilter-port-from-int-to-long-inode-support.patch
+Patch6042:      backport-ss-Fix-socket-type-check-in-packet_show_line.patch
+Patch6043:      backport-ss-print-unix-socket-ports-as-unsigned-int-inode.patch
+Patch6044:      backport-utils-fix-get_integer-logic.patch
+
+patch6045:      backport-lnstat-Fix-deref-of-null-in-print_json-function.patch
+patch6046:      backport-iproute2-prevent-memory-leak.patch
+patch6047:      backport-libnetlink-validate-nlmsg-header-length-first.patch
+patch6048:      backport-tc-remove-tcindex-classifier.patch
+patch6049:      backport-ip-fix-memory-leak-in-ip-maddr-show.patch
+patch6050:      backport-ila-fix-potential-snprintf-buffer-overflow.patch
+patch6051:      backport-bridge-fix-potential-snprintf-overflow.patch
+patch6052:      backport-mnl_utils-sanitize-incoming-netlink-payload-size-in-callbacks.patch
 
 Patch9000:      feature-iproute-add-support-for-ipvlan-l2e-mode.patch
 Patch9001:      bugfix-iproute2-cancel-some-test-cases.patch
+Patch9002:      feature-iproute2-supports-to-parse-UB-device-and-related-display-of-vf-address.patch
+Patch9003:      sync-ipvlan_mode-enum-with-kernel-headers.patch
 
 BuildRequires:	gcc bison elfutils-libelf-devel flex iptables-devel
-BuildRequires:  libmnl-devel libselinux-devel pkgconfig libbpf-devel sudo
+BuildRequires:  libmnl-devel libselinux-devel pkgconfig libbpf-devel sudo make
 Requires:       libbpf psmisc
 
 Provides:       /sbin/ip iproute-tc tc 
@@ -64,7 +104,7 @@ Header files for iprout2
 %build
 export LIBDIR='%{_libdir}'
 export IPT_LIB_DIR='/%{_lib}/xtables'
-%configure
+%configure --support_ub on
 %make_build
 
 %check
@@ -107,6 +147,88 @@ install -m 0644 lib/libnetlink.a %{buildroot}%{_libdir}/libnetlink.a
 %{_mandir}/*
 
 %changelog
+* Tue Apr 16 2024 liweigang <liweiganga@uniontech.com> - 1:5.15.0-19
+- Type: bugfix
+- ID: NA
+- SUG: NA
+- DESC: lnstat: Fix deref of null in print_json() function
+        iproute2: prevent memory leak
+        libnetlink: validate nlmsg header length first
+        tc: remove tcindex classifier
+        ip: fix memory leak in 'ip maddr show'
+        ila: fix potential snprintf buffer overflow
+        bridge: fix potential snprintf overflow
+        mnl_utils: sanitize incoming netlink payload size in callbacks
+
+* Fri Jan 12 2024 liubo <liubo335@huawei.com> - 1:5.15.0-18
+- Type:bugfix
+- ID:NA
+- SUG:NA
+- DESC:f_flower: Treat port 0 as valid
+       ip: error out if iplink does not consume all options
+       iplink_bridge: fix incorrect root id dump
+       ss: change aafilter port from int to long (inode support)
+       ss: Fix socket type check in packet_show_line()
+       ss: print unix socket "ports" as unsigned int (inode)
+       Add utility to convert an unsigned int to string
+       Add get_long utility and adapt get_integer accordingly
+       utils: fix get_integer() logic
+
+* Mon Nov 27 2023 liubo <liubo335@huawei.com> - 1:5.15.0-17
+- Type:bugfix
+- ID:NA
+- SUG:NA
+- DESC:libnetlink: Fix memory leak in __rtnl_talk_iov()
+       tc: ct: Fix invalid pointer dereference
+       tc_util: Change datatype for maj to avoid overflow issue
+       tc_util: Fix no error return when large parent id used
+       xfrm: prepare state offload logic to set mode
+
+* Mon Nov 27 2023 liubo <liubo335@huawei.com> - 1:5.15.0-16
+- Type:bugfix
+- ID:NA
+- SUG:NA
+- DESC: sync ipvlan_mode enum with kernel-headers
+
+* Sat Nov 25 2023 mufengyan <mufengyan@hisilicon.com> - 1:5.15.0-15
+- Type:feature
+- ID:NA
+- SUG:NA
+- DESC:This patch adds ARPHRD_UB for iproute2 and support name
+       parse for it and deletes the display of vf address
+       information in the pf
+
+* Thu Aug 17 2023 gaoxingwang <gaoxingwang1@huawei.com> - 1:5.15.0-14
+- Type:bugfix
+- ID:NA
+- SUG:NA
+- DESC:ipnetns: fix fd leak with 'ip netns set'
+       iproute2: optimize code and fix some mem-leak risk
+       iproute_lwtunnel: fix array boundary check
+       iproute_lwtunnel: fix possible use of NULL when malloc()
+       m_action: fix warning of overwrite of const string
+       netem: fix NULL deref on allocation failure
+       nstat: fix potential NULL deref
+       rdma/utils: fix some analyzer warnings
+       rt_names: check for malloc() failure
+       tc/prio: handle possible truncated kernel response
+       tc_exec: don't dereference NULL on calloc failure
+       tc_util fix unitialized warning
+       iptunnel: detect protocol mismatch on tunnel change
+       ipmaddr: fix dereference of NULL on malloc() failure
+
+* Thu Mar 02 2023 jiangheng <jiangheng14@huawei.com> - 1:5.15.0-13
+- Type:bugfix
+- ID:NA
+- SUG:NA
+- DESC:fix ip netns attach failed
+
+* Fri Feb 17 2023 gaoxingwang <gaoxingwang1@huawei.com> - 1:5.15.0-12
+- Type:bugfix
+- ID:NA
+- SUG:NA
+- DESC:add BuildRequire for make to fix build failure
+
 * Wed Feb 8 2023 gaoxingwang <gaoxingwang1@huawei.com> - 1:5.15.0-11
 - Type:bugfix
 - ID:NA

sync-ipvlan_mode-enum-with-kernel-headers.patch

@@ -0,0 +1,26 @@
+From 22f6c8174dca9de68e7a011f580ba07e7d9c15b2 Mon Sep 17 00:00:00 2001
+From: liyunqing <liyunqing@kylinos.cn>
+Date: Fri, 16 Jun 2023 17:48:11 +0800
+Subject: [PATCH] sync ipvlan_mode enum with kernel-headers
+
+---
+ include/uapi/linux/if_link.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/uapi/linux/if_link.h b/include/uapi/linux/if_link.h
+index bddbdc7..1c6f6b1 100644
+--- a/include/uapi/linux/if_link.h
++++ b/include/uapi/linux/if_link.h
+@@ -702,8 +702,8 @@ enum {
+ enum ipvlan_mode {
+ 	IPVLAN_MODE_L2 = 0,
+ 	IPVLAN_MODE_L3,
+-	IPVLAN_MODE_L2E,
+ 	IPVLAN_MODE_L3S,
++	IPVLAN_MODE_L2E,
+ 	IPVLAN_MODE_MAX
+ };
+ 
+-- 
+2.33.0
+