diff options
author | Greg Kroah-Hartman <gregkh@suse.de> | 2011-11-02 14:05:43 -0700 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@suse.de> | 2011-11-02 14:05:43 -0700 |
commit | 2b1a853793535674f01f37f01c69e806943b5121 (patch) | |
tree | 9d1e0bf1ab80669c4a529aca4f83a14423b16210 | |
parent | c061beea77d11ebad770584d3abd895e1028135c (diff) | |
download | longterm-queue-2.6.33-2b1a853793535674f01f37f01c69e806943b5121.tar.gz |
.33 patches
-rw-r--r-- | queue-2.6.33/gro-fix-different-skb-headrooms.patch | 69 | ||||
-rw-r--r-- | queue-2.6.33/gro-re-fix-different-skb-headrooms.patch | 45 | ||||
-rw-r--r-- | queue-2.6.33/net-fix-a-memmove-bug-in-dev_gro_receive.patch | 42 | ||||
-rw-r--r-- | queue-2.6.33/series | 3 |
4 files changed, 159 insertions, 0 deletions
diff --git a/queue-2.6.33/gro-fix-different-skb-headrooms.patch b/queue-2.6.33/gro-fix-different-skb-headrooms.patch new file mode 100644 index 0000000..f7b0edf --- /dev/null +++ b/queue-2.6.33/gro-fix-different-skb-headrooms.patch @@ -0,0 +1,69 @@ +From 3d3be4333fdf6faa080947b331a6a19bce1a4f57 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet <eric.dumazet@gmail.com> +Date: Wed, 1 Sep 2010 00:50:51 +0000 +Subject: gro: fix different skb headrooms + +From: Eric Dumazet <eric.dumazet@gmail.com> + +commit 3d3be4333fdf6faa080947b331a6a19bce1a4f57 upstream. + +Packets entering GRO might have different headrooms, even for a given +flow (because of implementation details in drivers, like copybreak). +We cant force drivers to deliver packets with a fixed headroom. + +1) fix skb_segment() + +skb_segment() makes the false assumption headrooms of fragments are same +than the head. When CHECKSUM_PARTIAL is used, this can give csum_start +errors, and crash later in skb_copy_and_csum_dev() + +2) allocate a minimal skb for head of frag_list + +skb_gro_receive() uses netdev_alloc_skb(headroom + skb_gro_offset(p)) to +allocate a fresh skb. This adds NET_SKB_PAD to a padding already +provided by netdevice, depending on various things, like copybreak. + +Use alloc_skb() to allocate an exact padding, to reduce cache line +needs: +NET_SKB_PAD + NET_IP_ALIGN + +bugzilla : https://bugzilla.kernel.org/show_bug.cgi?id=16626 + +Many thanks to Plamen Petrov, testing many debugging patches ! +With help of Jarek Poplawski. + +Reported-by: Plamen Petrov <pvp-lsts@fs.uni-ruse.bg> +Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> +CC: Jarek Poplawski <jarkao2@gmail.com> +Cc: Ben Hutchings <bhutchings@solarflare.com> +Signed-off-by: David S. Miller <davem@davemloft.net> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + net/core/skbuff.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -2578,6 +2578,10 @@ struct sk_buff *skb_segment(struct sk_bu + __copy_skb_header(nskb, skb); + nskb->mac_len = skb->mac_len; + ++ /* nskb and skb might have different headroom */ ++ if (nskb->ip_summed == CHECKSUM_PARTIAL) ++ nskb->csum_start += skb_headroom(nskb) - headroom; ++ + skb_reset_mac_header(nskb); + skb_set_network_header(nskb, skb->mac_len); + nskb->transport_header = (nskb->network_header + +@@ -2707,8 +2711,8 @@ int skb_gro_receive(struct sk_buff **hea + } else if (skb_gro_len(p) != pinfo->gso_size) + return -E2BIG; + +- headroom = skb_headroom(p); +- nskb = netdev_alloc_skb(p->dev, headroom + skb_gro_offset(p)); ++ headroom = NET_SKB_PAD + NET_IP_ALIGN; ++ nskb = alloc_skb(headroom + skb_gro_offset(p), GFP_ATOMIC); + if (unlikely(!nskb)) + return -ENOMEM; + diff --git a/queue-2.6.33/gro-re-fix-different-skb-headrooms.patch b/queue-2.6.33/gro-re-fix-different-skb-headrooms.patch new file mode 100644 index 0000000..322dc0d --- /dev/null +++ b/queue-2.6.33/gro-re-fix-different-skb-headrooms.patch @@ -0,0 +1,45 @@ +From 64289c8e6851bca0e589e064c9a5c9fbd6ae5dd4 Mon Sep 17 00:00:00 2001 +From: Jarek Poplawski <jarkao2@gmail.com> +Date: Sat, 4 Sep 2010 10:34:29 +0000 +Subject: gro: Re-fix different skb headrooms + +From: Jarek Poplawski <jarkao2@gmail.com> + +commit 64289c8e6851bca0e589e064c9a5c9fbd6ae5dd4 upstream. + +The patch: "gro: fix different skb headrooms" in its part: +"2) allocate a minimal skb for head of frag_list" is buggy. The copied +skb has p->data set at the ip header at the moment, and skb_gro_offset +is the length of ip + tcp headers. So, after the change the length of +mac header is skipped. Later skb_set_mac_header() sets it into the +NET_SKB_PAD area (if it's long enough) and ip header is misaligned at +NET_SKB_PAD + NET_IP_ALIGN offset. There is no reason to assume the +original skb was wrongly allocated, so let's copy it as it was. + +bugzilla : https://bugzilla.kernel.org/show_bug.cgi?id=16626 +fixes commit: 3d3be4333fdf6faa080947b331a6a19bce1a4f57 + +Reported-by: Plamen Petrov <pvp-lsts@fs.uni-ruse.bg> +Signed-off-by: Jarek Poplawski <jarkao2@gmail.com> +CC: Eric Dumazet <eric.dumazet@gmail.com> +Acked-by: Eric Dumazet <eric.dumazet@gmail.com> +Tested-by: Plamen Petrov <pvp-lsts@fs.uni-ruse.bg> +Signed-off-by: David S. Miller <davem@davemloft.net> +Cc: Ben Hutchings <bhutchings@solarflare.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + net/core/skbuff.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -2711,7 +2711,7 @@ int skb_gro_receive(struct sk_buff **hea + } else if (skb_gro_len(p) != pinfo->gso_size) + return -E2BIG; + +- headroom = NET_SKB_PAD + NET_IP_ALIGN; ++ headroom = skb_headroom(p); + nskb = alloc_skb(headroom + skb_gro_offset(p), GFP_ATOMIC); + if (unlikely(!nskb)) + return -ENOMEM; diff --git a/queue-2.6.33/net-fix-a-memmove-bug-in-dev_gro_receive.patch b/queue-2.6.33/net-fix-a-memmove-bug-in-dev_gro_receive.patch new file mode 100644 index 0000000..0cc8415 --- /dev/null +++ b/queue-2.6.33/net-fix-a-memmove-bug-in-dev_gro_receive.patch @@ -0,0 +1,42 @@ +From e5093aec2e6b60c3df2420057ffab9ed4a6d2792 Mon Sep 17 00:00:00 2001 +From: Jarek Poplawski <jarkao2@gmail.com> +Date: Wed, 11 Aug 2010 02:02:10 +0000 +Subject: net: Fix a memmove bug in dev_gro_receive() + +From: Jarek Poplawski <jarkao2@gmail.com> + +commit e5093aec2e6b60c3df2420057ffab9ed4a6d2792 upstream. + +>Xin Xiaohui wrote: +> I looked into the code dev_gro_receive(), found the code here: +> if the frags[0] is pulled to 0, then the page will be released, +> and memmove() frags left. +> Is that right? I'm not sure if memmove do right or not, but +> frags[0].size is never set after memove at least. what I think +> a simple way is not to do anything if we found frags[0].size == 0. +> The patch is as followed. +... + +This version of the patch fixes the bug directly in memmove. + +Reported-by: "Xin, Xiaohui" <xiaohui.xin@intel.com> +Signed-off-by: Jarek Poplawski <jarkao2@gmail.com> +Signed-off-by: David S. Miller <davem@davemloft.net> +Cc: Ben Hutchings <bhutchings@solarflare.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + net/core/dev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -2664,7 +2664,7 @@ pull: + put_page(skb_shinfo(skb)->frags[0].page); + memmove(skb_shinfo(skb)->frags, + skb_shinfo(skb)->frags + 1, +- --skb_shinfo(skb)->nr_frags); ++ --skb_shinfo(skb)->nr_frags * sizeof(skb_frag_t)); + } + } + diff --git a/queue-2.6.33/series b/queue-2.6.33/series index 77c19b3..cbeefac 100644 --- a/queue-2.6.33/series +++ b/queue-2.6.33/series @@ -83,3 +83,6 @@ carminefb-fix-module-parameters-permissions.patch uvcvideo-set-alternate-setting-0-on-resume-if-the-bus-has-been-reset.patch tuner_xc2028-allow-selection-of-the-frequency-adjustment-code-for-xc3028.patch plat-mxc-iomux-v3.h-implicitly-enable-pull-up-down-when-that-s-desired.patch +net-fix-a-memmove-bug-in-dev_gro_receive.patch +gro-fix-different-skb-headrooms.patch +gro-re-fix-different-skb-headrooms.patch |