Add an extra fix from Ben

2 files changed, 135 insertions, 0 deletions

diff --git a/patches/drivers-net-ipv6-select-ipv6-fragment-idents-for-virtio-ufo-packets.patch b/patches/drivers-net-ipv6-select-ipv6-fragment-idents-for-virtio-ufo-packets.patch
new file mode 100644
index 0000000..68d8d62
--- /dev/null
+++ b/patches/drivers-net-ipv6-select-ipv6-fragment-idents-for-virtio-ufo-packets.patch
@@ -0,0 +1,134 @@
+From 5188cd44c55db3e92cd9e77a40b5baa7ed4340f7 Mon Sep 17 00:00:00 2001
+From: Ben Hutchings <ben@decadent.org.uk>
+Date: Thu, 30 Oct 2014 18:27:17 +0000
+Subject: drivers/net, ipv6: Select IPv6 fragment idents for virtio UFO packets
+
+commit 5188cd44c55db3e92cd9e77a40b5baa7ed4340f7 upstream.
+
+UFO is now disabled on all drivers that work with virtio net headers,
+but userland may try to send UFO/IPv6 packets anyway.  Instead of
+sending with ID=0, we should select identifiers on their behalf (as we
+used to).
+
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Fixes: 916e4cf46d02 ("ipv6: reuse ip6_frag_id from ip6_ufo_append_data")
+Signed-off-by: David S. Miller <davem@davemloft.net>
+[bwh: For 3.2, net/ipv6/output_core.c is a completely new file]
+Signed-off-by: Zefan Li <lizefan@huawei.com>
+---
+ drivers/net/macvtap.c  |    3 +++
+ drivers/net/tun.c      |    5 +++++
+ include/net/ipv6.h     |    1 +
+ net/ipv6/Makefile      |    2 +-
+ net/ipv6/output_core.c |   38 ++++++++++++++++++++++++++++++++++++++
+ 5 files changed, 48 insertions(+), 1 deletion(-)
+ create mode 100644 net/ipv6/output_core.c
+
+--- a/drivers/net/macvtap.c
++++ b/drivers/net/macvtap.c
+@@ -17,6 +17,7 @@
+ #include <linux/idr.h>
+ #include <linux/fs.h>
+ 
++#include <net/ipv6.h>
+ #include <net/net_namespace.h>
+ #include <net/rtnetlink.h>
+ #include <net/sock.h>
+@@ -578,6 +579,8 @@ static int macvtap_skb_from_vnet_hdr(str
+ 			break;
+ 		case VIRTIO_NET_HDR_GSO_UDP:
+ 			gso_type = SKB_GSO_UDP;
++			if (skb->protocol == htons(ETH_P_IPV6))
++				ipv6_proxy_select_ident(skb);
+ 			break;
+ 		default:
+ 			return -EINVAL;
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -64,6 +64,7 @@
+ #include <linux/nsproxy.h>
+ #include <linux/virtio_net.h>
+ #include <linux/rcupdate.h>
++#include <net/ipv6.h>
+ #include <net/net_namespace.h>
+ #include <net/netns/generic.h>
+ #include <net/rtnetlink.h>
+@@ -696,6 +697,8 @@ static ssize_t tun_get_user(struct tun_s
+ 		break;
+ 	}
+ 
++	skb_reset_network_header(skb);
++
+ 	if (gso.gso_type != VIRTIO_NET_HDR_GSO_NONE) {
+ 		pr_debug("GSO!\n");
+ 		switch (gso.gso_type & ~VIRTIO_NET_HDR_GSO_ECN) {
+@@ -707,6 +710,8 @@ static ssize_t tun_get_user(struct tun_s
+ 			break;
+ 		case VIRTIO_NET_HDR_GSO_UDP:
+ 			skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
++			if (skb->protocol == htons(ETH_P_IPV6))
++				ipv6_proxy_select_ident(skb);
+ 			break;
+ 		default:
+ 			tun->dev->stats.rx_frame_errors++;
+--- a/include/net/ipv6.h
++++ b/include/net/ipv6.h
+@@ -485,6 +485,7 @@ static inline int ipv6_addr_diff(const s
+ }
+ 
+ extern void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt);
++void ipv6_proxy_select_ident(struct sk_buff *skb);
+ 
+ /*
+  *	Prototypes exported by ipv6
+--- a/net/ipv6/Makefile
++++ b/net/ipv6/Makefile
+@@ -37,6 +37,6 @@ obj-$(CONFIG_NETFILTER)	+= netfilter/
+ obj-$(CONFIG_IPV6_SIT) += sit.o
+ obj-$(CONFIG_IPV6_TUNNEL) += ip6_tunnel.o
+ 
+-obj-y += addrconf_core.o exthdrs_core.o
++obj-y += addrconf_core.o exthdrs_core.o output_core.o
+ 
+ obj-$(subst m,y,$(CONFIG_IPV6)) += inet6_hashtables.o
+--- /dev/null
++++ b/net/ipv6/output_core.c
+@@ -0,0 +1,38 @@
++#include <linux/export.h>
++#include <linux/skbuff.h>
++#include <net/ip.h>
++#include <net/ipv6.h>
++
++/* This function exists only for tap drivers that must support broken
++ * clients requesting UFO without specifying an IPv6 fragment ID.
++ *
++ * This is similar to ipv6_select_ident() but we use an independent hash
++ * seed to limit information leakage.
++ */
++void ipv6_proxy_select_ident(struct sk_buff *skb)
++{
++	static u32 ip6_proxy_idents_hashrnd __read_mostly;
++	static bool hashrnd_initialized = false;
++	struct in6_addr buf[2];
++	struct in6_addr *addrs;
++	u32 hash, id;
++
++	addrs = skb_header_pointer(skb,
++				   skb_network_offset(skb) +
++				   offsetof(struct ipv6hdr, saddr),
++				   sizeof(buf), buf);
++	if (!addrs)
++		return;
++
++	if (unlikely(!hashrnd_initialized)) {
++		hashrnd_initialized = true;
++		get_random_bytes(&ip6_proxy_idents_hashrnd,
++				 sizeof(ip6_proxy_idents_hashrnd));
++	}
++	hash = __ipv6_addr_jhash(&addrs[1], ip6_proxy_idents_hashrnd);
++	hash = __ipv6_addr_jhash(&addrs[0], hash);
++
++	id = ip_idents_reserve(hash, 1);
++	skb_shinfo(skb)->ip6_frag_id = htonl(id);
++}
++EXPORT_SYMBOL_GPL(ipv6_proxy_select_ident);
diff --git a/patches/series b/patches/series
index 10bbb90..d405110 100644
--- a/patches/series
+++ b/patches/series
@@ -178,3 +178,4 @@ x86-tls-ldt-stop-checking-lm-in-ldt_empty.patch
 x86-tls-interpret-an-all-zero-struct-user_desc-as-no-segment.patch
 kvm-x86-fix-far-jump-to-non-canonical-check.patch
 patch-for-3.2.x-3.4.x-ip-identifier-regression.patch
+drivers-net-ipv6-select-ipv6-fragment-idents-for-virtio-ufo-packets.patch