]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
3.10-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 14 Dec 2014 16:41:16 +0000 (08:41 -0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 14 Dec 2014 16:41:16 +0000 (08:41 -0800)
added patches:
ipv6-gre-fix-wrong-skb-protocol-in-wccp.patch
net-mlx4_core-limit-count-field-to-24-bits-in-qp_alloc_res.patch
net-mvneta-fix-tx-interrupt-delay.patch
net-sctp-use-max_header-for-headroom-reserve-in-output-path.patch
rtnetlink-release-net-refcnt-on-error-in-do_setlink.patch
tg3-fix-ring-init-when-there-are-more-tx-than-rx-channels.patch

queue-3.10/ipv6-gre-fix-wrong-skb-protocol-in-wccp.patch [new file with mode: 0644]
queue-3.10/net-mlx4_core-limit-count-field-to-24-bits-in-qp_alloc_res.patch [new file with mode: 0644]
queue-3.10/net-mvneta-fix-tx-interrupt-delay.patch [new file with mode: 0644]
queue-3.10/net-sctp-use-max_header-for-headroom-reserve-in-output-path.patch [new file with mode: 0644]
queue-3.10/rtnetlink-release-net-refcnt-on-error-in-do_setlink.patch [new file with mode: 0644]
queue-3.10/series
queue-3.10/tg3-fix-ring-init-when-there-are-more-tx-than-rx-channels.patch [new file with mode: 0644]

diff --git a/queue-3.10/ipv6-gre-fix-wrong-skb-protocol-in-wccp.patch b/queue-3.10/ipv6-gre-fix-wrong-skb-protocol-in-wccp.patch
new file mode 100644 (file)
index 0000000..4201679
--- /dev/null
@@ -0,0 +1,39 @@
+From foo@baz Sun Dec 14 08:38:16 PST 2014
+From: Yuri Chislov <yuri.chislov@gmail.com>
+Date: Mon, 24 Nov 2014 11:25:15 +0100
+Subject: ipv6: gre: fix wrong skb->protocol in WCCP
+
+From: Yuri Chislov <yuri.chislov@gmail.com>
+
+[ Upstream commit be6572fdb1bfbe23b2624d477de50af50b02f5d6 ]
+
+When using GRE redirection in WCCP, it sets the wrong skb->protocol,
+that is, ETH_P_IP instead of ETH_P_IPV6 for the encapuslated traffic.
+
+Fixes: c12b395a4664 ("gre: Support GRE over IPv6")
+Cc: Dmitry Kozlov <xeb@mail.ru>
+Signed-off-by: Yuri Chislov <yuri.chislov@gmail.com>
+Tested-by: Yuri Chislov <yuri.chislov@gmail.com>
+Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv6/ip6_gre.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/ipv6/ip6_gre.c
++++ b/net/ipv6/ip6_gre.c
+@@ -512,11 +512,11 @@ static int ip6gre_rcv(struct sk_buff *sk
+               skb->protocol = gre_proto;
+               /* WCCP version 1 and 2 protocol decoding.
+-               * - Change protocol to IP
++               * - Change protocol to IPv6
+                * - When dealing with WCCPv2, Skip extra 4 bytes in GRE header
+                */
+               if (flags == 0 && gre_proto == htons(ETH_P_WCCP)) {
+-                      skb->protocol = htons(ETH_P_IP);
++                      skb->protocol = htons(ETH_P_IPV6);
+                       if ((*(h + offset) & 0xF0) != 0x40)
+                               offset += 4;
+               }
diff --git a/queue-3.10/net-mlx4_core-limit-count-field-to-24-bits-in-qp_alloc_res.patch b/queue-3.10/net-mlx4_core-limit-count-field-to-24-bits-in-qp_alloc_res.patch
new file mode 100644 (file)
index 0000000..17c4438
--- /dev/null
@@ -0,0 +1,40 @@
+From foo@baz Sun Dec 14 08:38:16 PST 2014
+From: Jack Morgenstein <jackm@dev.mellanox.co.il>
+Date: Tue, 25 Nov 2014 11:54:31 +0200
+Subject: net/mlx4_core: Limit count field to 24 bits in qp_alloc_res
+
+From: Jack Morgenstein <jackm@dev.mellanox.co.il>
+
+[ Upstream commit 2d5c57d7fbfaa642fb7f0673df24f32b83d9066c ]
+
+Some VF drivers use the upper byte of "param1" (the qp count field)
+in mlx4_qp_reserve_range() to pass flags which are used to optimize
+the range allocation.
+
+Under the current code, if any of these flags are set, the 32-bit
+count field yields a count greater than 2^24, which is out of range,
+and this VF fails.
+
+As these flags represent a "best-effort" allocation hint anyway, they may
+safely be ignored. Therefore, the PF driver may simply mask out the bits.
+
+Fixes: c82e9aa0a8 "mlx4_core: resource tracking for HCA resources used by guests"
+Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
+Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx4/resource_tracker.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
++++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+@@ -1207,7 +1207,7 @@ static int qp_alloc_res(struct mlx4_dev
+       switch (op) {
+       case RES_OP_RESERVE:
+-              count = get_param_l(&in_param);
++              count = get_param_l(&in_param) & 0xffffff;
+               align = get_param_h(&in_param);
+               err = __mlx4_qp_reserve_range(dev, count, align, &base);
+               if (err)
diff --git a/queue-3.10/net-mvneta-fix-tx-interrupt-delay.patch b/queue-3.10/net-mvneta-fix-tx-interrupt-delay.patch
new file mode 100644 (file)
index 0000000..8b9191f
--- /dev/null
@@ -0,0 +1,69 @@
+From foo@baz Sun Dec 14 08:38:16 PST 2014
+From: willy tarreau <w@1wt.eu>
+Date: Tue, 2 Dec 2014 08:13:04 +0100
+Subject: net: mvneta: fix Tx interrupt delay
+
+From: willy tarreau <w@1wt.eu>
+
+[ Upstream commit aebea2ba0f7495e1a1c9ea5e753d146cb2f6b845 ]
+
+The mvneta driver sets the amount of Tx coalesce packets to 16 by
+default. Normally that does not cause any trouble since the driver
+uses a much larger Tx ring size (532 packets). But some sockets
+might run with very small buffers, much smaller than the equivalent
+of 16 packets. This is what ping is doing for example, by setting
+SNDBUF to 324 bytes rounded up to 2kB by the kernel.
+
+The problem is that there is no documented method to force a specific
+packet to emit an interrupt (eg: the last of the ring) nor is it
+possible to make the NIC emit an interrupt after a given delay.
+
+In this case, it causes trouble, because when ping sends packets over
+its raw socket, the few first packets leave the system, and the first
+15 packets will be emitted without an IRQ being generated, so without
+the skbs being freed. And since the socket's buffer is small, there's
+no way to reach that amount of packets, and the ping ends up with
+"send: no buffer available" after sending 6 packets. Running with 3
+instances of ping in parallel is enough to hide the problem, because
+with 6 packets per instance, that's 18 packets total, which is enough
+to grant a Tx interrupt before all are sent.
+
+The original driver in the LSP kernel worked around this design flaw
+by using a software timer to clean up the Tx descriptors. This timer
+was slow and caused terrible network performance on some Tx-bound
+workloads (such as routing) but was enough to make tools like ping
+work correctly.
+
+Instead here, we simply set the packet counts before interrupt to 1.
+This ensures that each packet sent will produce an interrupt. NAPI
+takes care of coalescing interrupts since the interrupt is disabled
+once generated.
+
+No measurable performance impact nor CPU usage were observed on small
+nor large packets, including when saturating the link on Tx, and this
+fixes tools like ping which rely on too small a send buffer. If one
+wants to increase this value for certain workloads where it is safe
+to do so, "ethtool -C $dev tx-frames" will override this default
+setting.
+
+This fix needs to be applied to stable kernels starting with 3.10.
+
+Tested-By: Maggie Mae Roxas <maggie.mae.roxas@gmail.com>
+Signed-off-by: Willy Tarreau <w@1wt.eu>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/marvell/mvneta.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/marvell/mvneta.c
++++ b/drivers/net/ethernet/marvell/mvneta.c
+@@ -210,7 +210,7 @@
+ /* Various constants */
+ /* Coalescing */
+-#define MVNETA_TXDONE_COAL_PKTS               16
++#define MVNETA_TXDONE_COAL_PKTS               1
+ #define MVNETA_RX_COAL_PKTS           32
+ #define MVNETA_RX_COAL_USEC           100
diff --git a/queue-3.10/net-sctp-use-max_header-for-headroom-reserve-in-output-path.patch b/queue-3.10/net-sctp-use-max_header-for-headroom-reserve-in-output-path.patch
new file mode 100644 (file)
index 0000000..b73c77f
--- /dev/null
@@ -0,0 +1,52 @@
+From foo@baz Sun Dec 14 08:38:16 PST 2014
+From: Daniel Borkmann <dborkman@redhat.com>
+Date: Wed, 3 Dec 2014 12:13:58 +0100
+Subject: net: sctp: use MAX_HEADER for headroom reserve in output path
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Daniel Borkmann <dborkman@redhat.com>
+
+[ Upstream commit 9772b54c55266ce80c639a80aa68eeb908f8ecf5 ]
+
+To accomodate for enough headroom for tunnels, use MAX_HEADER instead
+of LL_MAX_HEADER. Robert reported that he has hit after roughly 40hrs
+of trinity an skb_under_panic() via SCTP output path (see reference).
+I couldn't reproduce it from here, but not using MAX_HEADER as elsewhere
+in other protocols might be one possible cause for this.
+
+In any case, it looks like accounting on chunks themself seems to look
+good as the skb already passed the SCTP output path and did not hit
+any skb_over_panic(). Given tunneling was enabled in his .config, the
+headroom would have been expanded by MAX_HEADER in this case.
+
+Reported-by: Robert Święcki <robert@swiecki.net>
+Reference: https://lkml.org/lkml/2014/12/1/507
+Fixes: 594ccc14dfe4d ("[SCTP] Replace incorrect use of dev_alloc_skb with alloc_skb in sctp_packet_transmit().")
+Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
+Acked-by: Vlad Yasevich <vyasevich@gmail.com>
+Acked-by: Neil Horman <nhorman@tuxdriver.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sctp/output.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/sctp/output.c
++++ b/net/sctp/output.c
+@@ -413,12 +413,12 @@ int sctp_packet_transmit(struct sctp_pac
+       sk = chunk->skb->sk;
+       /* Allocate the new skb.  */
+-      nskb = alloc_skb(packet->size + LL_MAX_HEADER, GFP_ATOMIC);
++      nskb = alloc_skb(packet->size + MAX_HEADER, GFP_ATOMIC);
+       if (!nskb)
+               goto nomem;
+       /* Make sure the outbound skb has enough header room reserved. */
+-      skb_reserve(nskb, packet->overhead + LL_MAX_HEADER);
++      skb_reserve(nskb, packet->overhead + MAX_HEADER);
+       /* Set the owning socket so that we know where to get the
+        * destination IP address.
diff --git a/queue-3.10/rtnetlink-release-net-refcnt-on-error-in-do_setlink.patch b/queue-3.10/rtnetlink-release-net-refcnt-on-error-in-do_setlink.patch
new file mode 100644 (file)
index 0000000..980b969
--- /dev/null
@@ -0,0 +1,32 @@
+From foo@baz Sun Dec 14 08:38:16 PST 2014
+From: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+Date: Thu, 27 Nov 2014 10:16:15 +0100
+Subject: rtnetlink: release net refcnt on error in do_setlink()
+
+From: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+
+[ Upstream commit e0ebde0e131b529fd721b24f62872def5ec3718c ]
+
+rtnl_link_get_net() holds a reference on the 'struct net', we need to release
+it in case of error.
+
+CC: Eric W. Biederman <ebiederm@xmission.com>
+Fixes: b51642f6d77b ("net: Enable a userns root rtnl calls that are safe for unprivilged users")
+Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+Reviewed-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/core/rtnetlink.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -1318,6 +1318,7 @@ static int do_setlink(const struct sk_bu
+                       goto errout;
+               }
+               if (!netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN)) {
++                      put_net(net);
+                       err = -EPERM;
+                       goto errout;
+               }
index 67a5933bbcf25b2ef88192dd537d2e79fff40657..81e4f1b581409fb62f0fa54776b08e1f630fe68a 100644 (file)
@@ -10,3 +10,9 @@ media-smiapp-only-some-selection-targets-are-settable.patch
 ahci-add-deviceids-for-sunrise-point-lp-sata-controller.patch
 ahci-disable-msi-on-samsung-0xa800-ssd.patch
 sata_fsl-fix-error-handling-of-irq_of_parse_and_map.patch
+ipv6-gre-fix-wrong-skb-protocol-in-wccp.patch
+tg3-fix-ring-init-when-there-are-more-tx-than-rx-channels.patch
+net-mlx4_core-limit-count-field-to-24-bits-in-qp_alloc_res.patch
+rtnetlink-release-net-refcnt-on-error-in-do_setlink.patch
+net-mvneta-fix-tx-interrupt-delay.patch
+net-sctp-use-max_header-for-headroom-reserve-in-output-path.patch
diff --git a/queue-3.10/tg3-fix-ring-init-when-there-are-more-tx-than-rx-channels.patch b/queue-3.10/tg3-fix-ring-init-when-there-are-more-tx-than-rx-channels.patch
new file mode 100644 (file)
index 0000000..a9346b1
--- /dev/null
@@ -0,0 +1,34 @@
+From foo@baz Sun Dec 14 08:38:16 PST 2014
+From: Thadeu Lima de Souza Cascardo <cascardo@linux.vnet.ibm.com>
+Date: Tue, 25 Nov 2014 14:21:11 -0200
+Subject: tg3: fix ring init when there are more TX than RX channels
+
+From: Thadeu Lima de Souza Cascardo <cascardo@linux.vnet.ibm.com>
+
+[ Upstream commit a620a6bc1c94c22d6c312892be1e0ae171523125 ]
+
+If TX channels are set to 4 and RX channels are set to less than 4,
+using ethtool -L, the driver will try to initialize more RX channels
+than it has allocated, causing an oops.
+
+This fix only initializes the RX ring if it has been allocated.
+
+Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@linux.vnet.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/broadcom/tg3.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -8392,7 +8392,8 @@ static int tg3_init_rings(struct tg3 *tp
+               if (tnapi->rx_rcb)
+                       memset(tnapi->rx_rcb, 0, TG3_RX_RCB_RING_BYTES(tp));
+-              if (tg3_rx_prodring_alloc(tp, &tnapi->prodring)) {
++              if (tnapi->prodring.rx_std &&
++                  tg3_rx_prodring_alloc(tp, &tnapi->prodring)) {
+                       tg3_free_rings(tp);
+                       return -ENOMEM;
+               }