--- /dev/null
+From d28c756caee6e414d9ba367d0b92da24145af2a8 Mon Sep 17 00:00:00 2001
+From: Chirantan Ekbote <chirantan@chromium.org>
+Date: Mon, 16 Jul 2018 17:35:29 -0700
+Subject: 9p/net: Fix zero-copy path in the 9p virtio transport
+
+From: Chirantan Ekbote <chirantan@chromium.org>
+
+commit d28c756caee6e414d9ba367d0b92da24145af2a8 upstream.
+
+The zero-copy optimization when reading or writing large chunks of data
+is quite useful. However, the 9p messages created through the zero-copy
+write path have an incorrect message size: it should be the size of the
+header + size of the data being written but instead it's just the size
+of the header.
+
+This only works if the server ignores the size field of the message and
+otherwise breaks the framing of the protocol. Fix this by re-writing the
+message size field with the correct value.
+
+Tested by running `dd if=/dev/zero of=out bs=4k count=1` inside a
+virtio-9p mount.
+
+Link: http://lkml.kernel.org/r/20180717003529.114368-1-chirantan@chromium.org
+Signed-off-by: Chirantan Ekbote <chirantan@chromium.org>
+Reviewed-by: Greg Kurz <groug@kaod.org>
+Tested-by: Greg Kurz <groug@kaod.org>
+Cc: Dylan Reid <dgreid@chromium.org>
+Cc: Guenter Roeck <groeck@chromium.org>
+Cc: stable@vger.kernel.org
+Signed-off-by: Dominique Martinet <dominique.martinet@cea.fr>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/9p/trans_virtio.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/net/9p/trans_virtio.c
++++ b/net/9p/trans_virtio.c
+@@ -406,6 +406,7 @@ p9_virtio_zc_request(struct p9_client *c
+ p9_debug(P9_DEBUG_TRANS, "virtio request\n");
+
+ if (uodata) {
++ __le32 sz;
+ int n = p9_get_mapped_pages(chan, &out_pages, uodata,
+ outlen, &offs, &need_drop);
+ if (n < 0)
+@@ -416,6 +417,12 @@ p9_virtio_zc_request(struct p9_client *c
+ memcpy(&req->tc->sdata[req->tc->size - 4], &v, 4);
+ outlen = n;
+ }
++ /* The size field of the message must include the length of the
++ * header and the length of the data. We didn't actually know
++ * the length of the data until this point so add it in now.
++ */
++ sz = cpu_to_le32(req->tc->size + outlen);
++ memcpy(&req->tc->sdata[0], &sz, sizeof(sz));
+ } else if (uidata) {
+ int n = p9_get_mapped_pages(chan, &in_pages, uidata,
+ inlen, &offs, &need_drop);
--- /dev/null
+From ac74f87c789af40936a80131c4759f3e72579c3a Mon Sep 17 00:00:00 2001
+From: Alexander Aring <aring@mojatatu.com>
+Date: Sat, 14 Jul 2018 12:52:10 -0400
+Subject: net: 6lowpan: fix reserved space for single frames
+
+From: Alexander Aring <aring@mojatatu.com>
+
+commit ac74f87c789af40936a80131c4759f3e72579c3a upstream.
+
+This patch fixes patch add handling to take care tail and headroom for
+single 6lowpan frames. We need to be sure we have a skb with the right
+head and tailroom for single frames. This patch do it by using
+skb_copy_expand() if head and tailroom is not enough allocated by upper
+layer.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=195059
+Reported-by: David Palma <david.palma@ntnu.no>
+Reported-by: Rabi Narayan Sahoo <rabinarayans0828@gmail.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Alexander Aring <aring@mojatatu.com>
+Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/ieee802154/6lowpan/tx.c | 21 ++++++++++++++++++---
+ 1 file changed, 18 insertions(+), 3 deletions(-)
+
+--- a/net/ieee802154/6lowpan/tx.c
++++ b/net/ieee802154/6lowpan/tx.c
+@@ -265,9 +265,24 @@ netdev_tx_t lowpan_xmit(struct sk_buff *
+ /* We must take a copy of the skb before we modify/replace the ipv6
+ * header as the header could be used elsewhere
+ */
+- skb = skb_unshare(skb, GFP_ATOMIC);
+- if (!skb)
+- return NET_XMIT_DROP;
++ if (unlikely(skb_headroom(skb) < ldev->needed_headroom ||
++ skb_tailroom(skb) < ldev->needed_tailroom)) {
++ struct sk_buff *nskb;
++
++ nskb = skb_copy_expand(skb, ldev->needed_headroom,
++ ldev->needed_tailroom, GFP_ATOMIC);
++ if (likely(nskb)) {
++ consume_skb(skb);
++ skb = nskb;
++ } else {
++ kfree_skb(skb);
++ return NET_XMIT_DROP;
++ }
++ } else {
++ skb = skb_unshare(skb, GFP_ATOMIC);
++ if (!skb)
++ return NET_XMIT_DROP;
++ }
+
+ ret = lowpan_header(skb, ldev, &dgram_size, &dgram_offset);
+ if (ret < 0) {
--- /dev/null
+From f9c52831133050c6b82aa8b6831c92da2bbf2a0b Mon Sep 17 00:00:00 2001
+From: Alexander Aring <aring@mojatatu.com>
+Date: Mon, 2 Jul 2018 16:32:03 -0400
+Subject: net: mac802154: tx: expand tailroom if necessary
+
+From: Alexander Aring <aring@mojatatu.com>
+
+commit f9c52831133050c6b82aa8b6831c92da2bbf2a0b upstream.
+
+This patch is necessary if case of AF_PACKET or other socket interface
+which I am aware of it and didn't allocated the necessary room.
+
+Reported-by: David Palma <david.palma@ntnu.no>
+Reported-by: Rabi Narayan Sahoo <rabinarayans0828@gmail.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Alexander Aring <aring@mojatatu.com>
+Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac802154/tx.c | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+--- a/net/mac802154/tx.c
++++ b/net/mac802154/tx.c
+@@ -63,8 +63,21 @@ ieee802154_tx(struct ieee802154_local *l
+ int ret;
+
+ if (!(local->hw.flags & IEEE802154_HW_TX_OMIT_CKSUM)) {
+- u16 crc = crc_ccitt(0, skb->data, skb->len);
++ struct sk_buff *nskb;
++ u16 crc;
+
++ if (unlikely(skb_tailroom(skb) < IEEE802154_FCS_LEN)) {
++ nskb = skb_copy_expand(skb, 0, IEEE802154_FCS_LEN,
++ GFP_ATOMIC);
++ if (likely(nskb)) {
++ consume_skb(skb);
++ skb = nskb;
++ } else {
++ goto err_tx;
++ }
++ }
++
++ crc = crc_ccitt(0, skb->data, skb->len);
+ put_unaligned_le16(crc, skb_put(skb, 2));
+ }
+
rcu-make-expedited-gps-handle-cpu-0-being-offline.patch
+net-6lowpan-fix-reserved-space-for-single-frames.patch
+net-mac802154-tx-expand-tailroom-if-necessary.patch
+9p-net-fix-zero-copy-path-in-the-9p-virtio-transport.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
