Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
- drivers/net/macvlan.c | 5 +++--
+ drivers/net/macvlan.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
-diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
-index eb825ea52d6b..bd49303f7db2 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
-@@ -233,7 +233,7 @@ static void macvlan_broadcast(struct sk_buff *skb,
+@@ -233,7 +233,7 @@ static void macvlan_broadcast(struct sk_
struct net_device *src,
enum macvlan_mode mode)
{
const struct macvlan_dev *vlan;
struct sk_buff *nskb;
unsigned int i;
-@@ -476,10 +476,11 @@ static int macvlan_queue_xmit(struct sk_buff *skb, struct net_device *dev)
+@@ -476,10 +476,11 @@ static int macvlan_queue_xmit(struct sk_
const struct macvlan_dev *dest;
if (vlan->mode == MACVLAN_MODE_BRIDGE) {
macvlan_broadcast(skb, port, dev, MACVLAN_MODE_BRIDGE);
goto xmit_world;
}
---
-2.20.1
-
--- /dev/null
+From foo@baz Tue 21 Jan 2020 06:00:26 PM CET
+From: Eric Dumazet <edumazet@google.com>
+Date: Mon, 13 Jan 2020 09:27:11 -0800
+Subject: net: usb: lan78xx: limit size of local TSO packets
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit f8d7408a4d7f60f8b2df0f81decdc882dd9c20dc ]
+
+lan78xx_tx_bh() makes sure to not exceed MAX_SINGLE_PACKET_SIZE
+bytes in the aggregated packets it builds, but does
+nothing to prevent large GSO packets being submitted.
+
+Pierre-Francois reported various hangs when/if TSO is enabled.
+
+For localy generated packets, we can use netif_set_gso_max_size()
+to limit the size of TSO packets.
+
+Note that forwarded packets could still hit the issue,
+so a complete fix might require implementing .ndo_features_check
+for this driver, forcing a software segmentation if the size
+of the TSO packet exceeds MAX_SINGLE_PACKET_SIZE.
+
+Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reported-by: RENARD Pierre-Francois <pfrenard@gmail.com>
+Tested-by: RENARD Pierre-Francois <pfrenard@gmail.com>
+Cc: Stefan Wahren <stefan.wahren@i2se.com>
+Cc: Woojung Huh <woojung.huh@microchip.com>
+Cc: Microchip Linux Driver Support <UNGLinuxDriver@microchip.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/usb/lan78xx.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -2961,6 +2961,7 @@ static int lan78xx_probe(struct usb_inte
+
+ if (netdev->mtu > (dev->hard_mtu - netdev->hard_header_len))
+ netdev->mtu = dev->hard_mtu - netdev->hard_header_len;
++ netif_set_gso_max_size(netdev, MAX_SINGLE_PACKET_SIZE - MAX_HEADER);
+
+ dev->ep_blkin = (intf->cur_altsetting)->endpoint + 0;
+ dev->ep_blkout = (intf->cur_altsetting)->endpoint + 1;
--- /dev/null
+From foo@baz Tue 21 Jan 2020 06:02:46 PM CET
+From: Johan Hovold <johan@kernel.org>
+Date: Tue, 14 Jan 2020 09:27:29 +0100
+Subject: r8152: add missing endpoint sanity check
+
+From: Johan Hovold <johan@kernel.org>
+
+[ Upstream commit 86f3f4cd53707ceeec079b83205c8d3c756eca93 ]
+
+Add missing endpoint sanity check to probe in order to prevent a
+NULL-pointer dereference (or slab out-of-bounds access) when retrieving
+the interrupt-endpoint bInterval on ndo_open() in case a device lacks
+the expected endpoints.
+
+Fixes: 40a82917b1d3 ("net/usb/r8152: enable interrupt transfer")
+Cc: hayeswang <hayeswang@realtek.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/usb/r8152.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -4243,6 +4243,9 @@ static int rtl8152_probe(struct usb_inte
+ return -ENODEV;
+ }
+
++ if (intf->cur_altsetting->desc.bNumEndpoints < 3)
++ return -ENODEV;
++
+ usb_reset_device(udev);
+ netdev = alloc_etherdev(sizeof(struct r8152));
+ if (!netdev) {
netfilter-fix-a-use-after-free-in-mtype_destroy.patch
batman-adv-fix-dat-candidate-selection-on-little-endian-systems.patch
macvlan-use-skb_reset_mac_header-in-macvlan_queue_xm.patch
+r8152-add-missing-endpoint-sanity-check.patch
+tcp-fix-marked-lost-packets-not-being-retransmitted.patch
+net-usb-lan78xx-limit-size-of-local-tso-packets.patch
--- /dev/null
+From foo@baz Tue 21 Jan 2020 06:02:46 PM CET
+From: Pengcheng Yang <yangpc@wangsu.com>
+Date: Tue, 14 Jan 2020 17:23:40 +0800
+Subject: tcp: fix marked lost packets not being retransmitted
+
+From: Pengcheng Yang <yangpc@wangsu.com>
+
+[ Upstream commit e176b1ba476cf36f723cfcc7a9e57f3cb47dec70 ]
+
+When the packet pointed to by retransmit_skb_hint is unlinked by ACK,
+retransmit_skb_hint will be set to NULL in tcp_clean_rtx_queue().
+If packet loss is detected at this time, retransmit_skb_hint will be set
+to point to the current packet loss in tcp_verify_retransmit_hint(),
+then the packets that were previously marked lost but not retransmitted
+due to the restriction of cwnd will be skipped and cannot be
+retransmitted.
+
+To fix this, when retransmit_skb_hint is NULL, retransmit_skb_hint can
+be reset only after all marked lost packets are retransmitted
+(retrans_out >= lost_out), otherwise we need to traverse from
+tcp_rtx_queue_head in tcp_xmit_retransmit_queue().
+
+Packetdrill to demonstrate:
+
+// Disable RACK and set max_reordering to keep things simple
+ 0 `sysctl -q net.ipv4.tcp_recovery=0`
+ +0 `sysctl -q net.ipv4.tcp_max_reordering=3`
+
+// Establish a connection
+ +0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3
+ +0 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0
+ +0 bind(3, ..., ...) = 0
+ +0 listen(3, 1) = 0
+
+ +.1 < S 0:0(0) win 32792 <mss 1000,sackOK,nop,nop,nop,wscale 7>
+ +0 > S. 0:0(0) ack 1 <...>
+ +.01 < . 1:1(0) ack 1 win 257
+ +0 accept(3, ..., ...) = 4
+
+// Send 8 data segments
+ +0 write(4, ..., 8000) = 8000
+ +0 > P. 1:8001(8000) ack 1
+
+// Enter recovery and 1:3001 is marked lost
+ +.01 < . 1:1(0) ack 1 win 257 <sack 3001:4001,nop,nop>
+ +0 < . 1:1(0) ack 1 win 257 <sack 5001:6001 3001:4001,nop,nop>
+ +0 < . 1:1(0) ack 1 win 257 <sack 5001:7001 3001:4001,nop,nop>
+
+// Retransmit 1:1001, now retransmit_skb_hint points to 1001:2001
+ +0 > . 1:1001(1000) ack 1
+
+// 1001:2001 was ACKed causing retransmit_skb_hint to be set to NULL
+ +.01 < . 1:1(0) ack 2001 win 257 <sack 5001:8001 3001:4001,nop,nop>
+// Now retransmit_skb_hint points to 4001:5001 which is now marked lost
+
+// BUG: 2001:3001 was not retransmitted
+ +0 > . 2001:3001(1000) ack 1
+
+Signed-off-by: Pengcheng Yang <yangpc@wangsu.com>
+Acked-by: Neal Cardwell <ncardwell@google.com>
+Tested-by: Neal Cardwell <ncardwell@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/tcp_input.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -895,9 +895,10 @@ static void tcp_update_reordering(struct
+ /* This must be called before lost_out is incremented */
+ static void tcp_verify_retransmit_hint(struct tcp_sock *tp, struct sk_buff *skb)
+ {
+- if (!tp->retransmit_skb_hint ||
+- before(TCP_SKB_CB(skb)->seq,
+- TCP_SKB_CB(tp->retransmit_skb_hint)->seq))
++ if ((!tp->retransmit_skb_hint && tp->retrans_out >= tp->lost_out) ||
++ (tp->retransmit_skb_hint &&
++ before(TCP_SKB_CB(skb)->seq,
++ TCP_SKB_CB(tp->retransmit_skb_hint)->seq)))
+ tp->retransmit_skb_hint = skb;
+
+ if (!tp->lost_out ||
projects / thirdparty / kernel / stable-queue.git / commitdiff
