From: Greg Kroah-Hartman Date: Sun, 14 Dec 2014 16:41:16 +0000 (-0800) Subject: 3.10-stable patches X-Git-Tag: v3.10.63~10 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=09638a023e28be10c73c9ee576b2a1ce01068fcf;p=thirdparty%2Fkernel%2Fstable-queue.git 3.10-stable patches added patches: ipv6-gre-fix-wrong-skb-protocol-in-wccp.patch net-mlx4_core-limit-count-field-to-24-bits-in-qp_alloc_res.patch net-mvneta-fix-tx-interrupt-delay.patch net-sctp-use-max_header-for-headroom-reserve-in-output-path.patch rtnetlink-release-net-refcnt-on-error-in-do_setlink.patch tg3-fix-ring-init-when-there-are-more-tx-than-rx-channels.patch --- diff --git a/queue-3.10/ipv6-gre-fix-wrong-skb-protocol-in-wccp.patch b/queue-3.10/ipv6-gre-fix-wrong-skb-protocol-in-wccp.patch new file mode 100644 index 00000000000..4201679d9e3 --- /dev/null +++ b/queue-3.10/ipv6-gre-fix-wrong-skb-protocol-in-wccp.patch @@ -0,0 +1,39 @@ +From foo@baz Sun Dec 14 08:38:16 PST 2014 +From: Yuri Chislov +Date: Mon, 24 Nov 2014 11:25:15 +0100 +Subject: ipv6: gre: fix wrong skb->protocol in WCCP + +From: Yuri Chislov + +[ Upstream commit be6572fdb1bfbe23b2624d477de50af50b02f5d6 ] + +When using GRE redirection in WCCP, it sets the wrong skb->protocol, +that is, ETH_P_IP instead of ETH_P_IPV6 for the encapuslated traffic. + +Fixes: c12b395a4664 ("gre: Support GRE over IPv6") +Cc: Dmitry Kozlov +Signed-off-by: Yuri Chislov +Tested-by: Yuri Chislov +Signed-off-by: Daniel Borkmann +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/ip6_gre.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/ipv6/ip6_gre.c ++++ b/net/ipv6/ip6_gre.c +@@ -512,11 +512,11 @@ static int ip6gre_rcv(struct sk_buff *sk + + skb->protocol = gre_proto; + /* WCCP version 1 and 2 protocol decoding. +- * - Change protocol to IP ++ * - Change protocol to IPv6 + * - When dealing with WCCPv2, Skip extra 4 bytes in GRE header + */ + if (flags == 0 && gre_proto == htons(ETH_P_WCCP)) { +- skb->protocol = htons(ETH_P_IP); ++ skb->protocol = htons(ETH_P_IPV6); + if ((*(h + offset) & 0xF0) != 0x40) + offset += 4; + } diff --git a/queue-3.10/net-mlx4_core-limit-count-field-to-24-bits-in-qp_alloc_res.patch b/queue-3.10/net-mlx4_core-limit-count-field-to-24-bits-in-qp_alloc_res.patch new file mode 100644 index 00000000000..17c4438857e --- /dev/null +++ b/queue-3.10/net-mlx4_core-limit-count-field-to-24-bits-in-qp_alloc_res.patch @@ -0,0 +1,40 @@ +From foo@baz Sun Dec 14 08:38:16 PST 2014 +From: Jack Morgenstein +Date: Tue, 25 Nov 2014 11:54:31 +0200 +Subject: net/mlx4_core: Limit count field to 24 bits in qp_alloc_res + +From: Jack Morgenstein + +[ Upstream commit 2d5c57d7fbfaa642fb7f0673df24f32b83d9066c ] + +Some VF drivers use the upper byte of "param1" (the qp count field) +in mlx4_qp_reserve_range() to pass flags which are used to optimize +the range allocation. + +Under the current code, if any of these flags are set, the 32-bit +count field yields a count greater than 2^24, which is out of range, +and this VF fails. + +As these flags represent a "best-effort" allocation hint anyway, they may +safely be ignored. Therefore, the PF driver may simply mask out the bits. + +Fixes: c82e9aa0a8 "mlx4_core: resource tracking for HCA resources used by guests" +Signed-off-by: Jack Morgenstein +Signed-off-by: Or Gerlitz +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlx4/resource_tracker.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c ++++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c +@@ -1207,7 +1207,7 @@ static int qp_alloc_res(struct mlx4_dev + + switch (op) { + case RES_OP_RESERVE: +- count = get_param_l(&in_param); ++ count = get_param_l(&in_param) & 0xffffff; + align = get_param_h(&in_param); + err = __mlx4_qp_reserve_range(dev, count, align, &base); + if (err) diff --git a/queue-3.10/net-mvneta-fix-tx-interrupt-delay.patch b/queue-3.10/net-mvneta-fix-tx-interrupt-delay.patch new file mode 100644 index 00000000000..8b9191f2717 --- /dev/null +++ b/queue-3.10/net-mvneta-fix-tx-interrupt-delay.patch @@ -0,0 +1,69 @@ +From foo@baz Sun Dec 14 08:38:16 PST 2014 +From: willy tarreau +Date: Tue, 2 Dec 2014 08:13:04 +0100 +Subject: net: mvneta: fix Tx interrupt delay + +From: willy tarreau + +[ Upstream commit aebea2ba0f7495e1a1c9ea5e753d146cb2f6b845 ] + +The mvneta driver sets the amount of Tx coalesce packets to 16 by +default. Normally that does not cause any trouble since the driver +uses a much larger Tx ring size (532 packets). But some sockets +might run with very small buffers, much smaller than the equivalent +of 16 packets. This is what ping is doing for example, by setting +SNDBUF to 324 bytes rounded up to 2kB by the kernel. + +The problem is that there is no documented method to force a specific +packet to emit an interrupt (eg: the last of the ring) nor is it +possible to make the NIC emit an interrupt after a given delay. + +In this case, it causes trouble, because when ping sends packets over +its raw socket, the few first packets leave the system, and the first +15 packets will be emitted without an IRQ being generated, so without +the skbs being freed. And since the socket's buffer is small, there's +no way to reach that amount of packets, and the ping ends up with +"send: no buffer available" after sending 6 packets. Running with 3 +instances of ping in parallel is enough to hide the problem, because +with 6 packets per instance, that's 18 packets total, which is enough +to grant a Tx interrupt before all are sent. + +The original driver in the LSP kernel worked around this design flaw +by using a software timer to clean up the Tx descriptors. This timer +was slow and caused terrible network performance on some Tx-bound +workloads (such as routing) but was enough to make tools like ping +work correctly. + +Instead here, we simply set the packet counts before interrupt to 1. +This ensures that each packet sent will produce an interrupt. NAPI +takes care of coalescing interrupts since the interrupt is disabled +once generated. + +No measurable performance impact nor CPU usage were observed on small +nor large packets, including when saturating the link on Tx, and this +fixes tools like ping which rely on too small a send buffer. If one +wants to increase this value for certain workloads where it is safe +to do so, "ethtool -C $dev tx-frames" will override this default +setting. + +This fix needs to be applied to stable kernels starting with 3.10. + +Tested-By: Maggie Mae Roxas +Signed-off-by: Willy Tarreau +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/marvell/mvneta.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/marvell/mvneta.c ++++ b/drivers/net/ethernet/marvell/mvneta.c +@@ -210,7 +210,7 @@ + /* Various constants */ + + /* Coalescing */ +-#define MVNETA_TXDONE_COAL_PKTS 16 ++#define MVNETA_TXDONE_COAL_PKTS 1 + #define MVNETA_RX_COAL_PKTS 32 + #define MVNETA_RX_COAL_USEC 100 + diff --git a/queue-3.10/net-sctp-use-max_header-for-headroom-reserve-in-output-path.patch b/queue-3.10/net-sctp-use-max_header-for-headroom-reserve-in-output-path.patch new file mode 100644 index 00000000000..b73c77f7c3f --- /dev/null +++ b/queue-3.10/net-sctp-use-max_header-for-headroom-reserve-in-output-path.patch @@ -0,0 +1,52 @@ +From foo@baz Sun Dec 14 08:38:16 PST 2014 +From: Daniel Borkmann +Date: Wed, 3 Dec 2014 12:13:58 +0100 +Subject: net: sctp: use MAX_HEADER for headroom reserve in output path +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Daniel Borkmann + +[ Upstream commit 9772b54c55266ce80c639a80aa68eeb908f8ecf5 ] + +To accomodate for enough headroom for tunnels, use MAX_HEADER instead +of LL_MAX_HEADER. Robert reported that he has hit after roughly 40hrs +of trinity an skb_under_panic() via SCTP output path (see reference). +I couldn't reproduce it from here, but not using MAX_HEADER as elsewhere +in other protocols might be one possible cause for this. + +In any case, it looks like accounting on chunks themself seems to look +good as the skb already passed the SCTP output path and did not hit +any skb_over_panic(). Given tunneling was enabled in his .config, the +headroom would have been expanded by MAX_HEADER in this case. + +Reported-by: Robert Święcki +Reference: https://lkml.org/lkml/2014/12/1/507 +Fixes: 594ccc14dfe4d ("[SCTP] Replace incorrect use of dev_alloc_skb with alloc_skb in sctp_packet_transmit().") +Signed-off-by: Daniel Borkmann +Acked-by: Vlad Yasevich +Acked-by: Neil Horman +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/sctp/output.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/sctp/output.c ++++ b/net/sctp/output.c +@@ -413,12 +413,12 @@ int sctp_packet_transmit(struct sctp_pac + sk = chunk->skb->sk; + + /* Allocate the new skb. */ +- nskb = alloc_skb(packet->size + LL_MAX_HEADER, GFP_ATOMIC); ++ nskb = alloc_skb(packet->size + MAX_HEADER, GFP_ATOMIC); + if (!nskb) + goto nomem; + + /* Make sure the outbound skb has enough header room reserved. */ +- skb_reserve(nskb, packet->overhead + LL_MAX_HEADER); ++ skb_reserve(nskb, packet->overhead + MAX_HEADER); + + /* Set the owning socket so that we know where to get the + * destination IP address. diff --git a/queue-3.10/rtnetlink-release-net-refcnt-on-error-in-do_setlink.patch b/queue-3.10/rtnetlink-release-net-refcnt-on-error-in-do_setlink.patch new file mode 100644 index 00000000000..980b9698fd3 --- /dev/null +++ b/queue-3.10/rtnetlink-release-net-refcnt-on-error-in-do_setlink.patch @@ -0,0 +1,32 @@ +From foo@baz Sun Dec 14 08:38:16 PST 2014 +From: Nicolas Dichtel +Date: Thu, 27 Nov 2014 10:16:15 +0100 +Subject: rtnetlink: release net refcnt on error in do_setlink() + +From: Nicolas Dichtel + +[ Upstream commit e0ebde0e131b529fd721b24f62872def5ec3718c ] + +rtnl_link_get_net() holds a reference on the 'struct net', we need to release +it in case of error. + +CC: Eric W. Biederman +Fixes: b51642f6d77b ("net: Enable a userns root rtnl calls that are safe for unprivilged users") +Signed-off-by: Nicolas Dichtel +Reviewed-by: "Eric W. Biederman" +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/core/rtnetlink.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/core/rtnetlink.c ++++ b/net/core/rtnetlink.c +@@ -1318,6 +1318,7 @@ static int do_setlink(const struct sk_bu + goto errout; + } + if (!netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN)) { ++ put_net(net); + err = -EPERM; + goto errout; + } diff --git a/queue-3.10/series b/queue-3.10/series index 67a5933bbcf..81e4f1b5814 100644 --- a/queue-3.10/series +++ b/queue-3.10/series @@ -10,3 +10,9 @@ media-smiapp-only-some-selection-targets-are-settable.patch ahci-add-deviceids-for-sunrise-point-lp-sata-controller.patch ahci-disable-msi-on-samsung-0xa800-ssd.patch sata_fsl-fix-error-handling-of-irq_of_parse_and_map.patch +ipv6-gre-fix-wrong-skb-protocol-in-wccp.patch +tg3-fix-ring-init-when-there-are-more-tx-than-rx-channels.patch +net-mlx4_core-limit-count-field-to-24-bits-in-qp_alloc_res.patch +rtnetlink-release-net-refcnt-on-error-in-do_setlink.patch +net-mvneta-fix-tx-interrupt-delay.patch +net-sctp-use-max_header-for-headroom-reserve-in-output-path.patch diff --git a/queue-3.10/tg3-fix-ring-init-when-there-are-more-tx-than-rx-channels.patch b/queue-3.10/tg3-fix-ring-init-when-there-are-more-tx-than-rx-channels.patch new file mode 100644 index 00000000000..a9346b1300c --- /dev/null +++ b/queue-3.10/tg3-fix-ring-init-when-there-are-more-tx-than-rx-channels.patch @@ -0,0 +1,34 @@ +From foo@baz Sun Dec 14 08:38:16 PST 2014 +From: Thadeu Lima de Souza Cascardo +Date: Tue, 25 Nov 2014 14:21:11 -0200 +Subject: tg3: fix ring init when there are more TX than RX channels + +From: Thadeu Lima de Souza Cascardo + +[ Upstream commit a620a6bc1c94c22d6c312892be1e0ae171523125 ] + +If TX channels are set to 4 and RX channels are set to less than 4, +using ethtool -L, the driver will try to initialize more RX channels +than it has allocated, causing an oops. + +This fix only initializes the RX ring if it has been allocated. + +Signed-off-by: Thadeu Lima de Souza Cascardo +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/broadcom/tg3.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/broadcom/tg3.c ++++ b/drivers/net/ethernet/broadcom/tg3.c +@@ -8392,7 +8392,8 @@ static int tg3_init_rings(struct tg3 *tp + if (tnapi->rx_rcb) + memset(tnapi->rx_rcb, 0, TG3_RX_RCB_RING_BYTES(tp)); + +- if (tg3_rx_prodring_alloc(tp, &tnapi->prodring)) { ++ if (tnapi->prodring.rx_std && ++ tg3_rx_prodring_alloc(tp, &tnapi->prodring)) { + tg3_free_rings(tp); + return -ENOMEM; + }