5.15-stable patches

added patches:
	net-ipv6-skb-symmetric-hash-should-incorporate-transport-ports.patch

diff --git a/queue-5.15/net-ipv6-skb-symmetric-hash-should-incorporate-transport-ports.patch b/queue-5.15/net-ipv6-skb-symmetric-hash-should-incorporate-transport-ports.patch
new file mode 100644 (file)
index 0000000..5b61600
--- /dev/null
+++ b/queue-5.15/net-ipv6-skb-symmetric-hash-should-incorporate-transport-ports.patch
@@ -0,0 +1,51 @@
+From a5e2151ff9d5852d0ababbbcaeebd9646af9c8d9 Mon Sep 17 00:00:00 2001
+From: Quan Tian <qtian@vmware.com>
+Date: Tue, 5 Sep 2023 10:36:10 +0000
+Subject: net/ipv6: SKB symmetric hash should incorporate transport ports
+
+From: Quan Tian <qtian@vmware.com>
+
+commit a5e2151ff9d5852d0ababbbcaeebd9646af9c8d9 upstream.
+
+__skb_get_hash_symmetric() was added to compute a symmetric hash over
+the protocol, addresses and transport ports, by commit eb70db875671
+("packet: Use symmetric hash for PACKET_FANOUT_HASH."). It uses
+flow_keys_dissector_symmetric_keys as the flow_dissector to incorporate
+IPv4 addresses, IPv6 addresses and ports. However, it should not specify
+the flag as FLOW_DISSECTOR_F_STOP_AT_FLOW_LABEL, which stops further
+dissection when an IPv6 flow label is encountered, making transport
+ports not being incorporated in such case.
+
+As a consequence, the symmetric hash is based on 5-tuple for IPv4 but
+3-tuple for IPv6 when flow label is present. It caused a few problems,
+e.g. when nft symhash and openvswitch l4_sym rely on the symmetric hash
+to perform load balancing as different L4 flows between two given IPv6
+addresses would always get the same symmetric hash, leading to uneven
+traffic distribution.
+
+Removing the use of FLOW_DISSECTOR_F_STOP_AT_FLOW_LABEL makes sure the
+symmetric hash is based on 5-tuple for both IPv4 and IPv6 consistently.
+
+Fixes: eb70db875671 ("packet: Use symmetric hash for PACKET_FANOUT_HASH.")
+Reported-by: Lars Ekman <uablrek@gmail.com>
+Closes: https://github.com/antrea-io/antrea/issues/5457
+Signed-off-by: Quan Tian <qtian@vmware.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/core/flow_dissector.c |    3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/net/core/flow_dissector.c
++++ b/net/core/flow_dissector.c
+@@ -1614,8 +1614,7 @@ u32 __skb_get_hash_symmetric(const struc
+ 
+       memset(&keys, 0, sizeof(keys));
+       __skb_flow_dissect(NULL, skb, &flow_keys_dissector_symmetric,
+-                         &keys, NULL, 0, 0, 0,
+-                         FLOW_DISSECTOR_F_STOP_AT_FLOW_LABEL);
++                         &keys, NULL, 0, 0, 0, 0);
+ 
+       return __flow_hash_from_keys(&keys, &hashrnd);
+ }

diff --git a/queue-5.15/series b/queue-5.15/series
index 62d454f76987c551bc9e2a4a51f7921384390b8d..05b905460269947d5ee08102df873e4617235830 100644 (file)
--- a/queue-5.15/series
+++ b/queue-5.15/series
@@ -369,3 +369,4 @@ tracing-zero-the-pipe-cpumask-on-alloc-to-avoid-spurious-ebusy.patch
 md-md-bitmap-remove-unnecessary-local-variable-in-backlog_store.patch
 revert-drm-amdgpu-install-stub-fence-into-potential-unused-fence-pointers.patch
 udf-initialize-newblock-to-0.patch
+net-ipv6-skb-symmetric-hash-should-incorporate-transport-ports.patch