From: Greg Kroah-Hartman Date: Fri, 9 Jul 2010 21:55:36 +0000 (-0700) Subject: .33 patches X-Git-Tag: v2.6.27.49~42 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=217b9f9c2c9d4d8e3c53398288c94234d9a279fe;p=thirdparty%2Fkernel%2Fstable-queue.git .33 patches --- diff --git a/queue-2.6.33/bridge-fdb-cleanup-runs-too-often.patch b/queue-2.6.33/bridge-fdb-cleanup-runs-too-often.patch new file mode 100644 index 00000000000..5c8074a895a --- /dev/null +++ b/queue-2.6.33/bridge-fdb-cleanup-runs-too-often.patch @@ -0,0 +1,47 @@ +From 830ae4aac19b308c2fe8f8f8b2e1636dcb1cedd4 Mon Sep 17 00:00:00 2001 +From: stephen hemminger +Date: Tue, 15 Jun 2010 06:14:12 +0000 +Subject: bridge: fdb cleanup runs too often + + +From: stephen hemminger + +[ Upstream commit 25442e06d20aaba7d7b16438078a562b3e4cf19b ] + +It is common in end-node, non STP bridges to set forwarding +delay to zero; which causes the forwarding database cleanup +to run every clock tick. Change to run only as soon as needed +or at next ageing timer interval which ever is sooner. + +Use round_jiffies_up macro rather than attempting round up +by changing value. + +Signed-off-by: Stephen Hemminger +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/bridge/br_fdb.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +--- a/net/bridge/br_fdb.c ++++ b/net/bridge/br_fdb.c +@@ -127,7 +127,7 @@ void br_fdb_cleanup(unsigned long _data) + { + struct net_bridge *br = (struct net_bridge *)_data; + unsigned long delay = hold_time(br); +- unsigned long next_timer = jiffies + br->forward_delay; ++ unsigned long next_timer = jiffies + br->ageing_time; + int i; + + spin_lock_bh(&br->hash_lock); +@@ -148,9 +148,7 @@ void br_fdb_cleanup(unsigned long _data) + } + spin_unlock_bh(&br->hash_lock); + +- /* Add HZ/4 to ensure we round the jiffies upwards to be after the next +- * timer, otherwise we might round down and will have no-op run. */ +- mod_timer(&br->gc_timer, round_jiffies(next_timer + HZ/4)); ++ mod_timer(&br->gc_timer, round_jiffies_up(next_timer)); + } + + /* Completely flush all dynamic entries in forwarding database.*/ diff --git a/queue-2.6.33/gro-fix-bogus-gso_size-on-the-first-fraglist-entry.patch b/queue-2.6.33/gro-fix-bogus-gso_size-on-the-first-fraglist-entry.patch new file mode 100644 index 00000000000..73f1867f1d0 --- /dev/null +++ b/queue-2.6.33/gro-fix-bogus-gso_size-on-the-first-fraglist-entry.patch @@ -0,0 +1,37 @@ +From e2c5a1d655b00d7ff83fd43da5661056ae928803 Mon Sep 17 00:00:00 2001 +From: Herbert Xu +Date: Thu, 20 May 2010 23:07:56 -0700 +Subject: gro: Fix bogus gso_size on the first fraglist entry + + +From: Herbert Xu + +[ Upstream commit 622e0ca1cd4d459f5af4f2c65f4dc0dd823cb4c3 ] + +When GRO produces fraglist entries, and the resulting skb hits +an interface that is incapable of TSO but capable of FRAGLIST, +we end up producing a bogus packet with gso_size non-zero. + +This was reported in the field with older versions of KVM that +did not set the TSO bits on tuntap. + +This patch fixes that. + +Reported-by: Igor Zhang +Signed-off-by: Herbert Xu +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/core/skbuff.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -2729,6 +2729,7 @@ int skb_gro_receive(struct sk_buff **hea + *NAPI_GRO_CB(nskb) = *NAPI_GRO_CB(p); + skb_shinfo(nskb)->frag_list = p; + skb_shinfo(nskb)->gso_size = pinfo->gso_size; ++ pinfo->gso_size = 0; + skb_header_release(p); + nskb->prev = p; + diff --git a/queue-2.6.33/ipv6-fix-default-multicast-hops-setting.patch b/queue-2.6.33/ipv6-fix-default-multicast-hops-setting.patch new file mode 100644 index 00000000000..8d574259c5e --- /dev/null +++ b/queue-2.6.33/ipv6-fix-default-multicast-hops-setting.patch @@ -0,0 +1,34 @@ +From b9fe2cdcdc079213faac5527de316a293548963a Mon Sep 17 00:00:00 2001 +From: David S. Miller +Date: Mon, 3 May 2010 23:42:27 -0700 +Subject: ipv6: Fix default multicast hops setting. + + +From: David S. Miller + +[ Upstream commit f935aa9e99d6ec74a50871c120e6b21de7256efb ] + +As per RFC 3493 the default multicast hops setting +for a socket should be "1" just like ipv4. + +Ironically we have a IPV6_DEFAULT_MCASTHOPS macro +it just wasn't being used. + +Reported-by: Elliot Hughes +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/af_inet6.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/ipv6/af_inet6.c ++++ b/net/ipv6/af_inet6.c +@@ -199,7 +199,7 @@ lookup_protocol: + + inet_sk(sk)->pinet6 = np = inet6_sk_generic(sk); + np->hop_limit = -1; +- np->mcast_hops = -1; ++ np->mcast_hops = IPV6_DEFAULT_MCASTHOPS; + np->mc_loop = 1; + np->pmtudisc = IPV6_PMTUDISC_WANT; + np->ipv6only = net->ipv6.sysctl.bindv6only; diff --git a/queue-2.6.33/net-dccp-expansion-of-error-code-size.patch b/queue-2.6.33/net-dccp-expansion-of-error-code-size.patch new file mode 100644 index 00000000000..7eef0f22556 --- /dev/null +++ b/queue-2.6.33/net-dccp-expansion-of-error-code-size.patch @@ -0,0 +1,43 @@ +From adc32c22be012157d1ccfa4a54c774efab890ddd Mon Sep 17 00:00:00 2001 +From: Yoichi Yuasa +Date: Mon, 24 May 2010 18:37:02 -0700 +Subject: net/dccp: expansion of error code size + + +From: Yoichi Yuasa + +[ Upstream commit d9b52dc6fd1fbb2bad645cbc86a60f984c1cb179 ] + +Because MIPS's EDQUOT value is 1133(0x46d). +It's larger than u8. + +Signed-off-by: Yoichi Yuasa +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/dccp/input.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/net/dccp/input.c ++++ b/net/dccp/input.c +@@ -123,9 +123,9 @@ static int dccp_rcv_closereq(struct sock + return queued; + } + +-static u8 dccp_reset_code_convert(const u8 code) ++static u16 dccp_reset_code_convert(const u8 code) + { +- const u8 error_code[] = { ++ const u16 error_code[] = { + [DCCP_RESET_CODE_CLOSED] = 0, /* normal termination */ + [DCCP_RESET_CODE_UNSPECIFIED] = 0, /* nothing known */ + [DCCP_RESET_CODE_ABORTED] = ECONNRESET, +@@ -147,7 +147,7 @@ static u8 dccp_reset_code_convert(const + + static void dccp_rcv_reset(struct sock *sk, struct sk_buff *skb) + { +- u8 err = dccp_reset_code_convert(dccp_hdr_reset(skb)->dccph_reset_code); ++ u16 err = dccp_reset_code_convert(dccp_hdr_reset(skb)->dccph_reset_code); + + sk->sk_err = err; + diff --git a/queue-2.6.33/net-fix-fddi-and-tr-config-checks-in-ipv4-arp-and-llc.patch b/queue-2.6.33/net-fix-fddi-and-tr-config-checks-in-ipv4-arp-and-llc.patch new file mode 100644 index 00000000000..4975e2d5bbc --- /dev/null +++ b/queue-2.6.33/net-fix-fddi-and-tr-config-checks-in-ipv4-arp-and-llc.patch @@ -0,0 +1,57 @@ +From 7530475f9b50c2d02b272913fceb43f3c7924a9c Mon Sep 17 00:00:00 2001 +From: David S. Miller +Date: Mon, 10 May 2010 04:59:07 -0700 +Subject: net: Fix FDDI and TR config checks in ipv4 arp and LLC. + + +From: David S. Miller + +[ Upstream commit f0ecde1466f21edf577b809735f4f35f354777a0 ] + +Need to check both CONFIG_FOO and CONFIG_FOO_MODULE + +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/arp.c | 6 +++--- + net/llc/llc_sap.c | 2 +- + 2 files changed, 4 insertions(+), 4 deletions(-) + +--- a/net/ipv4/arp.c ++++ b/net/ipv4/arp.c +@@ -619,13 +619,13 @@ struct sk_buff *arp_create(int type, int + #endif + #endif + +-#ifdef CONFIG_FDDI ++#if defined(CONFIG_FDDI) || defined(CONFIG_FDDI_MODULE) + case ARPHRD_FDDI: + arp->ar_hrd = htons(ARPHRD_ETHER); + arp->ar_pro = htons(ETH_P_IP); + break; + #endif +-#ifdef CONFIG_TR ++#if defined(CONFIG_TR) || defined(CONFIG_TR_MODULE) + case ARPHRD_IEEE802_TR: + arp->ar_hrd = htons(ARPHRD_IEEE802); + arp->ar_pro = htons(ETH_P_IP); +@@ -1005,7 +1005,7 @@ static int arp_req_set(struct net *net, + return -EINVAL; + } + switch (dev->type) { +-#ifdef CONFIG_FDDI ++#if defined(CONFIG_FDDI) || defined(CONFIG_FDDI_MODULE) + case ARPHRD_FDDI: + /* + * According to RFC 1390, FDDI devices should accept ARP +--- a/net/llc/llc_sap.c ++++ b/net/llc/llc_sap.c +@@ -30,7 +30,7 @@ static int llc_mac_header_len(unsigned s + case ARPHRD_ETHER: + case ARPHRD_LOOPBACK: + return sizeof(struct ethhdr); +-#ifdef CONFIG_TR ++#if defined(CONFIG_TR) || defined(CONFIG_TR_MODULE) + case ARPHRD_IEEE802_TR: + return sizeof(struct trh_hdr); + #endif diff --git a/queue-2.6.33/pegasus-fix-usb-device-id-for-etx-us2.patch b/queue-2.6.33/pegasus-fix-usb-device-id-for-etx-us2.patch new file mode 100644 index 00000000000..41d1e7b775f --- /dev/null +++ b/queue-2.6.33/pegasus-fix-usb-device-id-for-etx-us2.patch @@ -0,0 +1,45 @@ +From 0feef5564eb60e669eabfd32bec84615ee9a76d5 Mon Sep 17 00:00:00 2001 +From: Tadashi Abe +Date: Mon, 17 May 2010 22:41:45 -0700 +Subject: pegasus: fix USB device ID for ETX-US2 + + +From: Tadashi Abe + +[ Upstream commit 95718c1c25370b2c85061a4d8dfab2831b3ad280 ] + +USB device ID definition for I-O Data ETX-US2 is wrong. +Correct ID is 0x093a. Here's snippet from /proc/bus/usb/devices; + +T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=ff(vend.) Sub=ff Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=04bb ProdID=093a Rev= 1.01 +S: Manufacturer=I-O DATA DEVICE,INC. +S: Product=I-O DATA ETX2-US2 +S: SerialNumber=A26427 +C:* #Ifs= 1 Cfg#= 1 Atr=80 MxPwr=224mA +I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=00 Driver=pegasus +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=03(Int.) MxPS= 8 Ivl=125us + +This patch enables pegasus driver to work fine with ETX-US2. + +Signed-off-by: Tadashi Abe +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/pegasus.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/usb/pegasus.h ++++ b/drivers/net/usb/pegasus.h +@@ -254,7 +254,7 @@ PEGASUS_DEV( "IO DATA USB ET/TX", VENDOR + DEFAULT_GPIO_RESET ) + PEGASUS_DEV( "IO DATA USB ET/TX-S", VENDOR_IODATA, 0x0913, + DEFAULT_GPIO_RESET | PEGASUS_II ) +-PEGASUS_DEV( "IO DATA USB ETX-US2", VENDOR_IODATA, 0x092a, ++PEGASUS_DEV( "IO DATA USB ETX-US2", VENDOR_IODATA, 0x093a, + DEFAULT_GPIO_RESET | PEGASUS_II ) + PEGASUS_DEV( "Kingston KNU101TX Ethernet", VENDOR_KINGSTON, 0x000a, + DEFAULT_GPIO_RESET) diff --git a/queue-2.6.33/r8169-fix-mdio_read-and-update-mdio_write-according-to-hw-specs.patch b/queue-2.6.33/r8169-fix-mdio_read-and-update-mdio_write-according-to-hw-specs.patch new file mode 100644 index 00000000000..75221c9f693 --- /dev/null +++ b/queue-2.6.33/r8169-fix-mdio_read-and-update-mdio_write-according-to-hw-specs.patch @@ -0,0 +1,51 @@ +From 58d08fe5684a974d705142e555a1f433bf0a9d63 Mon Sep 17 00:00:00 2001 +From: Timo Teräs +Date: Mon, 5 Jul 2010 22:05:02 -0700 +Subject: r8169: fix mdio_read and update mdio_write according to hw specs + + +From: Timo Teräs + +[ Upstream commit 81a95f049962ec20a9aed888e676208b206f0f2e ] + +Realtek confirmed that a 20us delay is needed after mdio_read and +mdio_write operations. Reduce the delay in mdio_write, and add it +to mdio_read too. Also add a comment that the 20us is from hw specs. + +Signed-off-by: Timo Teräs +Acked-by: Francois Romieu +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/r8169.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +--- a/drivers/net/r8169.c ++++ b/drivers/net/r8169.c +@@ -558,10 +558,10 @@ static void mdio_write(void __iomem *ioa + udelay(25); + } + /* +- * Some configurations require a small delay even after the write +- * completed indication or the next write might fail. ++ * According to hardware specs a 20us delay is required after write ++ * complete indication, but before sending next command. + */ +- udelay(25); ++ udelay(20); + } + + static int mdio_read(void __iomem *ioaddr, int reg_addr) +@@ -581,6 +581,12 @@ static int mdio_read(void __iomem *ioadd + } + udelay(25); + } ++ /* ++ * According to hardware specs a 20us delay is required after read ++ * complete indication, but before sending next command. ++ */ ++ udelay(20); ++ + return value; + } + diff --git a/queue-2.6.33/r8169-fix-random-mdio_write-failures.patch b/queue-2.6.33/r8169-fix-random-mdio_write-failures.patch new file mode 100644 index 00000000000..c65e340f385 --- /dev/null +++ b/queue-2.6.33/r8169-fix-random-mdio_write-failures.patch @@ -0,0 +1,46 @@ +From 54d56dfeacb35afdffb54724ef39bef28a689b5e Mon Sep 17 00:00:00 2001 +From: Timo Teräs +Date: Mon, 5 Jul 2010 22:04:45 -0700 +Subject: r8169: fix random mdio_write failures + + +From: Timo Teräs + +[ Upstream commit 024a07bacf8287a6ddfa83e9d5b951c5e8b4070e ] + +Some configurations need delay between the "write completed" indication +and new write to work reliably. + +Realtek driver seems to use longer delay when polling the "write complete" +bit, so it waits long enough between writes with high probability (but +could probably break too). This patch adds a new udelay to make sure we +wait unconditionally some time after the write complete indication. + +This caused a regression with XID 18000000 boards when the board specific +phy configuration writing many mdio registers was added in commit +2e955856ff (r8169: phy init for the 8169scd). Some of the configration +mdio writes would almost always fail, and depending on failure might leave +the PHY in non-working state. + +Signed-off-by: Timo Teräs +Acked-off-by: Francois Romieu +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/r8169.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/net/r8169.c ++++ b/drivers/net/r8169.c +@@ -557,6 +557,11 @@ static void mdio_write(void __iomem *ioa + break; + udelay(25); + } ++ /* ++ * Some configurations require a small delay even after the write ++ * completed indication or the next write might fail. ++ */ ++ udelay(25); + } + + static int mdio_read(void __iomem *ioaddr, int reg_addr) diff --git a/queue-2.6.33/series b/queue-2.6.33/series new file mode 100644 index 00000000000..33b187f9de2 --- /dev/null +++ b/queue-2.6.33/series @@ -0,0 +1,11 @@ +bridge-fdb-cleanup-runs-too-often.patch +net-dccp-expansion-of-error-code-size.patch +gro-fix-bogus-gso_size-on-the-first-fraglist-entry.patch +ipv6-fix-default-multicast-hops-setting.patch +net-fix-fddi-and-tr-config-checks-in-ipv4-arp-and-llc.patch +pegasus-fix-usb-device-id-for-etx-us2.patch +r8169-fix-random-mdio_write-failures.patch +r8169-fix-mdio_read-and-update-mdio_write-according-to-hw-specs.patch +tcp-tcp_synack_options-fix.patch +tcp-use-correct-net-ns-in-cookie_v4_check.patch +veth-dont-kfree_skb-after-dev_forward_skb.patch diff --git a/queue-2.6.33/tcp-tcp_synack_options-fix.patch b/queue-2.6.33/tcp-tcp_synack_options-fix.patch new file mode 100644 index 00000000000..7bfe29698d9 --- /dev/null +++ b/queue-2.6.33/tcp-tcp_synack_options-fix.patch @@ -0,0 +1,77 @@ +From aad91c50da64ccc3663aa5a729add5850f6331a4 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Mon, 17 May 2010 22:35:36 -0700 +Subject: tcp: tcp_synack_options() fix + + +From: Eric Dumazet + +[ Upstream commit de213e5eedecdfb1b1eea7e6be28bc64cac5c078 ] + +Commit 33ad798c924b4a (tcp: options clean up) introduced a problem +if MD5+SACK+timestamps were used in initial SYN message. + +Some stacks (old linux for example) try to negotiate MD5+SACK+TSTAMP +sessions, but since 40 bytes of tcp options space are not enough to +store all the bits needed, we chose to disable timestamps in this case. + +We send a SYN-ACK _without_ timestamp option, but socket has timestamps +enabled and all further outgoing messages contain a TS block, all with +the initial timestamp of the remote peer. + +Fix is to really disable timestamps option for the whole session. + +Reported-by: Bijay Singh +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/tcp_output.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -659,7 +659,6 @@ static unsigned tcp_synack_options(struc + u8 cookie_plus = (xvp != NULL && !xvp->cookie_out_never) ? + xvp->cookie_plus : + 0; +- bool doing_ts = ireq->tstamp_ok; + + #ifdef CONFIG_TCP_MD5SIG + *md5 = tcp_rsk(req)->af_specific->md5_lookup(sk, req); +@@ -672,7 +671,7 @@ static unsigned tcp_synack_options(struc + * rather than TS in order to fit in better with old, + * buggy kernels, but that was deemed to be unnecessary. + */ +- doing_ts &= !ireq->sack_ok; ++ ireq->tstamp_ok &= !ireq->sack_ok; + } + #else + *md5 = NULL; +@@ -687,7 +686,7 @@ static unsigned tcp_synack_options(struc + opts->options |= OPTION_WSCALE; + remaining -= TCPOLEN_WSCALE_ALIGNED; + } +- if (likely(doing_ts)) { ++ if (likely(ireq->tstamp_ok)) { + opts->options |= OPTION_TS; + opts->tsval = TCP_SKB_CB(skb)->when; + opts->tsecr = req->ts_recent; +@@ -695,7 +694,7 @@ static unsigned tcp_synack_options(struc + } + if (likely(ireq->sack_ok)) { + opts->options |= OPTION_SACK_ADVERTISE; +- if (unlikely(!doing_ts)) ++ if (unlikely(!ireq->tstamp_ok)) + remaining -= TCPOLEN_SACKPERM_ALIGNED; + } + +@@ -703,7 +702,7 @@ static unsigned tcp_synack_options(struc + * If the options fit, the same options should fit now! + */ + if (*md5 == NULL && +- doing_ts && ++ ireq->tstamp_ok && + cookie_plus > TCPOLEN_COOKIE_BASE) { + int need = cookie_plus; /* has TCPOLEN_COOKIE_BASE */ + diff --git a/queue-2.6.33/tcp-use-correct-net-ns-in-cookie_v4_check.patch b/queue-2.6.33/tcp-use-correct-net-ns-in-cookie_v4_check.patch new file mode 100644 index 00000000000..225bed51910 --- /dev/null +++ b/queue-2.6.33/tcp-use-correct-net-ns-in-cookie_v4_check.patch @@ -0,0 +1,30 @@ +From c0d10c8e809ba320da97f8767b0c59430307fbf9 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Thu, 3 Jun 2010 05:45:47 +0000 +Subject: tcp: use correct net ns in cookie_v4_check() + + +From: Eric Dumazet + +[ Upstream commit c44649216522cd607a4027d2ebf4a8147d3fa94c ] + +Its better to make a route lookup in appropriate namespace. + +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/syncookies.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/ipv4/syncookies.c ++++ b/net/ipv4/syncookies.c +@@ -347,7 +347,7 @@ struct sock *cookie_v4_check(struct sock + { .sport = th->dest, + .dport = th->source } } }; + security_req_classify_flow(req, &fl); +- if (ip_route_output_key(&init_net, &rt, &fl)) { ++ if (ip_route_output_key(sock_net(sk), &rt, &fl)) { + reqsk_free(req); + goto out; + } diff --git a/queue-2.6.33/veth-dont-kfree_skb-after-dev_forward_skb.patch b/queue-2.6.33/veth-dont-kfree_skb-after-dev_forward_skb.patch new file mode 100644 index 00000000000..43c6b8f59c7 --- /dev/null +++ b/queue-2.6.33/veth-dont-kfree_skb-after-dev_forward_skb.patch @@ -0,0 +1,67 @@ +From ffc6c72d51b934da6bae5a226aebc0b50d57fac0 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Mon, 5 Jul 2010 22:12:53 -0700 +Subject: veth: Dont kfree_skb() after dev_forward_skb() + + +From: Eric Dumazet + +[ Upstream commit 6ec82562ffc6f297d0de36d65776cff8e5704867 ] + +In case of congestion, netif_rx() frees the skb, so we must assume +dev_forward_skb() also consume skb. + +Bug introduced by commit 445409602c092 +(veth: move loopback logic to common location) + +We must change dev_forward_skb() to always consume skb, and veth to not +double free it. + +Bug report : http://marc.info/?l=linux-netdev&m=127310770900442&w=3 + +Reported-by: Martín Ferrari +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/veth.c | 1 - + net/core/dev.c | 10 +++++----- + 2 files changed, 5 insertions(+), 6 deletions(-) + +--- a/drivers/net/veth.c ++++ b/drivers/net/veth.c +@@ -186,7 +186,6 @@ tx_drop: + return NETDEV_TX_OK; + + rx_drop: +- kfree_skb(skb); + rcv_stats->rx_dropped++; + return NETDEV_TX_OK; + } +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -1428,7 +1428,7 @@ static inline void net_timestamp(struct + * + * return values: + * NET_RX_SUCCESS (no congestion) +- * NET_RX_DROP (packet was dropped) ++ * NET_RX_DROP (packet was dropped, but freed) + * + * dev_forward_skb can be used for injecting an skb from the + * start_xmit function of one device into the receive queue +@@ -1442,11 +1442,11 @@ int dev_forward_skb(struct net_device *d + { + skb_orphan(skb); + +- if (!(dev->flags & IFF_UP)) +- return NET_RX_DROP; +- +- if (skb->len > (dev->mtu + dev->hard_header_len)) ++ if (!(dev->flags & IFF_UP) || ++ (skb->len > (dev->mtu + dev->hard_header_len))) { ++ kfree_skb(skb); + return NET_RX_DROP; ++ } + + skb_dst_drop(skb); + skb->tstamp.tv64 = 0;