From 8c518c37a555b02fe95e119999ed7a664c67412e Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Thu, 27 Feb 2014 20:08:49 -0800 Subject: [PATCH] 3.10-stable patches added patches: 6lowpan-fix-lockdep-splats.patch 9p-trans_virtio.c-fix-broken-zero-copy-on-vmalloc-buffers.patch bonding-802.3ad-make-aggregator_identifier-bond-private.patch can-add-destructor-for-self-generated-skbs.patch ipv4-fix-counter-in_slow_tot.patch ipv4-fix-runtime-warning-in-rtmsg_ifa.patch net-add-and-use-skb_gso_transport_seglen.patch net-asix-add-missing-flag-to-struct-driver_info.patch net-core-introduce-netif_skb_dev_features.patch net-fix-ip-rule-iif-oif-device-rename.patch net-ip-ipv6-handle-gso-skbs-in-forwarding-path.patch netpoll-fix-netconsole-ipv6-setup.patch net-qmi_wwan-add-netgear-aircard-340u.patch net-sctp-fix-sctp_connectx-abi-for-ia32-emulation-compat-mode.patch net-use-__gfp_noretry-for-high-order-allocations.patch tcp-tsq-fix-nonagle-handling.patch tg3-fix-deadlock-in-tg3_change_mtu.patch usbnet-remove-generic-hard_header_len-check.patch --- queue-3.10/6lowpan-fix-lockdep-splats.patch | 59 +++++ ...-broken-zero-copy-on-vmalloc-buffers.patch | 66 ++++++ ...e-aggregator_identifier-bond-private.patch | 77 ++++++ ...d-destructor-for-self-generated-skbs.patch | 222 ++++++++++++++++++ queue-3.10/ipv4-fix-counter-in_slow_tot.patch | 50 ++++ ...pv4-fix-runtime-warning-in-rtmsg_ifa.patch | 65 +++++ ...add-and-use-skb_gso_transport_seglen.patch | 72 ++++++ ...d-missing-flag-to-struct-driver_info.patch | 39 +++ ...ore-introduce-netif_skb_dev_features.patch | 109 +++++++++ ...et-fix-ip-rule-iif-oif-device-rename.patch | 45 ++++ ...6-handle-gso-skbs-in-forwarding-path.patch | 219 +++++++++++++++++ ...et-qmi_wwan-add-netgear-aircard-340u.patch | 37 +++ ...x-abi-for-ia32-emulation-compat-mode.patch | 105 +++++++++ ...p_noretry-for-high-order-allocations.patch | 64 +++++ .../netpoll-fix-netconsole-ipv6-setup.patch | 52 ++++ queue-3.10/series | 18 ++ queue-3.10/tcp-tsq-fix-nonagle-handling.patch | 68 ++++++ .../tg3-fix-deadlock-in-tg3_change_mtu.patch | 49 ++++ ...remove-generic-hard_header_len-check.patch | 211 +++++++++++++++++ 19 files changed, 1627 insertions(+) create mode 100644 queue-3.10/6lowpan-fix-lockdep-splats.patch create mode 100644 queue-3.10/9p-trans_virtio.c-fix-broken-zero-copy-on-vmalloc-buffers.patch create mode 100644 queue-3.10/bonding-802.3ad-make-aggregator_identifier-bond-private.patch create mode 100644 queue-3.10/can-add-destructor-for-self-generated-skbs.patch create mode 100644 queue-3.10/ipv4-fix-counter-in_slow_tot.patch create mode 100644 queue-3.10/ipv4-fix-runtime-warning-in-rtmsg_ifa.patch create mode 100644 queue-3.10/net-add-and-use-skb_gso_transport_seglen.patch create mode 100644 queue-3.10/net-asix-add-missing-flag-to-struct-driver_info.patch create mode 100644 queue-3.10/net-core-introduce-netif_skb_dev_features.patch create mode 100644 queue-3.10/net-fix-ip-rule-iif-oif-device-rename.patch create mode 100644 queue-3.10/net-ip-ipv6-handle-gso-skbs-in-forwarding-path.patch create mode 100644 queue-3.10/net-qmi_wwan-add-netgear-aircard-340u.patch create mode 100644 queue-3.10/net-sctp-fix-sctp_connectx-abi-for-ia32-emulation-compat-mode.patch create mode 100644 queue-3.10/net-use-__gfp_noretry-for-high-order-allocations.patch create mode 100644 queue-3.10/netpoll-fix-netconsole-ipv6-setup.patch create mode 100644 queue-3.10/tcp-tsq-fix-nonagle-handling.patch create mode 100644 queue-3.10/tg3-fix-deadlock-in-tg3_change_mtu.patch create mode 100644 queue-3.10/usbnet-remove-generic-hard_header_len-check.patch diff --git a/queue-3.10/6lowpan-fix-lockdep-splats.patch b/queue-3.10/6lowpan-fix-lockdep-splats.patch new file mode 100644 index 00000000000..635dc45069d --- /dev/null +++ b/queue-3.10/6lowpan-fix-lockdep-splats.patch @@ -0,0 +1,59 @@ +From foo@baz Thu Feb 27 19:58:01 PST 2014 +From: Eric Dumazet +Date: Mon, 10 Feb 2014 11:42:35 -0800 +Subject: 6lowpan: fix lockdep splats + +From: Eric Dumazet + +[ Upstream commit 20e7c4e80dcd01dad5e6c8b32455228b8fe9c619 ] + +When a device ndo_start_xmit() calls again dev_queue_xmit(), +lockdep can complain because dev_queue_xmit() is re-entered and the +spinlocks protecting tx queues share a common lockdep class. + +Same issue was fixed for bonding/l2tp/ppp in commits + +0daa2303028a6 ("[PATCH] bonding: lockdep annotation") +49ee49202b4ac ("bonding: set qdisc_tx_busylock to avoid LOCKDEP splat") +23d3b8bfb8eb2 ("net: qdisc busylock needs lockdep annotations ") +303c07db487be ("ppp: set qdisc_tx_busylock to avoid LOCKDEP splat ") + +Reported-by: Alexander Aring +Signed-off-by: Eric Dumazet +Tested-by: Alexander Aring +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ieee802154/6lowpan.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +--- a/net/ieee802154/6lowpan.c ++++ b/net/ieee802154/6lowpan.c +@@ -1173,7 +1173,27 @@ static struct header_ops lowpan_header_o + .create = lowpan_header_create, + }; + ++static struct lock_class_key lowpan_tx_busylock; ++static struct lock_class_key lowpan_netdev_xmit_lock_key; ++ ++static void lowpan_set_lockdep_class_one(struct net_device *dev, ++ struct netdev_queue *txq, ++ void *_unused) ++{ ++ lockdep_set_class(&txq->_xmit_lock, ++ &lowpan_netdev_xmit_lock_key); ++} ++ ++ ++static int lowpan_dev_init(struct net_device *dev) ++{ ++ netdev_for_each_tx_queue(dev, lowpan_set_lockdep_class_one, NULL); ++ dev->qdisc_tx_busylock = &lowpan_tx_busylock; ++ return 0; ++} ++ + static const struct net_device_ops lowpan_netdev_ops = { ++ .ndo_init = lowpan_dev_init, + .ndo_start_xmit = lowpan_xmit, + .ndo_set_mac_address = lowpan_set_address, + }; diff --git a/queue-3.10/9p-trans_virtio.c-fix-broken-zero-copy-on-vmalloc-buffers.patch b/queue-3.10/9p-trans_virtio.c-fix-broken-zero-copy-on-vmalloc-buffers.patch new file mode 100644 index 00000000000..7ceaa7e1f11 --- /dev/null +++ b/queue-3.10/9p-trans_virtio.c-fix-broken-zero-copy-on-vmalloc-buffers.patch @@ -0,0 +1,66 @@ +From foo@baz Thu Feb 27 19:58:01 PST 2014 +From: Richard Yao +Date: Sat, 8 Feb 2014 19:32:01 -0500 +Subject: 9p/trans_virtio.c: Fix broken zero-copy on vmalloc() buffers + +From: Richard Yao + +[ Upstream commit b6f52ae2f0d32387bde2b89883e3b64d88b9bfe8 ] + +The 9p-virtio transport does zero copy on things larger than 1024 bytes +in size. It accomplishes this by returning the physical addresses of +pages to the virtio-pci device. At present, the translation is usually a +bit shift. + +That approach produces an invalid page address when we read/write to +vmalloc buffers, such as those used for Linux kernel modules. Any +attempt to load a Linux kernel module from 9p-virtio produces the +following stack. + +[] p9_virtio_zc_request+0x45e/0x510 +[] p9_client_zc_rpc.constprop.16+0xfd/0x4f0 +[] p9_client_read+0x15d/0x240 +[] v9fs_fid_readn+0x50/0xa0 +[] v9fs_file_readn+0x10/0x20 +[] v9fs_file_read+0x37/0x70 +[] vfs_read+0x9b/0x160 +[] kernel_read+0x41/0x60 +[] copy_module_from_fd.isra.34+0xfb/0x180 + +Subsequently, QEMU will die printing: + +qemu-system-x86_64: virtio: trying to map MMIO memory + +This patch enables 9p-virtio to correctly handle this case. This not +only enables us to load Linux kernel modules off virtfs, but also +enables ZFS file-based vdevs on virtfs to be used without killing QEMU. + +Special thanks to both Avi Kivity and Alexander Graf for their +interpretation of QEMU backtraces. Without their guidence, tracking down +this bug would have taken much longer. Also, special thanks to Linus +Torvalds for his insightful explanation of why this should use +is_vmalloc_addr() instead of is_vmalloc_or_module_addr(): + +https://lkml.org/lkml/2014/2/8/272 + +Signed-off-by: Richard Yao +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/9p/trans_virtio.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/net/9p/trans_virtio.c ++++ b/net/9p/trans_virtio.c +@@ -340,7 +340,10 @@ static int p9_get_mapped_pages(struct vi + int count = nr_pages; + while (nr_pages) { + s = rest_of_page(data); +- pages[index++] = kmap_to_page(data); ++ if (is_vmalloc_addr(data)) ++ pages[index++] = vmalloc_to_page(data); ++ else ++ pages[index++] = kmap_to_page(data); + data += s; + nr_pages--; + } diff --git a/queue-3.10/bonding-802.3ad-make-aggregator_identifier-bond-private.patch b/queue-3.10/bonding-802.3ad-make-aggregator_identifier-bond-private.patch new file mode 100644 index 00000000000..84c6183fdfb --- /dev/null +++ b/queue-3.10/bonding-802.3ad-make-aggregator_identifier-bond-private.patch @@ -0,0 +1,77 @@ +From foo@baz Thu Feb 27 19:58:01 PST 2014 +From: Jiri Bohac +Date: Fri, 14 Feb 2014 18:13:50 +0100 +Subject: bonding: 802.3ad: make aggregator_identifier bond-private + +From: Jiri Bohac + +[ Upstream commit 163c8ff30dbe473abfbb24a7eac5536c87f3baa9 ] + +aggregator_identifier is used to assign unique aggregator identifiers +to aggregators of a bond during device enslaving. + +aggregator_identifier is currently a global variable that is zeroed in +bond_3ad_initialize(). + +This sequence will lead to duplicate aggregator identifiers for eth1 and eth3: + +create bond0 +change bond0 mode to 802.3ad +enslave eth0 to bond0 //eth0 gets agg id 1 +enslave eth1 to bond0 //eth1 gets agg id 2 +create bond1 +change bond1 mode to 802.3ad +enslave eth2 to bond1 //aggregator_identifier is reset to 0 + //eth2 gets agg id 1 +enslave eth3 to bond0 //eth3 gets agg id 2 + +Fix this by making aggregator_identifier private to the bond. + +Signed-off-by: Jiri Bohac +Acked-by: Veaceslav Falico +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/bonding/bond_3ad.c | 6 ++---- + drivers/net/bonding/bond_3ad.h | 1 + + 2 files changed, 3 insertions(+), 4 deletions(-) + +--- a/drivers/net/bonding/bond_3ad.c ++++ b/drivers/net/bonding/bond_3ad.c +@@ -1854,8 +1854,6 @@ void bond_3ad_initiate_agg_selection(str + BOND_AD_INFO(bond).agg_select_timer = timeout; + } + +-static u16 aggregator_identifier; +- + /** + * bond_3ad_initialize - initialize a bond's 802.3ad parameters and structures + * @bond: bonding struct to work on +@@ -1869,7 +1867,7 @@ void bond_3ad_initialize(struct bonding + if (MAC_ADDRESS_COMPARE(&(BOND_AD_INFO(bond).system.sys_mac_addr), + bond->dev->dev_addr)) { + +- aggregator_identifier = 0; ++ BOND_AD_INFO(bond).aggregator_identifier = 0; + + BOND_AD_INFO(bond).system.sys_priority = 0xFFFF; + BOND_AD_INFO(bond).system.sys_mac_addr = *((struct mac_addr *)bond->dev->dev_addr); +@@ -1940,7 +1938,7 @@ int bond_3ad_bind_slave(struct slave *sl + ad_initialize_agg(aggregator); + + aggregator->aggregator_mac_address = *((struct mac_addr *)bond->dev->dev_addr); +- aggregator->aggregator_identifier = (++aggregator_identifier); ++ aggregator->aggregator_identifier = ++BOND_AD_INFO(bond).aggregator_identifier; + aggregator->slave = slave; + aggregator->is_active = 0; + aggregator->num_of_ports = 0; +--- a/drivers/net/bonding/bond_3ad.h ++++ b/drivers/net/bonding/bond_3ad.h +@@ -253,6 +253,7 @@ struct ad_system { + struct ad_bond_info { + struct ad_system system; /* 802.3ad system structure */ + u32 agg_select_timer; // Timer to select aggregator after all adapter's hand shakes ++ u16 aggregator_identifier; + }; + + struct ad_slave_info { diff --git a/queue-3.10/can-add-destructor-for-self-generated-skbs.patch b/queue-3.10/can-add-destructor-for-self-generated-skbs.patch new file mode 100644 index 00000000000..53d83a79a85 --- /dev/null +++ b/queue-3.10/can-add-destructor-for-self-generated-skbs.patch @@ -0,0 +1,222 @@ +From foo@baz Thu Feb 27 19:58:01 PST 2014 +From: Oliver Hartkopp +Date: Thu, 30 Jan 2014 10:11:28 +0100 +Subject: can: add destructor for self generated skbs + +From: Oliver Hartkopp + +[ Upstream commit 0ae89beb283a0db5980d1d4781c7d7be2f2810d6 ] + +Self generated skbuffs in net/can/bcm.c are setting a skb->sk reference but +no explicit destructor which is enforced since Linux 3.11 with commit +376c7311bdb6 (net: add a temporary sanity check in skb_orphan()). + +This patch adds some helper functions to make sure that a destructor is +properly defined when a sock reference is assigned to a CAN related skb. +To create an unshared skb owned by the original sock a common helper function +has been introduced to replace open coded functions to create CAN echo skbs. + +Signed-off-by: Oliver Hartkopp +Tested-by: Andre Naujoks +Reviewed-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/can/dev.c | 15 +++------------ + drivers/net/can/janz-ican3.c | 18 ++++-------------- + drivers/net/can/vcan.c | 9 ++++----- + include/linux/can/skb.h | 38 ++++++++++++++++++++++++++++++++++++++ + net/can/af_can.c | 3 ++- + net/can/bcm.c | 4 ++-- + 6 files changed, 53 insertions(+), 34 deletions(-) + +--- a/drivers/net/can/dev.c ++++ b/drivers/net/can/dev.c +@@ -324,19 +324,10 @@ void can_put_echo_skb(struct sk_buff *sk + } + + if (!priv->echo_skb[idx]) { +- struct sock *srcsk = skb->sk; + +- if (atomic_read(&skb->users) != 1) { +- struct sk_buff *old_skb = skb; +- +- skb = skb_clone(old_skb, GFP_ATOMIC); +- kfree_skb(old_skb); +- if (!skb) +- return; +- } else +- skb_orphan(skb); +- +- skb->sk = srcsk; ++ skb = can_create_echo_skb(skb); ++ if (!skb) ++ return; + + /* make settings for echo to reduce code in irq context */ + skb->protocol = htons(ETH_P_CAN); +--- a/drivers/net/can/janz-ican3.c ++++ b/drivers/net/can/janz-ican3.c +@@ -19,6 +19,7 @@ + #include + #include + #include ++#include + #include + + #include +@@ -1134,20 +1135,9 @@ static void ican3_handle_message(struct + */ + static void ican3_put_echo_skb(struct ican3_dev *mod, struct sk_buff *skb) + { +- struct sock *srcsk = skb->sk; +- +- if (atomic_read(&skb->users) != 1) { +- struct sk_buff *old_skb = skb; +- +- skb = skb_clone(old_skb, GFP_ATOMIC); +- kfree_skb(old_skb); +- if (!skb) +- return; +- } else { +- skb_orphan(skb); +- } +- +- skb->sk = srcsk; ++ skb = can_create_echo_skb(skb); ++ if (!skb) ++ return; + + /* save this skb for tx interrupt echo handling */ + skb_queue_tail(&mod->echoq, skb); +--- a/drivers/net/can/vcan.c ++++ b/drivers/net/can/vcan.c +@@ -46,6 +46,7 @@ + #include + #include + #include ++#include + #include + #include + +@@ -109,25 +110,23 @@ static netdev_tx_t vcan_tx(struct sk_buf + stats->rx_packets++; + stats->rx_bytes += cfd->len; + } +- kfree_skb(skb); ++ consume_skb(skb); + return NETDEV_TX_OK; + } + + /* perform standard echo handling for CAN network interfaces */ + + if (loop) { +- struct sock *srcsk = skb->sk; + +- skb = skb_share_check(skb, GFP_ATOMIC); ++ skb = can_create_echo_skb(skb); + if (!skb) + return NETDEV_TX_OK; + + /* receive with packet counting */ +- skb->sk = srcsk; + vcan_rx(skb, dev); + } else { + /* no looped packets => no counting */ +- kfree_skb(skb); ++ consume_skb(skb); + } + return NETDEV_TX_OK; + } +--- a/include/linux/can/skb.h ++++ b/include/linux/can/skb.h +@@ -11,7 +11,9 @@ + #define CAN_SKB_H + + #include ++#include + #include ++#include + + /* + * The struct can_skb_priv is used to transport additional information along +@@ -42,4 +44,40 @@ static inline void can_skb_reserve(struc + skb_reserve(skb, sizeof(struct can_skb_priv)); + } + ++static inline void can_skb_destructor(struct sk_buff *skb) ++{ ++ sock_put(skb->sk); ++} ++ ++static inline void can_skb_set_owner(struct sk_buff *skb, struct sock *sk) ++{ ++ if (sk) { ++ sock_hold(sk); ++ skb->destructor = can_skb_destructor; ++ skb->sk = sk; ++ } ++} ++ ++/* ++ * returns an unshared skb owned by the original sock to be echo'ed back ++ */ ++static inline struct sk_buff *can_create_echo_skb(struct sk_buff *skb) ++{ ++ if (skb_shared(skb)) { ++ struct sk_buff *nskb = skb_clone(skb, GFP_ATOMIC); ++ ++ if (likely(nskb)) { ++ can_skb_set_owner(nskb, skb->sk); ++ consume_skb(skb); ++ return nskb; ++ } else { ++ kfree_skb(skb); ++ return NULL; ++ } ++ } ++ ++ /* we can assume to have an unshared skb with proper owner */ ++ return skb; ++} ++ + #endif /* CAN_SKB_H */ +--- a/net/can/af_can.c ++++ b/net/can/af_can.c +@@ -57,6 +57,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -290,7 +291,7 @@ int can_send(struct sk_buff *skb, int lo + return -ENOMEM; + } + +- newskb->sk = skb->sk; ++ can_skb_set_owner(newskb, skb->sk); + newskb->ip_summed = CHECKSUM_UNNECESSARY; + newskb->pkt_type = PACKET_BROADCAST; + } +--- a/net/can/bcm.c ++++ b/net/can/bcm.c +@@ -268,7 +268,7 @@ static void bcm_can_tx(struct bcm_op *op + + /* send with loopback */ + skb->dev = dev; +- skb->sk = op->sk; ++ can_skb_set_owner(skb, op->sk); + can_send(skb, 1); + + /* update statistics */ +@@ -1223,7 +1223,7 @@ static int bcm_tx_send(struct msghdr *ms + + can_skb_prv(skb)->ifindex = dev->ifindex; + skb->dev = dev; +- skb->sk = sk; ++ can_skb_set_owner(skb, sk); + err = can_send(skb, 1); /* send with loopback */ + dev_put(dev); + diff --git a/queue-3.10/ipv4-fix-counter-in_slow_tot.patch b/queue-3.10/ipv4-fix-counter-in_slow_tot.patch new file mode 100644 index 00000000000..84cd7606716 --- /dev/null +++ b/queue-3.10/ipv4-fix-counter-in_slow_tot.patch @@ -0,0 +1,50 @@ +From foo@baz Thu Feb 27 19:58:01 PST 2014 +From: Duan Jiong +Date: Mon, 17 Feb 2014 15:23:43 +0800 +Subject: ipv4: fix counter in_slow_tot + +From: Duan Jiong + +[ Upstream commit a6254864c08109c66a194612585afc0439005286 ] + +since commit 89aef8921bf("ipv4: Delete routing cache."), the counter +in_slow_tot can't work correctly. + +The counter in_slow_tot increase by one when fib_lookup() return successfully +in ip_route_input_slow(), but actually the dst struct maybe not be created and +cached, so we can increase in_slow_tot after the dst struct is created. + +Signed-off-by: Duan Jiong +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/route.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/ipv4/route.c ++++ b/net/ipv4/route.c +@@ -1544,6 +1544,7 @@ static int __mkroute_input(struct sk_buf + rth->rt_gateway = 0; + rth->rt_uses_gateway = 0; + INIT_LIST_HEAD(&rth->rt_uncached); ++ RT_CACHE_STAT_INC(in_slow_tot); + + rth->dst.input = ip_forward; + rth->dst.output = ip_output; +@@ -1645,8 +1646,6 @@ static int ip_route_input_slow(struct sk + if (err != 0) + goto no_route; + +- RT_CACHE_STAT_INC(in_slow_tot); +- + if (res.type == RTN_BROADCAST) + goto brd_input; + +@@ -1715,6 +1714,7 @@ local_input: + rth->rt_gateway = 0; + rth->rt_uses_gateway = 0; + INIT_LIST_HEAD(&rth->rt_uncached); ++ RT_CACHE_STAT_INC(in_slow_tot); + if (res.type == RTN_UNREACHABLE) { + rth->dst.input= ip_error; + rth->dst.error= -err; diff --git a/queue-3.10/ipv4-fix-runtime-warning-in-rtmsg_ifa.patch b/queue-3.10/ipv4-fix-runtime-warning-in-rtmsg_ifa.patch new file mode 100644 index 00000000000..8e02fbb1b5e --- /dev/null +++ b/queue-3.10/ipv4-fix-runtime-warning-in-rtmsg_ifa.patch @@ -0,0 +1,65 @@ +From foo@baz Thu Feb 27 19:58:01 PST 2014 +From: Geert Uytterhoeven +Date: Wed, 5 Feb 2014 08:38:25 +0100 +Subject: ipv4: Fix runtime WARNING in rtmsg_ifa() + +From: Geert Uytterhoeven + +[ Upstream commit 63b5f152eb4a5bb79b9caf7ec37b4201d12f6e66 ] + +On m68k/ARAnyM: + +WARNING: CPU: 0 PID: 407 at net/ipv4/devinet.c:1599 0x316a99() +Modules linked in: +CPU: 0 PID: 407 Comm: ifconfig Not tainted +3.13.0-atari-09263-g0c71d68014d1 #1378 +Stack from 10c4fdf0: + 10c4fdf0 002ffabb 000243e8 00000000 008ced6c 00024416 00316a99 0000063f + 00316a99 00000009 00000000 002501b4 00316a99 0000063f c0a86117 00000080 + c0a86117 00ad0c90 00250a5a 00000014 00ad0c90 00000000 00000000 00000001 + 00b02dd0 00356594 00000000 00356594 c0a86117 eff6c9e4 008ced6c 00000002 + 008ced60 0024f9b4 00250b52 00ad0c90 00000000 00000000 00252390 00ad0c90 + eff6c9e4 0000004f 00000000 00000000 eff6c9e4 8000e25c eff6c9e4 80001020 +Call Trace: [<000243e8>] warn_slowpath_common+0x52/0x6c + [<00024416>] warn_slowpath_null+0x14/0x1a + [<002501b4>] rtmsg_ifa+0xdc/0xf0 + [<00250a5a>] __inet_insert_ifa+0xd6/0x1c2 + [<0024f9b4>] inet_abc_len+0x0/0x42 + [<00250b52>] inet_insert_ifa+0xc/0x12 + [<00252390>] devinet_ioctl+0x2ae/0x5d6 + +Adding some debugging code reveals that net_fill_ifaddr() fails in + + put_cacheinfo(skb, ifa->ifa_cstamp, ifa->ifa_tstamp, + preferred, valid)) + +nla_put complains: + + lib/nlattr.c:454: skb_tailroom(skb) = 12, nla_total_size(attrlen) = 20 + +Apparently commit 5c766d642bcaffd0c2a5b354db2068515b3846cf ("ipv4: +introduce address lifetime") forgot to take into account the addition of +struct ifa_cacheinfo in inet_nlmsg_size(). Hence add it, like is already +done for ipv6. + +Suggested-by: Cong Wang +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Cong Wang +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/devinet.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/net/ipv4/devinet.c ++++ b/net/ipv4/devinet.c +@@ -1433,7 +1433,8 @@ static size_t inet_nlmsg_size(void) + + nla_total_size(4) /* IFA_ADDRESS */ + + nla_total_size(4) /* IFA_LOCAL */ + + nla_total_size(4) /* IFA_BROADCAST */ +- + nla_total_size(IFNAMSIZ); /* IFA_LABEL */ ++ + nla_total_size(IFNAMSIZ) /* IFA_LABEL */ ++ + nla_total_size(sizeof(struct ifa_cacheinfo)); /* IFA_CACHEINFO */ + } + + static inline u32 cstamp_delta(unsigned long cstamp) diff --git a/queue-3.10/net-add-and-use-skb_gso_transport_seglen.patch b/queue-3.10/net-add-and-use-skb_gso_transport_seglen.patch new file mode 100644 index 00000000000..6bb5ff227b1 --- /dev/null +++ b/queue-3.10/net-add-and-use-skb_gso_transport_seglen.patch @@ -0,0 +1,72 @@ +From foo@baz Thu Feb 27 19:58:01 PST 2014 +From: Florian Westphal +Date: Sat, 22 Feb 2014 10:30:17 +0100 +Subject: net: add and use skb_gso_transport_seglen() + +From: Florian Westphal + +commit de960aa9ab4decc3304959f69533eef64d05d8e8 upstream. + +[ no skb_gso_seglen helper in 3.10, leave tbf alone ] + +This moves part of Eric Dumazets skb_gso_seglen helper from tbf sched to +skbuff core so it may be reused by upcoming ip forwarding path patch. + +Signed-off-by: Florian Westphal +Acked-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/skbuff.h | 2 ++ + net/core/skbuff.c | 25 +++++++++++++++++++++++++ + 2 files changed, 27 insertions(+) + +--- a/include/linux/skbuff.h ++++ b/include/linux/skbuff.h +@@ -2488,6 +2488,8 @@ extern int skb_shift(struct sk_bu + extern struct sk_buff *skb_segment(struct sk_buff *skb, + netdev_features_t features); + ++unsigned int skb_gso_transport_seglen(const struct sk_buff *skb); ++ + static inline void *skb_header_pointer(const struct sk_buff *skb, int offset, + int len, void *buffer) + { +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -47,6 +47,8 @@ + #include + #include + #include ++#include ++#include + #include + #ifdef CONFIG_NET_CLS_ACT + #include +@@ -3471,3 +3473,26 @@ bool skb_try_coalesce(struct sk_buff *to + return true; + } + EXPORT_SYMBOL(skb_try_coalesce); ++ ++/** ++ * skb_gso_transport_seglen - Return length of individual segments of a gso packet ++ * ++ * @skb: GSO skb ++ * ++ * skb_gso_transport_seglen is used to determine the real size of the ++ * individual segments, including Layer4 headers (TCP/UDP). ++ * ++ * The MAC/L2 or network (IP, IPv6) headers are not accounted for. ++ */ ++unsigned int skb_gso_transport_seglen(const struct sk_buff *skb) ++{ ++ const struct skb_shared_info *shinfo = skb_shinfo(skb); ++ unsigned int hdr_len; ++ ++ if (likely(shinfo->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6))) ++ hdr_len = tcp_hdrlen(skb); ++ else ++ hdr_len = sizeof(struct udphdr); ++ return hdr_len + shinfo->gso_size; ++} ++EXPORT_SYMBOL_GPL(skb_gso_transport_seglen); diff --git a/queue-3.10/net-asix-add-missing-flag-to-struct-driver_info.patch b/queue-3.10/net-asix-add-missing-flag-to-struct-driver_info.patch new file mode 100644 index 00000000000..65f8e511991 --- /dev/null +++ b/queue-3.10/net-asix-add-missing-flag-to-struct-driver_info.patch @@ -0,0 +1,39 @@ +From foo@baz Thu Feb 27 19:58:01 PST 2014 +From: Emil Goode +Date: Thu, 13 Feb 2014 19:30:39 +0100 +Subject: net: asix: add missing flag to struct driver_info +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Emil Goode + +[ Upstream commit d43ff4cd798911736fb39025ec8004284b1b0bc2 ] + +The struct driver_info ax88178_info is assigned the function +asix_rx_fixup_common as it's rx_fixup callback. This means that +FLAG_MULTI_PACKET must be set as this function is cloning the +data and calling usbnet_skb_return. Not setting this flag leads +to usbnet_skb_return beeing called a second time from within +the rx_process function in the usbnet module. + +Signed-off-by: Emil Goode +Reported-by: Bjørn Mork +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/asix_devices.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/usb/asix_devices.c ++++ b/drivers/net/usb/asix_devices.c +@@ -915,7 +915,8 @@ static const struct driver_info ax88178_ + .status = asix_status, + .link_reset = ax88178_link_reset, + .reset = ax88178_reset, +- .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_LINK_INTR, ++ .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_LINK_INTR | ++ FLAG_MULTI_PACKET, + .rx_fixup = asix_rx_fixup_common, + .tx_fixup = asix_tx_fixup, + }; diff --git a/queue-3.10/net-core-introduce-netif_skb_dev_features.patch b/queue-3.10/net-core-introduce-netif_skb_dev_features.patch new file mode 100644 index 00000000000..24f8316f7ef --- /dev/null +++ b/queue-3.10/net-core-introduce-netif_skb_dev_features.patch @@ -0,0 +1,109 @@ +From foo@baz Thu Feb 27 19:58:01 PST 2014 +From: Florian Westphal +Date: Sat, 22 Feb 2014 10:30:18 +0100 +Subject: net: core: introduce netif_skb_dev_features + +From: Florian Westphal + +commit d206940319c41df4299db75ed56142177bb2e5f6 upstream. + +Will be used by upcoming ipv4 forward path change that needs to +determine feature mask using skb->dst->dev instead of skb->dev. + +Signed-off-by: Florian Westphal +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/netdevice.h | 7 ++++++- + net/core/dev.c | 27 ++++++++++++++++----------- + 2 files changed, 22 insertions(+), 12 deletions(-) + +--- a/include/linux/netdevice.h ++++ b/include/linux/netdevice.h +@@ -2761,7 +2761,12 @@ void netdev_change_features(struct net_d + void netif_stacked_transfer_operstate(const struct net_device *rootdev, + struct net_device *dev); + +-netdev_features_t netif_skb_features(struct sk_buff *skb); ++netdev_features_t netif_skb_dev_features(struct sk_buff *skb, ++ const struct net_device *dev); ++static inline netdev_features_t netif_skb_features(struct sk_buff *skb) ++{ ++ return netif_skb_dev_features(skb, skb->dev); ++} + + static inline bool net_gso_ok(netdev_features_t features, int gso_type) + { +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -2374,7 +2374,7 @@ EXPORT_SYMBOL(netdev_rx_csum_fault); + * 2. No high memory really exists on this machine. + */ + +-static int illegal_highdma(struct net_device *dev, struct sk_buff *skb) ++static int illegal_highdma(const struct net_device *dev, struct sk_buff *skb) + { + #ifdef CONFIG_HIGHMEM + int i; +@@ -2454,46 +2454,51 @@ static int dev_gso_segment(struct sk_buf + } + + static netdev_features_t harmonize_features(struct sk_buff *skb, +- __be16 protocol, netdev_features_t features) ++ __be16 protocol, ++ const struct net_device *dev, ++ netdev_features_t features) + { + if (skb->ip_summed != CHECKSUM_NONE && + !can_checksum_protocol(features, protocol)) { + features &= ~NETIF_F_ALL_CSUM; +- } else if (illegal_highdma(skb->dev, skb)) { ++ } else if (illegal_highdma(dev, skb)) { + features &= ~NETIF_F_SG; + } + + return features; + } + +-netdev_features_t netif_skb_features(struct sk_buff *skb) ++netdev_features_t netif_skb_dev_features(struct sk_buff *skb, ++ const struct net_device *dev) + { + __be16 protocol = skb->protocol; +- netdev_features_t features = skb->dev->features; ++ netdev_features_t features = dev->features; + +- if (skb_shinfo(skb)->gso_segs > skb->dev->gso_max_segs) ++ if (skb_shinfo(skb)->gso_segs > dev->gso_max_segs) + features &= ~NETIF_F_GSO_MASK; + + if (protocol == htons(ETH_P_8021Q) || protocol == htons(ETH_P_8021AD)) { + struct vlan_ethhdr *veh = (struct vlan_ethhdr *)skb->data; + protocol = veh->h_vlan_encapsulated_proto; + } else if (!vlan_tx_tag_present(skb)) { +- return harmonize_features(skb, protocol, features); ++ return harmonize_features(skb, protocol, dev, features); + } + +- features &= (skb->dev->vlan_features | NETIF_F_HW_VLAN_CTAG_TX | ++ features &= (dev->vlan_features | NETIF_F_HW_VLAN_CTAG_TX | + NETIF_F_HW_VLAN_STAG_TX); + + if (protocol != htons(ETH_P_8021Q) && protocol != htons(ETH_P_8021AD)) { +- return harmonize_features(skb, protocol, features); ++ return harmonize_features(skb, protocol, dev, features); + } else { + features &= NETIF_F_SG | NETIF_F_HIGHDMA | NETIF_F_FRAGLIST | + NETIF_F_GEN_CSUM | NETIF_F_HW_VLAN_CTAG_TX | + NETIF_F_HW_VLAN_STAG_TX; +- return harmonize_features(skb, protocol, features); ++ return harmonize_features(skb, protocol, dev, features); + } ++ ++ return harmonize_features(skb, protocol, dev, features); + } +-EXPORT_SYMBOL(netif_skb_features); ++EXPORT_SYMBOL(netif_skb_dev_features); + + /* + * Returns true if either: diff --git a/queue-3.10/net-fix-ip-rule-iif-oif-device-rename.patch b/queue-3.10/net-fix-ip-rule-iif-oif-device-rename.patch new file mode 100644 index 00000000000..3fab8b5a832 --- /dev/null +++ b/queue-3.10/net-fix-ip-rule-iif-oif-device-rename.patch @@ -0,0 +1,45 @@ +From foo@baz Thu Feb 27 19:58:01 PST 2014 +From: Maciej Å»enczykowski +Date: Fri, 7 Feb 2014 16:23:48 -0800 +Subject: net: fix 'ip rule' iif/oif device rename +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Maciej Å»enczykowski + +[ Upstream commit 946c032e5a53992ea45e062ecb08670ba39b99e3 ] + +ip rules with iif/oif references do not update: +(detach/attach) across interface renames. + +Signed-off-by: Maciej Å»enczykowski +CC: Willem de Bruijn +CC: Eric Dumazet +CC: Chris Davis +CC: Carlo Contavalli + +Google-Bug-Id: 12936021 +Acked-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/core/fib_rules.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/net/core/fib_rules.c ++++ b/net/core/fib_rules.c +@@ -720,6 +720,13 @@ static int fib_rules_event(struct notifi + attach_rules(&ops->rules_list, dev); + break; + ++ case NETDEV_CHANGENAME: ++ list_for_each_entry(ops, &net->rules_ops, list) { ++ detach_rules(&ops->rules_list, dev); ++ attach_rules(&ops->rules_list, dev); ++ } ++ break; ++ + case NETDEV_UNREGISTER: + list_for_each_entry(ops, &net->rules_ops, list) + detach_rules(&ops->rules_list, dev); diff --git a/queue-3.10/net-ip-ipv6-handle-gso-skbs-in-forwarding-path.patch b/queue-3.10/net-ip-ipv6-handle-gso-skbs-in-forwarding-path.patch new file mode 100644 index 00000000000..5c7bf01b4cf --- /dev/null +++ b/queue-3.10/net-ip-ipv6-handle-gso-skbs-in-forwarding-path.patch @@ -0,0 +1,219 @@ +From foo@baz Thu Feb 27 19:58:01 PST 2014 +From: Florian Westphal +Date: Sat, 22 Feb 2014 10:30:19 +0100 +Subject: net: ip, ipv6: handle gso skbs in forwarding path + +From: Florian Westphal + +commit fe6cc55f3a9a053482a76f5a6b2257cee51b4663 upstream. + +Marcelo Ricardo Leitner reported problems when the forwarding link path +has a lower mtu than the incoming one if the inbound interface supports GRO. + +Given: +Host R1 R2 + +Host sends tcp stream which is routed via R1 and R2. R1 performs GRO. + +In this case, the kernel will fail to send ICMP fragmentation needed +messages (or pkt too big for ipv6), as GSO packets currently bypass dstmtu +checks in forward path. Instead, Linux tries to send out packets exceeding +the mtu. + +When locking route MTU on Host (i.e., no ipv4 DF bit set), R1 does +not fragment the packets when forwarding, and again tries to send out +packets exceeding R1-R2 link mtu. + +This alters the forwarding dstmtu checks to take the individual gso +segment lengths into account. + +For ipv6, we send out pkt too big error for gso if the individual +segments are too big. + +For ipv4, we either send icmp fragmentation needed, or, if the DF bit +is not set, perform software segmentation and let the output path +create fragments when the packet is leaving the machine. +It is not 100% correct as the error message will contain the headers of +the GRO skb instead of the original/segmented one, but it seems to +work fine in my (limited) tests. + +Eric Dumazet suggested to simply shrink mss via ->gso_size to avoid +sofware segmentation. + +However it turns out that skb_segment() assumes skb nr_frags is related +to mss size so we would BUG there. I don't want to mess with it considering +Herbert and Eric disagree on what the correct behavior should be. + +Hannes Frederic Sowa notes that when we would shrink gso_size +skb_segment would then also need to deal with the case where +SKB_MAX_FRAGS would be exceeded. + +This uses sofware segmentation in the forward path when we hit ipv4 +non-DF packets and the outgoing link mtu is too small. Its not perfect, +but given the lack of bug reports wrt. GRO fwd being broken this is a +rare case anyway. Also its not like this could not be improved later +once the dust settles. + +Acked-by: Herbert Xu +Reported-by: Marcelo Ricardo Leitner +Signed-off-by: Florian Westphal +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/skbuff.h | 17 +++++++++++ + net/ipv4/ip_forward.c | 71 +++++++++++++++++++++++++++++++++++++++++++++++-- + net/ipv6/ip6_output.c | 17 ++++++++++- + 3 files changed, 101 insertions(+), 4 deletions(-) + +--- a/include/linux/skbuff.h ++++ b/include/linux/skbuff.h +@@ -2913,5 +2913,22 @@ static inline bool skb_head_is_locked(co + { + return !skb->head_frag || skb_cloned(skb); + } ++ ++/** ++ * skb_gso_network_seglen - Return length of individual segments of a gso packet ++ * ++ * @skb: GSO skb ++ * ++ * skb_gso_network_seglen is used to determine the real size of the ++ * individual segments, including Layer3 (IP, IPv6) and L4 headers (TCP/UDP). ++ * ++ * The MAC/L2 header is not accounted for. ++ */ ++static inline unsigned int skb_gso_network_seglen(const struct sk_buff *skb) ++{ ++ unsigned int hdr_len = skb_transport_header(skb) - ++ skb_network_header(skb); ++ return hdr_len + skb_gso_transport_seglen(skb); ++} + #endif /* __KERNEL__ */ + #endif /* _LINUX_SKBUFF_H */ +--- a/net/ipv4/ip_forward.c ++++ b/net/ipv4/ip_forward.c +@@ -39,6 +39,71 @@ + #include + #include + ++static bool ip_may_fragment(const struct sk_buff *skb) ++{ ++ return unlikely((ip_hdr(skb)->frag_off & htons(IP_DF)) == 0) || ++ !skb->local_df; ++} ++ ++static bool ip_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu) ++{ ++ if (skb->len <= mtu || skb->local_df) ++ return false; ++ ++ if (skb_is_gso(skb) && skb_gso_network_seglen(skb) <= mtu) ++ return false; ++ ++ return true; ++} ++ ++static bool ip_gso_exceeds_dst_mtu(const struct sk_buff *skb) ++{ ++ unsigned int mtu; ++ ++ if (skb->local_df || !skb_is_gso(skb)) ++ return false; ++ ++ mtu = dst_mtu(skb_dst(skb)); ++ ++ /* if seglen > mtu, do software segmentation for IP fragmentation on ++ * output. DF bit cannot be set since ip_forward would have sent ++ * icmp error. ++ */ ++ return skb_gso_network_seglen(skb) > mtu; ++} ++ ++/* called if GSO skb needs to be fragmented on forward */ ++static int ip_forward_finish_gso(struct sk_buff *skb) ++{ ++ struct dst_entry *dst = skb_dst(skb); ++ netdev_features_t features; ++ struct sk_buff *segs; ++ int ret = 0; ++ ++ features = netif_skb_dev_features(skb, dst->dev); ++ segs = skb_gso_segment(skb, features & ~NETIF_F_GSO_MASK); ++ if (IS_ERR(segs)) { ++ kfree_skb(skb); ++ return -ENOMEM; ++ } ++ ++ consume_skb(skb); ++ ++ do { ++ struct sk_buff *nskb = segs->next; ++ int err; ++ ++ segs->next = NULL; ++ err = dst_output(segs); ++ ++ if (err && ret == 0) ++ ret = err; ++ segs = nskb; ++ } while (segs); ++ ++ return ret; ++} ++ + static int ip_forward_finish(struct sk_buff *skb) + { + struct ip_options *opt = &(IPCB(skb)->opt); +@@ -49,6 +114,9 @@ static int ip_forward_finish(struct sk_b + if (unlikely(opt->optlen)) + ip_forward_options(skb); + ++ if (ip_gso_exceeds_dst_mtu(skb)) ++ return ip_forward_finish_gso(skb); ++ + return dst_output(skb); + } + +@@ -88,8 +156,7 @@ int ip_forward(struct sk_buff *skb) + if (opt->is_strictroute && rt->rt_uses_gateway) + goto sr_failed; + +- if (unlikely(skb->len > dst_mtu(&rt->dst) && !skb_is_gso(skb) && +- (ip_hdr(skb)->frag_off & htons(IP_DF))) && !skb->local_df) { ++ if (!ip_may_fragment(skb) && ip_exceeds_mtu(skb, dst_mtu(&rt->dst))) { + IP_INC_STATS(dev_net(rt->dst.dev), IPSTATS_MIB_FRAGFAILS); + icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, + htonl(dst_mtu(&rt->dst))); +--- a/net/ipv6/ip6_output.c ++++ b/net/ipv6/ip6_output.c +@@ -345,6 +345,20 @@ static inline int ip6_forward_finish(str + return dst_output(skb); + } + ++static bool ip6_pkt_too_big(const struct sk_buff *skb, unsigned int mtu) ++{ ++ if (skb->len <= mtu || skb->local_df) ++ return false; ++ ++ if (IP6CB(skb)->frag_max_size && IP6CB(skb)->frag_max_size > mtu) ++ return true; ++ ++ if (skb_is_gso(skb) && skb_gso_network_seglen(skb) <= mtu) ++ return false; ++ ++ return true; ++} ++ + int ip6_forward(struct sk_buff *skb) + { + struct dst_entry *dst = skb_dst(skb); +@@ -467,8 +481,7 @@ int ip6_forward(struct sk_buff *skb) + if (mtu < IPV6_MIN_MTU) + mtu = IPV6_MIN_MTU; + +- if ((!skb->local_df && skb->len > mtu && !skb_is_gso(skb)) || +- (IP6CB(skb)->frag_max_size && IP6CB(skb)->frag_max_size > mtu)) { ++ if (ip6_pkt_too_big(skb, mtu)) { + /* Again, force OUTPUT device used as source address */ + skb->dev = dst->dev; + icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu); diff --git a/queue-3.10/net-qmi_wwan-add-netgear-aircard-340u.patch b/queue-3.10/net-qmi_wwan-add-netgear-aircard-340u.patch new file mode 100644 index 00000000000..04ecc8441f9 --- /dev/null +++ b/queue-3.10/net-qmi_wwan-add-netgear-aircard-340u.patch @@ -0,0 +1,37 @@ +From foo@baz Thu Feb 27 19:58:01 PST 2014 +From: Bjørn Mork +Date: Tue, 4 Feb 2014 13:04:33 +0100 +Subject: net: qmi_wwan: add Netgear Aircard 340U +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Bjørn Mork + +[ Upstream commit fbd3a77d813f211060f86cc7a2f8416caf0e03b1 ] + +This device was mentioned in an OpenWRT forum. Seems to have a "standard" +Sierra Wireless ifnumber to function layout: + 0: qcdm + 2: nmea + 3: modem + 8: qmi + 9: storage + +Signed-off-by: Bjørn Mork +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/qmi_wwan.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -709,6 +709,7 @@ static const struct usb_device_id produc + {QMI_FIXED_INTF(0x1199, 0x68a2, 8)}, /* Sierra Wireless MC7710 in QMI mode */ + {QMI_FIXED_INTF(0x1199, 0x68a2, 19)}, /* Sierra Wireless MC7710 in QMI mode */ + {QMI_FIXED_INTF(0x1199, 0x901c, 8)}, /* Sierra Wireless EM7700 */ ++ {QMI_FIXED_INTF(0x1199, 0x9051, 8)}, /* Netgear AirCard 340U */ + {QMI_FIXED_INTF(0x1bbb, 0x011e, 4)}, /* Telekom Speedstick LTE II (Alcatel One Touch L100V LTE) */ + {QMI_FIXED_INTF(0x2357, 0x0201, 4)}, /* TP-LINK HSUPA Modem MA180 */ + {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)}, /* Telit LE920 */ diff --git a/queue-3.10/net-sctp-fix-sctp_connectx-abi-for-ia32-emulation-compat-mode.patch b/queue-3.10/net-sctp-fix-sctp_connectx-abi-for-ia32-emulation-compat-mode.patch new file mode 100644 index 00000000000..401f79061d6 --- /dev/null +++ b/queue-3.10/net-sctp-fix-sctp_connectx-abi-for-ia32-emulation-compat-mode.patch @@ -0,0 +1,105 @@ +From foo@baz Thu Feb 27 19:58:01 PST 2014 +From: Daniel Borkmann +Date: Mon, 17 Feb 2014 12:11:11 +0100 +Subject: net: sctp: fix sctp_connectx abi for ia32 emulation/compat mode + +From: Daniel Borkmann + +[ Upstream commit ffd5939381c609056b33b7585fb05a77b4c695f3 ] + +SCTP's sctp_connectx() abi breaks for 64bit kernels compiled with 32bit +emulation (e.g. ia32 emulation or x86_x32). Due to internal usage of +'struct sctp_getaddrs_old' which includes a struct sockaddr pointer, +sizeof(param) check will always fail in kernel as the structure in +64bit kernel space is 4bytes larger than for user binaries compiled +in 32bit mode. Thus, applications making use of sctp_connectx() won't +be able to run under such circumstances. + +Introduce a compat interface in the kernel to deal with such +situations by using a 'struct compat_sctp_getaddrs_old' structure +where user data is copied into it, and then sucessively transformed +into a 'struct sctp_getaddrs_old' structure with the help of +compat_ptr(). That fixes sctp_connectx() abi without any changes +needed in user space, and lets the SCTP test suite pass when compiled +in 32bit and run on 64bit kernels. + +Fixes: f9c67811ebc0 ("sctp: Fix regression introduced by new sctp_connectx api") +Signed-off-by: Daniel Borkmann +Acked-by: Neil Horman +Acked-by: Vlad Yasevich +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/sctp/socket.c | 41 ++++++++++++++++++++++++++++++++--------- + 1 file changed, 32 insertions(+), 9 deletions(-) + +--- a/net/sctp/socket.c ++++ b/net/sctp/socket.c +@@ -71,6 +71,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -1384,11 +1385,19 @@ SCTP_STATIC int sctp_setsockopt_connectx + /* + * New (hopefully final) interface for the API. + * We use the sctp_getaddrs_old structure so that use-space library +- * can avoid any unnecessary allocations. The only defferent part ++ * can avoid any unnecessary allocations. The only different part + * is that we store the actual length of the address buffer into the +- * addrs_num structure member. That way we can re-use the existing ++ * addrs_num structure member. That way we can re-use the existing + * code. + */ ++#ifdef CONFIG_COMPAT ++struct compat_sctp_getaddrs_old { ++ sctp_assoc_t assoc_id; ++ s32 addr_num; ++ compat_uptr_t addrs; /* struct sockaddr * */ ++}; ++#endif ++ + SCTP_STATIC int sctp_getsockopt_connectx3(struct sock* sk, int len, + char __user *optval, + int __user *optlen) +@@ -1397,16 +1406,30 @@ SCTP_STATIC int sctp_getsockopt_connectx + sctp_assoc_t assoc_id = 0; + int err = 0; + +- if (len < sizeof(param)) +- return -EINVAL; ++#ifdef CONFIG_COMPAT ++ if (is_compat_task()) { ++ struct compat_sctp_getaddrs_old param32; + +- if (copy_from_user(¶m, optval, sizeof(param))) +- return -EFAULT; ++ if (len < sizeof(param32)) ++ return -EINVAL; ++ if (copy_from_user(¶m32, optval, sizeof(param32))) ++ return -EFAULT; + +- err = __sctp_setsockopt_connectx(sk, +- (struct sockaddr __user *)param.addrs, +- param.addr_num, &assoc_id); ++ param.assoc_id = param32.assoc_id; ++ param.addr_num = param32.addr_num; ++ param.addrs = compat_ptr(param32.addrs); ++ } else ++#endif ++ { ++ if (len < sizeof(param)) ++ return -EINVAL; ++ if (copy_from_user(¶m, optval, sizeof(param))) ++ return -EFAULT; ++ } + ++ err = __sctp_setsockopt_connectx(sk, (struct sockaddr __user *) ++ param.addrs, param.addr_num, ++ &assoc_id); + if (err == 0 || err == -EINPROGRESS) { + if (copy_to_user(optval, &assoc_id, sizeof(assoc_id))) + return -EFAULT; diff --git a/queue-3.10/net-use-__gfp_noretry-for-high-order-allocations.patch b/queue-3.10/net-use-__gfp_noretry-for-high-order-allocations.patch new file mode 100644 index 00000000000..badc0641716 --- /dev/null +++ b/queue-3.10/net-use-__gfp_noretry-for-high-order-allocations.patch @@ -0,0 +1,64 @@ +From foo@baz Thu Feb 27 19:58:01 PST 2014 +From: Eric Dumazet +Date: Thu, 6 Feb 2014 10:42:42 -0800 +Subject: net: use __GFP_NORETRY for high order allocations + +From: Eric Dumazet + +[ Upstream commit ed98df3361f059db42786c830ea96e2d18b8d4db ] + +sock_alloc_send_pskb() & sk_page_frag_refill() +have a loop trying high order allocations to prepare +skb with low number of fragments as this increases performance. + +Problem is that under memory pressure/fragmentation, this can +trigger OOM while the intent was only to try the high order +allocations, then fallback to order-0 allocations. + +We had various reports from unexpected regressions. + +According to David, setting __GFP_NORETRY should be fine, +as the asynchronous compaction is still enabled, and this +will prevent OOM from kicking as in : + +CFSClientEventm invoked oom-killer: gfp_mask=0x42d0, order=3, oom_adj=0, +oom_score_adj=0, oom_score_badness=2 (enabled),memcg_scoring=disabled +CFSClientEventm + +Call Trace: + [] dump_header+0xe1/0x23e + [] oom_kill_process+0x6a/0x323 + [] out_of_memory+0x4b3/0x50d + [] __alloc_pages_may_oom+0xa2/0xc7 + [] __alloc_pages_nodemask+0x1002/0x17f0 + [] alloc_pages_current+0x103/0x2b0 + [] sk_page_frag_refill+0x8f/0x160 + [] tcp_sendmsg+0x560/0xee0 + [] inet_sendmsg+0x67/0x100 + [] __sock_sendmsg_nosec+0x6c/0x90 + [] sock_sendmsg+0xc5/0xf0 + [] __sys_sendmsg+0x136/0x430 + [] sys_sendmsg+0x88/0x110 + [] system_call_fastpath+0x16/0x1b +Out of Memory: Kill process 2856 (bash) score 9999 or sacrifice child + +Signed-off-by: Eric Dumazet +Acked-by: David Rientjes +Acked-by: "Eric W. Biederman" +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/core/sock.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/core/sock.c ++++ b/net/core/sock.c +@@ -1814,7 +1814,7 @@ bool sk_page_frag_refill(struct sock *sk + gfp_t gfp = sk->sk_allocation; + + if (order) +- gfp |= __GFP_COMP | __GFP_NOWARN; ++ gfp |= __GFP_COMP | __GFP_NOWARN | __GFP_NORETRY; + pfrag->page = alloc_pages(gfp, order); + if (likely(pfrag->page)) { + pfrag->offset = 0; diff --git a/queue-3.10/netpoll-fix-netconsole-ipv6-setup.patch b/queue-3.10/netpoll-fix-netconsole-ipv6-setup.patch new file mode 100644 index 00000000000..6ab185d1d1c --- /dev/null +++ b/queue-3.10/netpoll-fix-netconsole-ipv6-setup.patch @@ -0,0 +1,52 @@ +From foo@baz Thu Feb 27 19:58:01 PST 2014 +From: Sabrina Dubroca +Date: Thu, 6 Feb 2014 18:34:12 +0100 +Subject: netpoll: fix netconsole IPv6 setup + +From: Sabrina Dubroca + +[ Upstream commit 00fe11b3c67dc670fe6391d22f1fe64e7c99a8ec ] + +Currently, to make netconsole start over IPv6, the source address +needs to be specified. Without a source address, netpoll_parse_options +assumes we're setting up over IPv4 and the destination IPv6 address is +rejected. + +Check if the IP version has been forced by a source address before +checking for a version mismatch when parsing the destination address. + +Signed-off-by: Sabrina Dubroca +Acked-by: Cong Wang +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/core/netpoll.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/net/core/netpoll.c ++++ b/net/core/netpoll.c +@@ -948,6 +948,7 @@ int netpoll_parse_options(struct netpoll + { + char *cur=opt, *delim; + int ipv6; ++ bool ipversion_set = false; + + if (*cur != '@') { + if ((delim = strchr(cur, '@')) == NULL) +@@ -960,6 +961,7 @@ int netpoll_parse_options(struct netpoll + cur++; + + if (*cur != '/') { ++ ipversion_set = true; + if ((delim = strchr(cur, '/')) == NULL) + goto parse_failed; + *delim = 0; +@@ -1002,7 +1004,7 @@ int netpoll_parse_options(struct netpoll + ipv6 = netpoll_parse_ip_addr(cur, &np->remote_ip); + if (ipv6 < 0) + goto parse_failed; +- else if (np->ipv6 != (bool)ipv6) ++ else if (ipversion_set && np->ipv6 != (bool)ipv6) + goto parse_failed; + else + np->ipv6 = (bool)ipv6; diff --git a/queue-3.10/series b/queue-3.10/series index 7fe7ec40f02..824b7d8153a 100644 --- a/queue-3.10/series +++ b/queue-3.10/series @@ -17,3 +17,21 @@ cifs-fix-too-big-maxbuf-size-for-smb3-mounts.patch rtl8187-fix-regression-on-mips-without-coherent-dma.patch rtlwifi-fix-incorrect-return-from-rtl_ps_enable_nic.patch rtlwifi-rtl8192ce-fix-too-long-disable-of-irqs.patch +6lowpan-fix-lockdep-splats.patch +9p-trans_virtio.c-fix-broken-zero-copy-on-vmalloc-buffers.patch +can-add-destructor-for-self-generated-skbs.patch +ipv4-fix-runtime-warning-in-rtmsg_ifa.patch +net-fix-ip-rule-iif-oif-device-rename.patch +netpoll-fix-netconsole-ipv6-setup.patch +net-qmi_wwan-add-netgear-aircard-340u.patch +tcp-tsq-fix-nonagle-handling.patch +tg3-fix-deadlock-in-tg3_change_mtu.patch +net-asix-add-missing-flag-to-struct-driver_info.patch +usbnet-remove-generic-hard_header_len-check.patch +bonding-802.3ad-make-aggregator_identifier-bond-private.patch +ipv4-fix-counter-in_slow_tot.patch +net-sctp-fix-sctp_connectx-abi-for-ia32-emulation-compat-mode.patch +net-add-and-use-skb_gso_transport_seglen.patch +net-core-introduce-netif_skb_dev_features.patch +net-ip-ipv6-handle-gso-skbs-in-forwarding-path.patch +net-use-__gfp_noretry-for-high-order-allocations.patch diff --git a/queue-3.10/tcp-tsq-fix-nonagle-handling.patch b/queue-3.10/tcp-tsq-fix-nonagle-handling.patch new file mode 100644 index 00000000000..428b13b00ec --- /dev/null +++ b/queue-3.10/tcp-tsq-fix-nonagle-handling.patch @@ -0,0 +1,68 @@ +From foo@baz Thu Feb 27 19:58:01 PST 2014 +From: John Ogness +Date: Sun, 9 Feb 2014 18:40:11 -0800 +Subject: tcp: tsq: fix nonagle handling + +From: John Ogness + +[ Upstream commit bf06200e732de613a1277984bf34d1a21c2de03d ] + +Commit 46d3ceabd8d9 ("tcp: TCP Small Queues") introduced a possible +regression for applications using TCP_NODELAY. + +If TCP session is throttled because of tsq, we should consult +tp->nonagle when TX completion is done and allow us to send additional +segment, especially if this segment is not a full MSS. +Otherwise this segment is sent after an RTO. + +[edumazet] : Cooked the changelog, added another fix about testing +sk_wmem_alloc twice because TX completion can happen right before +setting TSQ_THROTTLED bit. + +This problem is particularly visible with recent auto corking, +but might also be triggered with low tcp_limit_output_bytes +values or NIC drivers delaying TX completion by hundred of usec, +and very low rtt. + +Thomas Glanzmann for example reported an iscsi regression, caused +by tcp auto corking making this bug quite visible. + +Fixes: 46d3ceabd8d9 ("tcp: TCP Small Queues") +Signed-off-by: John Ogness +Signed-off-by: Eric Dumazet +Reported-by: Thomas Glanzmann +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/tcp_output.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -686,7 +686,8 @@ static void tcp_tsq_handler(struct sock + if ((1 << sk->sk_state) & + (TCPF_ESTABLISHED | TCPF_FIN_WAIT1 | TCPF_CLOSING | + TCPF_CLOSE_WAIT | TCPF_LAST_ACK)) +- tcp_write_xmit(sk, tcp_current_mss(sk), 0, 0, GFP_ATOMIC); ++ tcp_write_xmit(sk, tcp_current_mss(sk), tcp_sk(sk)->nonagle, ++ 0, GFP_ATOMIC); + } + /* + * One tasklest per cpu tries to send more skbs. +@@ -1875,7 +1876,15 @@ static bool tcp_write_xmit(struct sock * + + if (atomic_read(&sk->sk_wmem_alloc) > limit) { + set_bit(TSQ_THROTTLED, &tp->tsq_flags); +- break; ++ /* It is possible TX completion already happened ++ * before we set TSQ_THROTTLED, so we must ++ * test again the condition. ++ * We abuse smp_mb__after_clear_bit() because ++ * there is no smp_mb__after_set_bit() yet ++ */ ++ smp_mb__after_clear_bit(); ++ if (atomic_read(&sk->sk_wmem_alloc) > limit) ++ break; + } + + limit = mss_now; diff --git a/queue-3.10/tg3-fix-deadlock-in-tg3_change_mtu.patch b/queue-3.10/tg3-fix-deadlock-in-tg3_change_mtu.patch new file mode 100644 index 00000000000..e57bacab230 --- /dev/null +++ b/queue-3.10/tg3-fix-deadlock-in-tg3_change_mtu.patch @@ -0,0 +1,49 @@ +From foo@baz Thu Feb 27 19:58:01 PST 2014 +From: Nithin Sujir +Date: Thu, 6 Feb 2014 14:13:05 -0800 +Subject: tg3: Fix deadlock in tg3_change_mtu() + +From: Nithin Sujir + +[ Upstream commit c6993dfd7db9b0c6b7ca7503a56fda9236a4710f ] + +Quoting David Vrabel - +"5780 cards cannot have jumbo frames and TSO enabled together. When +jumbo frames are enabled by setting the MTU, the TSO feature must be +cleared. This is done indirectly by calling netdev_update_features() +which will call tg3_fix_features() to actually clear the flags. + +netdev_update_features() will also trigger a new netlink message for the +feature change event which will result in a call to tg3_get_stats64() +which deadlocks on the tg3 lock." + +tg3_set_mtu() does not need to be under the tg3 lock since converting +the flags to use set_bit(). Move it out to after tg3_netif_stop(). + +Reported-by: David Vrabel +Tested-by: David Vrabel +Signed-off-by: Michael Chan +Signed-off-by: Nithin Nayak Sujir +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/broadcom/tg3.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/broadcom/tg3.c ++++ b/drivers/net/ethernet/broadcom/tg3.c +@@ -13777,12 +13777,12 @@ static int tg3_change_mtu(struct net_dev + + tg3_netif_stop(tp); + ++ tg3_set_mtu(dev, tp, new_mtu); ++ + tg3_full_lock(tp, 1); + + tg3_halt(tp, RESET_KIND_SHUTDOWN, 1); + +- tg3_set_mtu(dev, tp, new_mtu); +- + /* Reset PHY, otherwise the read DMA engine will be in a mode that + * breaks all requests to 256 bytes. + */ diff --git a/queue-3.10/usbnet-remove-generic-hard_header_len-check.patch b/queue-3.10/usbnet-remove-generic-hard_header_len-check.patch new file mode 100644 index 00000000000..eef12a69be8 --- /dev/null +++ b/queue-3.10/usbnet-remove-generic-hard_header_len-check.patch @@ -0,0 +1,211 @@ +From foo@baz Thu Feb 27 19:58:01 PST 2014 +From: Emil Goode +Date: Thu, 13 Feb 2014 17:50:19 +0100 +Subject: usbnet: remove generic hard_header_len check + +From: Emil Goode + +[ Upstream commit eb85569fe2d06c2fbf4de7b66c263ca095b397aa ] + +This patch removes a generic hard_header_len check from the usbnet +module that is causing dropped packages under certain circumstances +for devices that send rx packets that cross urb boundaries. + +One example is the AX88772B which occasionally send rx packets that +cross urb boundaries where the remaining partial packet is sent with +no hardware header. When the buffer with a partial packet is of less +number of octets than the value of hard_header_len the buffer is +discarded by the usbnet module. + +With AX88772B this can be reproduced by using ping with a packet +size between 1965-1976. + +The bug has been reported here: + +https://bugzilla.kernel.org/show_bug.cgi?id=29082 + +This patch introduces the following changes: +- Removes the generic hard_header_len check in the rx_complete + function in the usbnet module. +- Introduces a ETH_HLEN check for skbs that are not cloned from + within a rx_fixup callback. +- For safety a hard_header_len check is added to each rx_fixup + callback function that could be affected by this change. + These extra checks could possibly be removed by someone + who has the hardware to test. +- Removes a call to dev_kfree_skb_any() and instead utilizes the + dev->done list to queue skbs for cleanup. + +The changes place full responsibility on the rx_fixup callback +functions that clone skbs to only pass valid skbs to the +usbnet_skb_return function. + +Signed-off-by: Emil Goode +Reported-by: Igor Gnatenko +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/ax88179_178a.c | 4 ++++ + drivers/net/usb/gl620a.c | 4 ++++ + drivers/net/usb/mcs7830.c | 5 +++-- + drivers/net/usb/net1080.c | 4 ++++ + drivers/net/usb/qmi_wwan.c | 8 ++++---- + drivers/net/usb/rndis_host.c | 4 ++++ + drivers/net/usb/smsc75xx.c | 4 ++++ + drivers/net/usb/smsc95xx.c | 4 ++++ + drivers/net/usb/usbnet.c | 25 ++++++++++--------------- + 9 files changed, 41 insertions(+), 21 deletions(-) + +--- a/drivers/net/usb/ax88179_178a.c ++++ b/drivers/net/usb/ax88179_178a.c +@@ -1109,6 +1109,10 @@ static int ax88179_rx_fixup(struct usbne + u16 hdr_off; + u32 *pkt_hdr; + ++ /* This check is no longer done by usbnet */ ++ if (skb->len < dev->net->hard_header_len) ++ return 0; ++ + skb_trim(skb, skb->len - 4); + memcpy(&rx_hdr, skb_tail_pointer(skb), 4); + le32_to_cpus(&rx_hdr); +--- a/drivers/net/usb/gl620a.c ++++ b/drivers/net/usb/gl620a.c +@@ -86,6 +86,10 @@ static int genelink_rx_fixup(struct usbn + u32 size; + u32 count; + ++ /* This check is no longer done by usbnet */ ++ if (skb->len < dev->net->hard_header_len) ++ return 0; ++ + header = (struct gl_header *) skb->data; + + // get the packet count of the received skb +--- a/drivers/net/usb/mcs7830.c ++++ b/drivers/net/usb/mcs7830.c +@@ -529,8 +529,9 @@ static int mcs7830_rx_fixup(struct usbne + { + u8 status; + +- if (skb->len == 0) { +- dev_err(&dev->udev->dev, "unexpected empty rx frame\n"); ++ /* This check is no longer done by usbnet */ ++ if (skb->len < dev->net->hard_header_len) { ++ dev_err(&dev->udev->dev, "unexpected tiny rx frame\n"); + return 0; + } + +--- a/drivers/net/usb/net1080.c ++++ b/drivers/net/usb/net1080.c +@@ -366,6 +366,10 @@ static int net1080_rx_fixup(struct usbne + struct nc_trailer *trailer; + u16 hdr_len, packet_len; + ++ /* This check is no longer done by usbnet */ ++ if (skb->len < dev->net->hard_header_len) ++ return 0; ++ + if (!(skb->len & 0x01)) { + netdev_dbg(dev->net, "rx framesize %d range %d..%d mtu %d\n", + skb->len, dev->net->hard_header_len, dev->hard_mtu, +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -80,10 +80,10 @@ static int qmi_wwan_rx_fixup(struct usbn + { + __be16 proto; + +- /* usbnet rx_complete guarantees that skb->len is at least +- * hard_header_len, so we can inspect the dest address without +- * checking skb->len +- */ ++ /* This check is no longer done by usbnet */ ++ if (skb->len < dev->net->hard_header_len) ++ return 0; ++ + switch (skb->data[0] & 0xf0) { + case 0x40: + proto = htons(ETH_P_IP); +--- a/drivers/net/usb/rndis_host.c ++++ b/drivers/net/usb/rndis_host.c +@@ -494,6 +494,10 @@ EXPORT_SYMBOL_GPL(rndis_unbind); + */ + int rndis_rx_fixup(struct usbnet *dev, struct sk_buff *skb) + { ++ /* This check is no longer done by usbnet */ ++ if (skb->len < dev->net->hard_header_len) ++ return 0; ++ + /* peripheral may have batched packets to us... */ + while (likely(skb->len)) { + struct rndis_data_hdr *hdr = (void *)skb->data; +--- a/drivers/net/usb/smsc75xx.c ++++ b/drivers/net/usb/smsc75xx.c +@@ -2108,6 +2108,10 @@ static void smsc75xx_rx_csum_offload(str + + static int smsc75xx_rx_fixup(struct usbnet *dev, struct sk_buff *skb) + { ++ /* This check is no longer done by usbnet */ ++ if (skb->len < dev->net->hard_header_len) ++ return 0; ++ + while (skb->len > 0) { + u32 rx_cmd_a, rx_cmd_b, align_count, size; + struct sk_buff *ax_skb; +--- a/drivers/net/usb/smsc95xx.c ++++ b/drivers/net/usb/smsc95xx.c +@@ -1725,6 +1725,10 @@ static void smsc95xx_rx_csum_offload(str + + static int smsc95xx_rx_fixup(struct usbnet *dev, struct sk_buff *skb) + { ++ /* This check is no longer done by usbnet */ ++ if (skb->len < dev->net->hard_header_len) ++ return 0; ++ + while (skb->len > 0) { + u32 header, align_count; + struct sk_buff *ax_skb; +--- a/drivers/net/usb/usbnet.c ++++ b/drivers/net/usb/usbnet.c +@@ -517,17 +517,19 @@ static inline void rx_process (struct us + } + // else network stack removes extra byte if we forced a short packet + +- if (skb->len) { +- /* all data was already cloned from skb inside the driver */ +- if (dev->driver_info->flags & FLAG_MULTI_PACKET) +- dev_kfree_skb_any(skb); +- else +- usbnet_skb_return(dev, skb); ++ /* all data was already cloned from skb inside the driver */ ++ if (dev->driver_info->flags & FLAG_MULTI_PACKET) ++ goto done; ++ ++ if (skb->len < ETH_HLEN) { ++ dev->net->stats.rx_errors++; ++ dev->net->stats.rx_length_errors++; ++ netif_dbg(dev, rx_err, dev->net, "rx length %d\n", skb->len); ++ } else { ++ usbnet_skb_return(dev, skb); + return; + } + +- netif_dbg(dev, rx_err, dev->net, "drop\n"); +- dev->net->stats.rx_errors++; + done: + skb_queue_tail(&dev->done, skb); + } +@@ -549,13 +551,6 @@ static void rx_complete (struct urb *urb + switch (urb_status) { + /* success */ + case 0: +- if (skb->len < dev->net->hard_header_len) { +- state = rx_cleanup; +- dev->net->stats.rx_errors++; +- dev->net->stats.rx_length_errors++; +- netif_dbg(dev, rx_err, dev->net, +- "rx length %d\n", skb->len); +- } + break; + + /* stalls need manual reset. this is rare ... except that -- 2.47.3