From bea93ed907f287e2e5b9689a1da6fdd57690d996 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Thu, 8 Aug 2013 17:32:13 -0700 Subject: [PATCH] 3.10-stable patches added patches: 8139cp-add-dma_mapping_error-checking.patch af_key-more-info-leaks-in-pfkey-messages.patch arcnet-cleanup-sizeof-parameter.patch atl1c-use-custom-skb-allocator.patch genetlink-release-cb_lock-before-requesting-additional-module.patch ipv6-take-rtnl_lock-and-mark-mrt6-table-as-freed-on-namespace-cleanup.patch ndisc-add-missing-inline-to-ndisc_addr_option_pad.patch net-mlx4_core-don-t-give-vfs-mac-addresses-which-are-derived-from-the-pf-mac.patch net-mlx4_core-vfs-must-ignore-the-enable_64b_cqe_eqe-module-param.patch net_sched-fix-stack-info-leak-in-cbq_dump_wrr.patch net_sched-info-leak-in-atm_tc_dump_class.patch sfc-enable-rx-scatter-for-flows-steered-by-rfs.patch sysctl-net-keep-tcp_syn_retries-inside-the-boundary.patch usbnet-do-not-pretend-to-support-sg-tso.patch --- ...139cp-add-dma_mapping_error-checking.patch | 148 ++++++++++++++++++ ...ey-more-info-leaks-in-pfkey-messages.patch | 50 ++++++ .../arcnet-cleanup-sizeof-parameter.patch | 31 ++++ .../atl1c-use-custom-skb-allocator.patch | 115 ++++++++++++++ ...-before-requesting-additional-module.patch | 120 ++++++++++++++ ...-table-as-freed-on-namespace-cleanup.patch | 94 +++++++++++ ...sing-inline-to-ndisc_addr_option_pad.patch | 27 ++++ ...es-which-are-derived-from-the-pf-mac.patch | 42 +++++ ...-the-enable_64b_cqe_eqe-module-param.patch | 34 ++++ ...-fix-stack-info-leak-in-cbq_dump_wrr.patch | 31 ++++ ...sched-info-leak-in-atm_tc_dump_class.patch | 29 ++++ queue-3.10/series | 14 ++ ...-rx-scatter-for-flows-steered-by-rfs.patch | 34 ++++ ...-tcp_syn_retries-inside-the-boundary.patch | 41 +++++ ...net-do-not-pretend-to-support-sg-tso.patch | 107 +++++++++++++ 15 files changed, 917 insertions(+) create mode 100644 queue-3.10/8139cp-add-dma_mapping_error-checking.patch create mode 100644 queue-3.10/af_key-more-info-leaks-in-pfkey-messages.patch create mode 100644 queue-3.10/arcnet-cleanup-sizeof-parameter.patch create mode 100644 queue-3.10/atl1c-use-custom-skb-allocator.patch create mode 100644 queue-3.10/genetlink-release-cb_lock-before-requesting-additional-module.patch create mode 100644 queue-3.10/ipv6-take-rtnl_lock-and-mark-mrt6-table-as-freed-on-namespace-cleanup.patch create mode 100644 queue-3.10/ndisc-add-missing-inline-to-ndisc_addr_option_pad.patch create mode 100644 queue-3.10/net-mlx4_core-don-t-give-vfs-mac-addresses-which-are-derived-from-the-pf-mac.patch create mode 100644 queue-3.10/net-mlx4_core-vfs-must-ignore-the-enable_64b_cqe_eqe-module-param.patch create mode 100644 queue-3.10/net_sched-fix-stack-info-leak-in-cbq_dump_wrr.patch create mode 100644 queue-3.10/net_sched-info-leak-in-atm_tc_dump_class.patch create mode 100644 queue-3.10/sfc-enable-rx-scatter-for-flows-steered-by-rfs.patch create mode 100644 queue-3.10/sysctl-net-keep-tcp_syn_retries-inside-the-boundary.patch create mode 100644 queue-3.10/usbnet-do-not-pretend-to-support-sg-tso.patch diff --git a/queue-3.10/8139cp-add-dma_mapping_error-checking.patch b/queue-3.10/8139cp-add-dma_mapping_error-checking.patch new file mode 100644 index 00000000000..344e3b6f223 --- /dev/null +++ b/queue-3.10/8139cp-add-dma_mapping_error-checking.patch @@ -0,0 +1,148 @@ +From c610c10796608605c16a799104b970739317faf2 Mon Sep 17 00:00:00 2001 +From: Neil Horman +Date: Wed, 31 Jul 2013 09:03:56 -0400 +Subject: 8139cp: Add dma_mapping_error checking + +From: Neil Horman + +[ Upstream commit cf3c4c03060b688cbc389ebc5065ebcce5653e96 ] + +Self explanitory dma_mapping_error addition to the 8139 driver, based on this: +https://bugzilla.redhat.com/show_bug.cgi?id=947250 + +It showed several backtraces arising for dma_map_* usage without checking the +return code on the mapping. Add the check and abort the rx/tx operation if its +failed. Untested as I have no hardware and the reporter has wandered off, but +seems pretty straightforward. + +Signed-off-by: Neil Horman +CC: "David S. Miller" +CC: Francois Romieu +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/realtek/8139cp.c | 48 +++++++++++++++++++++++++++++++--- + 1 file changed, 45 insertions(+), 3 deletions(-) + +--- a/drivers/net/ethernet/realtek/8139cp.c ++++ b/drivers/net/ethernet/realtek/8139cp.c +@@ -478,7 +478,7 @@ rx_status_loop: + + while (1) { + u32 status, len; +- dma_addr_t mapping; ++ dma_addr_t mapping, new_mapping; + struct sk_buff *skb, *new_skb; + struct cp_desc *desc; + const unsigned buflen = cp->rx_buf_sz; +@@ -520,6 +520,13 @@ rx_status_loop: + goto rx_next; + } + ++ new_mapping = dma_map_single(&cp->pdev->dev, new_skb->data, buflen, ++ PCI_DMA_FROMDEVICE); ++ if (dma_mapping_error(&cp->pdev->dev, new_mapping)) { ++ dev->stats.rx_dropped++; ++ goto rx_next; ++ } ++ + dma_unmap_single(&cp->pdev->dev, mapping, + buflen, PCI_DMA_FROMDEVICE); + +@@ -531,12 +538,11 @@ rx_status_loop: + + skb_put(skb, len); + +- mapping = dma_map_single(&cp->pdev->dev, new_skb->data, buflen, +- PCI_DMA_FROMDEVICE); + cp->rx_skb[rx_tail] = new_skb; + + cp_rx_skb(cp, skb, desc); + rx++; ++ mapping = new_mapping; + + rx_next: + cp->rx_ring[rx_tail].opts2 = 0; +@@ -716,6 +722,22 @@ static inline u32 cp_tx_vlan_tag(struct + TxVlanTag | swab16(vlan_tx_tag_get(skb)) : 0x00; + } + ++static void unwind_tx_frag_mapping(struct cp_private *cp, struct sk_buff *skb, ++ int first, int entry_last) ++{ ++ int frag, index; ++ struct cp_desc *txd; ++ skb_frag_t *this_frag; ++ for (frag = 0; frag+first < entry_last; frag++) { ++ index = first+frag; ++ cp->tx_skb[index] = NULL; ++ txd = &cp->tx_ring[index]; ++ this_frag = &skb_shinfo(skb)->frags[frag]; ++ dma_unmap_single(&cp->pdev->dev, le64_to_cpu(txd->addr), ++ skb_frag_size(this_frag), PCI_DMA_TODEVICE); ++ } ++} ++ + static netdev_tx_t cp_start_xmit (struct sk_buff *skb, + struct net_device *dev) + { +@@ -749,6 +771,9 @@ static netdev_tx_t cp_start_xmit (struct + + len = skb->len; + mapping = dma_map_single(&cp->pdev->dev, skb->data, len, PCI_DMA_TODEVICE); ++ if (dma_mapping_error(&cp->pdev->dev, mapping)) ++ goto out_dma_error; ++ + txd->opts2 = opts2; + txd->addr = cpu_to_le64(mapping); + wmb(); +@@ -786,6 +811,9 @@ static netdev_tx_t cp_start_xmit (struct + first_len = skb_headlen(skb); + first_mapping = dma_map_single(&cp->pdev->dev, skb->data, + first_len, PCI_DMA_TODEVICE); ++ if (dma_mapping_error(&cp->pdev->dev, first_mapping)) ++ goto out_dma_error; ++ + cp->tx_skb[entry] = skb; + entry = NEXT_TX(entry); + +@@ -799,6 +827,11 @@ static netdev_tx_t cp_start_xmit (struct + mapping = dma_map_single(&cp->pdev->dev, + skb_frag_address(this_frag), + len, PCI_DMA_TODEVICE); ++ if (dma_mapping_error(&cp->pdev->dev, mapping)) { ++ unwind_tx_frag_mapping(cp, skb, first_entry, entry); ++ goto out_dma_error; ++ } ++ + eor = (entry == (CP_TX_RING_SIZE - 1)) ? RingEnd : 0; + + ctrl = eor | len | DescOwn; +@@ -859,11 +892,16 @@ static netdev_tx_t cp_start_xmit (struct + if (TX_BUFFS_AVAIL(cp) <= (MAX_SKB_FRAGS + 1)) + netif_stop_queue(dev); + ++out_unlock: + spin_unlock_irqrestore(&cp->lock, intr_flags); + + cpw8(TxPoll, NormalTxPoll); + + return NETDEV_TX_OK; ++out_dma_error: ++ kfree_skb(skb); ++ cp->dev->stats.tx_dropped++; ++ goto out_unlock; + } + + /* Set or clear the multicast filter for this adaptor. +@@ -1054,6 +1092,10 @@ static int cp_refill_rx(struct cp_privat + + mapping = dma_map_single(&cp->pdev->dev, skb->data, + cp->rx_buf_sz, PCI_DMA_FROMDEVICE); ++ if (dma_mapping_error(&cp->pdev->dev, mapping)) { ++ kfree_skb(skb); ++ goto err_out; ++ } + cp->rx_skb[i] = skb; + + cp->rx_ring[i].opts2 = 0; diff --git a/queue-3.10/af_key-more-info-leaks-in-pfkey-messages.patch b/queue-3.10/af_key-more-info-leaks-in-pfkey-messages.patch new file mode 100644 index 00000000000..ac2e41b68b2 --- /dev/null +++ b/queue-3.10/af_key-more-info-leaks-in-pfkey-messages.patch @@ -0,0 +1,50 @@ +From c5606776451a929334fa68240e59fd77fbd0732d Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Sun, 28 Jul 2013 23:04:45 +0300 +Subject: af_key: more info leaks in pfkey messages + +From: Dan Carpenter + +[ Upstream commit ff862a4668dd6dba962b1d2d8bd344afa6375683 ] + +This is inspired by a5cc68f3d6 "af_key: fix info leaks in notify +messages". There are some struct members which don't get initialized +and could disclose small amounts of private information. + +Acked-by: Mathias Krause +Signed-off-by: Dan Carpenter +Acked-by: Steffen Klassert +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/key/af_key.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/net/key/af_key.c ++++ b/net/key/af_key.c +@@ -2081,6 +2081,7 @@ static int pfkey_xfrm_policy2msg(struct + pol->sadb_x_policy_type = IPSEC_POLICY_NONE; + } + pol->sadb_x_policy_dir = dir+1; ++ pol->sadb_x_policy_reserved = 0; + pol->sadb_x_policy_id = xp->index; + pol->sadb_x_policy_priority = xp->priority; + +@@ -3137,7 +3138,9 @@ static int pfkey_send_acquire(struct xfr + pol->sadb_x_policy_exttype = SADB_X_EXT_POLICY; + pol->sadb_x_policy_type = IPSEC_POLICY_IPSEC; + pol->sadb_x_policy_dir = XFRM_POLICY_OUT + 1; ++ pol->sadb_x_policy_reserved = 0; + pol->sadb_x_policy_id = xp->index; ++ pol->sadb_x_policy_priority = xp->priority; + + /* Set sadb_comb's. */ + if (x->id.proto == IPPROTO_AH) +@@ -3525,6 +3528,7 @@ static int pfkey_send_migrate(const stru + pol->sadb_x_policy_exttype = SADB_X_EXT_POLICY; + pol->sadb_x_policy_type = IPSEC_POLICY_IPSEC; + pol->sadb_x_policy_dir = dir + 1; ++ pol->sadb_x_policy_reserved = 0; + pol->sadb_x_policy_id = 0; + pol->sadb_x_policy_priority = 0; + diff --git a/queue-3.10/arcnet-cleanup-sizeof-parameter.patch b/queue-3.10/arcnet-cleanup-sizeof-parameter.patch new file mode 100644 index 00000000000..4a104984078 --- /dev/null +++ b/queue-3.10/arcnet-cleanup-sizeof-parameter.patch @@ -0,0 +1,31 @@ +From 89e2c474ab38ffd0f1abc551ee2b4744230f169c Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Fri, 19 Jul 2013 08:48:05 +0300 +Subject: arcnet: cleanup sizeof parameter + +From: Dan Carpenter + +[ Upstream commit 087d273caf4f7d3f2159256f255f1f432bc84a5b ] + +This patch doesn't change the compiled code because ARC_HDR_SIZE is 4 +and sizeof(int) is 4, but the intent was to use the header size and not +the sizeof the header size. + +Signed-off-by: Dan Carpenter +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/arcnet/arcnet.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/arcnet/arcnet.c ++++ b/drivers/net/arcnet/arcnet.c +@@ -1007,7 +1007,7 @@ static void arcnet_rx(struct net_device + + soft = &pkt.soft.rfc1201; + +- lp->hw.copy_from_card(dev, bufnum, 0, &pkt, sizeof(ARC_HDR_SIZE)); ++ lp->hw.copy_from_card(dev, bufnum, 0, &pkt, ARC_HDR_SIZE); + if (pkt.hard.offset[0]) { + ofs = pkt.hard.offset[0]; + length = 256 - ofs; diff --git a/queue-3.10/atl1c-use-custom-skb-allocator.patch b/queue-3.10/atl1c-use-custom-skb-allocator.patch new file mode 100644 index 00000000000..327eb2f71ec --- /dev/null +++ b/queue-3.10/atl1c-use-custom-skb-allocator.patch @@ -0,0 +1,115 @@ +From 93b9b6e69777de669032e068df8f44f61f87b7bb Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Mon, 29 Jul 2013 10:24:04 -0700 +Subject: atl1c: use custom skb allocator + +From: Eric Dumazet + +[ Upstream commit 7b70176421993866e616f1cbc4d0dd4054f1bf78 ] + +We had reports ( https://bugzilla.kernel.org/show_bug.cgi?id=54021 ) +that using high order pages for skb allocations is problematic for atl1c + +We do not know exactly what the problem is, but we suspect that crossing +4K pages is not well supported by this hardware. + +Use a custom allocator, using page allocator and 2K fragments for +optimal stack behavior. We might make this allocator generic +in future kernels. + +Signed-off-by: Eric Dumazet +Cc: Luis Henriques +Cc: Neil Horman +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/atheros/atl1c/atl1c.h | 3 + + drivers/net/ethernet/atheros/atl1c/atl1c_main.c | 40 +++++++++++++++++++++++- + 2 files changed, 42 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/atheros/atl1c/atl1c.h ++++ b/drivers/net/ethernet/atheros/atl1c/atl1c.h +@@ -520,6 +520,9 @@ struct atl1c_adapter { + struct net_device *netdev; + struct pci_dev *pdev; + struct napi_struct napi; ++ struct page *rx_page; ++ unsigned int rx_page_offset; ++ unsigned int rx_frag_size; + struct atl1c_hw hw; + struct atl1c_hw_stats hw_stats; + struct mii_if_info mii; /* MII interface info */ +--- a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c ++++ b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c +@@ -481,10 +481,15 @@ static int atl1c_set_mac_addr(struct net + static void atl1c_set_rxbufsize(struct atl1c_adapter *adapter, + struct net_device *dev) + { ++ unsigned int head_size; + int mtu = dev->mtu; + + adapter->rx_buffer_len = mtu > AT_RX_BUF_SIZE ? + roundup(mtu + ETH_HLEN + ETH_FCS_LEN + VLAN_HLEN, 8) : AT_RX_BUF_SIZE; ++ ++ head_size = SKB_DATA_ALIGN(adapter->rx_buffer_len + NET_SKB_PAD) + ++ SKB_DATA_ALIGN(sizeof(struct skb_shared_info)); ++ adapter->rx_frag_size = roundup_pow_of_two(head_size); + } + + static netdev_features_t atl1c_fix_features(struct net_device *netdev, +@@ -952,6 +957,10 @@ static void atl1c_free_ring_resources(st + kfree(adapter->tpd_ring[0].buffer_info); + adapter->tpd_ring[0].buffer_info = NULL; + } ++ if (adapter->rx_page) { ++ put_page(adapter->rx_page); ++ adapter->rx_page = NULL; ++ } + } + + /** +@@ -1639,6 +1648,35 @@ static inline void atl1c_rx_checksum(str + skb_checksum_none_assert(skb); + } + ++static struct sk_buff *atl1c_alloc_skb(struct atl1c_adapter *adapter) ++{ ++ struct sk_buff *skb; ++ struct page *page; ++ ++ if (adapter->rx_frag_size > PAGE_SIZE) ++ return netdev_alloc_skb(adapter->netdev, ++ adapter->rx_buffer_len); ++ ++ page = adapter->rx_page; ++ if (!page) { ++ adapter->rx_page = page = alloc_page(GFP_ATOMIC); ++ if (unlikely(!page)) ++ return NULL; ++ adapter->rx_page_offset = 0; ++ } ++ ++ skb = build_skb(page_address(page) + adapter->rx_page_offset, ++ adapter->rx_frag_size); ++ if (likely(skb)) { ++ adapter->rx_page_offset += adapter->rx_frag_size; ++ if (adapter->rx_page_offset >= PAGE_SIZE) ++ adapter->rx_page = NULL; ++ else ++ get_page(page); ++ } ++ return skb; ++} ++ + static int atl1c_alloc_rx_buffer(struct atl1c_adapter *adapter) + { + struct atl1c_rfd_ring *rfd_ring = &adapter->rfd_ring; +@@ -1660,7 +1698,7 @@ static int atl1c_alloc_rx_buffer(struct + while (next_info->flags & ATL1C_BUFFER_FREE) { + rfd_desc = ATL1C_RFD_DESC(rfd_ring, rfd_next_to_use); + +- skb = netdev_alloc_skb(adapter->netdev, adapter->rx_buffer_len); ++ skb = atl1c_alloc_skb(adapter); + if (unlikely(!skb)) { + if (netif_msg_rx_err(adapter)) + dev_warn(&pdev->dev, "alloc rx buffer failed\n"); diff --git a/queue-3.10/genetlink-release-cb_lock-before-requesting-additional-module.patch b/queue-3.10/genetlink-release-cb_lock-before-requesting-additional-module.patch new file mode 100644 index 00000000000..b27c4446136 --- /dev/null +++ b/queue-3.10/genetlink-release-cb_lock-before-requesting-additional-module.patch @@ -0,0 +1,120 @@ +From 6883c1fc2e91010dc9bbb097da29ec9923a1e9f7 Mon Sep 17 00:00:00 2001 +From: Stanislaw Gruszka +Date: Fri, 26 Jul 2013 11:00:10 +0200 +Subject: genetlink: release cb_lock before requesting additional module + +From: Stanislaw Gruszka + +[ Upstream commit c74f2b2678f40b80265dd53556f1f778c8e1823f ] + +Requesting external module with cb_lock taken can result in +the deadlock like showed below: + +[ 2458.111347] Showing all locks held in the system: +[ 2458.111347] 1 lock held by NetworkManager/582: +[ 2458.111347] #0: (cb_lock){++++++}, at: [] genl_rcv+0x19/0x40 +[ 2458.111347] 1 lock held by modprobe/603: +[ 2458.111347] #0: (cb_lock){++++++}, at: [] genl_lock_all+0x15/0x30 + +[ 2461.579457] SysRq : Show Blocked State +[ 2461.580103] task PC stack pid father +[ 2461.580103] NetworkManager D ffff880034b84500 4040 582 1 0x00000080 +[ 2461.580103] ffff8800197ff720 0000000000000046 00000000001d5340 ffff8800197fffd8 +[ 2461.580103] ffff8800197fffd8 00000000001d5340 ffff880019631700 7fffffffffffffff +[ 2461.580103] ffff8800197ff880 ffff8800197ff878 ffff880019631700 ffff880019631700 +[ 2461.580103] Call Trace: +[ 2461.580103] [] schedule+0x29/0x70 +[ 2461.580103] [] schedule_timeout+0x1c1/0x360 +[ 2461.580103] [] ? mark_held_locks+0xbb/0x140 +[ 2461.580103] [] ? _raw_spin_unlock_irq+0x2c/0x50 +[ 2461.580103] [] ? trace_hardirqs_on_caller+0xfd/0x1c0 +[ 2461.580103] [] wait_for_completion_killable+0xe8/0x170 +[ 2461.580103] [] ? wake_up_state+0x20/0x20 +[ 2461.580103] [] call_usermodehelper_exec+0x1a5/0x210 +[ 2461.580103] [] ? wait_for_completion_killable+0x3d/0x170 +[ 2461.580103] [] __request_module+0x1b3/0x370 +[ 2461.580103] [] ? trace_hardirqs_on_caller+0xfd/0x1c0 +[ 2461.580103] [] ctrl_getfamily+0x159/0x190 +[ 2461.580103] [] genl_family_rcv_msg+0x1f4/0x2e0 +[ 2461.580103] [] ? genl_family_rcv_msg+0x2e0/0x2e0 +[ 2461.580103] [] genl_rcv_msg+0x8e/0xd0 +[ 2461.580103] [] netlink_rcv_skb+0xa9/0xc0 +[ 2461.580103] [] genl_rcv+0x28/0x40 +[ 2461.580103] [] netlink_unicast+0xdd/0x190 +[ 2461.580103] [] netlink_sendmsg+0x329/0x750 +[ 2461.580103] [] sock_sendmsg+0x99/0xd0 +[ 2461.580103] [] ? local_clock+0x5f/0x70 +[ 2461.580103] [] ? lock_release_non_nested+0x308/0x350 +[ 2461.580103] [] ___sys_sendmsg+0x39e/0x3b0 +[ 2461.580103] [] ? kvm_clock_read+0x2f/0x50 +[ 2461.580103] [] ? sched_clock+0x9/0x10 +[ 2461.580103] [] ? sched_clock_local+0x1d/0x80 +[ 2461.580103] [] ? sched_clock_cpu+0xa8/0x100 +[ 2461.580103] [] ? trace_hardirqs_off+0xd/0x10 +[ 2461.580103] [] ? local_clock+0x5f/0x70 +[ 2461.580103] [] ? lock_release_holdtime.part.28+0xf/0x1a0 +[ 2461.580103] [] ? fget_light+0xf9/0x510 +[ 2461.580103] [] ? fget_light+0x3c/0x510 +[ 2461.580103] [] __sys_sendmsg+0x42/0x80 +[ 2461.580103] [] SyS_sendmsg+0x12/0x20 +[ 2461.580103] [] system_call_fastpath+0x16/0x1b +[ 2461.580103] modprobe D ffff88000f2c8000 4632 603 602 0x00000080 +[ 2461.580103] ffff88000f04fba8 0000000000000046 00000000001d5340 ffff88000f04ffd8 +[ 2461.580103] ffff88000f04ffd8 00000000001d5340 ffff8800377d4500 ffff8800377d4500 +[ 2461.580103] ffffffff81d0b260 ffffffff81d0b268 ffffffff00000000 ffffffff81d0b2b0 +[ 2461.580103] Call Trace: +[ 2461.580103] [] schedule+0x29/0x70 +[ 2461.580103] [] rwsem_down_write_failed+0xed/0x1a0 +[ 2461.580103] [] ? update_cpu_load_active+0x10/0xb0 +[ 2461.580103] [] call_rwsem_down_write_failed+0x13/0x20 +[ 2461.580103] [] ? down_write+0x9d/0xb2 +[ 2461.580103] [] ? genl_lock_all+0x15/0x30 +[ 2461.580103] [] genl_lock_all+0x15/0x30 +[ 2461.580103] [] genl_register_family+0x53/0x1f0 +[ 2461.580103] [] ? 0xffffffffa01dbfff +[ 2461.580103] [] genl_register_family_with_ops+0x20/0x80 +[ 2461.580103] [] ? 0xffffffffa01dbfff +[ 2461.580103] [] nl80211_init+0x24/0xf0 [cfg80211] +[ 2461.580103] [] ? 0xffffffffa01dbfff +[ 2461.580103] [] cfg80211_init+0x43/0xdb [cfg80211] +[ 2461.580103] [] do_one_initcall+0xfa/0x1b0 +[ 2461.580103] [] ? set_memory_nx+0x43/0x50 +[ 2461.580103] [] load_module+0x1c6f/0x27f0 +[ 2461.580103] [] ? store_uevent+0x40/0x40 +[ 2461.580103] [] SyS_finit_module+0x86/0xb0 +[ 2461.580103] [] system_call_fastpath+0x16/0x1b +[ 2461.580103] Sched Debug Version: v0.10, 3.11.0-0.rc1.git4.1.fc20.x86_64 #1 + +Problem start to happen after adding net-pf-16-proto-16-family-nl80211 +alias name to cfg80211 module by below commit (though that commit +itself is perfectly fine): + +commit fb4e156886ce6e8309e912d8b370d192330d19d3 +Author: Marcel Holtmann +Date: Sun Apr 28 16:22:06 2013 -0700 + + nl80211: Add generic netlink module alias for cfg80211/nl80211 + +Reported-and-tested-by: Jeff Layton +Reported-by: Richard W.M. Jones +Signed-off-by: Stanislaw Gruszka +Reviewed-by: Pravin B Shelar +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/netlink/genetlink.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/net/netlink/genetlink.c ++++ b/net/netlink/genetlink.c +@@ -877,8 +877,10 @@ static int ctrl_getfamily(struct sk_buff + #ifdef CONFIG_MODULES + if (res == NULL) { + genl_unlock(); ++ up_read(&cb_lock); + request_module("net-pf-%d-proto-%d-family-%s", + PF_NETLINK, NETLINK_GENERIC, name); ++ down_read(&cb_lock); + genl_lock(); + res = genl_family_find_byname(name); + } diff --git a/queue-3.10/ipv6-take-rtnl_lock-and-mark-mrt6-table-as-freed-on-namespace-cleanup.patch b/queue-3.10/ipv6-take-rtnl_lock-and-mark-mrt6-table-as-freed-on-namespace-cleanup.patch new file mode 100644 index 00000000000..94e12757bab --- /dev/null +++ b/queue-3.10/ipv6-take-rtnl_lock-and-mark-mrt6-table-as-freed-on-namespace-cleanup.patch @@ -0,0 +1,94 @@ +From 611d77e7e12e173caaa266b503bab54dbaf08139 Mon Sep 17 00:00:00 2001 +From: Hannes Frederic Sowa +Date: Mon, 22 Jul 2013 23:45:53 +0200 +Subject: ipv6: take rtnl_lock and mark mrt6 table as freed on namespace cleanup + +From: Hannes Frederic Sowa + +[ Upstream commit 905a6f96a1b18e490a75f810d733ced93c39b0e5 ] + +Otherwise we end up dereferencing the already freed net->ipv6.mrt pointer +which leads to a panic (from Srivatsa S. Bhat): + +BUG: unable to handle kernel paging request at ffff882018552020 +IP: [] ip6mr_sk_done+0x32/0xb0 [ipv6] +PGD 290a067 PUD 207ffe0067 PMD 207ff1d067 PTE 8000002018552060 +Oops: 0000 [#1] SMP DEBUG_PAGEALLOC +Modules linked in: ebtable_nat ebtables nfs fscache nf_conntrack_ipv4 nf_defrag_ipv4 ipt_REJECT xt_CHECKSUM iptable_mangle iptable_filter ip_tables nfsd lockd nfs_acl exportfs auth_rpcgss autofs4 sunrpc 8021q garp bridge stp llc ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 xt_state nf_conntrack ip6table_filter ++ip6_tables ipv6 vfat fat vhost_net macvtap macvlan vhost tun kvm_intel kvm uinput iTCO_wdt iTCO_vendor_support cdc_ether usbnet mii microcode i2c_i801 i2c_core lpc_ich mfd_core shpchp ioatdma dca mlx4_core be2net wmi acpi_cpufreq mperf ext4 jbd2 mbcache dm_mirror dm_region_hash dm_log dm_mod +CPU: 0 PID: 7 Comm: kworker/u33:0 Not tainted 3.11.0-rc1-ea45e-a #4 +Hardware name: IBM -[8737R2A]-/00Y2738, BIOS -[B2E120RUS-1.20]- 11/30/2012 +Workqueue: netns cleanup_net +task: ffff8810393641c0 ti: ffff881039366000 task.ti: ffff881039366000 +RIP: 0010:[] [] ip6mr_sk_done+0x32/0xb0 [ipv6] +RSP: 0018:ffff881039367bd8 EFLAGS: 00010286 +RAX: ffff881039367fd8 RBX: ffff882018552000 RCX: dead000000200200 +RDX: 0000000000000000 RSI: ffff881039367b68 RDI: ffff881039367b68 +RBP: ffff881039367bf8 R08: ffff881039367b68 R09: 2222222222222222 +R10: 2222222222222222 R11: 2222222222222222 R12: ffff882015a7a040 +R13: ffff882014eb89c0 R14: ffff8820289e2800 R15: 0000000000000000 +FS: 0000000000000000(0000) GS:ffff88103fc00000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: ffff882018552020 CR3: 0000000001c0b000 CR4: 00000000000407f0 +Stack: + ffff881039367c18 ffff882014eb89c0 ffff882015e28c00 0000000000000000 + ffff881039367c18 ffffffffa034d9d1 ffff8820289e2800 ffff882014eb89c0 + ffff881039367c58 ffffffff815bdecb ffffffff815bddf2 ffff882014eb89c0 +Call Trace: + [] rawv6_close+0x21/0x40 [ipv6] + [] inet_release+0xfb/0x220 + [] ? inet_release+0x22/0x220 + [] inet6_release+0x3f/0x50 [ipv6] + [] sock_release+0x29/0xa0 + [] sk_release_kernel+0x30/0x70 + [] icmpv6_sk_exit+0x3b/0x80 [ipv6] + [] ops_exit_list+0x39/0x60 + [] cleanup_net+0xfb/0x1a0 + [] process_one_work+0x1da/0x610 + [] ? process_one_work+0x169/0x610 + [] worker_thread+0x120/0x3a0 + [] ? process_one_work+0x610/0x610 + [] kthread+0xee/0x100 + [] ? __init_kthread_worker+0x70/0x70 + [] ret_from_fork+0x7c/0xb0 + [] ? __init_kthread_worker+0x70/0x70 +Code: 20 48 89 5d e8 4c 89 65 f0 4c 89 6d f8 66 66 66 66 90 4c 8b 67 30 49 89 fd e8 db 3c 1e e1 49 8b 9c 24 90 08 00 00 48 85 db 74 06 <4c> 39 6b 20 74 20 bb f3 ff ff ff e8 8e 3c 1e e1 89 d8 4c 8b 65 +RIP [] ip6mr_sk_done+0x32/0xb0 [ipv6] + RSP +CR2: ffff882018552020 + +Reported-by: Srivatsa S. Bhat +Tested-by: Srivatsa S. Bhat +Signed-off-by: Hannes Frederic Sowa +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/ip6mr.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/net/ipv6/ip6mr.c ++++ b/net/ipv6/ip6mr.c +@@ -259,10 +259,12 @@ static void __net_exit ip6mr_rules_exit( + { + struct mr6_table *mrt, *next; + ++ rtnl_lock(); + list_for_each_entry_safe(mrt, next, &net->ipv6.mr6_tables, list) { + list_del(&mrt->list); + ip6mr_free_table(mrt); + } ++ rtnl_unlock(); + fib_rules_unregister(net->ipv6.mr6_rules_ops); + } + #else +@@ -289,7 +291,10 @@ static int __net_init ip6mr_rules_init(s + + static void __net_exit ip6mr_rules_exit(struct net *net) + { ++ rtnl_lock(); + ip6mr_free_table(net->ipv6.mrt6); ++ net->ipv6.mrt6 = NULL; ++ rtnl_unlock(); + } + #endif + diff --git a/queue-3.10/ndisc-add-missing-inline-to-ndisc_addr_option_pad.patch b/queue-3.10/ndisc-add-missing-inline-to-ndisc_addr_option_pad.patch new file mode 100644 index 00000000000..4e76fbe18d7 --- /dev/null +++ b/queue-3.10/ndisc-add-missing-inline-to-ndisc_addr_option_pad.patch @@ -0,0 +1,27 @@ +From 5dce790e0555436b087918988bbbd326b756249c Mon Sep 17 00:00:00 2001 +From: Joe Perches +Date: Tue, 30 Jul 2013 10:31:00 -0700 +Subject: ndisc: Add missing inline to ndisc_addr_option_pad + +From: Joe Perches + +[ Upstream commit d9d10a30964504af834d8d250a0c76d4ae91eb1e ] + +Signed-off-by: Joe Perches +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + include/net/ndisc.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/include/net/ndisc.h ++++ b/include/net/ndisc.h +@@ -119,7 +119,7 @@ extern struct ndisc_options *ndisc_parse + * if RFC 3831 IPv6-over-Fibre Channel is ever implemented it may + * also need a pad of 2. + */ +-static int ndisc_addr_option_pad(unsigned short type) ++static inline int ndisc_addr_option_pad(unsigned short type) + { + switch (type) { + case ARPHRD_INFINIBAND: return 2; diff --git a/queue-3.10/net-mlx4_core-don-t-give-vfs-mac-addresses-which-are-derived-from-the-pf-mac.patch b/queue-3.10/net-mlx4_core-don-t-give-vfs-mac-addresses-which-are-derived-from-the-pf-mac.patch new file mode 100644 index 00000000000..cf17a975f59 --- /dev/null +++ b/queue-3.10/net-mlx4_core-don-t-give-vfs-mac-addresses-which-are-derived-from-the-pf-mac.patch @@ -0,0 +1,42 @@ +From 53d4517253579a520aed8c897b175b2256b517b7 Mon Sep 17 00:00:00 2001 +From: Or Gerlitz +Date: Thu, 1 Aug 2013 19:55:00 +0300 +Subject: net/mlx4_core: Don't give VFs MAC addresses which are derived from the PF MAC + +From: Or Gerlitz + +[ Upstream commit 0508ad646836007e6e6b62331eee7356844eac3d ] + +If the user has not assigned a MAC address to a VM, then don't give it MAC which +is based on the PF one. The current derivation scheme is wrong and leads to VM +MAC collisions when the number of cards/hypervisors becomes big enough. + +Instead, just give it zeros and let them figure out what to do with that. + +Signed-off-by: Or Gerlitz +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlx4/fw.c | 11 +---------- + 1 file changed, 1 insertion(+), 10 deletions(-) + +--- a/drivers/net/ethernet/mellanox/mlx4/fw.c ++++ b/drivers/net/ethernet/mellanox/mlx4/fw.c +@@ -840,16 +840,7 @@ int mlx4_QUERY_PORT_wrapper(struct mlx4_ + MLX4_CMD_NATIVE); + + if (!err && dev->caps.function != slave) { +- /* if config MAC in DB use it */ +- if (priv->mfunc.master.vf_oper[slave].vport[vhcr->in_modifier].state.mac) +- def_mac = priv->mfunc.master.vf_oper[slave].vport[vhcr->in_modifier].state.mac; +- else { +- /* set slave default_mac address */ +- MLX4_GET(def_mac, outbox->buf, QUERY_PORT_MAC_OFFSET); +- def_mac += slave << 8; +- priv->mfunc.master.vf_admin[slave].vport[vhcr->in_modifier].mac = def_mac; +- } +- ++ def_mac = priv->mfunc.master.vf_oper[slave].vport[vhcr->in_modifier].state.mac; + MLX4_PUT(outbox->buf, def_mac, QUERY_PORT_MAC_OFFSET); + + /* get port type - currently only eth is enabled */ diff --git a/queue-3.10/net-mlx4_core-vfs-must-ignore-the-enable_64b_cqe_eqe-module-param.patch b/queue-3.10/net-mlx4_core-vfs-must-ignore-the-enable_64b_cqe_eqe-module-param.patch new file mode 100644 index 00000000000..eaecb0c805c --- /dev/null +++ b/queue-3.10/net-mlx4_core-vfs-must-ignore-the-enable_64b_cqe_eqe-module-param.patch @@ -0,0 +1,34 @@ +From 4b70714fca9f0c8de72451f091294ba26c5bf24b Mon Sep 17 00:00:00 2001 +From: Jack Morgenstein +Date: Thu, 1 Aug 2013 19:55:01 +0300 +Subject: net/mlx4_core: VFs must ignore the enable_64b_cqe_eqe module param + +From: Jack Morgenstein + +[ Upstream commit b30513202c6c14120f70b2e9aa1e97d47bbc2313 ] + +Slaves get the 64B CQE/EQE state from QUERY_HCA, not from the module parameter. + +If the parameter is set to zero, the slave outputs an incorrect/irrelevant +warning message that 64B CQEs/EQEs are supported but not enabled (even if the +hypervisor has enabled 64B CQEs/EQEs). + +Signed-off-by: Jack Morgenstein +Signed-off-by: Or Gerlitz +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlx4/main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/mellanox/mlx4/main.c ++++ b/drivers/net/ethernet/mellanox/mlx4/main.c +@@ -371,7 +371,7 @@ static int mlx4_dev_cap(struct mlx4_dev + + dev->caps.sqp_demux = (mlx4_is_master(dev)) ? MLX4_MAX_NUM_SLAVES : 0; + +- if (!enable_64b_cqe_eqe) { ++ if (!enable_64b_cqe_eqe && !mlx4_is_slave(dev)) { + if (dev_cap->flags & + (MLX4_DEV_CAP_FLAG_64B_CQE | MLX4_DEV_CAP_FLAG_64B_EQE)) { + mlx4_warn(dev, "64B EQEs/CQEs supported by the device but not enabled\n"); diff --git a/queue-3.10/net_sched-fix-stack-info-leak-in-cbq_dump_wrr.patch b/queue-3.10/net_sched-fix-stack-info-leak-in-cbq_dump_wrr.patch new file mode 100644 index 00000000000..60c9172d0ee --- /dev/null +++ b/queue-3.10/net_sched-fix-stack-info-leak-in-cbq_dump_wrr.patch @@ -0,0 +1,31 @@ +From e0112818950ca4668db30a9919f1b252ee0f267b Mon Sep 17 00:00:00 2001 +From: "David S. Miller" +Date: Tue, 30 Jul 2013 00:16:21 -0700 +Subject: net_sched: Fix stack info leak in cbq_dump_wrr(). + +From: "David S. Miller" + +[ Upstream commit a0db856a95a29efb1c23db55c02d9f0ff4f0db48 ] + +Make sure the reserved fields, and padding (if any), are +fully initialized. + +Based upon a patch by Dan Carpenter and feedback from +Joe Perches. + +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/sched/sch_cbq.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/sched/sch_cbq.c ++++ b/net/sched/sch_cbq.c +@@ -1465,6 +1465,7 @@ static int cbq_dump_wrr(struct sk_buff * + unsigned char *b = skb_tail_pointer(skb); + struct tc_cbq_wrropt opt; + ++ memset(&opt, 0, sizeof(opt)); + opt.flags = 0; + opt.allot = cl->allot; + opt.priority = cl->priority + 1; diff --git a/queue-3.10/net_sched-info-leak-in-atm_tc_dump_class.patch b/queue-3.10/net_sched-info-leak-in-atm_tc_dump_class.patch new file mode 100644 index 00000000000..fd5a4a4bafd --- /dev/null +++ b/queue-3.10/net_sched-info-leak-in-atm_tc_dump_class.patch @@ -0,0 +1,29 @@ +From 6275c04a8e60f5e8b300964f63c94121bfc5c4a5 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Tue, 30 Jul 2013 13:23:39 +0300 +Subject: net_sched: info leak in atm_tc_dump_class() + +From: Dan Carpenter + +[ Upstream commit 8cb3b9c3642c0263d48f31d525bcee7170eedc20 ] + +The "pvc" struct has a hole after pvc.sap_family which is not cleared. + +Signed-off-by: Dan Carpenter +Reviewed-by: Jiri Pirko +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/sched/sch_atm.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/sched/sch_atm.c ++++ b/net/sched/sch_atm.c +@@ -605,6 +605,7 @@ static int atm_tc_dump_class(struct Qdis + struct sockaddr_atmpvc pvc; + int state; + ++ memset(&pvc, 0, sizeof(pvc)); + pvc.sap_family = AF_ATMPVC; + pvc.sap_addr.itf = flow->vcc->dev ? flow->vcc->dev->number : -1; + pvc.sap_addr.vpi = flow->vcc->vpi; diff --git a/queue-3.10/series b/queue-3.10/series index 1ba1760adc7..2371126dba4 100644 --- a/queue-3.10/series +++ b/queue-3.10/series @@ -85,3 +85,17 @@ workqueue-copy-workqueue_attrs-with-all-fields.patch userns-unshare_userns-cred-should-not-populate-cred-on-failure.patch x86-iommu-vt-d-expand-interrupt-remapping-quirk-to-cover-x58-chipset.patch spi-spi-davinci-fix-direction-in-dma_map_single.patch +arcnet-cleanup-sizeof-parameter.patch +sysctl-net-keep-tcp_syn_retries-inside-the-boundary.patch +sfc-enable-rx-scatter-for-flows-steered-by-rfs.patch +ipv6-take-rtnl_lock-and-mark-mrt6-table-as-freed-on-namespace-cleanup.patch +usbnet-do-not-pretend-to-support-sg-tso.patch +genetlink-release-cb_lock-before-requesting-additional-module.patch +net_sched-fix-stack-info-leak-in-cbq_dump_wrr.patch +af_key-more-info-leaks-in-pfkey-messages.patch +atl1c-use-custom-skb-allocator.patch +net_sched-info-leak-in-atm_tc_dump_class.patch +ndisc-add-missing-inline-to-ndisc_addr_option_pad.patch +8139cp-add-dma_mapping_error-checking.patch +net-mlx4_core-don-t-give-vfs-mac-addresses-which-are-derived-from-the-pf-mac.patch +net-mlx4_core-vfs-must-ignore-the-enable_64b_cqe_eqe-module-param.patch diff --git a/queue-3.10/sfc-enable-rx-scatter-for-flows-steered-by-rfs.patch b/queue-3.10/sfc-enable-rx-scatter-for-flows-steered-by-rfs.patch new file mode 100644 index 00000000000..cdb72df1e45 --- /dev/null +++ b/queue-3.10/sfc-enable-rx-scatter-for-flows-steered-by-rfs.patch @@ -0,0 +1,34 @@ +From 23e050350e7460f1289d65651bfdd1d1f5663a9e Mon Sep 17 00:00:00 2001 +From: Ben Hutchings +Date: Tue, 23 Jul 2013 00:17:25 +0100 +Subject: sfc: Enable RX scatter for flows steered by RFS + +From: Ben Hutchings + +[ Upstream commit 7aa0076c497d6f0d5d957b431d0d80e1e9780274 ] + +Received packets are only scattered if this is enabled in both the +matching filter and the receiving queue. This was not being done for +filters inserted for RFS, so any packet requiring more than a single +descriptor was dropped. + +Signed-off-by: Ben Hutchings +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/sfc/filter.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/sfc/filter.c ++++ b/drivers/net/ethernet/sfc/filter.c +@@ -1196,7 +1196,9 @@ int efx_filter_rfs(struct net_device *ne + EFX_BUG_ON_PARANOID(skb_headlen(skb) < nhoff + 4 * ip->ihl + 4); + ports = (const __be16 *)(skb->data + nhoff + 4 * ip->ihl); + +- efx_filter_init_rx(&spec, EFX_FILTER_PRI_HINT, 0, rxq_index); ++ efx_filter_init_rx(&spec, EFX_FILTER_PRI_HINT, ++ efx->rx_scatter ? EFX_FILTER_FLAG_RX_SCATTER : 0, ++ rxq_index); + rc = efx_filter_set_ipv4_full(&spec, ip->protocol, + ip->daddr, ports[1], ip->saddr, ports[0]); + if (rc) diff --git a/queue-3.10/sysctl-net-keep-tcp_syn_retries-inside-the-boundary.patch b/queue-3.10/sysctl-net-keep-tcp_syn_retries-inside-the-boundary.patch new file mode 100644 index 00000000000..233d09f0179 --- /dev/null +++ b/queue-3.10/sysctl-net-keep-tcp_syn_retries-inside-the-boundary.patch @@ -0,0 +1,41 @@ +From 3f61e3472f3a999b825a8c925003f251fbba0995 Mon Sep 17 00:00:00 2001 +From: Michal Tesar +Date: Fri, 19 Jul 2013 14:09:01 +0200 +Subject: sysctl net: Keep tcp_syn_retries inside the boundary + +From: Michal Tesar + +[ Upstream commit 651e92716aaae60fc41b9652f54cb6803896e0da ] + +Limit the min/max value passed to the +/proc/sys/net/ipv4/tcp_syn_retries. + +Signed-off-by: Michal Tesar +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/sysctl_net_ipv4.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/net/ipv4/sysctl_net_ipv4.c ++++ b/net/ipv4/sysctl_net_ipv4.c +@@ -36,6 +36,8 @@ static int tcp_adv_win_scale_min = -31; + static int tcp_adv_win_scale_max = 31; + static int ip_ttl_min = 1; + static int ip_ttl_max = 255; ++static int tcp_syn_retries_min = 1; ++static int tcp_syn_retries_max = MAX_TCP_SYNCNT; + static int ip_ping_group_range_min[] = { 0, 0 }; + static int ip_ping_group_range_max[] = { GID_T_MAX, GID_T_MAX }; + +@@ -331,7 +333,9 @@ static struct ctl_table ipv4_table[] = { + .data = &sysctl_tcp_syn_retries, + .maxlen = sizeof(int), + .mode = 0644, +- .proc_handler = proc_dointvec ++ .proc_handler = proc_dointvec_minmax, ++ .extra1 = &tcp_syn_retries_min, ++ .extra2 = &tcp_syn_retries_max + }, + { + .procname = "tcp_synack_retries", diff --git a/queue-3.10/usbnet-do-not-pretend-to-support-sg-tso.patch b/queue-3.10/usbnet-do-not-pretend-to-support-sg-tso.patch new file mode 100644 index 00000000000..2d40b9c894c --- /dev/null +++ b/queue-3.10/usbnet-do-not-pretend-to-support-sg-tso.patch @@ -0,0 +1,107 @@ +From be7f6ab12c0cff03312ee9d534e1121097e5f638 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Tue, 23 Jul 2013 17:15:54 -0700 +Subject: usbnet: do not pretend to support SG/TSO + +From: Eric Dumazet + +[ Upstream commit 20f0170377264e8449b6987041f0bcc4d746d3ed ] + +usbnet doesn't support yet SG, so drivers should not advertise SG or TSO +capabilities, as they allow TCP stack to build large TSO packets that +need to be linearized and might use order-5 pages. + +This adds an extra copy overhead and possible allocation failures. + +Current code ignore skb_linearize() return code so crashes are even +possible. + +Best is to not pretend SG/TSO is supported, and add this again when/if +usbnet really supports SG for devices who could get a performance gain. + +Based on a prior patch from Freddy Xin + +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/ax88179_178a.c | 9 ++++----- + drivers/net/usb/smsc75xx.c | 12 +++--------- + 2 files changed, 7 insertions(+), 14 deletions(-) + +--- a/drivers/net/usb/ax88179_178a.c ++++ b/drivers/net/usb/ax88179_178a.c +@@ -1029,10 +1029,10 @@ static int ax88179_bind(struct usbnet *d + dev->mii.supports_gmii = 1; + + dev->net->features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM | +- NETIF_F_RXCSUM | NETIF_F_SG | NETIF_F_TSO; ++ NETIF_F_RXCSUM; + + dev->net->hw_features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM | +- NETIF_F_RXCSUM | NETIF_F_SG | NETIF_F_TSO; ++ NETIF_F_RXCSUM; + + /* Enable checksum offload */ + *tmp = AX_RXCOE_IP | AX_RXCOE_TCP | AX_RXCOE_UDP | +@@ -1173,7 +1173,6 @@ ax88179_tx_fixup(struct usbnet *dev, str + if (((skb->len + 8) % frame_size) == 0) + tx_hdr2 |= 0x80008000; /* Enable padding */ + +- skb_linearize(skb); + headroom = skb_headroom(skb); + tailroom = skb_tailroom(skb); + +@@ -1317,10 +1316,10 @@ static int ax88179_reset(struct usbnet * + 1, 1, tmp); + + dev->net->features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM | +- NETIF_F_RXCSUM | NETIF_F_SG | NETIF_F_TSO; ++ NETIF_F_RXCSUM; + + dev->net->hw_features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM | +- NETIF_F_RXCSUM | NETIF_F_SG | NETIF_F_TSO; ++ NETIF_F_RXCSUM; + + /* Enable checksum offload */ + *tmp = AX_RXCOE_IP | AX_RXCOE_TCP | AX_RXCOE_UDP | +--- a/drivers/net/usb/smsc75xx.c ++++ b/drivers/net/usb/smsc75xx.c +@@ -45,7 +45,6 @@ + #define EEPROM_MAC_OFFSET (0x01) + #define DEFAULT_TX_CSUM_ENABLE (true) + #define DEFAULT_RX_CSUM_ENABLE (true) +-#define DEFAULT_TSO_ENABLE (true) + #define SMSC75XX_INTERNAL_PHY_ID (1) + #define SMSC75XX_TX_OVERHEAD (8) + #define MAX_RX_FIFO_SIZE (20 * 1024) +@@ -1410,17 +1409,14 @@ static int smsc75xx_bind(struct usbnet * + + INIT_WORK(&pdata->set_multicast, smsc75xx_deferred_multicast_write); + +- if (DEFAULT_TX_CSUM_ENABLE) { ++ if (DEFAULT_TX_CSUM_ENABLE) + dev->net->features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM; +- if (DEFAULT_TSO_ENABLE) +- dev->net->features |= NETIF_F_SG | +- NETIF_F_TSO | NETIF_F_TSO6; +- } ++ + if (DEFAULT_RX_CSUM_ENABLE) + dev->net->features |= NETIF_F_RXCSUM; + + dev->net->hw_features = NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM | +- NETIF_F_SG | NETIF_F_TSO | NETIF_F_TSO6 | NETIF_F_RXCSUM; ++ NETIF_F_RXCSUM; + + ret = smsc75xx_wait_ready(dev, 0); + if (ret < 0) { +@@ -2200,8 +2196,6 @@ static struct sk_buff *smsc75xx_tx_fixup + { + u32 tx_cmd_a, tx_cmd_b; + +- skb_linearize(skb); +- + if (skb_headroom(skb) < SMSC75XX_TX_OVERHEAD) { + struct sk_buff *skb2 = + skb_copy_expand(skb, SMSC75XX_TX_OVERHEAD, 0, flags); -- 2.47.3