[pve-devel] [PATCH kernel 2/3] drop patches applied upstream
Fabian Grünbichler
f.gruenbichler at proxmox.com
Thu Mar 23 09:48:55 CET 2017
Signed-off-by: Fabian Grünbichler <f.gruenbichler at proxmox.com>
---
Makefile | 6 -
...rectly-reset-dest_map-vector-when-restori.patch | 68 ----
...001-TTY-n_hdlc-fix-lockdep-false-positive.patch | 111 -------
...02-tty-n_hdlc-get-rid-of-racy-n_hdlc.tbuf.patch | 319 ------------------
...reeing-skb-too-early-for-IPV6_RECVPKTINFO.patch | 58 ----
...ck-the-IB-LL-address-into-the-hard-header.patch | 365 ---------------------
6 files changed, 927 deletions(-)
delete mode 100644 0001-kvm-x86-correctly-reset-dest_map-vector-when-restori.patch
delete mode 100644 CVE-2017-2636-0001-TTY-n_hdlc-fix-lockdep-false-positive.patch
delete mode 100644 CVE-2017-2636-0002-tty-n_hdlc-get-rid-of-racy-n_hdlc.tbuf.patch
delete mode 100644 CVE-2017-6074-dccp-fix-freeing-skb-too-early-for-IPV6_RECVPKTINFO.patch
delete mode 100644 IB-ipoib-move-back-the-IB-LL-address-into-the-hard-header.patch
diff --git a/Makefile b/Makefile
index 6686c73..f8c2075 100644
--- a/Makefile
+++ b/Makefile
@@ -262,15 +262,9 @@ ${KERNEL_SRC}/README ${KERNEL_CFG_ORG}: ${KERNELSRCTAR}
cd ${KERNEL_SRC}; patch -p1 < ../watchdog_implement-mei-iamt-driver.patch
cd ${KERNEL_SRC}; patch -p1 < ../mei_drop-watchdog-code.patch
cd ${KERNEL_SRC}; patch -p1 < ../mei_bus-whitelist-watchdog-client.patch
- # IPoIB performance regression fix
- cd ${KERNEL_SRC}; patch -p1 < ../IB-ipoib-move-back-the-IB-LL-address-into-the-hard-header.patch
cd ${KERNEL_SRC}; patch -p1 < ../cgroup-cpuset-add-cpuset.remap_cpus.patch
- cd ${KERNEL_SRC}; patch -p1 < ../0001-kvm-x86-correctly-reset-dest_map-vector-when-restori.patch
cd ${KERNEL_SRC}; patch -p1 < ../CVE-2017-2596-kvm-page-reference-leakage-in-handle_vmon.patch
- cd ${KERNEL_SRC}; patch -p1 < ../CVE-2017-6074-dccp-fix-freeing-skb-too-early-for-IPV6_RECVPKTINFO.patch
cd ${KERNEL_SRC}; patch -p1 < ../Revert-intel_idle-Add-CPU-model-54-Atom-N2000-series.patch
- cd ${KERNEL_SRC}; patch -p1 < ../CVE-2017-2636-0001-TTY-n_hdlc-fix-lockdep-false-positive.patch
- cd ${KERNEL_SRC}; patch -p1 < ../CVE-2017-2636-0002-tty-n_hdlc-get-rid-of-racy-n_hdlc.tbuf.patch
sed -i ${KERNEL_SRC}/Makefile -e 's/^EXTRAVERSION.*$$/EXTRAVERSION=${EXTRAVERSION}/'
touch $@
diff --git a/0001-kvm-x86-correctly-reset-dest_map-vector-when-restori.patch b/0001-kvm-x86-correctly-reset-dest_map-vector-when-restori.patch
deleted file mode 100644
index da9f4f8..0000000
--- a/0001-kvm-x86-correctly-reset-dest_map-vector-when-restori.patch
+++ /dev/null
@@ -1,68 +0,0 @@
-From b0eaf4506f5f95d15d6731d72c0ddf4a2179eefa Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini at redhat.com>
-Date: Wed, 14 Sep 2016 23:39:12 +0200
-Subject: [PATCH] kvm: x86: correctly reset dest_map->vector when restoring
- LAPIC state
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-When userspace sends KVM_SET_LAPIC, KVM schedules a check between
-the vCPU's IRR and ISR and the IOAPIC redirection table, in order
-to re-establish the IOAPIC's dest_map (the list of CPUs servicing
-the real-time clock interrupt with the corresponding vectors).
-
-However, __rtc_irq_eoi_tracking_restore_one was forgetting to
-set dest_map->vectors. Because of this, the IOAPIC did not process
-the real-time clock interrupt EOI, ioapic->rtc_status.pending_eoi
-got stuck at a non-zero value, and further RTC interrupts were
-reported to userspace as coalesced.
-
-Fixes: 9e4aabe2bb3454c83dac8139cf9974503ee044db
-Fixes: 4d99ba898dd0c521ca6cdfdde55c9b58aea3cb3d
-Cc: stable at vger.kernel.org
-Cc: Joerg Roedel <jroedel at suse.de>
-Cc: David Gilbert <dgilbert at redhat.com>
-Reviewed-by: Radim Krčmář <rkrcmar at redhat.com>
-Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
-Signed-off-by: Fabian Grünbichler <f.gruenbichler at proxmox.com>
----
- arch/x86/kvm/ioapic.c | 8 +++++---
- 1 file changed, 5 insertions(+), 3 deletions(-)
-
-diff --git a/arch/x86/kvm/ioapic.c b/arch/x86/kvm/ioapic.c
-index 5f42d03..c7220ba 100644
---- a/arch/x86/kvm/ioapic.c
-+++ b/arch/x86/kvm/ioapic.c
-@@ -109,6 +109,7 @@ static void __rtc_irq_eoi_tracking_restore_one(struct kvm_vcpu *vcpu)
- {
- bool new_val, old_val;
- struct kvm_ioapic *ioapic = vcpu->kvm->arch.vioapic;
-+ struct dest_map *dest_map = &ioapic->rtc_status.dest_map;
- union kvm_ioapic_redirect_entry *e;
-
- e = &ioapic->redirtbl[RTC_GSI];
-@@ -117,16 +118,17 @@ static void __rtc_irq_eoi_tracking_restore_one(struct kvm_vcpu *vcpu)
- return;
-
- new_val = kvm_apic_pending_eoi(vcpu, e->fields.vector);
-- old_val = test_bit(vcpu->vcpu_id, ioapic->rtc_status.dest_map.map);
-+ old_val = test_bit(vcpu->vcpu_id, dest_map->map);
-
- if (new_val == old_val)
- return;
-
- if (new_val) {
-- __set_bit(vcpu->vcpu_id, ioapic->rtc_status.dest_map.map);
-+ __set_bit(vcpu->vcpu_id, dest_map->map);
-+ dest_map->vectors[vcpu->vcpu_id] = e->fields.vector;
- ioapic->rtc_status.pending_eoi++;
- } else {
-- __clear_bit(vcpu->vcpu_id, ioapic->rtc_status.dest_map.map);
-+ __clear_bit(vcpu->vcpu_id, dest_map->map);
- ioapic->rtc_status.pending_eoi--;
- rtc_status_pending_eoi_check_valid(ioapic);
- }
---
-2.1.4
-
diff --git a/CVE-2017-2636-0001-TTY-n_hdlc-fix-lockdep-false-positive.patch b/CVE-2017-2636-0001-TTY-n_hdlc-fix-lockdep-false-positive.patch
deleted file mode 100644
index 6a64b82..0000000
--- a/CVE-2017-2636-0001-TTY-n_hdlc-fix-lockdep-false-positive.patch
+++ /dev/null
@@ -1,111 +0,0 @@
-From c1c6bc86390390ba07618328909a9eb881ef6ace Mon Sep 17 00:00:00 2001
-From: Jiri Slaby <jslaby at suse.cz>
-Date: Thu, 26 Nov 2015 19:28:26 +0100
-Subject: [PATCH 1/2] TTY: n_hdlc, fix lockdep false positive
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-The class of 4 n_hdls buf locks is the same because a single function
-n_hdlc_buf_list_init is used to init all the locks. But since
-flush_tx_queue takes n_hdlc->tx_buf_list.spinlock and then calls
-n_hdlc_buf_put which takes n_hdlc->tx_free_buf_list.spinlock, lockdep
-emits a warning:
-=============================================
-[ INFO: possible recursive locking detected ]
-4.3.0-25.g91e30a7-default #1 Not tainted
----------------------------------------------
-a.out/1248 is trying to acquire lock:
- (&(&list->spinlock)->rlock){......}, at: [<ffffffffa01fd020>] n_hdlc_buf_put+0x20/0x60 [n_hdlc]
-
-but task is already holding lock:
- (&(&list->spinlock)->rlock){......}, at: [<ffffffffa01fdc07>] n_hdlc_tty_ioctl+0x127/0x1d0 [n_hdlc]
-
-other info that might help us debug this:
- Possible unsafe locking scenario:
-
- CPU0
- ----
- lock(&(&list->spinlock)->rlock);
- lock(&(&list->spinlock)->rlock);
-
- *** DEADLOCK ***
-
- May be due to missing lock nesting notation
-
-2 locks held by a.out/1248:
- #0: (&tty->ldisc_sem){++++++}, at: [<ffffffff814c9eb0>] tty_ldisc_ref_wait+0x20/0x50
- #1: (&(&list->spinlock)->rlock){......}, at: [<ffffffffa01fdc07>] n_hdlc_tty_ioctl+0x127/0x1d0 [n_hdlc]
-...
-Call Trace:
-...
- [<ffffffff81738fd0>] _raw_spin_lock_irqsave+0x50/0x70
- [<ffffffffa01fd020>] n_hdlc_buf_put+0x20/0x60 [n_hdlc]
- [<ffffffffa01fdc24>] n_hdlc_tty_ioctl+0x144/0x1d0 [n_hdlc]
- [<ffffffff814c25c1>] tty_ioctl+0x3f1/0xe40
-...
-
-Fix it by initializing the spin_locks separately. This removes also
-reduntand memset of a freshly kzallocated space.
-
-Signed-off-by: Jiri Slaby <jslaby at suse.cz>
-Reported-by: Dmitry Vyukov <dvyukov at google.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
-
-CVE-2017-2636
-
-(cherry-picked from e9b736d88af1a143530565929390cadf036dc799 upstream)
-Signed-off-by: Stefan Bader <stefan.bader at canonical.com>
-
-Signed-off-by: Fabian Grünbichler <f.gruenbichler at proxmox.com>
----
- drivers/tty/n_hdlc.c | 19 ++++---------------
- 1 file changed, 4 insertions(+), 15 deletions(-)
-
-diff --git a/drivers/tty/n_hdlc.c b/drivers/tty/n_hdlc.c
-index 644ddb8..a7fa016 100644
---- a/drivers/tty/n_hdlc.c
-+++ b/drivers/tty/n_hdlc.c
-@@ -159,7 +159,6 @@ struct n_hdlc {
- /*
- * HDLC buffer list manipulation functions
- */
--static void n_hdlc_buf_list_init(struct n_hdlc_buf_list *list);
- static void n_hdlc_buf_put(struct n_hdlc_buf_list *list,
- struct n_hdlc_buf *buf);
- static struct n_hdlc_buf *n_hdlc_buf_get(struct n_hdlc_buf_list *list);
-@@ -853,10 +852,10 @@ static struct n_hdlc *n_hdlc_alloc(void)
- if (!n_hdlc)
- return NULL;
-
-- n_hdlc_buf_list_init(&n_hdlc->rx_free_buf_list);
-- n_hdlc_buf_list_init(&n_hdlc->tx_free_buf_list);
-- n_hdlc_buf_list_init(&n_hdlc->rx_buf_list);
-- n_hdlc_buf_list_init(&n_hdlc->tx_buf_list);
-+ spin_lock_init(&n_hdlc->rx_free_buf_list.spinlock);
-+ spin_lock_init(&n_hdlc->tx_free_buf_list.spinlock);
-+ spin_lock_init(&n_hdlc->rx_buf_list.spinlock);
-+ spin_lock_init(&n_hdlc->tx_buf_list.spinlock);
-
- /* allocate free rx buffer list */
- for(i=0;i<DEFAULT_RX_BUF_COUNT;i++) {
-@@ -885,16 +884,6 @@ static struct n_hdlc *n_hdlc_alloc(void)
- } /* end of n_hdlc_alloc() */
-
- /**
-- * n_hdlc_buf_list_init - initialize specified HDLC buffer list
-- * @list - pointer to buffer list
-- */
--static void n_hdlc_buf_list_init(struct n_hdlc_buf_list *list)
--{
-- memset(list, 0, sizeof(*list));
-- spin_lock_init(&list->spinlock);
--} /* end of n_hdlc_buf_list_init() */
--
--/**
- * n_hdlc_buf_put - add specified HDLC buffer to tail of specified list
- * @list - pointer to buffer list
- * @buf - pointer to buffer
---
-2.1.4
-
diff --git a/CVE-2017-2636-0002-tty-n_hdlc-get-rid-of-racy-n_hdlc.tbuf.patch b/CVE-2017-2636-0002-tty-n_hdlc-get-rid-of-racy-n_hdlc.tbuf.patch
deleted file mode 100644
index 5c14529..0000000
--- a/CVE-2017-2636-0002-tty-n_hdlc-get-rid-of-racy-n_hdlc.tbuf.patch
+++ /dev/null
@@ -1,319 +0,0 @@
-From 579abe8dfc6c4e87577fcd43f7afdf79f2ce6102 Mon Sep 17 00:00:00 2001
-From: Alexander Popov <alex.popov at linux.com>
-Date: Wed, 1 Mar 2017 13:31:58 -0800
-Subject: [PATCH 2/2] tty: n_hdlc: get rid of racy n_hdlc.tbuf
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Currently N_HDLC line discipline uses a self-made singly linked list for
-data buffers and has n_hdlc.tbuf pointer for buffer retransmitting after
-an error.
-
-The commit be10eb7589337e5defbe214dae038a53dd21add8
-("tty: n_hdlc add buffer flushing") introduced racy access to n_hdlc.tbuf.
-After tx error concurrent flush_tx_queue() and n_hdlc_send_frames() can put
-one data buffer to tx_free_buf_list twice. That causes double free in
-n_hdlc_release().
-
-Let's use standard kernel linked list and get rid of n_hdlc.tbuf:
-in case of tx error put current data buffer after the head of tx_buf_list.
-
-Signed-off-by: Alexander Popov <alex.popov at linux.com>
-
-CVE-2017-2636
-
-Signed-off-by: Stefan Bader <stefan.bader at canonical.com>
-Signed-off-by: Fabian Grünbichler <f.gruenbichler at proxmox.com>
----
- drivers/tty/n_hdlc.c | 132 +++++++++++++++++++++++++++------------------------
- 1 file changed, 69 insertions(+), 63 deletions(-)
-
-diff --git a/drivers/tty/n_hdlc.c b/drivers/tty/n_hdlc.c
-index a7fa016..6d1e2f7 100644
---- a/drivers/tty/n_hdlc.c
-+++ b/drivers/tty/n_hdlc.c
-@@ -114,7 +114,7 @@
- #define DEFAULT_TX_BUF_COUNT 3
-
- struct n_hdlc_buf {
-- struct n_hdlc_buf *link;
-+ struct list_head list_item;
- int count;
- char buf[1];
- };
-@@ -122,8 +122,7 @@ struct n_hdlc_buf {
- #define N_HDLC_BUF_SIZE (sizeof(struct n_hdlc_buf) + maxframe)
-
- struct n_hdlc_buf_list {
-- struct n_hdlc_buf *head;
-- struct n_hdlc_buf *tail;
-+ struct list_head list;
- int count;
- spinlock_t spinlock;
- };
-@@ -136,7 +135,6 @@ struct n_hdlc_buf_list {
- * @backup_tty - TTY to use if tty gets closed
- * @tbusy - reentrancy flag for tx wakeup code
- * @woke_up - FIXME: describe this field
-- * @tbuf - currently transmitting tx buffer
- * @tx_buf_list - list of pending transmit frame buffers
- * @rx_buf_list - list of received frame buffers
- * @tx_free_buf_list - list unused transmit frame buffers
-@@ -149,7 +147,6 @@ struct n_hdlc {
- struct tty_struct *backup_tty;
- int tbusy;
- int woke_up;
-- struct n_hdlc_buf *tbuf;
- struct n_hdlc_buf_list tx_buf_list;
- struct n_hdlc_buf_list rx_buf_list;
- struct n_hdlc_buf_list tx_free_buf_list;
-@@ -159,6 +156,8 @@ struct n_hdlc {
- /*
- * HDLC buffer list manipulation functions
- */
-+static void n_hdlc_buf_return(struct n_hdlc_buf_list *buf_list,
-+ struct n_hdlc_buf *buf);
- static void n_hdlc_buf_put(struct n_hdlc_buf_list *list,
- struct n_hdlc_buf *buf);
- static struct n_hdlc_buf *n_hdlc_buf_get(struct n_hdlc_buf_list *list);
-@@ -208,16 +207,9 @@ static void flush_tx_queue(struct tty_struct *tty)
- {
- struct n_hdlc *n_hdlc = tty2n_hdlc(tty);
- struct n_hdlc_buf *buf;
-- unsigned long flags;
-
- while ((buf = n_hdlc_buf_get(&n_hdlc->tx_buf_list)))
- n_hdlc_buf_put(&n_hdlc->tx_free_buf_list, buf);
-- spin_lock_irqsave(&n_hdlc->tx_buf_list.spinlock, flags);
-- if (n_hdlc->tbuf) {
-- n_hdlc_buf_put(&n_hdlc->tx_free_buf_list, n_hdlc->tbuf);
-- n_hdlc->tbuf = NULL;
-- }
-- spin_unlock_irqrestore(&n_hdlc->tx_buf_list.spinlock, flags);
- }
-
- static struct tty_ldisc_ops n_hdlc_ldisc = {
-@@ -283,7 +275,6 @@ static void n_hdlc_release(struct n_hdlc *n_hdlc)
- } else
- break;
- }
-- kfree(n_hdlc->tbuf);
- kfree(n_hdlc);
-
- } /* end of n_hdlc_release() */
-@@ -402,13 +393,7 @@ static void n_hdlc_send_frames(struct n_hdlc *n_hdlc, struct tty_struct *tty)
- n_hdlc->woke_up = 0;
- spin_unlock_irqrestore(&n_hdlc->tx_buf_list.spinlock, flags);
-
-- /* get current transmit buffer or get new transmit */
-- /* buffer from list of pending transmit buffers */
--
-- tbuf = n_hdlc->tbuf;
-- if (!tbuf)
-- tbuf = n_hdlc_buf_get(&n_hdlc->tx_buf_list);
--
-+ tbuf = n_hdlc_buf_get(&n_hdlc->tx_buf_list);
- while (tbuf) {
- if (debuglevel >= DEBUG_LEVEL_INFO)
- printk("%s(%d)sending frame %p, count=%d\n",
-@@ -420,7 +405,7 @@ static void n_hdlc_send_frames(struct n_hdlc *n_hdlc, struct tty_struct *tty)
-
- /* rollback was possible and has been done */
- if (actual == -ERESTARTSYS) {
-- n_hdlc->tbuf = tbuf;
-+ n_hdlc_buf_return(&n_hdlc->tx_buf_list, tbuf);
- break;
- }
- /* if transmit error, throw frame away by */
-@@ -435,10 +420,7 @@ static void n_hdlc_send_frames(struct n_hdlc *n_hdlc, struct tty_struct *tty)
-
- /* free current transmit buffer */
- n_hdlc_buf_put(&n_hdlc->tx_free_buf_list, tbuf);
--
-- /* this tx buffer is done */
-- n_hdlc->tbuf = NULL;
--
-+
- /* wait up sleeping writers */
- wake_up_interruptible(&tty->write_wait);
-
-@@ -448,10 +430,12 @@ static void n_hdlc_send_frames(struct n_hdlc *n_hdlc, struct tty_struct *tty)
- if (debuglevel >= DEBUG_LEVEL_INFO)
- printk("%s(%d)frame %p pending\n",
- __FILE__,__LINE__,tbuf);
--
-- /* buffer not accepted by driver */
-- /* set this buffer as pending buffer */
-- n_hdlc->tbuf = tbuf;
-+
-+ /*
-+ * the buffer was not accepted by driver,
-+ * return it back into tx queue
-+ */
-+ n_hdlc_buf_return(&n_hdlc->tx_buf_list, tbuf);
- break;
- }
- }
-@@ -749,7 +733,8 @@ static int n_hdlc_tty_ioctl(struct tty_struct *tty, struct file *file,
- int error = 0;
- int count;
- unsigned long flags;
--
-+ struct n_hdlc_buf *buf = NULL;
-+
- if (debuglevel >= DEBUG_LEVEL_INFO)
- printk("%s(%d)n_hdlc_tty_ioctl() called %d\n",
- __FILE__,__LINE__,cmd);
-@@ -763,8 +748,10 @@ static int n_hdlc_tty_ioctl(struct tty_struct *tty, struct file *file,
- /* report count of read data available */
- /* in next available frame (if any) */
- spin_lock_irqsave(&n_hdlc->rx_buf_list.spinlock,flags);
-- if (n_hdlc->rx_buf_list.head)
-- count = n_hdlc->rx_buf_list.head->count;
-+ buf = list_first_entry_or_null(&n_hdlc->rx_buf_list.list,
-+ struct n_hdlc_buf, list_item);
-+ if (buf)
-+ count = buf->count;
- else
- count = 0;
- spin_unlock_irqrestore(&n_hdlc->rx_buf_list.spinlock,flags);
-@@ -776,8 +763,10 @@ static int n_hdlc_tty_ioctl(struct tty_struct *tty, struct file *file,
- count = tty_chars_in_buffer(tty);
- /* add size of next output frame in queue */
- spin_lock_irqsave(&n_hdlc->tx_buf_list.spinlock,flags);
-- if (n_hdlc->tx_buf_list.head)
-- count += n_hdlc->tx_buf_list.head->count;
-+ buf = list_first_entry_or_null(&n_hdlc->tx_buf_list.list,
-+ struct n_hdlc_buf, list_item);
-+ if (buf)
-+ count += buf->count;
- spin_unlock_irqrestore(&n_hdlc->tx_buf_list.spinlock,flags);
- error = put_user(count, (int __user *)arg);
- break;
-@@ -825,14 +814,14 @@ static unsigned int n_hdlc_tty_poll(struct tty_struct *tty, struct file *filp,
- poll_wait(filp, &tty->write_wait, wait);
-
- /* set bits for operations that won't block */
-- if (n_hdlc->rx_buf_list.head)
-+ if (!list_empty(&n_hdlc->rx_buf_list.list))
- mask |= POLLIN | POLLRDNORM; /* readable */
- if (test_bit(TTY_OTHER_CLOSED, &tty->flags))
- mask |= POLLHUP;
- if (tty_hung_up_p(filp))
- mask |= POLLHUP;
- if (!tty_is_writelocked(tty) &&
-- n_hdlc->tx_free_buf_list.head)
-+ !list_empty(&n_hdlc->tx_free_buf_list.list))
- mask |= POLLOUT | POLLWRNORM; /* writable */
- }
- return mask;
-@@ -856,7 +845,12 @@ static struct n_hdlc *n_hdlc_alloc(void)
- spin_lock_init(&n_hdlc->tx_free_buf_list.spinlock);
- spin_lock_init(&n_hdlc->rx_buf_list.spinlock);
- spin_lock_init(&n_hdlc->tx_buf_list.spinlock);
--
-+
-+ INIT_LIST_HEAD(&n_hdlc->rx_free_buf_list.list);
-+ INIT_LIST_HEAD(&n_hdlc->tx_free_buf_list.list);
-+ INIT_LIST_HEAD(&n_hdlc->rx_buf_list.list);
-+ INIT_LIST_HEAD(&n_hdlc->tx_buf_list.list);
-+
- /* allocate free rx buffer list */
- for(i=0;i<DEFAULT_RX_BUF_COUNT;i++) {
- buf = kmalloc(N_HDLC_BUF_SIZE, GFP_KERNEL);
-@@ -884,53 +878,65 @@ static struct n_hdlc *n_hdlc_alloc(void)
- } /* end of n_hdlc_alloc() */
-
- /**
-+ * n_hdlc_buf_return - put the HDLC buffer after the head of the specified list
-+ * @buf_list - pointer to the buffer list
-+ * @buf - pointer to the buffer
-+ */
-+static void n_hdlc_buf_return(struct n_hdlc_buf_list *buf_list,
-+ struct n_hdlc_buf *buf)
-+{
-+ unsigned long flags;
-+
-+ spin_lock_irqsave(&buf_list->spinlock, flags);
-+
-+ list_add(&buf->list_item, &buf_list->list);
-+ buf_list->count++;
-+
-+ spin_unlock_irqrestore(&buf_list->spinlock, flags);
-+}
-+
-+/**
- * n_hdlc_buf_put - add specified HDLC buffer to tail of specified list
-- * @list - pointer to buffer list
-+ * @buf_list - pointer to buffer list
- * @buf - pointer to buffer
- */
--static void n_hdlc_buf_put(struct n_hdlc_buf_list *list,
-+static void n_hdlc_buf_put(struct n_hdlc_buf_list *buf_list,
- struct n_hdlc_buf *buf)
- {
- unsigned long flags;
-- spin_lock_irqsave(&list->spinlock,flags);
--
-- buf->link=NULL;
-- if (list->tail)
-- list->tail->link = buf;
-- else
-- list->head = buf;
-- list->tail = buf;
-- (list->count)++;
--
-- spin_unlock_irqrestore(&list->spinlock,flags);
--
-+
-+ spin_lock_irqsave(&buf_list->spinlock, flags);
-+
-+ list_add_tail(&buf->list_item, &buf_list->list);
-+ buf_list->count++;
-+
-+ spin_unlock_irqrestore(&buf_list->spinlock, flags);
- } /* end of n_hdlc_buf_put() */
-
- /**
- * n_hdlc_buf_get - remove and return an HDLC buffer from list
-- * @list - pointer to HDLC buffer list
-+ * @buf_list - pointer to HDLC buffer list
- *
- * Remove and return an HDLC buffer from the head of the specified HDLC buffer
- * list.
- * Returns a pointer to HDLC buffer if available, otherwise %NULL.
- */
--static struct n_hdlc_buf* n_hdlc_buf_get(struct n_hdlc_buf_list *list)
-+static struct n_hdlc_buf *n_hdlc_buf_get(struct n_hdlc_buf_list *buf_list)
- {
- unsigned long flags;
- struct n_hdlc_buf *buf;
-- spin_lock_irqsave(&list->spinlock,flags);
--
-- buf = list->head;
-+
-+ spin_lock_irqsave(&buf_list->spinlock, flags);
-+
-+ buf = list_first_entry_or_null(&buf_list->list,
-+ struct n_hdlc_buf, list_item);
- if (buf) {
-- list->head = buf->link;
-- (list->count)--;
-+ list_del(&buf->list_item);
-+ buf_list->count--;
- }
-- if (!list->head)
-- list->tail = NULL;
--
-- spin_unlock_irqrestore(&list->spinlock,flags);
-+
-+ spin_unlock_irqrestore(&buf_list->spinlock, flags);
- return buf;
--
- } /* end of n_hdlc_buf_get() */
-
- static char hdlc_banner[] __initdata =
---
-2.1.4
-
diff --git a/CVE-2017-6074-dccp-fix-freeing-skb-too-early-for-IPV6_RECVPKTINFO.patch b/CVE-2017-6074-dccp-fix-freeing-skb-too-early-for-IPV6_RECVPKTINFO.patch
deleted file mode 100644
index 202aa59..0000000
--- a/CVE-2017-6074-dccp-fix-freeing-skb-too-early-for-IPV6_RECVPKTINFO.patch
+++ /dev/null
@@ -1,58 +0,0 @@
-From 4feb04ade2a559e0e76a0215d259c5673e5b1cbd Mon Sep 17 00:00:00 2001
-From: Andrey Konovalov <andreyknvl at google.com>
-Date: Thu, 16 Feb 2017 17:22:46 +0100
-Subject: [PATCH] dccp: fix freeing skb too early for IPV6_RECVPKTINFO
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-In the current DCCP implementation an skb for a DCCP_PKT_REQUEST packet
-is forcibly freed via __kfree_skb in dccp_rcv_state_process if
-dccp_v6_conn_request successfully returns.
-
-However, if IPV6_RECVPKTINFO is set on a socket, the address of the skb
-is saved to ireq->pktopts and the ref count for skb is incremented in
-dccp_v6_conn_request, so skb is still in use. Nevertheless, it gets freed
-in dccp_rcv_state_process.
-
-Fix by calling consume_skb instead of doing goto discard and therefore
-calling __kfree_skb.
-
-Similar fixes for TCP:
-
-fb7e2399ec17f1004c0e0ccfd17439f8759ede01 [TCP]: skb is unexpectedly freed.
-0aea76d35c9651d55bbaf746e7914e5f9ae5a25d tcp: SYN packets are now
-simply consumed
-
-Signed-off-by: Andrey Konovalov <andreyknvl at google.com>
-Acked-by: Eric Dumazet <edumazet at google.com>
-Signed-off-by: David S. Miller <davem at davemloft.net>
-
-CVE-2017-6074
-BugLink: http://bugs.launchpad.net/bugs/1665935
-
-(cherry-picked from 5edabca9d4cff7f1f2b68f0bac55ef99d9798ba4 davem)
-Signed-off-by: Stefan Bader <stefan.bader at canonical.com>
-
-Signed-off-by: Fabian Grünbichler <f.gruenbichler at proxmox.com>
----
- net/dccp/input.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/net/dccp/input.c b/net/dccp/input.c
-index 3bd14e8..dbe2573 100644
---- a/net/dccp/input.c
-+++ b/net/dccp/input.c
-@@ -606,7 +606,8 @@ int dccp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
- if (inet_csk(sk)->icsk_af_ops->conn_request(sk,
- skb) < 0)
- return 1;
-- goto discard;
-+ consume_skb(skb);
-+ return 0;
- }
- if (dh->dccph_type == DCCP_PKT_RESET)
- goto discard;
---
-2.1.4
-
diff --git a/IB-ipoib-move-back-the-IB-LL-address-into-the-hard-header.patch b/IB-ipoib-move-back-the-IB-LL-address-into-the-hard-header.patch
deleted file mode 100644
index 5b58edd..0000000
--- a/IB-ipoib-move-back-the-IB-LL-address-into-the-hard-header.patch
+++ /dev/null
@@ -1,365 +0,0 @@
-From patchwork Wed Oct 12 14:30:30 2016
-Content-Type: text/plain; charset="utf-8"
-MIME-Version: 1.0
-Content-Transfer-Encoding: 7bit
-Subject: [v2] IB/ipoib: move back IB LL address into the hard header
-From: Paolo Abeni <pabeni at redhat.com>
-X-Patchwork-Id: 681344
-X-Patchwork-Delegate: davem at davemloft.net
-Message-Id: <60efcf739ce3d45a01a7127dbaf7fe366e5ddce4.1476264804.git.pabeni at redhat.com>
-To: linux-rdma at vger.kernel.org
-Cc: Doug Ledford <dledford at redhat.com>, Sean Hefty <sean.hefty at intel.com>,
- Hal Rosenstock <hal.rosenstock at gmail.com>,
- Jason Gunthorpe <jgunthorpe at obsidianresearch.com>, netdev at vger.kernel.org
-Date: Wed, 12 Oct 2016 16:30:30 +0200
-
-After the commit 9207f9d45b0a ("net: preserve IP control block
-during GSO segmentation"), the GSO CB and the IPoIB CB conflict.
-That destroy the IPoIB address information cached there,
-causing a severe performance regression, as better described here:
-
-http://marc.info/?l=linux-kernel&m=146787279825501&w=2
-
-This change moves the data cached by the IPoIB driver from the
-skb control lock into the IPoIB hard header, as done before
-the commit 936d7de3d736 ("IPoIB: Stop lying about hard_header_len
-and use skb->cb to stash LL addresses").
-In order to avoid GRO issue, on packet reception, the IPoIB driver
-stash into the skb a dummy pseudo header, so that the received
-packets have actually a hard header matching the declared length.
-To avoid changing the connected mode maximum mtu, the allocated
-head buffer size is increased by the pseudo header length.
-
-After this commit, IPoIB performances are back to pre-regression
-value.
-
-v1 -> v2: avoid changing the max mtu, increasing the head buf size
-
-Fixes: 9207f9d45b0a ("net: preserve IP control block during GSO segmentation")
-Signed-off-by: Paolo Abeni <pabeni at redhat.com>
----
- drivers/infiniband/ulp/ipoib/ipoib.h | 20 +++++++---
- drivers/infiniband/ulp/ipoib/ipoib_cm.c | 15 +++----
- drivers/infiniband/ulp/ipoib/ipoib_ib.c | 12 +++---
- drivers/infiniband/ulp/ipoib/ipoib_main.c | 54 ++++++++++++++++----------
- drivers/infiniband/ulp/ipoib/ipoib_multicast.c | 6 ++-
- 5 files changed, 64 insertions(+), 43 deletions(-)
-
-diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h
-index 9dbfcc0..5ff64af 100644
---- a/drivers/infiniband/ulp/ipoib/ipoib.h
-+++ b/drivers/infiniband/ulp/ipoib/ipoib.h
-@@ -63,6 +63,8 @@ enum ipoib_flush_level {
-
- enum {
- IPOIB_ENCAP_LEN = 4,
-+ IPOIB_PSEUDO_LEN = 20,
-+ IPOIB_HARD_LEN = IPOIB_ENCAP_LEN + IPOIB_PSEUDO_LEN,
-
- IPOIB_UD_HEAD_SIZE = IB_GRH_BYTES + IPOIB_ENCAP_LEN,
- IPOIB_UD_RX_SG = 2, /* max buffer needed for 4K mtu */
-@@ -134,15 +136,21 @@ struct ipoib_header {
- u16 reserved;
- };
-
--struct ipoib_cb {
-- struct qdisc_skb_cb qdisc_cb;
-- u8 hwaddr[INFINIBAND_ALEN];
-+struct ipoib_pseudo_header {
-+ u8 hwaddr[INFINIBAND_ALEN];
- };
-
--static inline struct ipoib_cb *ipoib_skb_cb(const struct sk_buff *skb)
-+static inline void skb_add_pseudo_hdr(struct sk_buff *skb)
- {
-- BUILD_BUG_ON(sizeof(skb->cb) < sizeof(struct ipoib_cb));
-- return (struct ipoib_cb *)skb->cb;
-+ char *data = skb_push(skb, IPOIB_PSEUDO_LEN);
-+
-+ /*
-+ * only the ipoib header is present now, make room for a dummy
-+ * pseudo header and set skb field accordingly
-+ */
-+ memset(data, 0, IPOIB_PSEUDO_LEN);
-+ skb_reset_mac_header(skb);
-+ skb_pull(skb, IPOIB_HARD_LEN);
- }
-
- /* Used for all multicast joins (broadcast, IPv4 mcast and IPv6 mcast) */
-diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
-index 4ad297d..339a1ee 100644
---- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
-+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
-@@ -63,6 +63,8 @@ MODULE_PARM_DESC(cm_data_debug_level,
- #define IPOIB_CM_RX_DELAY (3 * 256 * HZ)
- #define IPOIB_CM_RX_UPDATE_MASK (0x3)
-
-+#define IPOIB_CM_RX_RESERVE (ALIGN(IPOIB_HARD_LEN, 16) - IPOIB_ENCAP_LEN)
-+
- static struct ib_qp_attr ipoib_cm_err_attr = {
- .qp_state = IB_QPS_ERR
- };
-@@ -146,15 +148,15 @@ static struct sk_buff *ipoib_cm_alloc_rx_skb(struct net_device *dev,
- struct sk_buff *skb;
- int i;
-
-- skb = dev_alloc_skb(IPOIB_CM_HEAD_SIZE + 12);
-+ skb = dev_alloc_skb(ALIGN(IPOIB_CM_HEAD_SIZE + IPOIB_PSEUDO_LEN, 16));
- if (unlikely(!skb))
- return NULL;
-
- /*
-- * IPoIB adds a 4 byte header. So we need 12 more bytes to align the
-+ * IPoIB adds a IPOIB_ENCAP_LEN byte header, this will align the
- * IP header to a multiple of 16.
- */
-- skb_reserve(skb, 12);
-+ skb_reserve(skb, IPOIB_CM_RX_RESERVE);
-
- mapping[0] = ib_dma_map_single(priv->ca, skb->data, IPOIB_CM_HEAD_SIZE,
- DMA_FROM_DEVICE);
-@@ -624,9 +626,9 @@ void ipoib_cm_handle_rx_wc(struct net_device *dev, struct ib_wc *wc)
- if (wc->byte_len < IPOIB_CM_COPYBREAK) {
- int dlen = wc->byte_len;
-
-- small_skb = dev_alloc_skb(dlen + 12);
-+ small_skb = dev_alloc_skb(dlen + IPOIB_CM_RX_RESERVE);
- if (small_skb) {
-- skb_reserve(small_skb, 12);
-+ skb_reserve(small_skb, IPOIB_CM_RX_RESERVE);
- ib_dma_sync_single_for_cpu(priv->ca, rx_ring[wr_id].mapping[0],
- dlen, DMA_FROM_DEVICE);
- skb_copy_from_linear_data(skb, small_skb->data, dlen);
-@@ -663,8 +665,7 @@ void ipoib_cm_handle_rx_wc(struct net_device *dev, struct ib_wc *wc)
-
- copied:
- skb->protocol = ((struct ipoib_header *) skb->data)->proto;
-- skb_reset_mac_header(skb);
-- skb_pull(skb, IPOIB_ENCAP_LEN);
-+ skb_add_pseudo_hdr(skb);
-
- ++dev->stats.rx_packets;
- dev->stats.rx_bytes += skb->len;
-diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
-index be11d5d..830fecb 100644
---- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
-+++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
-@@ -128,16 +128,15 @@ static struct sk_buff *ipoib_alloc_rx_skb(struct net_device *dev, int id)
-
- buf_size = IPOIB_UD_BUF_SIZE(priv->max_ib_mtu);
-
-- skb = dev_alloc_skb(buf_size + IPOIB_ENCAP_LEN);
-+ skb = dev_alloc_skb(buf_size + IPOIB_HARD_LEN);
- if (unlikely(!skb))
- return NULL;
-
- /*
-- * IB will leave a 40 byte gap for a GRH and IPoIB adds a 4 byte
-- * header. So we need 4 more bytes to get to 48 and align the
-- * IP header to a multiple of 16.
-+ * the IP header will be at IPOIP_HARD_LEN + IB_GRH_BYTES, that is
-+ * 64 bytes aligned
- */
-- skb_reserve(skb, 4);
-+ skb_reserve(skb, sizeof(struct ipoib_pseudo_header));
-
- mapping = priv->rx_ring[id].mapping;
- mapping[0] = ib_dma_map_single(priv->ca, skb->data, buf_size,
-@@ -253,8 +252,7 @@ static void ipoib_ib_handle_rx_wc(struct net_device *dev, struct ib_wc *wc)
- skb_pull(skb, IB_GRH_BYTES);
-
- skb->protocol = ((struct ipoib_header *) skb->data)->proto;
-- skb_reset_mac_header(skb);
-- skb_pull(skb, IPOIB_ENCAP_LEN);
-+ skb_add_pseudo_hdr(skb);
-
- ++dev->stats.rx_packets;
- dev->stats.rx_bytes += skb->len;
-diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
-index cc1c1b0..823a528 100644
---- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
-+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
-@@ -925,9 +925,12 @@ static void neigh_add_path(struct sk_buff *skb, u8 *daddr,
- ipoib_neigh_free(neigh);
- goto err_drop;
- }
-- if (skb_queue_len(&neigh->queue) < IPOIB_MAX_PATH_REC_QUEUE)
-+ if (skb_queue_len(&neigh->queue) <
-+ IPOIB_MAX_PATH_REC_QUEUE) {
-+ /* put pseudoheader back on for next time */
-+ skb_push(skb, IPOIB_PSEUDO_LEN);
- __skb_queue_tail(&neigh->queue, skb);
-- else {
-+ } else {
- ipoib_warn(priv, "queue length limit %d. Packet drop.\n",
- skb_queue_len(&neigh->queue));
- goto err_drop;
-@@ -964,7 +967,7 @@ err_drop:
- }
-
- static void unicast_arp_send(struct sk_buff *skb, struct net_device *dev,
-- struct ipoib_cb *cb)
-+ struct ipoib_pseudo_header *phdr)
- {
- struct ipoib_dev_priv *priv = netdev_priv(dev);
- struct ipoib_path *path;
-@@ -972,16 +975,18 @@ static void unicast_arp_send(struct sk_buff *skb, struct net_device *dev,
-
- spin_lock_irqsave(&priv->lock, flags);
-
-- path = __path_find(dev, cb->hwaddr + 4);
-+ path = __path_find(dev, phdr->hwaddr + 4);
- if (!path || !path->valid) {
- int new_path = 0;
-
- if (!path) {
-- path = path_rec_create(dev, cb->hwaddr + 4);
-+ path = path_rec_create(dev, phdr->hwaddr + 4);
- new_path = 1;
- }
- if (path) {
- if (skb_queue_len(&path->queue) < IPOIB_MAX_PATH_REC_QUEUE) {
-+ /* put pseudoheader back on for next time */
-+ skb_push(skb, IPOIB_PSEUDO_LEN);
- __skb_queue_tail(&path->queue, skb);
- } else {
- ++dev->stats.tx_dropped;
-@@ -1009,10 +1014,12 @@ static void unicast_arp_send(struct sk_buff *skb, struct net_device *dev,
- be16_to_cpu(path->pathrec.dlid));
-
- spin_unlock_irqrestore(&priv->lock, flags);
-- ipoib_send(dev, skb, path->ah, IPOIB_QPN(cb->hwaddr));
-+ ipoib_send(dev, skb, path->ah, IPOIB_QPN(phdr->hwaddr));
- return;
- } else if ((path->query || !path_rec_start(dev, path)) &&
- skb_queue_len(&path->queue) < IPOIB_MAX_PATH_REC_QUEUE) {
-+ /* put pseudoheader back on for next time */
-+ skb_push(skb, IPOIB_PSEUDO_LEN);
- __skb_queue_tail(&path->queue, skb);
- } else {
- ++dev->stats.tx_dropped;
-@@ -1026,13 +1033,15 @@ static int ipoib_start_xmit(struct sk_buff *skb, struct net_device *dev)
- {
- struct ipoib_dev_priv *priv = netdev_priv(dev);
- struct ipoib_neigh *neigh;
-- struct ipoib_cb *cb = ipoib_skb_cb(skb);
-+ struct ipoib_pseudo_header *phdr;
- struct ipoib_header *header;
- unsigned long flags;
-
-+ phdr = (struct ipoib_pseudo_header *) skb->data;
-+ skb_pull(skb, sizeof(*phdr));
- header = (struct ipoib_header *) skb->data;
-
-- if (unlikely(cb->hwaddr[4] == 0xff)) {
-+ if (unlikely(phdr->hwaddr[4] == 0xff)) {
- /* multicast, arrange "if" according to probability */
- if ((header->proto != htons(ETH_P_IP)) &&
- (header->proto != htons(ETH_P_IPV6)) &&
-@@ -1045,13 +1054,13 @@ static int ipoib_start_xmit(struct sk_buff *skb, struct net_device *dev)
- return NETDEV_TX_OK;
- }
- /* Add in the P_Key for multicast*/
-- cb->hwaddr[8] = (priv->pkey >> 8) & 0xff;
-- cb->hwaddr[9] = priv->pkey & 0xff;
-+ phdr->hwaddr[8] = (priv->pkey >> 8) & 0xff;
-+ phdr->hwaddr[9] = priv->pkey & 0xff;
-
-- neigh = ipoib_neigh_get(dev, cb->hwaddr);
-+ neigh = ipoib_neigh_get(dev, phdr->hwaddr);
- if (likely(neigh))
- goto send_using_neigh;
-- ipoib_mcast_send(dev, cb->hwaddr, skb);
-+ ipoib_mcast_send(dev, phdr->hwaddr, skb);
- return NETDEV_TX_OK;
- }
-
-@@ -1060,16 +1069,16 @@ static int ipoib_start_xmit(struct sk_buff *skb, struct net_device *dev)
- case htons(ETH_P_IP):
- case htons(ETH_P_IPV6):
- case htons(ETH_P_TIPC):
-- neigh = ipoib_neigh_get(dev, cb->hwaddr);
-+ neigh = ipoib_neigh_get(dev, phdr->hwaddr);
- if (unlikely(!neigh)) {
-- neigh_add_path(skb, cb->hwaddr, dev);
-+ neigh_add_path(skb, phdr->hwaddr, dev);
- return NETDEV_TX_OK;
- }
- break;
- case htons(ETH_P_ARP):
- case htons(ETH_P_RARP):
- /* for unicast ARP and RARP should always perform path find */
-- unicast_arp_send(skb, dev, cb);
-+ unicast_arp_send(skb, dev, phdr);
- return NETDEV_TX_OK;
- default:
- /* ethertype not supported by IPoIB */
-@@ -1086,11 +1095,13 @@ send_using_neigh:
- goto unref;
- }
- } else if (neigh->ah) {
-- ipoib_send(dev, skb, neigh->ah, IPOIB_QPN(cb->hwaddr));
-+ ipoib_send(dev, skb, neigh->ah, IPOIB_QPN(phdr->hwaddr));
- goto unref;
- }
-
- if (skb_queue_len(&neigh->queue) < IPOIB_MAX_PATH_REC_QUEUE) {
-+ /* put pseudoheader back on for next time */
-+ skb_push(skb, sizeof(*phdr));
- spin_lock_irqsave(&priv->lock, flags);
- __skb_queue_tail(&neigh->queue, skb);
- spin_unlock_irqrestore(&priv->lock, flags);
-@@ -1122,8 +1133,8 @@ static int ipoib_hard_header(struct sk_buff *skb,
- unsigned short type,
- const void *daddr, const void *saddr, unsigned len)
- {
-+ struct ipoib_pseudo_header *phdr;
- struct ipoib_header *header;
-- struct ipoib_cb *cb = ipoib_skb_cb(skb);
-
- header = (struct ipoib_header *) skb_push(skb, sizeof *header);
-
-@@ -1132,12 +1143,13 @@ static int ipoib_hard_header(struct sk_buff *skb,
-
- /*
- * we don't rely on dst_entry structure, always stuff the
-- * destination address into skb->cb so we can figure out where
-+ * destination address into skb hard header so we can figure out where
- * to send the packet later.
- */
-- memcpy(cb->hwaddr, daddr, INFINIBAND_ALEN);
-+ phdr = (struct ipoib_pseudo_header *) skb_push(skb, sizeof(*phdr));
-+ memcpy(phdr->hwaddr, daddr, INFINIBAND_ALEN);
-
-- return sizeof *header;
-+ return IPOIB_HARD_LEN;
- }
-
- static void ipoib_set_mcast_list(struct net_device *dev)
-@@ -1759,7 +1771,7 @@ void ipoib_setup(struct net_device *dev)
-
- dev->flags |= IFF_BROADCAST | IFF_MULTICAST;
-
-- dev->hard_header_len = IPOIB_ENCAP_LEN;
-+ dev->hard_header_len = IPOIB_HARD_LEN;
- dev->addr_len = INFINIBAND_ALEN;
- dev->type = ARPHRD_INFINIBAND;
- dev->tx_queue_len = ipoib_sendq_size * 2;
-diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
-index d3394b6..1909dd2 100644
---- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
-+++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
-@@ -796,9 +796,11 @@ void ipoib_mcast_send(struct net_device *dev, u8 *daddr, struct sk_buff *skb)
- __ipoib_mcast_add(dev, mcast);
- list_add_tail(&mcast->list, &priv->multicast_list);
- }
-- if (skb_queue_len(&mcast->pkt_queue) < IPOIB_MAX_MCAST_QUEUE)
-+ if (skb_queue_len(&mcast->pkt_queue) < IPOIB_MAX_MCAST_QUEUE) {
-+ /* put pseudoheader back on for next time */
-+ skb_push(skb, sizeof(struct ipoib_pseudo_header));
- skb_queue_tail(&mcast->pkt_queue, skb);
-- else {
-+ } else {
- ++dev->stats.tx_dropped;
- dev_kfree_skb_any(skb);
- }
--
2.1.4
More information about the pve-devel
mailing list