[1/3] gro: Fix handling of complete checksums in IPv6

[1/3] gro: Fix handling of complete checksums in IPv6

[Herbert Xu]

Hi Dave:

Here are three bug fixes for GRO.

The first one makes sure we don't penalise CHECKSUM_COMPLETE
drivers for doing the right thing.

gro: Fix handling of complete checksums in IPv6

We need to perform skb_postpull_rcsum after pulling the IPv6
header in order to maintain the correctness of the complete
checksum.

This patch also adds a missing iph reload after pulling.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 94f74f5..c802bc1 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -797,6 +797,7 @@ static struct sk_buff **ipv6_gro_receive(struct sk_buff **head,
 	unsigned int nlen;
 	int flush = 1;
 	int proto;
+	__wsum csum;
 
 	if (unlikely(!pskb_may_pull(skb, sizeof(*iph))))
 		goto out;
@@ -808,6 +809,7 @@ static struct sk_buff **ipv6_gro_receive(struct sk_buff **head,
 
 	rcu_read_lock();
 	proto = ipv6_gso_pull_exthdrs(skb, iph->nexthdr);
+	iph = ipv6_hdr(skb);
 	IPV6_GRO_CB(skb)->proto = proto;
 	ops = rcu_dereference(inet6_protos[proto]);
 	if (!ops || !ops->gro_receive)
@@ -839,8 +841,13 @@ static struct sk_buff **ipv6_gro_receive(struct sk_buff **head,
 
 	NAPI_GRO_CB(skb)->flush |= flush;
 
+	csum = skb->csum;
+	skb_postpull_rcsum(skb, iph, skb_network_header_len(skb));
+
 	pp = ops->gro_receive(head, skb);
 
+	skb->csum = csum;
+
 out_unlock:
 	rcu_read_unlock();

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

[2/3] gro: Fix error handling on extremely short frags

[Herbert Xu]

The second is a trivial error handling bug.

gro: Fix error handling on extremely short frags

When a frag is shorter than an Ethernet header, we'd return a
zeroed packet instead of aborting.  This patch fixes that.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

diff --git a/net/core/dev.c b/net/core/dev.c
index 4f69a2d..2fb3a00 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2514,6 +2514,7 @@ struct sk_buff *napi_fraginfo_skb(struct napi_struct *napi,
 
 	if (!pskb_may_pull(skb, ETH_HLEN)) {
 		napi_reuse_skb(napi, skb);
+		skb = NULL;
 		goto out;
 	}

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Re: [2/3] gro: Fix error handling on extremely short frags

[David Miller]

From: Herbert Xu <herbert@gondor.apana.org.au>
Date: Sun, 18 Jan 2009 16:47:18 +1100

> gro: Fix error handling on extremely short frags
> 
> When a frag is shorter than an Ethernet header, we'd return a
> zeroed packet instead of aborting.  This patch fixes that.
> 
> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

Applied.

[3/3] gro: Fix merging of paged packets

[Herbert Xu]

The third fixes a serious bug in a previous bug fix.

gro: Fix merging of paged packets

The previous fix to paged packets broke the merging because it
reset the skb->len before we added it to the merged packet.  This
wasn't detected because it simply resulted in the truncation of
the packet while the missing bit is subsequently retransmitted.

The fix is to store skb->len before we clobber it.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 65eac77..9127c47 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2588,8 +2588,9 @@ int skb_gro_receive(struct sk_buff **head, struct sk_buff *skb)
 	struct sk_buff *nskb;
 	unsigned int headroom;
 	unsigned int hlen = p->data - skb_mac_header(p);
+	unsigned int len = skb->len;
 
-	if (hlen + p->len + skb->len >= 65536)
+	if (hlen + p->len + len >= 65536)
 		return -E2BIG;
 
 	if (skb_shinfo(p)->frag_list)
@@ -2651,9 +2652,9 @@ merge:
 
 done:
 	NAPI_GRO_CB(p)->count++;
-	p->data_len += skb->len;
-	p->truesize += skb->len;
-	p->len += skb->len;
+	p->data_len += len;
+	p->truesize += len;
+	p->len += len;
 
 	NAPI_GRO_CB(skb)->same_flow = 1;
 	return 0;

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Re: [3/3] gro: Fix merging of paged packets

[David Miller]

From: Herbert Xu <herbert@gondor.apana.org.au>
Date: Sun, 18 Jan 2009 16:48:13 +1100

> gro: Fix merging of paged packets
> 
> The previous fix to paged packets broke the merging because it
> reset the skb->len before we added it to the merged packet.  This
> wasn't detected because it simply resulted in the truncation of
> the packet while the missing bit is subsequently retransmitted.
> 
> The fix is to store skb->len before we clobber it.
> 
> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

Applied.

Re: [1/3] gro: Fix handling of complete checksums in IPv6

[David Miller]

From: Herbert Xu <herbert@gondor.apana.org.au>
Date: Sun, 18 Jan 2009 16:46:16 +1100

> gro: Fix handling of complete checksums in IPv6
> 
> We need to perform skb_postpull_rcsum after pulling the IPv6
> header in order to maintain the correctness of the complete
> checksum.
> 
> This patch also adds a missing iph reload after pulling.
> 
> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

Applied.