Missed mainstream fix in 3.10

Missed mainstream fix in 3.10

[Kirill Tkhai]

Hi,

it looks like the bellow commit is missed in stable 3.10 kernel.
In 2.6.32 without this commit we observed a bridge dropping big
packets. The fix is in mainstream kernel now.
Please, look if it's need in stable 3.10 kernel.

commit aff09ce303f83bd370772349238482ae422a2341
Author: Vasily Averin <vvs@parallels.com>
Date:   Mon May 5 00:17:48 2014 +0400

    bridge: superfluous skb->nfct check in br_nf_dev_queue_xmit

    Currently bridge can silently drop ipv4 fragments.
    If node have loaded nf_defrag_ipv4 module but have no nf_conntrack_ipv4,
    br_nf_pre_routing defragments incoming ipv4 fragments
    but nfct check in br_nf_dev_queue_xmit does not allow re-fragment combined
    packet back, and therefore it is dropped in br_dev_queue_push_xmit without
    incrementing of any failcounters
    
    It seems the only way to hit the ip_fragment code in the bridge xmit
    path is to have a fragment list whose reassembled fragments go over
    the mtu. This only happens if nf_defrag is enabled. Thanks to
    Florian Westphal for providing feedback to clarify this.
    
    Defragmentation ipv4 is required not only in conntracks but at least in
    TPROXY target and socket match, therefore #ifdef is changed from
    NF_CONNTRACK_IPV4 to NF_DEFRAG_IPV4
    
    Signed-off-by: Vasily Averin <vvs@openvz.org>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

Kirill

Re: Missed mainstream fix in 3.10

[Willy Tarreau]

Hi,

On Tue, Jun 09, 2015 at 06:15:28PM +0300, Kirill Tkhai wrote:
> Hi,
> 
> it looks like the bellow commit is missed in stable 3.10 kernel.
> In 2.6.32 without this commit we observed a bridge dropping big
> packets. The fix is in mainstream kernel now.
> Please, look if it's need in stable 3.10 kernel.
> 
> commit aff09ce303f83bd370772349238482ae422a2341
> Author: Vasily Averin <vvs@parallels.com>
> Date:   Mon May 5 00:17:48 2014 +0400
> 
>     bridge: superfluous skb->nfct check in br_nf_dev_queue_xmit
> 
(...)

But this patch is not in 2.6.32 either. Does this mean you applied it to
your own tree, in which case it should have been backported to all kernels
from 2.6.32 to 3.14 as well (since it was merged in 3.15) ? That's a bit
confusing.

Anyway anything related to network should pass via netdev.

Thanks,
Willy

Re: Missed mainstream fix in 3.10

[Kirill Tkhai]

В Вт, 09/06/2015 в 17:23 +0200, Willy Tarreau пишет:
> Hi,
> 
> On Tue, Jun 09, 2015 at 06:15:28PM +0300, Kirill Tkhai wrote:
> > Hi,
> > 
> > it looks like the bellow commit is missed in stable 3.10 kernel.
> > In 2.6.32 without this commit we observed a bridge dropping big
> > packets. The fix is in mainstream kernel now.
> > Please, look if it's need in stable 3.10 kernel.
> > 
> > commit aff09ce303f83bd370772349238482ae422a2341
> > Author: Vasily Averin <vvs@parallels.com>
> > Date:   Mon May 5 00:17:48 2014 +0400
> > 
> >     bridge: superfluous skb->nfct check in br_nf_dev_queue_xmit
> > 
> (...)
> 
> But this patch is not in 2.6.32 either. Does this mean you applied it to
> your own tree, in which case it should have been backported to all kernels
> from 2.6.32 to 3.14 as well (since it was merged in 3.15) ? That's a bit
> confusing.

It was applied to our local 2.6.32 kernel tree and was commited to upstream.
We didn't trace if it was commited to stable trees.

Now I'm porting some local patches from 2.6.32 to 3.10 and found that this
patch isn't in stable 3.10. So I'm reporting to stable tree guys.

> Anyway anything related to network should pass via netdev.

Re: Missed mainstream fix in 3.10

[Willy Tarreau]

On Tue, Jun 09, 2015 at 06:30:46PM +0300, Kirill Tkhai wrote:
> ?? ????, 09/06/2015 ?? 17:23 +0200, Willy Tarreau ??????????:
> > Hi,
> > 
> > On Tue, Jun 09, 2015 at 06:15:28PM +0300, Kirill Tkhai wrote:
> > > Hi,
> > > 
> > > it looks like the bellow commit is missed in stable 3.10 kernel.
> > > In 2.6.32 without this commit we observed a bridge dropping big
> > > packets. The fix is in mainstream kernel now.
> > > Please, look if it's need in stable 3.10 kernel.
> > > 
> > > commit aff09ce303f83bd370772349238482ae422a2341
> > > Author: Vasily Averin <vvs@parallels.com>
> > > Date:   Mon May 5 00:17:48 2014 +0400
> > > 
> > >     bridge: superfluous skb->nfct check in br_nf_dev_queue_xmit
> > > 
> > (...)
> > 
> > But this patch is not in 2.6.32 either. Does this mean you applied it to
> > your own tree, in which case it should have been backported to all kernels
> > from 2.6.32 to 3.14 as well (since it was merged in 3.15) ? That's a bit
> > confusing.
> 
> It was applied to our local 2.6.32 kernel tree and was commited to upstream.
> We didn't trace if it was commited to stable trees.
> 
> Now I'm porting some local patches from 2.6.32 to 3.10 and found that this
> patch isn't in stable 3.10. So I'm reporting to stable tree guys.

OK. So then it should cover all stable trees, not just 3.10.

Since Davem handles the stable backports of the networking stuff, please
remind him to add this one to his queue.

Thanks,
Willy