Linux kernel -stable discussions
 help / color / mirror / Atom feed
From: Michael Pratte <slatoncomputers@gmail.com>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	Sasha Levin <sashal@kernel.org>
Subject: [PATCH] s2io: only arm hardware LSO for GSO skbs
Date: Tue, 23 Jun 2026 06:21:31 -0500	[thread overview]
Message-ID: <20260623112131.752148-1-slatoncomputers@gmail.com> (raw)

s2io_xmit() enables the Xframe/Xframe-II hardware LSO (TCP segmentation)
engine whenever the skb's gso_type carries SKB_GSO_TCPV4/TCPV6, and
programs the segment size from gso_size:

	offload_type = s2io_offload_type(skb);
	if (offload_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6)) {
		txdp->Control_1 |= TXD_TCP_LSO_EN;
		txdp->Control_1 |= TXD_TCP_LSO_MSS(s2io_tcp_mss(skb));
	}

Since commit 51466a7545b7 ("tcp: fill shinfo->gso_type at last moment")
tcp_transmit_skb() sets skb_shinfo(skb)->gso_type unconditionally on
every TCP skb, including non-GSO frames where gso_size is 0. The driver
therefore arms the LSO engine with MSS == 0 for ordinary TCP segments
such as the connection's SYN. The Xframe-II LSO engine treats an MSS of
0 as an illegal descriptor and aborts the transmit (lso_err_reg reports
LSO6_ABORT), so the frame is dropped before it reaches the MAC. The
result is that no TCP can be transmitted on these adapters since v4.2;
UDP and ICMP (which never carry SKB_GSO_TCPV4) are unaffected.

Only arm the LSO engine when the skb is actually GSO (gso_size > 0),
restoring the pre-4.2 behaviour. Non-GSO TCP frames take the normal
transmit path.

Reproduced and fixed on Linux 6.6.67 with an Xframe-II adapter
(PCI 17d5:5832); bisected to good v4.1.6 / bad v4.2.2.

Fixes: 51466a7545b7 ("tcp: fill shinfo->gso_type at last moment")
Signed-off-by: Michael Pratte <slatoncomputers@gmail.com>
---
[ Not upstream and cannot be: the s2io driver was removed from mainline in
  commit aba0138eb7d7 ("net: ethernet: neterion: s2io: remove unused
  driver"). It still ships in the 6.6.y and 6.12.y stable trees, where this
  bug is present and the patch applies cleanly. Please apply there. ]

 drivers/net/ethernet/neterion/s2io.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/neterion/s2io.c b/drivers/net/ethernet/neterion/s2io.c
index 1e55ccb..9988ff9 100644
--- a/drivers/net/ethernet/neterion/s2io.c
+++ b/drivers/net/ethernet/neterion/s2io.c
@@ -4105,7 +4105,7 @@ static netdev_tx_t s2io_xmit(struct sk_buff *skb, struct net_device *dev)
 	}
 
 	offload_type = s2io_offload_type(skb);
-	if (offload_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6)) {
+	if ((offload_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6)) && skb_is_gso(skb)) {
 		txdp->Control_1 |= TXD_TCP_LSO_EN;
 		txdp->Control_1 |= TXD_TCP_LSO_MSS(s2io_tcp_mss(skb));
 	}
-- 
2.54.0


             reply	other threads:[~2026-06-23 11:21 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-06-23 11:21 Michael Pratte [this message]
2026-06-23 11:39 ` [PATCH] s2io: only arm hardware LSO for GSO skbs Greg Kroah-Hartman
2026-06-23 11:48   ` Michael Pratte
2026-06-23 11:54     ` Greg Kroah-Hartman
2026-06-23 12:12       ` Michael Pratte

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260623112131.752148-1-slatoncomputers@gmail.com \
    --to=slatoncomputers@gmail.com \
    --cc=gregkh@linuxfoundation.org \
    --cc=sashal@kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox