1. 26 Apr, 2016 35 commits
  2. 25 Apr, 2016 5 commits
    • Glenn Ruben Bakke's avatar
      Bluetooth: 6lowpan: Fix memory corruption of ipv6 destination address · 55441070
      Glenn Ruben Bakke authored
      The memcpy of ipv6 header destination address to the skb control block
      (sbk->cb) in header_create() results in currupted memory when bt_xmit()
      is issued. The skb->cb is "released" in the return of header_create()
      making room for lower layer to minipulate the skb->cb.
      The value retrieved in bt_xmit is not persistent across header creation
      and sending, and the lower layer will overwrite portions of skb->cb,
      making the copied destination address wrong.
      The memory corruption will lead to non-working multicast as the first 4
      bytes of the copied destination address is replaced by a value that
      resolves into a non-multicast prefix.
      This fix removes the dependency on the skb control block between header
      creation and send, by moving the destination address memcpy to the send
      function path (setup_create, which is called from bt_xmit).
      Signed-off-by: default avatarGlenn Ruben Bakke <glenn.ruben.bakke@nordicsemi.no>
      Acked-by: default avatarJukka Rissanen <jukka.rissanen@linux.intel.com>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      Cc: stable@vger.kernel.org # 4.5+
    • David S. Miller's avatar
      Merge branch 'pskb_extract' · 5a5f0792
      David S. Miller authored
      Sowmini Varadhan says:
      pskb_extract() helper function.
      This patchset follows up on the discussion in
      For RDS-TCP, we have to deal with the full gamut of
      nonlinear sk_buffs, including all the frag_list variants.
      Also, the parent skb has to remain unchanged, while the clone
      is queued for Rx on the PF_RDS socket.
      Patch 1 of this patchset adds a pskb_extract() function that
      does all this without the redundant memcpy's in pskb_expand_head()
      and __pskb_pull_tail().
      v2: Marcelo Leitner review comments
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    • Sowmini Varadhan's avatar
      RDS: TCP: Call pskb_extract() helper function · 947d2756
      Sowmini Varadhan authored
      rds-stress experiments with request size 256 bytes, 8K acks,
      using 16 threads show a 40% improvment when pskb_extract()
      replaces the {skb_clone(..); pskb_pull(..); pskb_trim(..);}
      pattern in the Rx path, so we leverage the perf gain with
      this commit.
      Signed-off-by: default avatarSowmini Varadhan <sowmini.varadhan@oracle.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    • Sowmini Varadhan's avatar
      skbuff: Add pskb_extract() helper function · 6fa01ccd
      Sowmini Varadhan authored
      A pattern of skb usage seen in modules such as RDS-TCP is to
      extract `to_copy' bytes from the received TCP segment, starting
      at some offset `off' into a new skb `clone'. This is done in
      the ->data_ready callback, where the clone skb is queued up for rx on
      the PF_RDS socket, while the parent TCP segment is returned unchanged
      back to the TCP engine.
      The existing code uses the sequence
      	clone = skb_clone(..);
      	pskb_pull(clone, off, ..);
      	pskb_trim(clone, to_copy, ..);
      with the intention of discarding the first `off' bytes. However,
      skb_clone() + pskb_pull() implies pksb_expand_head(), which ends
      up doing a redundant memcpy of bytes that will then get discarded
      in __pskb_pull_tail().
      To avoid this inefficiency, this commit adds pskb_extract() that
      creates the clone, and memcpy's only the relevant header/frag/frag_list
      to the start of `clone'. pskb_trim() is then invoked to trim clone
      down to the requested to_copy bytes.
      Signed-off-by: default avatarSowmini Varadhan <sowmini.varadhan@oracle.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    • Michal Kazior's avatar
      fq: add fair queuing framework · 557fc4a0
      Michal Kazior authored
      This works on the same implementation principle as
      codel*.h, i.e. there's a generic header with
      structures and macros and a implementation header
      carrying function definitions to include in given,
      e.g. driver or module.
      The fairness logic comes from
      net/sched/sch_fq_codel.c but is generalized so it
      is more flexible and easier to re-use.
      Signed-off-by: default avatarMichal Kazior <michal.kazior@tieto.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>