1. 26 Apr, 2016 34 commits
  2. 25 Apr, 2016 6 commits
    • Glenn Ruben Bakke's avatar
      Bluetooth: 6lowpan: Fix memory corruption of ipv6 destination address · 55441070
      Glenn Ruben Bakke authored
      The memcpy of ipv6 header destination address to the skb control block
      (sbk->cb) in header_create() results in currupted memory when bt_xmit()
      is issued. The skb->cb is "released" in the return of header_create()
      making room for lower layer to minipulate the skb->cb.
      
      The value retrieved in bt_xmit is not persistent across header creation
      and sending, and the lower layer will overwrite portions of skb->cb,
      making the copied destination address wrong.
      
      The memory corruption will lead to non-working multicast as the first 4
      bytes of the copied destination address is replaced by a value that
      resolves into a non-multicast prefix.
      
      This fix removes the dependency on the skb control block between header
      creation and send, by moving the destination address memcpy to the send
      function path (setup_create, which is called from bt_xmit).
      Signed-off-by: default avatarGlenn Ruben Bakke <glenn.ruben.bakke@nordicsemi.no>
      Acked-by: default avatarJukka Rissanen <jukka.rissanen@linux.intel.com>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      Cc: stable@vger.kernel.org # 4.5+
      55441070
    • David S. Miller's avatar
      Merge branch 'pskb_extract' · 5a5f0792
      David S. Miller authored
      Sowmini Varadhan says:
      
      ====================
      pskb_extract() helper function.
      
      This patchset follows up on the discussion in
       https://www.mail-archive.com/netdev@vger.kernel.org/msg105090.html
      
      For RDS-TCP, we have to deal with the full gamut of
      nonlinear sk_buffs, including all the frag_list variants.
      Also, the parent skb has to remain unchanged, while the clone
      is queued for Rx on the PF_RDS socket.
      
      Patch 1 of this patchset adds a pskb_extract() function that
      does all this without the redundant memcpy's in pskb_expand_head()
      and __pskb_pull_tail().
      
      v2: Marcelo Leitner review comments
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5a5f0792
    • Sowmini Varadhan's avatar
      RDS: TCP: Call pskb_extract() helper function · 947d2756
      Sowmini Varadhan authored
      rds-stress experiments with request size 256 bytes, 8K acks,
      using 16 threads show a 40% improvment when pskb_extract()
      replaces the {skb_clone(..); pskb_pull(..); pskb_trim(..);}
      pattern in the Rx path, so we leverage the perf gain with
      this commit.
      Signed-off-by: default avatarSowmini Varadhan <sowmini.varadhan@oracle.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      947d2756
    • Sowmini Varadhan's avatar
      skbuff: Add pskb_extract() helper function · 6fa01ccd
      Sowmini Varadhan authored
      A pattern of skb usage seen in modules such as RDS-TCP is to
      extract `to_copy' bytes from the received TCP segment, starting
      at some offset `off' into a new skb `clone'. This is done in
      the ->data_ready callback, where the clone skb is queued up for rx on
      the PF_RDS socket, while the parent TCP segment is returned unchanged
      back to the TCP engine.
      
      The existing code uses the sequence
      	clone = skb_clone(..);
      	pskb_pull(clone, off, ..);
      	pskb_trim(clone, to_copy, ..);
      with the intention of discarding the first `off' bytes. However,
      skb_clone() + pskb_pull() implies pksb_expand_head(), which ends
      up doing a redundant memcpy of bytes that will then get discarded
      in __pskb_pull_tail().
      
      To avoid this inefficiency, this commit adds pskb_extract() that
      creates the clone, and memcpy's only the relevant header/frag/frag_list
      to the start of `clone'. pskb_trim() is then invoked to trim clone
      down to the requested to_copy bytes.
      Signed-off-by: default avatarSowmini Varadhan <sowmini.varadhan@oracle.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6fa01ccd
    • Michal Kazior's avatar
      fq: add fair queuing framework · 557fc4a0
      Michal Kazior authored
      This works on the same implementation principle as
      codel*.h, i.e. there's a generic header with
      structures and macros and a implementation header
      carrying function definitions to include in given,
      e.g. driver or module.
      
      The fairness logic comes from
      net/sched/sch_fq_codel.c but is generalized so it
      is more flexible and easier to re-use.
      Signed-off-by: default avatarMichal Kazior <michal.kazior@tieto.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      557fc4a0
    • David S. Miller's avatar
      Merge branch 'reusable-codel' · 05d82c42
      David S. Miller authored
      Michal Kazior says:
      
      ====================
      codel: make it reuseable beyond qdiscs
      
      There's an ongoing effort in fixing wireless
      bufferbloat. As part of that fq_codel is being
      ported into mac80211. To prevent code duplication
      codel.h needs to be slightly modified before it
      can be used in mac80211 (or other drivers FWIW).
      
      For more background please see:
      
        https://www.spinics.net/lists/linux-wireless/msg149976.html
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      05d82c42