aboutsummaryrefslogtreecommitdiffstats
path: root/target/linux/generic/backport-5.15
diff options
context:
space:
mode:
authorRui Salvaterra <rsalvaterra@gmail.com>2022-05-25 11:21:59 +0100
committerHauke Mehrtens <hauke@hauke-m.de>2022-06-06 19:20:28 +0200
commit2454342e068335ec0a52b2304e83f5f62f6b6b2d (patch)
treebe13490842f4786e960fc2fcb36956727273fe29 /target/linux/generic/backport-5.15
parented1536e0b6b7f2aeea6881632b89b269d27ff7ce (diff)
downloadupstream-2454342e068335ec0a52b2304e83f5f62f6b6b2d.tar.gz
upstream-2454342e068335ec0a52b2304e83f5f62f6b6b2d.tar.bz2
upstream-2454342e068335ec0a52b2304e83f5f62f6b6b2d.zip
kernel: bump 5.15 to 5.15.42
Deleted (upstreamed): generic/backport-5.15/610-v5.18-netfilter-flowtable-move-dst_check-to-packet-path.patch [1] generic/pending-5.15/704-00-netfilter-flowtable-fix-excessive-hw-offload-attempt.patch [2] generic/pending-5.15/704-01-netfilter-nft_flow_offload-skip-dst-neigh-lookup-for.patch [3] generic/pending-5.15/704-02-net-fix-dev_fill_forward_path-with-pppoe-bridge.patch [4] generic/pending-5.15/704-03-netfilter-nft_flow_offload-fix-offload-with-pppoe-vl.patch [5] Manually rebased: generic/hack-5.15/650-netfilter-add-xt_FLOWOFFLOAD-target.patch [1] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v5.15.42&id=88b937673b3552d54da20f648e61a123f4c1fa67 [2] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v5.15.42&id=5f4197a020c049a59ea7907c31f9ab037dcefefe [3] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v5.15.42&id=7613dcaceee281973145588f4244f2f78ef85b7f [4] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v5.15.42&id=f96b2e06721249ebf8da3254cfef29dcb6583948 [5] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v5.15.42&id=b329889974aed47e1167c85653c07097013e01a7 Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>
Diffstat (limited to 'target/linux/generic/backport-5.15')
-rw-r--r--target/linux/generic/backport-5.15/343-netfilter-nft_flow_offload-handle-netdevice-events-f.patch4
-rw-r--r--target/linux/generic/backport-5.15/610-v5.18-netfilter-flowtable-move-dst_check-to-packet-path.patch99
2 files changed, 2 insertions, 101 deletions
diff --git a/target/linux/generic/backport-5.15/343-netfilter-nft_flow_offload-handle-netdevice-events-f.patch b/target/linux/generic/backport-5.15/343-netfilter-nft_flow_offload-handle-netdevice-events-f.patch
index 9a6b802fd1..19ec9d9409 100644
--- a/target/linux/generic/backport-5.15/343-netfilter-nft_flow_offload-handle-netdevice-events-f.patch
+++ b/target/linux/generic/backport-5.15/343-netfilter-nft_flow_offload-handle-netdevice-events-f.patch
@@ -10,7 +10,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
--- a/net/netfilter/nf_flow_table_core.c
+++ b/net/netfilter/nf_flow_table_core.c
-@@ -646,13 +646,41 @@ void nf_flow_table_free(struct nf_flowta
+@@ -608,13 +608,41 @@ void nf_flow_table_free(struct nf_flowta
}
EXPORT_SYMBOL_GPL(nf_flow_table_free);
@@ -55,7 +55,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
--- a/net/netfilter/nft_flow_offload.c
+++ b/net/netfilter/nft_flow_offload.c
-@@ -438,47 +438,14 @@ static struct nft_expr_type nft_flow_off
+@@ -444,47 +444,14 @@ static struct nft_expr_type nft_flow_off
.owner = THIS_MODULE,
};
diff --git a/target/linux/generic/backport-5.15/610-v5.18-netfilter-flowtable-move-dst_check-to-packet-path.patch b/target/linux/generic/backport-5.15/610-v5.18-netfilter-flowtable-move-dst_check-to-packet-path.patch
deleted file mode 100644
index 8d355315c9..0000000000
--- a/target/linux/generic/backport-5.15/610-v5.18-netfilter-flowtable-move-dst_check-to-packet-path.patch
+++ /dev/null
@@ -1,99 +0,0 @@
-From 2738d9d963bd1f06d5114c2b4fa5771a95703991 Mon Sep 17 00:00:00 2001
-From: Ritaro Takenaka <ritarot634@gmail.com>
-Date: Tue, 17 May 2022 12:55:30 +0200
-Subject: [PATCH] netfilter: flowtable: move dst_check to packet path
-
-Fixes sporadic IPv6 packet loss when flow offloading is enabled.
-
-IPv6 route GC and flowtable GC are not synchronized.
-When dst_cache becomes stale and a packet passes through the flow before
-the flowtable GC teardowns it, the packet can be dropped.
-So, it is necessary to check dst every time in packet path.
-
-Fixes: 227e1e4d0d6c ("netfilter: nf_flowtable: skip device lookup from interface index")
-Signed-off-by: Ritaro Takenaka <ritarot634@gmail.com>
-Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
----
- net/netfilter/nf_flow_table_core.c | 23 +----------------------
- net/netfilter/nf_flow_table_ip.c | 19 +++++++++++++++++++
- 2 files changed, 20 insertions(+), 22 deletions(-)
-
---- a/net/netfilter/nf_flow_table_core.c
-+++ b/net/netfilter/nf_flow_table_core.c
-@@ -431,33 +431,12 @@ nf_flow_table_iterate(struct nf_flowtabl
- return err;
- }
-
--static bool flow_offload_stale_dst(struct flow_offload_tuple *tuple)
--{
-- struct dst_entry *dst;
--
-- if (tuple->xmit_type == FLOW_OFFLOAD_XMIT_NEIGH ||
-- tuple->xmit_type == FLOW_OFFLOAD_XMIT_XFRM) {
-- dst = tuple->dst_cache;
-- if (!dst_check(dst, tuple->dst_cookie))
-- return true;
-- }
--
-- return false;
--}
--
--static bool nf_flow_has_stale_dst(struct flow_offload *flow)
--{
-- return flow_offload_stale_dst(&flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple) ||
-- flow_offload_stale_dst(&flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple);
--}
--
- static void nf_flow_offload_gc_step(struct flow_offload *flow, void *data)
- {
- struct nf_flowtable *flow_table = data;
-
- if (nf_flow_has_expired(flow) ||
-- nf_ct_is_dying(flow->ct) ||
-- nf_flow_has_stale_dst(flow))
-+ nf_ct_is_dying(flow->ct))
- set_bit(NF_FLOW_TEARDOWN, &flow->flags);
-
- if (test_bit(NF_FLOW_TEARDOWN, &flow->flags)) {
---- a/net/netfilter/nf_flow_table_ip.c
-+++ b/net/netfilter/nf_flow_table_ip.c
-@@ -227,6 +227,15 @@ static bool nf_flow_exceeds_mtu(const st
- return true;
- }
-
-+static inline bool nf_flow_dst_check(struct flow_offload_tuple *tuple)
-+{
-+ if (tuple->xmit_type != FLOW_OFFLOAD_XMIT_NEIGH &&
-+ tuple->xmit_type != FLOW_OFFLOAD_XMIT_XFRM)
-+ return true;
-+
-+ return dst_check(tuple->dst_cache, tuple->dst_cookie);
-+}
-+
- static unsigned int nf_flow_xmit_xfrm(struct sk_buff *skb,
- const struct nf_hook_state *state,
- struct dst_entry *dst)
-@@ -346,6 +355,11 @@ nf_flow_offload_ip_hook(void *priv, stru
- if (nf_flow_state_check(flow, iph->protocol, skb, thoff))
- return NF_ACCEPT;
-
-+ if (!nf_flow_dst_check(&tuplehash->tuple)) {
-+ flow_offload_teardown(flow);
-+ return NF_ACCEPT;
-+ }
-+
- if (skb_try_make_writable(skb, thoff + hdrsize))
- return NF_DROP;
-
-@@ -582,6 +596,11 @@ nf_flow_offload_ipv6_hook(void *priv, st
- if (nf_flow_state_check(flow, ip6h->nexthdr, skb, thoff))
- return NF_ACCEPT;
-
-+ if (!nf_flow_dst_check(&tuplehash->tuple)) {
-+ flow_offload_teardown(flow);
-+ return NF_ACCEPT;
-+ }
-+
- if (skb_try_make_writable(skb, thoff + hdrsize))
- return NF_DROP;
-