Hello Greg,
For the 3.4 kernel, the below patch is also needed in order to fix all
bugs in the asix module related to packets crossing urb boundaries.
commit 8b5b6f5413e97c3e8bafcdd67553d508f4f698cd
Author: Lucas Stach <dev@xxxxxxxxxx>
Date: Wed Jan 16 04:24:07 2013 +0000
net: asix: handle packets crossing URB boundaries
It was included in the v3.8-rc3 mainline kernel and it would be best
that a backport of this patch is also included in the next 3.4 release.
I will send backports that applies to 3.2 and 3.4 today.
Best regards,
Emil Goode
On Wed, Feb 26, 2014 at 09:12:29PM -0800, gregkh@xxxxxxxxxxxxxxxxxxx wrote:
>
> This is a note to let you know that I've just added the patch titled
>
> usbnet: remove generic hard_header_len check
>
> to the 3.4-stable tree which can be found at:
> http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
>
> The filename of the patch is:
> usbnet-remove-generic-hard_header_len-check.patch
> and it can be found in the queue-3.4 subdirectory.
>
> If you, or anyone else, feels it should not be added to the stable tree,
> please let <stable@xxxxxxxxxxxxxxx> know about it.
>
>
> From foo@baz Wed Feb 26 20:38:29 PST 2014
> From: Emil Goode <emilgoode@xxxxxxxxx>
> Date: Thu, 13 Feb 2014 17:50:19 +0100
> Subject: usbnet: remove generic hard_header_len check
>
> From: Emil Goode <emilgoode@xxxxxxxxx>
>
> [ Upstream commit eb85569fe2d06c2fbf4de7b66c263ca095b397aa ]
>
> This patch removes a generic hard_header_len check from the usbnet
> module that is causing dropped packages under certain circumstances
> for devices that send rx packets that cross urb boundaries.
>
> One example is the AX88772B which occasionally send rx packets that
> cross urb boundaries where the remaining partial packet is sent with
> no hardware header. When the buffer with a partial packet is of less
> number of octets than the value of hard_header_len the buffer is
> discarded by the usbnet module.
>
> With AX88772B this can be reproduced by using ping with a packet
> size between 1965-1976.
>
> The bug has been reported here:
>
> https://bugzilla.kernel.org/show_bug.cgi?id=29082
>
> This patch introduces the following changes:
> - Removes the generic hard_header_len check in the rx_complete
> function in the usbnet module.
> - Introduces a ETH_HLEN check for skbs that are not cloned from
> within a rx_fixup callback.
> - For safety a hard_header_len check is added to each rx_fixup
> callback function that could be affected by this change.
> These extra checks could possibly be removed by someone
> who has the hardware to test.
> - Removes a call to dev_kfree_skb_any() and instead utilizes the
> dev->done list to queue skbs for cleanup.
>
> The changes place full responsibility on the rx_fixup callback
> functions that clone skbs to only pass valid skbs to the
> usbnet_skb_return function.
>
> Signed-off-by: Emil Goode <emilgoode@xxxxxxxxx>
> Reported-by: Igor Gnatenko <i.gnatenko.brain@xxxxxxxxx>
> Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
> ---
> drivers/net/usb/gl620a.c | 4 ++++
> drivers/net/usb/mcs7830.c | 5 +++--
> drivers/net/usb/net1080.c | 4 ++++
> drivers/net/usb/qmi_wwan.c | 8 ++++----
> drivers/net/usb/rndis_host.c | 4 ++++
> drivers/net/usb/smsc75xx.c | 4 ++++
> drivers/net/usb/smsc95xx.c | 4 ++++
> drivers/net/usb/usbnet.c | 25 ++++++++++---------------
> 8 files changed, 37 insertions(+), 21 deletions(-)
>
> --- a/drivers/net/usb/gl620a.c
> +++ b/drivers/net/usb/gl620a.c
> @@ -86,6 +86,10 @@ static int genelink_rx_fixup(struct usbn
> u32 size;
> u32 count;
>
> + /* This check is no longer done by usbnet */
> + if (skb->len < dev->net->hard_header_len)
> + return 0;
> +
> header = (struct gl_header *) skb->data;
>
> // get the packet count of the received skb
> --- a/drivers/net/usb/mcs7830.c
> +++ b/drivers/net/usb/mcs7830.c
> @@ -601,8 +601,9 @@ static int mcs7830_rx_fixup(struct usbne
> {
> u8 status;
>
> - if (skb->len == 0) {
> - dev_err(&dev->udev->dev, "unexpected empty rx frame\n");
> + /* This check is no longer done by usbnet */
> + if (skb->len < dev->net->hard_header_len) {
> + dev_err(&dev->udev->dev, "unexpected tiny rx frame\n");
> return 0;
> }
>
> --- a/drivers/net/usb/net1080.c
> +++ b/drivers/net/usb/net1080.c
> @@ -419,6 +419,10 @@ static int net1080_rx_fixup(struct usbne
> struct nc_trailer *trailer;
> u16 hdr_len, packet_len;
>
> + /* This check is no longer done by usbnet */
> + if (skb->len < dev->net->hard_header_len)
> + return 0;
> +
> if (!(skb->len & 0x01)) {
> #ifdef DEBUG
> struct net_device *net = dev->net;
> --- a/drivers/net/usb/qmi_wwan.c
> +++ b/drivers/net/usb/qmi_wwan.c
> @@ -202,10 +202,10 @@ static int qmi_wwan_rx_fixup(struct usbn
> {
> __be16 proto;
>
> - /* usbnet rx_complete guarantees that skb->len is at least
> - * hard_header_len, so we can inspect the dest address without
> - * checking skb->len
> - */
> + /* This check is no longer done by usbnet */
> + if (skb->len < dev->net->hard_header_len)
> + return 0;
> +
> switch (skb->data[0] & 0xf0) {
> case 0x40:
> proto = htons(ETH_P_IP);
> --- a/drivers/net/usb/rndis_host.c
> +++ b/drivers/net/usb/rndis_host.c
> @@ -490,6 +490,10 @@ EXPORT_SYMBOL_GPL(rndis_unbind);
> */
> int rndis_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
> {
> + /* This check is no longer done by usbnet */
> + if (skb->len < dev->net->hard_header_len)
> + return 0;
> +
> /* peripheral may have batched packets to us... */
> while (likely(skb->len)) {
> struct rndis_data_hdr *hdr = (void *)skb->data;
> --- a/drivers/net/usb/smsc75xx.c
> +++ b/drivers/net/usb/smsc75xx.c
> @@ -1093,6 +1093,10 @@ static void smsc75xx_rx_csum_offload(str
>
> static int smsc75xx_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
> {
> + /* This check is no longer done by usbnet */
> + if (skb->len < dev->net->hard_header_len)
> + return 0;
> +
> while (skb->len > 0) {
> u32 rx_cmd_a, rx_cmd_b, align_count, size;
> struct sk_buff *ax_skb;
> --- a/drivers/net/usb/smsc95xx.c
> +++ b/drivers/net/usb/smsc95xx.c
> @@ -1041,6 +1041,10 @@ static void smsc95xx_rx_csum_offload(str
>
> static int smsc95xx_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
> {
> + /* This check is no longer done by usbnet */
> + if (skb->len < dev->net->hard_header_len)
> + return 0;
> +
> while (skb->len > 0) {
> u32 header, align_count;
> struct sk_buff *ax_skb;
> --- a/drivers/net/usb/usbnet.c
> +++ b/drivers/net/usb/usbnet.c
> @@ -415,17 +415,19 @@ static inline void rx_process (struct us
> }
> // else network stack removes extra byte if we forced a short packet
>
> - if (skb->len) {
> - /* all data was already cloned from skb inside the driver */
> - if (dev->driver_info->flags & FLAG_MULTI_PACKET)
> - dev_kfree_skb_any(skb);
> - else
> - usbnet_skb_return(dev, skb);
> + /* all data was already cloned from skb inside the driver */
> + if (dev->driver_info->flags & FLAG_MULTI_PACKET)
> + goto done;
> +
> + if (skb->len < ETH_HLEN) {
> + dev->net->stats.rx_errors++;
> + dev->net->stats.rx_length_errors++;
> + netif_dbg(dev, rx_err, dev->net, "rx length %d\n", skb->len);
> + } else {
> + usbnet_skb_return(dev, skb);
> return;
> }
>
> - netif_dbg(dev, rx_err, dev->net, "drop\n");
> - dev->net->stats.rx_errors++;
> done:
> skb_queue_tail(&dev->done, skb);
> }
> @@ -447,13 +449,6 @@ static void rx_complete (struct urb *urb
> switch (urb_status) {
> /* success */
> case 0:
> - if (skb->len < dev->net->hard_header_len) {
> - state = rx_cleanup;
> - dev->net->stats.rx_errors++;
> - dev->net->stats.rx_length_errors++;
> - netif_dbg(dev, rx_err, dev->net,
> - "rx length %d\n", skb->len);
> - }
> break;
>
> /* stalls need manual reset. this is rare ... except that
>
>
> Patches currently in stable-queue which might be from emilgoode@xxxxxxxxx are
>
> queue-3.4/usbnet-remove-generic-hard_header_len-check.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html