main/linux-grsec: backport ipsec regression fix + gre fix

1 files changed, 44 insertions, 0 deletions

diff --git a/main/linux-grsec/0001-ipv4-fix-ipsec-forward-performance-regression.patch b/main/linux-grsec/0001-ipv4-fix-ipsec-forward-performance-regression.patch
new file mode 100644
index 0000000000..678662c276
--- /dev/null
+++ b/main/linux-grsec/0001-ipv4-fix-ipsec-forward-performance-regression.patch
@@ -0,0 +1,44 @@
+From b73233960a59ee66e09d642f13d0592b13651e94 Mon Sep 17 00:00:00 2001
+From: "Yan, Zheng" <zheng.z.yan@intel.com>
+Date: Sat, 22 Oct 2011 21:58:20 +0000
+Subject: [PATCH] ipv4: fix ipsec forward performance regression
+
+There is bug in commit 5e2b61f(ipv4: Remove flowi from struct rtable).
+It makes xfrm4_fill_dst() modify wrong data structure.
+
+Signed-off-by: Zheng Yan <zheng.z.yan@intel.com>
+Reported-by: Kim Phillips <kim.phillips@freescale.com>
+Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ net/ipv4/xfrm4_policy.c |   14 +++++++-------
+ 1 files changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
+index fc5368a..a0b4c5d 100644
+--- a/net/ipv4/xfrm4_policy.c
++++ b/net/ipv4/xfrm4_policy.c
+@@ -79,13 +79,13 @@ static int xfrm4_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
+ 	struct rtable *rt = (struct rtable *)xdst->route;
+ 	const struct flowi4 *fl4 = &fl->u.ip4;
+ 
+-	rt->rt_key_dst = fl4->daddr;
+-	rt->rt_key_src = fl4->saddr;
+-	rt->rt_key_tos = fl4->flowi4_tos;
+-	rt->rt_route_iif = fl4->flowi4_iif;
+-	rt->rt_iif = fl4->flowi4_iif;
+-	rt->rt_oif = fl4->flowi4_oif;
+-	rt->rt_mark = fl4->flowi4_mark;
++	xdst->u.rt.rt_key_dst = fl4->daddr;
++	xdst->u.rt.rt_key_src = fl4->saddr;
++	xdst->u.rt.rt_key_tos = fl4->flowi4_tos;
++	xdst->u.rt.rt_route_iif = fl4->flowi4_iif;
++	xdst->u.rt.rt_iif = fl4->flowi4_iif;
++	xdst->u.rt.rt_oif = fl4->flowi4_oif;
++	xdst->u.rt.rt_mark = fl4->flowi4_mark;
+ 
+ 	xdst->u.dst.dev = dev;
+ 	dev_hold(dev);
+-- 
+1.7.7
+