kernel 5.15.166: broken TCP segmentation offloading

[cfm]

Description

Preflight testing for v2.10.1 found that the securedrop-admin install playbook fetched packages from apt-qa.freedom.press (but not e.g. security.debian.org) slowly and unreliably. @zenmonkeykstop and I both encountered this in libvirt-prod-focal VMs on separate physical hosts, while equivalent fetches from those physical hosts and even other VMs had the expected performance.

Comments

virtio network driver on 5.15.166-1-grsec-securedrop; no bare-metal (read: production) impacts.

• Original kernel bug report: https://bugzilla.kernel.org/show_bug.cgi?id=219129

• Kernel backport thread: https://lore.kernel.org/stable/2024091110-winter-cornflake-efa0@gregkh/T/

• Original Debian bug report: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1079684

• Others:

  • virtio-net is completely broken in terms of LSO / RSO  virtio-win/kvm-guest-drivers-windows#1131
  • ens3: bad gso: type: 1, size: 1432 gardenlinux/gardenlinux#2278

• Installing kernel 5.15.166-1-grsec-securedrop into a VM reproduces this bug:

    Oct 18 23:28:06 app-prod kernel: eth0: bad gso: type: 1, size: 1460
  

• On the host ethtool -k $BRIDGE tso off fixes it.