mirror of
https://github.com/xen-project/xen.git
synced 2026-10-28 02:01:24 +01:00
[NET]: Fix segmentation of linear packets
skb_segment fails to segment linear packets correctly because it tries to write all linear parts of the original skb into each segment. This will always panic as each segment only contains enough space for one MSS. This was not detected earlier because linear packets should be rare for GSO. In fact it still remains to be seen what exactly created the linear packets that triggered this bug. Basically the only time this should happen is if someone enables GSO emulation on an interface that does not support SG. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
kfraser@localhost.localdomain committed
1 parent
28f48c121e
commit
805c949b34
3 files changed
+31
-5
No files matched your search
@@ -1875,7 +1875,7 @@ struct sk_buff *skb_segment(struct sk_buff *skb, int features)
|
||||
do {
|
||||
struct sk_buff *nskb;
|
||||
skb_frag_t *frag;
|
||||
int hsize, nsize;
|
||||
int hsize;
|
||||
int k;
|
||||
int size;
|
||||
|
||||
@@ -1886,11 +1886,10 @@ struct sk_buff *skb_segment(struct sk_buff *skb, int features)
|
||||
hsize = skb_headlen(skb) - offset;
|
||||
if (hsize < 0)
|
||||
hsize = 0;
|
||||
nsize = hsize + doffset;
|
||||
if (nsize > len + doffset || !sg)
|
||||
nsize = len + doffset;
|
||||
if (hsize > len || !sg)
|
||||
hsize = len;
|
||||
|
||||
nskb = alloc_skb(nsize + headroom, GFP_ATOMIC);
|
||||
nskb = alloc_skb(hsize + doffset + headroom, GFP_ATOMIC);
|
||||
if (unlikely(!nskb))
|
||||
goto err;
|
||||
|
||||
|
||||
@@ -0,0 +1,26 @@
|
||||
diff -Naru a/net/core/skbuff.c b/net/core/skbuff.c
|
||||
--- a/net/core/skbuff.c 2006-12-14 09:32:04 -08:00
|
||||
+++ b/net/core/skbuff.c 2006-12-14 09:32:04 -08:00
|
||||
@@ -1946,7 +1946,7 @@
|
||||
do {
|
||||
struct sk_buff *nskb;
|
||||
skb_frag_t *frag;
|
||||
- int hsize, nsize;
|
||||
+ int hsize;
|
||||
int k;
|
||||
int size;
|
||||
|
||||
@@ -1957,11 +1957,10 @@
|
||||
hsize = skb_headlen(skb) - offset;
|
||||
if (hsize < 0)
|
||||
hsize = 0;
|
||||
- nsize = hsize + doffset;
|
||||
- if (nsize > len + doffset || !sg)
|
||||
- nsize = len + doffset;
|
||||
+ if (hsize > len || !sg)
|
||||
+ hsize = len;
|
||||
|
||||
- nskb = alloc_skb(nsize + headroom, GFP_ATOMIC);
|
||||
+ nskb = alloc_skb(hsize + doffset + headroom, GFP_ATOMIC);
|
||||
if (unlikely(!nskb))
|
||||
goto err;
|
||||
@@ -17,6 +17,7 @@ net-gso-2-checksum-fix.patch
|
||||
net-gso-3-fix-errorcheck.patch
|
||||
net-gso-4-kill-warnon.patch
|
||||
net-gso-5-rcv-mss.patch
|
||||
net-gso-6-linear-segmentation.patch
|
||||
pci-mmconfig-fix-from-2.6.17.patch
|
||||
pmd-shared.patch
|
||||
rcu_needs_cpu.patch
|
||||
|
||||