aboutsummaryrefslogtreecommitdiff
path: root/net
diff options
context:
space:
mode:
authorHerbert Xu <herbert@gondor.apana.org.au>2009-02-05 21:26:52 -0800
committerDavid S. Miller <davem@davemloft.net>2009-02-05 21:26:52 -0800
commit56035022d86fff45299288cb372a42f752ba23fa (patch)
treeee00ef2a7153e627c3c20aee45b49270008691dc /net
parentfe2918b098cdbf55b69ba8762bd3de0ae64f33ff (diff)
gro: Fix frag_list merging on imprecisely split packets
The previous fix ad0f9904444de1309dedd2b9e365cae8af77d9b1 (gro: Fix handling of imprecisely split packets) only fixed the case of frags merging, frag_list merging in the same circumstances were still broken. In particular, the packet headers end up in the data stream. This patch fixes this plus another issue where an imprecisely split packet header may be read incorrectly (this is mostly harmless since it'll simply cause the packet to not match and be rejected for GRO). Thanks to Emil Tantilov and Jeff Kirsher for helping to track this down. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
-rw-r--r--net/core/dev.c3
-rw-r--r--net/core/skbuff.c11
2 files changed, 13 insertions, 1 deletions
diff --git a/net/core/dev.c b/net/core/dev.c
index 3337cf98f23..247f1614a79 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2391,7 +2391,8 @@ void *skb_gro_header(struct sk_buff *skb, unsigned int hlen)
return pskb_may_pull(skb, hlen) ? skb->data + offset : NULL;
return page_address(skb_shinfo(skb)->frags[0].page) +
- skb_shinfo(skb)->frags[0].page_offset + offset;
+ skb_shinfo(skb)->frags[0].page_offset +
+ offset - skb_headlen(skb);
}
EXPORT_SYMBOL(skb_gro_header);
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index e55d1ef5690..67f2a2f8582 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2678,6 +2678,17 @@ int skb_gro_receive(struct sk_buff **head, struct sk_buff *skb)
p = nskb;
merge:
+ if (skb_gro_offset(skb) > skb_headlen(skb)) {
+ skb_shinfo(skb)->frags[0].page_offset +=
+ skb_gro_offset(skb) - skb_headlen(skb);
+ skb_shinfo(skb)->frags[0].size -=
+ skb_gro_offset(skb) - skb_headlen(skb);
+ skb_gro_reset_offset(skb);
+ skb_gro_pull(skb, skb_headlen(skb));
+ }
+
+ __skb_pull(skb, skb_gro_offset(skb));
+
p->prev->next = skb;
p->prev = skb;
skb_header_release(skb);