Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit edbd9e30 authored by Herbert Xu's avatar Herbert Xu Committed by David S. Miller
Browse files

gro: Fix handling of headers that extend over the tail 



The skb_gro_* code fails to handle the case where a header starts
in the linear area but ends in the frags area.  Since the goal
of skb_gro_* is to optimise the case of completely non-linear
packets, we can simply bail out if we have anything in the linear
area.

Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 56ed4351

include/linux/netdevice.h

+1 −1
Original line number Diff line number Diff line
@@ -1137,7 +1137,7 @@ static inline void skb_gro_reset_offset(struct sk_buff *skb) 


static inline void *skb_gro_mac_header(struct sk_buff *skb)

{

	return skb_mac_header(skb) < skb->data ? skb_mac_header(skb) :

	return skb_headlen(skb) ? skb_mac_header(skb) :

	       page_address(skb_shinfo(skb)->frags[0].page) +

	       skb_shinfo(skb)->frags[0].page_offset;

}

net/core/dev.c

+3 −8
Original line number Diff line number Diff line
@@ -2378,18 +2378,13 @@ void *skb_gro_header(struct sk_buff *skb, unsigned int hlen) 
	unsigned int offset = skb_gro_offset(skb);



	hlen += offset;

	if (hlen <= skb_headlen(skb))

		return skb->data + offset;



	if (unlikely(!skb_shinfo(skb)->nr_frags ||

		     skb_shinfo(skb)->frags[0].size <=

		     hlen - skb_headlen(skb) ||

	if (unlikely(skb_headlen(skb) ||

		     skb_shinfo(skb)->frags[0].size < hlen ||

		     PageHighMem(skb_shinfo(skb)->frags[0].page)))

		return pskb_may_pull(skb, hlen) ? skb->data + offset : NULL;



	return page_address(skb_shinfo(skb)->frags[0].page) +

	       skb_shinfo(skb)->frags[0].page_offset +

	       offset - skb_headlen(skb);

	       skb_shinfo(skb)->frags[0].page_offset + offset;

}

EXPORT_SYMBOL(skb_gro_header);