| commit | 923dd347b8904c24bcac89bf038ed4da87f8aa90 | |
| author | Eric Dumazet <edumazet@google.com> | |
| Wed, 2 May 2012 07:55:58 +0000 (2 07:55 +0000) | ||
| committer | David S. Miller <davem@davemloft.net> | |
| Thu, 3 May 2012 01:11:11 +0000 (2 21:11 -0400) | ||
| tree | d329204cb40e4d13e07ffc538fd9978c334ef90c | treesnapshot (tar.gz zip) |
| parent | eeb7fc7bc095546b21188e8e076a59bce73f9ca6 | commitdiff |
net: take care of cloned skbs in tcp_try_coalesce()
Before stealing fragments or skb head, we must make sure skbs are not
cloned.
Alexander was worried about destination skb being cloned : In bridge
setups, a driver could be fooled if skb->data_len would not match skb
nr_frags.
If source skb is cloned, we must take references on pages instead.
Bug happened using tcpdump (if not using mmap())
Introduce kfree_skb_partial() helper to cleanup code.
Reported-by: Alexander Duyck <alexander.h.duyck@intel.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Before stealing fragments or skb head, we must make sure skbs are not
cloned.
Alexander was worried about destination skb being cloned : In bridge
setups, a driver could be fooled if skb->data_len would not match skb
nr_frags.
If source skb is cloned, we must take references on pages instead.
Bug happened using tcpdump (if not using mmap())
Introduce kfree_skb_partial() helper to cleanup code.
Reported-by: Alexander Duyck <alexander.h.duyck@intel.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
| net/ipv4/tcp_input.c | diffblobblamehistory |