net: test tailroom before appending to linear skb (113f99c3) · Commits · 戴 / test

Device features may change during transmission. In particular with corking, a device may toggle scatter-gather in between allocating and writing to an skb. Do not unconditionally assume that !NETIF_F_SG at write time implies that the same held at alloc time and thus the skb has sufficient tailroom. This issue predates git history. Fixes: ("Linux-2.6.12-rc2") Reported-by:

Eric Dumazet <edumazet@google.com> Signed-off-by:

Willem de Bruijn <willemb@google.com> Reviewed-by:

Eric Dumazet <edumazet@google.com> Signed-off-by:

David S. Miller <davem@davemloft.net>

net/ipv4/ip_output.c

+2 −1

Original line number	Original line	Diff line number	Diff line
	@@ -1045,7 +1045,8 @@ alloc_new_skb:
	if (copy > length)		if (copy > length)
	copy = length;		copy = length;

	if (!(rt->dst.dev->features&NETIF_F_SG)) {		if (!(rt->dst.dev->features&NETIF_F_SG) &&
			skb_tailroom(skb) >= copy) {
	unsigned int off;		unsigned int off;

	off = skb->len;		off = skb->len;

net/ipv6/ip6_output.c

+2 −1

Original line number	Original line	Diff line number	Diff line
	@@ -1503,7 +1503,8 @@ alloc_new_skb:
	if (copy > length)		if (copy > length)
	copy = length;		copy = length;

	if (!(rt->dst.dev->features&NETIF_F_SG)) {		if (!(rt->dst.dev->features&NETIF_F_SG) &&
			skb_tailroom(skb) >= copy) {
	unsigned int off;		unsigned int off;

	off = skb->len;		off = skb->len;

Admin message