Commit ef5cb973 authored Apr 18, 2006 by Herbert Xu Committed by David S. Miller Apr 18, 2006

[TCP]: Fix truesize underflow



There is a problem with the TSO packet trimming code.  The cause of
this lies in the tcp_fragment() function.

When we allocate a fragment for a completely non-linear packet the
truesize is calculated for a payload length of zero.  This means that
truesize could in fact be less than the real payload length.

When that happens the TSO packet trimming can cause truesize to become
negative.  This in turn can cause sk_forward_alloc to be -n * PAGE_SIZE
which would trigger the warning.

I've copied the code DaveM used in tso_fragment which should work here.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 385910f2

net/ipv4/tcp_output.c

+3 −1

Original line number	Diff line number	Diff line
		@@ -551,7 +551,9 @@ int tcp_fragment(struct sock sk, struct sk_buff skb, u32 len, unsigned int mss
		buff = sk_stream_alloc_skb(sk, nsize, GFP_ATOMIC);
		if (buff == NULL)
		return -ENOMEM; /* We'll just try again later. */
		sk_charge_skb(sk, buff);

		buff->truesize = skb->len - len;
		skb->truesize -= buff->truesize;

		/* Correct the sequence numbers. */
		TCP_SKB_CB(buff)->seq = TCP_SKB_CB(skb)->seq + len;

Admin message