gro: Fix handling of headers that extend over the tail
The skb_gro_* code fails to handle the case where a header starts in the linear area but ends in the frags area. Since the goal of skb_gro_* is to optimise the case of completely non-linear packets, we can simply bail out if we have anything in the linear area. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
committed by
David S. Miller
parent
56ed4351c2
commit
edbd9e3030
@ -2378,18 +2378,13 @@ void *skb_gro_header(struct sk_buff *skb, unsigned int hlen)
|
||||
unsigned int offset = skb_gro_offset(skb);
|
||||
|
||||
hlen += offset;
|
||||
if (hlen <= skb_headlen(skb))
|
||||
return skb->data + offset;
|
||||
|
||||
if (unlikely(!skb_shinfo(skb)->nr_frags ||
|
||||
skb_shinfo(skb)->frags[0].size <=
|
||||
hlen - skb_headlen(skb) ||
|
||||
if (unlikely(skb_headlen(skb) ||
|
||||
skb_shinfo(skb)->frags[0].size < hlen ||
|
||||
PageHighMem(skb_shinfo(skb)->frags[0].page)))
|
||||
return pskb_may_pull(skb, hlen) ? skb->data + offset : NULL;
|
||||
|
||||
return page_address(skb_shinfo(skb)->frags[0].page) +
|
||||
skb_shinfo(skb)->frags[0].page_offset +
|
||||
offset - skb_headlen(skb);
|
||||
skb_shinfo(skb)->frags[0].page_offset + offset;
|
||||
}
|
||||
EXPORT_SYMBOL(skb_gro_header);
|
||||
|
||||
|
Reference in New Issue
Block a user