Messages in this thread Patch in this message | | | Date | Thu, 20 Apr 2006 21:37:51 -0700 | From | Greg KH <> | Subject | [patch 04/22] : Fix truesize underflow |
| |
From: Herbert Xu <herbert@gondor.apana.org.au>
[TCP]: Fix truesize underflow
There is a problem with the TSO packet trimming code. The cause of this lies in the tcp_fragment() function.
When we allocate a fragment for a completely non-linear packet the truesize is calculated for a payload length of zero. This means that truesize could in fact be less than the real payload length.
When that happens the TSO packet trimming can cause truesize to become negative. This in turn can cause sk_forward_alloc to be -n * PAGE_SIZE which would trigger the warning.
I've copied the code DaveM used in tso_fragment which should work here.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
--- net/ipv4/tcp_output.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
--- linux-2.6.16.9.orig/net/ipv4/tcp_output.c +++ linux-2.6.16.9/net/ipv4/tcp_output.c @@ -537,7 +537,9 @@ int tcp_fragment(struct sock *sk, struct buff = sk_stream_alloc_skb(sk, nsize, GFP_ATOMIC); if (buff == NULL) return -ENOMEM; /* We'll just try again later. */ - sk_charge_skb(sk, buff); + + buff->truesize = skb->len - len; + skb->truesize -= buff->truesize; /* Correct the sequence numbers. */ TCP_SKB_CB(buff)->seq = TCP_SKB_CB(skb)->seq + len; -- - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |