Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S936046AbZLQBfW (ORCPT ); Wed, 16 Dec 2009 20:35:22 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S936022AbZLQBeg (ORCPT ); Wed, 16 Dec 2009 20:34:36 -0500 Received: from kroah.org ([198.145.64.141]:48032 "EHLO coco.kroah.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1763645AbZLQBUg (ORCPT ); Wed, 16 Dec 2009 20:20:36 -0500 X-Mailbox-Line: From gregkh@mini.kroah.org Wed Dec 16 17:16:04 2009 Message-Id: <20091217011604.755061670@mini.kroah.org> User-Agent: quilt/0.48-1 Date: Wed, 16 Dec 2009 17:15:03 -0800 From: Greg KH To: linux-kernel@vger.kernel.org, stable@kernel.org Cc: stable-review@kernel.org, torvalds@linux-foundation.org, akpm@linux-foundation.org, alan@lxorguk.ukuu.org.uk, Patrick McHardy , "David S. Miller" Subject: [52/90] ip_fragment: also adjust skb->truesize for packets not owned by a socket In-Reply-To: <20091217011835.GA20434@kroah.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1680 Lines: 41 2.6.31-stable review patch. If anyone has any objections, please let us know. ------------------ From: Patrick McHardy [ Upstream commit b2722b1c3a893ec6021508da15b32282ec79f4da ] When a large packet gets reassembled by ip_defrag(), the head skb accounts for all the fragments in skb->truesize. If this packet is refragmented again, skb->truesize is not re-adjusted to reflect only the head size since its not owned by a socket. If the head fragment then gets recycled and reused for another received fragment, it might exceed the defragmentation limits due to its large truesize value. skb_recycle_check() explicitly checks for linear skbs, so any recycled skb should reflect its true size in skb->truesize. Change ip_fragment() to also adjust the truesize value of skbs not owned by a socket. Reported-and-tested-by: Ben Menchaca Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/ipv4/ip_output.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/net/ipv4/ip_output.c +++ b/net/ipv4/ip_output.c @@ -500,8 +500,8 @@ int ip_fragment(struct sk_buff *skb, int if (skb->sk) { frag->sk = skb->sk; frag->destructor = sock_wfree; - truesizes += frag->truesize; } + truesizes += frag->truesize; } /* Everything is OK. Generate! */ -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/