From patchwork Thu Aug 27 00:56:05 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: chenweilong X-Patchwork-Id: 511133 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id CF3E8140157 for ; Thu, 27 Aug 2015 10:56:33 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752231AbbH0A43 (ORCPT ); Wed, 26 Aug 2015 20:56:29 -0400 Received: from szxga01-in.huawei.com ([58.251.152.64]:20926 "EHLO szxga01-in.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750982AbbH0A42 (ORCPT ); Wed, 26 Aug 2015 20:56:28 -0400 Received: from 172.24.1.47 (EHLO szxeml425-hub.china.huawei.com) ([172.24.1.47]) by szxrg01-dlp.huawei.com (MOS 4.3.7-GA FastPath queued) with ESMTP id CTW17040; Thu, 27 Aug 2015 08:56:08 +0800 (CST) Received: from localhost (10.177.36.145) by szxeml425-hub.china.huawei.com (10.82.67.180) with Microsoft SMTP Server id 14.3.235.1; Thu, 27 Aug 2015 08:56:02 +0800 From: To: , , , , CC: Subject: [PATCH net-next] net: Check frag_lists first to prevent data out of order Date: Thu, 27 Aug 2015 08:56:05 +0800 Message-ID: <1440636965-11552-1-git-send-email-chenweilong@huawei.com> X-Mailer: git-send-email 1.9.5.msysgit.1 MIME-Version: 1.0 X-Originating-IP: [10.177.36.145] X-CFilter-Loop: Reflected Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org From: Weilong Chen When try to merge several skbs to prior one, if the frag_list is used and the the last one is a small packet, once the condition "len <= skb_tailroom(to)" is satisfied, we will get a wrong packet! This patch just check frag_lists before the condtion to prevent this from happening. Signed-off-by: Weilong Chen --- net/core/skbuff.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/net/core/skbuff.c b/net/core/skbuff.c index 8a725cc..d08edcb 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -4133,6 +4133,9 @@ bool skb_try_coalesce(struct sk_buff *to, struct sk_buff *from, if (skb_cloned(to)) return false; + if (skb_has_frag_list(to) || skb_has_frag_list(from)) + return false; + if (len <= skb_tailroom(to)) { if (len) BUG_ON(skb_copy_bits(from, 0, skb_put(to, len), len)); @@ -4140,9 +4143,6 @@ bool skb_try_coalesce(struct sk_buff *to, struct sk_buff *from, return true; } - if (skb_has_frag_list(to) || skb_has_frag_list(from)) - return false; - if (skb_headlen(from) != 0) { struct page *page; unsigned int offset;