summaryrefslogtreecommitdiffstats
path: root/include
diff options
context:
space:
mode:
authorEric Dumazet <edumazet@google.com>2012-12-06 13:54:59 +0000
committerDavid S. Miller <davem@davemloft.net>2012-12-07 14:39:29 -0500
commitc3c7c254b2e8cd99b0adf288c2a1bddacd7ba255 (patch)
treecca25bcae0cc6172a616335041c1e54a33db451c /include
parent93b174ad71b08e504c2cf6e8a58ecce778b77a40 (diff)
downloadlinux-c3c7c254b2e8cd99b0adf288c2a1bddacd7ba255.tar.gz
linux-c3c7c254b2e8cd99b0adf288c2a1bddacd7ba255.tar.bz2
linux-c3c7c254b2e8cd99b0adf288c2a1bddacd7ba255.zip
net: gro: fix possible panic in skb_gro_receive()
commit 2e71a6f8084e (net: gro: selective flush of packets) added a bug for skbs using frag_list. This part of the GRO stack is rarely used, as it needs skb not using a page fragment for their skb->head. Most drivers do use a page fragment, but some of them use GFP_KERNEL allocations for the initial fill of their RX ring buffer. napi_gro_flush() overwrite skb->prev that was used for these skb to point to the last skb in frag_list. Fix this using a separate field in struct napi_gro_cb to point to the last fragment. Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'include')
-rw-r--r--include/linux/netdevice.h3
1 files changed, 3 insertions, 0 deletions
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index f8eda0276f03..a848ffc327f4 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -1488,6 +1488,9 @@ struct napi_gro_cb {
/* Used in ipv6_gro_receive() */
int proto;
+
+ /* used in skb_gro_receive() slow path */
+ struct sk_buff *last;
};
#define NAPI_GRO_CB(skb) ((struct napi_gro_cb *)(skb)->cb)