gro: Fix page ref count for skbs freed normally

When an skb with page frags is merged into an existing one, we
cannibalise its reference count.  This is OK when the skb is
reused because we set nr_frags to zero in that case.  However,
for the case where the skb is freed through kfree_skb, we didn't
clear nr_frags which causes the page to be freed prematurely.

This is fixed by moving the skb resetting into skb_gro_receive.

Reported-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/core/dev.c b/net/core/dev.c
index 7dec715293b1d40b1fb770354b552ed88e429c9c..60377b6c0a804798a41ce8d128421a41226c25f1 100644 (file)
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2491,12 +2491,6 @@ EXPORT_SYMBOL(napi_gro_receive);
 
 void napi_reuse_skb(struct napi_struct *napi, struct sk_buff *skb)
 {
-       skb_shinfo(skb)->nr_frags = 0;
-
-       skb->len -= skb->data_len;
-       skb->truesize -= skb->data_len;
-       skb->data_len = 0;
-
        __skb_pull(skb, skb_headlen(skb));
        skb_reserve(skb, NET_IP_ALIGN - skb_headroom(skb));
 

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 5110b359c758c2e8abe7d13e5f63f90269fbbd5e..65eac77390337e9857c73736618a60ff09737d84 100644 (file)
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2602,6 +2602,12 @@ int skb_gro_receive(struct sk_buff **head, struct sk_buff *skb)
                       skb_shinfo(skb)->nr_frags * sizeof(skb_frag_t));
 
                skb_shinfo(p)->nr_frags += skb_shinfo(skb)->nr_frags;
+               skb_shinfo(skb)->nr_frags = 0;
+
+               skb->truesize -= skb->data_len;
+               skb->len -= skb->data_len;
+               skb->data_len = 0;
+
                NAPI_GRO_CB(skb)->free = 1;
                goto done;
        }