From: Patrick McHardy Date: Tue, 1 Dec 2009 23:53:57 +0000 (-0800) Subject: ip_fragment: also adjust skb->truesize for packets not owned by a socket X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=b2722b1c3a893ec6021508da15b32282ec79f4da;p=GitHub%2Fmoto-9609%2Fandroid_kernel_motorola_exynos9610.git ip_fragment: also adjust skb->truesize for packets not owned by a socket When a large packet gets reassembled by ip_defrag(), the head skb accounts for all the fragments in skb->truesize. If this packet is refragmented again, skb->truesize is not re-adjusted to reflect only the head size since its not owned by a socket. If the head fragment then gets recycled and reused for another received fragment, it might exceed the defragmentation limits due to its large truesize value. skb_recycle_check() explicitly checks for linear skbs, so any recycled skb should reflect its true size in skb->truesize. Change ip_fragment() to also adjust the truesize value of skbs not owned by a socket. Reported-and-tested-by: Ben Menchaca Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller --- diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c index f9895180f481..4d50daab0c3e 100644 --- a/net/ipv4/ip_output.c +++ b/net/ipv4/ip_output.c @@ -501,8 +501,8 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *)) if (skb->sk) { frag->sk = skb->sk; frag->destructor = sock_wfree; - truesizes += frag->truesize; } + truesizes += frag->truesize; } /* Everything is OK. Generate! */