1. 14 Jul, 2006 1 commit
    • Herbert Xu's avatar
      [NET]: Update frag_list in pskb_trim · 27b437c8
      Herbert Xu authored
      When pskb_trim has to defer to ___pksb_trim to trim the frag_list part of
      the packet, the frag_list is not updated to reflect the trimming.  This
      will usually work fine until you hit something that uses the packet length
      or tail from the frag_list.
      
      Examples include esp_output and ip_fragment.
      
      Another problem caused by this is that you can end up with a linear packet
      with a frag_list attached.
      
      It is possible to get away with this if we audit everything to make sure
      that they always consult skb->len before going down onto frag_list.  In
      fact we can do the samething for the paged part as well to avoid copying
      the data area of the skb.  For now though, let's do the conservative fix
      and update frag_list.
      
      Many thanks to Marco Berizzi for helping me to track down this bug.
      
      This 4-year old bug took 3 months to track down.  Marco was very patient
      indeed :)
      Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      27b437c8
  2. 13 Jul, 2006 39 commits