path: root/net/ipv4/netfilter/ipt_REJECT.c
diff options
authorEric Dumazet <eric.dumazet@gmail.com>2010-09-21 08:47:45 +0000
committerDavid S. Miller <davem@davemloft.net>2010-09-21 15:05:50 -0700
commit3d13008e7345fa7a79d8f6438150dc15d6ba6e9d (patch)
treea36caa5636e4030419ca8907642e75c0cd565143 /net/ipv4/netfilter/ipt_REJECT.c
parent7e96dc7045bff8758804b047c0dfb6868f182500 (diff)
ip: fix truesize mismatch in ip fragmentation
Special care should be taken when slow path is hit in ip_fragment() : When walking through frags, we transfert truesize ownership from skb to frags. Then if we hit a slow_path condition, we must undo this or risk uncharging frags->truesize twice, and in the end, having negative socket sk_wmem_alloc counter, or even freeing socket sooner than expected. Many thanks to Nick Bowler, who provided a very clean bug report and test program. Thanks to Jarek for reviewing my first patch and providing a V2 While Nick bisection pointed to commit 2b85a34e911 (net: No more expensive sock_hold()/sock_put() on each tx), underlying bug is older (2.6.12-rc5) A side effect is to extend work done in commit b2722b1c3a893e (ip_fragment: also adjust skb->truesize for packets not owned by a socket) to ipv6 as well. Reported-and-bisected-by: Nick Bowler <nbowler@elliptictech.com> Tested-by: Nick Bowler <nbowler@elliptictech.com> Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> CC: Jarek Poplawski <jarkao2@gmail.com> CC: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv4/netfilter/ipt_REJECT.c')
0 files changed, 0 insertions, 0 deletions

Privacy Policy