• Eric Dumazet's avatar
    net: gro: fix possible panic in skb_gro_receive() · c3c7c254
    Eric Dumazet authored
    commit 2e71a6f8 (net: gro: selective flush of packets) added
    a bug for skbs using frag_list. This part of the GRO stack is rarely
    used, as it needs skb not using a page fragment for their skb->head.
    
    Most drivers do use a page fragment, but some of them use GFP_KERNEL
    allocations for the initial fill of their RX ring buffer.
    
    napi_gro_flush() overwrite skb->prev that was used for these skb to
    point to the last skb in frag_list.
    
    Fix this using a separate field in struct napi_gro_cb to point to the
    last fragment.
    Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    c3c7c254
dev.c 164 KB