From: Herbert Xu <herbert@gondor.apana.org.au>
Date: Fri, 17 Apr 2009 09:34:38 +0000 (-0700)
Subject: gro: Fix use after free in tcp_gro_receive
X-Git-Tag: v2.6.30-rc4~68^2~42
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a0a69a0106dab8d20596f97f6674bed3b394d1ee;p=pandora-kernel.git

gro: Fix use after free in tcp_gro_receive

After calling skb_gro_receive skb->len can no longer be relied
on since if the skb was merged using frags, then its pages will
have been removed and the length reduced.

This caused tcp_gro_receive to prematurely end merging which
resulted in suboptimal performance with ixgbe.

The fix is to store skb->len on the stack.

Reported-by: Mark Wagner <mwagner@redhat.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
---

Reading git-diff-tree failed