]>
Commit | Line | Data |
---|---|---|
15569d91 GKH |
1 | From 38c99a9ef2af39226b875ad264f55e8e427daf80 Mon Sep 17 00:00:00 2001 |
2 | From: Thomas Chenault <thomas_chenault@dell.com> | |
3 | Date: Mon, 18 May 2009 21:43:27 -0700 | |
4 | Subject: net: fix skb_seq_read returning wrong offset/length for page frag data | |
5 | ||
6 | From: Thomas Chenault <thomas_chenault@dell.com> | |
7 | ||
8 | [ Upstream commit 995b337952cdf7e05d288eede580257b632a8343 ] | |
9 | ||
10 | When called with a consumed value that is less than skb_headlen(skb) | |
11 | bytes into a page frag, skb_seq_read() incorrectly returns an | |
12 | offset/length relative to skb->data. Ensure that data which should come | |
13 | from a page frag does. | |
14 | ||
15 | Signed-off-by: Thomas Chenault <thomas_chenault@dell.com> | |
16 | Tested-by: Shyam Iyer <shyam_iyer@dell.com> | |
17 | Signed-off-by: David S. Miller <davem@davemloft.net> | |
18 | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> | |
19 | --- | |
20 | net/core/skbuff.c | 2 +- | |
21 | 1 file changed, 1 insertion(+), 1 deletion(-) | |
22 | ||
23 | --- a/net/core/skbuff.c | |
24 | +++ b/net/core/skbuff.c | |
25 | @@ -2206,7 +2206,7 @@ unsigned int skb_seq_read(unsigned int c | |
26 | next_skb: | |
27 | block_limit = skb_headlen(st->cur_skb) + st->stepped_offset; | |
28 | ||
29 | - if (abs_offset < block_limit) { | |
30 | + if (abs_offset < block_limit && !st->frag_data) { | |
31 | *data = st->cur_skb->data + (abs_offset - st->stepped_offset); | |
32 | return block_limit - abs_offset; | |
33 | } |