6.1-stable patches

added patches:
	ipv4-account-for-fraggap-on-the-paged-allocation-path.patch

diff --git a/queue-6.1/ipv4-account-for-fraggap-on-the-paged-allocation-path.patch b/queue-6.1/ipv4-account-for-fraggap-on-the-paged-allocation-path.patch
new file mode 100644 (file)
index 0000000..317497c
--- /dev/null
+++ b/queue-6.1/ipv4-account-for-fraggap-on-the-paged-allocation-path.patch
@@ -0,0 +1,52 @@
+From eca856950f7cb1a221e02b99d758409f2c5cec42 Mon Sep 17 00:00:00 2001
+From: Wongi Lee <qw3rtyp0@gmail.com>
+Date: Tue, 16 Jun 2026 22:38:29 +0900
+Subject: ipv4: account for fraggap on the paged allocation path
+
+From: Wongi Lee <qw3rtyp0@gmail.com>
+
+commit eca856950f7cb1a221e02b99d758409f2c5cec42 upstream.
+
+In __ip_append_data(), when the paged-allocation branch is taken,
+alloclen and pagedlen are computed as
+
+       alloclen = fragheaderlen + transhdrlen;
+       pagedlen = datalen - transhdrlen;
+
+datalen already includes fraggap, but the fraggap bytes carried over
+from the previous skb are copied into the new skb's linear area at
+offset transhdrlen by the subsequent skb_copy_and_csum_bits(). The
+linear area is therefore undersized by fraggap bytes while pagedlen is
+overstated by the same amount.
+
+The non-paged branch sets alloclen to fraglen, which already accounts
+for fraggap because datalen does. Bring the paged branch in line by
+adding fraggap to alloclen and subtracting it from pagedlen.
+
+After this adjustment, copy no longer collapses to -fraggap on the
+paged path, so remove the stale comment describing that old arithmetic.
+
+Fixes: 8eb77cc73977 ("ipv4: avoid partial copy for zc")
+Signed-off-by: Jungwoo Lee <jwlee2217@gmail.com>
+Signed-off-by: Wongi Lee <qw3rtyp0@gmail.com>
+Reviewed-by: Ido Schimmel <idosch@nvidia.com>
+Link: https://patch.msgid.link/ajFR1eLAIs42TN3g@DESKTOP-19IMU7U.localdomain
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/ip_output.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/ipv4/ip_output.c
++++ b/net/ipv4/ip_output.c
+@@ -1117,8 +1117,8 @@ alloc_new_skb:
+                                 !(rt->dst.dev->features & NETIF_F_SG)))
+                               alloclen = fraglen;
+                       else {
+-                              alloclen = fragheaderlen + transhdrlen;
+-                              pagedlen = datalen - transhdrlen;
++                              alloclen = fragheaderlen + transhdrlen + fraggap;
++                              pagedlen = datalen - transhdrlen - fraggap;
+                       }
+ 
+                       alloclen += alloc_extra;

diff --git a/queue-6.1/series b/queue-6.1/series
index c1ff6606498bfe639f08ca3eef7a1a18ea51d3b4..5bf1c40b4c985e17ed730e47d98a10fdd5111aa1 100644 (file)
--- a/queue-6.1/series
+++ b/queue-6.1/series
@@ -248,3 +248,4 @@ rdma-rtrs-srv-bound-rdma-write-length-to-chunk-size-in-rdma_write_sg.patch
 rdma-siw-bound-read-response-placement-to-the-rread-length.patch
 fuse-fix-device-node-leak-in-cuse_process_init_reply.patch
 fuse-re-lock-request-before-returning-from-fuse_ref_folio.patch
+ipv4-account-for-fraggap-on-the-paged-allocation-path.patch