From 64b67718a7d169b9e3fdb0ddfbbcae7f0d60ca0c Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Thu, 16 Jul 2026 15:35:50 +0200 Subject: [PATCH] 6.1-stable patches added patches: ipv4-account-for-fraggap-on-the-paged-allocation-path.patch --- ...fraggap-on-the-paged-allocation-path.patch | 52 +++++++++++++++++++ queue-6.1/series | 1 + 2 files changed, 53 insertions(+) create mode 100644 queue-6.1/ipv4-account-for-fraggap-on-the-paged-allocation-path.patch diff --git a/queue-6.1/ipv4-account-for-fraggap-on-the-paged-allocation-path.patch b/queue-6.1/ipv4-account-for-fraggap-on-the-paged-allocation-path.patch new file mode 100644 index 0000000000..317497c44f --- /dev/null +++ b/queue-6.1/ipv4-account-for-fraggap-on-the-paged-allocation-path.patch @@ -0,0 +1,52 @@ +From eca856950f7cb1a221e02b99d758409f2c5cec42 Mon Sep 17 00:00:00 2001 +From: Wongi Lee +Date: Tue, 16 Jun 2026 22:38:29 +0900 +Subject: ipv4: account for fraggap on the paged allocation path + +From: Wongi Lee + +commit eca856950f7cb1a221e02b99d758409f2c5cec42 upstream. + +In __ip_append_data(), when the paged-allocation branch is taken, +alloclen and pagedlen are computed as + + alloclen = fragheaderlen + transhdrlen; + pagedlen = datalen - transhdrlen; + +datalen already includes fraggap, but the fraggap bytes carried over +from the previous skb are copied into the new skb's linear area at +offset transhdrlen by the subsequent skb_copy_and_csum_bits(). The +linear area is therefore undersized by fraggap bytes while pagedlen is +overstated by the same amount. + +The non-paged branch sets alloclen to fraglen, which already accounts +for fraggap because datalen does. Bring the paged branch in line by +adding fraggap to alloclen and subtracting it from pagedlen. + +After this adjustment, copy no longer collapses to -fraggap on the +paged path, so remove the stale comment describing that old arithmetic. + +Fixes: 8eb77cc73977 ("ipv4: avoid partial copy for zc") +Signed-off-by: Jungwoo Lee +Signed-off-by: Wongi Lee +Reviewed-by: Ido Schimmel +Link: https://patch.msgid.link/ajFR1eLAIs42TN3g@DESKTOP-19IMU7U.localdomain +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/ip_output.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/ipv4/ip_output.c ++++ b/net/ipv4/ip_output.c +@@ -1117,8 +1117,8 @@ alloc_new_skb: + !(rt->dst.dev->features & NETIF_F_SG))) + alloclen = fraglen; + else { +- alloclen = fragheaderlen + transhdrlen; +- pagedlen = datalen - transhdrlen; ++ alloclen = fragheaderlen + transhdrlen + fraggap; ++ pagedlen = datalen - transhdrlen - fraggap; + } + + alloclen += alloc_extra; diff --git a/queue-6.1/series b/queue-6.1/series index c1ff660649..5bf1c40b4c 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -248,3 +248,4 @@ rdma-rtrs-srv-bound-rdma-write-length-to-chunk-size-in-rdma_write_sg.patch rdma-siw-bound-read-response-placement-to-the-rread-length.patch fuse-fix-device-node-leak-in-cuse_process_init_reply.patch fuse-re-lock-request-before-returning-from-fuse_ref_folio.patch +ipv4-account-for-fraggap-on-the-paged-allocation-path.patch -- 2.47.3