[PATCH] Fix truesize underflow
authorHerbert Xu <herbert@gondor.apana.org.au>
Wed, 19 Apr 2006 04:43:31 +0000 (21:43 -0700)
committerGreg Kroah-Hartman <gregkh@suse.de>
Mon, 24 Apr 2006 16:56:03 +0000 (09:56 -0700)
commit5d0b6f2bdaf7e016e750cd24164a241512d968a3
tree63cc8e4a8124a6d8fa3f8acc22d08ed7adc206ac
parent9d9c917ebaf0185248e80d6b4a589b8b4d193947
[PATCH] Fix truesize underflow

[TCP]: Fix truesize underflow

There is a problem with the TSO packet trimming code.  The cause of
this lies in the tcp_fragment() function.

When we allocate a fragment for a completely non-linear packet the
truesize is calculated for a payload length of zero.  This means that
truesize could in fact be less than the real payload length.

When that happens the TSO packet trimming can cause truesize to become
negative.  This in turn can cause sk_forward_alloc to be -n * PAGE_SIZE
which would trigger the warning.

I've copied the code DaveM used in tso_fragment which should work here.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
net/ipv4/tcp_output.c