From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1CC2A36DA1D; Tue, 21 Jul 2026 21:17:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784668638; cv=none; b=GWKjMusWp3ARJbO6Baqmngyd1dwNYrBzgdG0f2O8TVuW4ok2fed+8pwxFZkeiSOEDiUagQMEYMB2fq3FFfWPcKkGR6gzNnCs7MdREgfX5Fd+zk9iVhLxz9NWjd/RARV2ooWSm0THxf0vOuOAfAkfXfk8cZCYhARMa3pIvs2cIqk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784668638; c=relaxed/simple; bh=rS0kKZBisOP5EGQCaRSg/69T/gQKWbbmgiZzWJUxCvs=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=S2Hakv7L3kyTFruNvl4/5AG+Wg3rmAg4TqJYbeTzWlAm5RFc0N1pQvTuoJxYWEv92V/l6rsL4umTJhNJuNqFHRdDW4OcRpamJG0Wg4csl1K+aRpQyYRfFXo6X5l2eahsUGJml+w0t6UYtR/ysJJEZUmK0hObGUwwuD8T2laW/X8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=PVVgVtEb; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="PVVgVtEb" Received: by smtp.kernel.org (Postfix) with ESMTPSA id B82201F000E9; Tue, 21 Jul 2026 21:17:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1784668631; bh=uzUE6crRS5iSri9gt+eTiZ0pYiIxtIsDKp9p+HXm9u4=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=PVVgVtEbJe/D7MmGyAq/5He9vb3bK2Dr+kgfVupdTzRQU15U9i9ef1cPvQZ+ODKHV d/IfqAEPrS6tmDkW08au3+OomgXZGYPnYFjnJy5OssH99rpzpr2BGxjI0A2arhZAd0 n3khwQTO7mH0af9WkHb2EfrvdORb6AfrkrJ/BbbY= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Jungwoo Lee , Wongi Lee , Ido Schimmel , Jakub Kicinski Subject: [PATCH 6.1 0250/1067] ipv4: account for fraggap on the paged allocation path Date: Tue, 21 Jul 2026 17:14:11 +0200 Message-ID: <20260721152430.189949575@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260721152424.521567757@linuxfoundation.org> References: <20260721152424.521567757@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.1-stable review patch. If anyone has any objections, please let me know. ------------------ From: Wongi Lee commit eca856950f7cb1a221e02b99d758409f2c5cec42 upstream. In __ip_append_data(), when the paged-allocation branch is taken, alloclen and pagedlen are computed as alloclen = fragheaderlen + transhdrlen; pagedlen = datalen - transhdrlen; datalen already includes fraggap, but the fraggap bytes carried over from the previous skb are copied into the new skb's linear area at offset transhdrlen by the subsequent skb_copy_and_csum_bits(). The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount. The non-paged branch sets alloclen to fraglen, which already accounts for fraggap because datalen does. Bring the paged branch in line by adding fraggap to alloclen and subtracting it from pagedlen. After this adjustment, copy no longer collapses to -fraggap on the paged path, so remove the stale comment describing that old arithmetic. Fixes: 8eb77cc73977 ("ipv4: avoid partial copy for zc") Signed-off-by: Jungwoo Lee Signed-off-by: Wongi Lee Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/ajFR1eLAIs42TN3g@DESKTOP-19IMU7U.localdomain Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman --- net/ipv4/ip_output.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/net/ipv4/ip_output.c +++ b/net/ipv4/ip_output.c @@ -1117,8 +1117,8 @@ alloc_new_skb: !(rt->dst.dev->features & NETIF_F_SG))) alloclen = fraglen; else { - alloclen = fragheaderlen + transhdrlen; - pagedlen = datalen - transhdrlen; + alloclen = fragheaderlen + transhdrlen + fraggap; + pagedlen = datalen - transhdrlen - fraggap; } alloclen += alloc_extra;