Matt Walters wrote:

>On Mon, 2004-08-16 at 15:38, Patrick McHardy wrote:
>
>>skb_tailroom should return 0 in this case and the skb should be linearized
>>by skb_copy_expand already. The check isn't triggered because this line is
>>wrong:
>>
>>diff = v->data_len - e->skb->len
>>
>>skb->len is the total length, including fragments. If we want to copy to it,
>>we either need to linearize it or look at skb_headlen(skb). It's complicated
>>getting everything right, I need to think about it some more.
>>    
>>

This patch on top of the ip_queue_nonlinear_skbs patch should fix the 
problem.
It wastes a couple of bytes when enlarging a non-linear skb, but that 
shouldn't be
a problem. When you test it, please try all three possibilities (replace 
by smaller,
equally sized and larger packet).

Regards
Patrick