Re: 2.6.20 crash in tcp_tso_segment()

[David Miller <davem@davemloft.net>]

From: Herbert Xu <herbert@gondor.apana.org.au>
Date: Wed, 14 Feb 2007 04:51:21 +1100

> On Tue, Feb 13, 2007 at 03:34:43PM +0100, Patrick McHardy wrote:
> >
> > The callpath shows the REJECT target sending a TCP reset.
> > I'm guessing it has something to do with skb_copy_expand
> > copying the gso fields.
> 
> Indeed.  We need to reset the GSO bits there since the new
> packet is nothing like the one it's copied from.
> 
> [NETFILTER]: Clear GSO bits for TCP reset packet
> 
> The TCP reset packet is copied from the original.  This
> includes all the GSO bits which do not apply to the new
> packet.  So we should clear those bits.
> 
> Spotted by Patrick McHardy.
> 
> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
> 
> Something like this is needed for all trees with GSO.
> Actually it applies to TSO too although the effect there
> is a bit harder to notice.

Applied, thanks Herbert.

I'll push this to -stable.

I'm kind of challenged for time as I'll be out of town from
Wednesday until Sunday, so if someone could cook up the TSO
variable of the patch for pre-GSO kernels I'd appreciate it.