[PATCH] deal with if frags[0].size is pulled to 0 in dev_gro_receive()

[PATCH] deal with if frags[0].size is pulled to 0 in dev_gro_receive()

[xiaohui.xin]

From: Xin Xiaohui <xiaohui.xin@intel.com>

Now in dev_gro_receive(), if frags[0].size is pulled to 0, memmove is called and
the null page is released. But it's not enough, we should reset size of each frags
left as well. Compared to this, we can have another way to do this, it's not do do
anything at all.

Signed-off-by: Xin Xiaohui <xiaohui.xin@intel.com>

---
 net/core/dev.c |    7 -------
 1 files changed, 0 insertions(+), 7 deletions(-)

diff --git a/net/core/dev.c b/net/core/dev.c
index 264137f..28cdbbf 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2730,13 +2730,6 @@ pull:
 
 		skb_shinfo(skb)->frags[0].page_offset += grow;
 		skb_shinfo(skb)->frags[0].size -= grow;
-
-		if (unlikely(!skb_shinfo(skb)->frags[0].size)) {
-			put_page(skb_shinfo(skb)->frags[0].page);
-			memmove(skb_shinfo(skb)->frags,
-				skb_shinfo(skb)->frags + 1,
-				--skb_shinfo(skb)->nr_frags);
-		}
 	}
 
 ok:
-- 
1.5.4.4

Re: [PATCH] deal with if frags[0].size is pulled to 0 in dev_gro_receive()

[Herbert Xu]

On Tue, Aug 03, 2010 at 11:17:19AM +0800, xiaohui.xin@intel.com wrote:
> From: Xin Xiaohui <xiaohui.xin@intel.com>
> 
> Now in dev_gro_receive(), if frags[0].size is pulled to 0, memmove is called and
> the null page is released. But it's not enough, we should reset size of each frags
> left as well. Compared to this, we can have another way to do this, it's not do do
> anything at all.
> 
> Signed-off-by: Xin Xiaohui <xiaohui.xin@intel.com>

This patch can only work if you audit everything that uses skb
frags to ensure that they can tolerate a zero-sided frag.

I think it's much easier to just fix the memmove.

Thanks,
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Re: [PATCH] deal with if frags[0].size is pulled to 0 in dev_gro_receive()

[David Miller]

From: Herbert Xu <herbert@gondor.apana.org.au>
Date: Tue, 3 Aug 2010 12:56:38 +0800

> On Tue, Aug 03, 2010 at 11:17:19AM +0800, xiaohui.xin@intel.com wrote:
>> From: Xin Xiaohui <xiaohui.xin@intel.com>
>> 
>> Now in dev_gro_receive(), if frags[0].size is pulled to 0, memmove is called and
>> the null page is released. But it's not enough, we should reset size of each frags
>> left as well. Compared to this, we can have another way to do this, it's not do do
>> anything at all.
>> 
>> Signed-off-by: Xin Xiaohui <xiaohui.xin@intel.com>
> 
> This patch can only work if you audit everything that uses skb
> frags to ensure that they can tolerate a zero-sided frag.
> 
> I think it's much easier to just fix the memmove.

Agreed.