diff options
-rw-r--r-- | net/core/skbuff.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/net/core/skbuff.c b/net/core/skbuff.c index f9f4065a7e9..d386f1082eb 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c | |||
@@ -2591,9 +2591,11 @@ int skb_gro_receive(struct sk_buff **head, struct sk_buff *skb) | |||
2591 | 2591 | ||
2592 | if (skb_shinfo(p)->frag_list) | 2592 | if (skb_shinfo(p)->frag_list) |
2593 | goto merge; | 2593 | goto merge; |
2594 | else if (skb_headlen(skb) <= skb_gro_offset(skb) && | 2594 | else if (skb_headlen(skb) <= skb_gro_offset(skb)) { |
2595 | skb_shinfo(p)->nr_frags + skb_shinfo(skb)->nr_frags <= | 2595 | if (skb_shinfo(p)->nr_frags + skb_shinfo(skb)->nr_frags > |
2596 | MAX_SKB_FRAGS) { | 2596 | MAX_SKB_FRAGS) |
2597 | return -E2BIG; | ||
2598 | |||
2597 | skb_shinfo(skb)->frags[0].page_offset += | 2599 | skb_shinfo(skb)->frags[0].page_offset += |
2598 | skb_gro_offset(skb) - skb_headlen(skb); | 2600 | skb_gro_offset(skb) - skb_headlen(skb); |
2599 | skb_shinfo(skb)->frags[0].size -= | 2601 | skb_shinfo(skb)->frags[0].size -= |