gro: Fix handling of headers that extend over the tail

The skb_gro_* code fails to handle the case where a header starts
in the linear area but ends in the frags area.  Since the goal
of skb_gro_* is to optimise the case of completely non-linear
packets, we can simply bail out if we have anything in the linear
area.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>

2 files changed, 4 insertions, 9 deletions

diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 31167451d08d..c9ef41916071 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -1137,7 +1137,7 @@ static inline void skb_gro_reset_offset(struct sk_buff *skb)
 
 static inline void *skb_gro_mac_header(struct sk_buff *skb)
 {
-        return skb_mac_header(skb) < skb->data ? skb_mac_header(skb) :
+        return skb_headlen(skb) ? skb_mac_header(skb) :
                page_address(skb_shinfo(skb)->frags[0].page) +
                skb_shinfo(skb)->frags[0].page_offset;
 }
diff --git a/net/core/dev.c b/net/core/dev.c
index e48c08af76ad..6785b067ad50 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2378,18 +2378,13 @@ void *skb_gro_header(struct sk_buff *skb, unsigned int hlen)
         unsigned int offset = skb_gro_offset(skb);
 
         hlen += offset;
-        if (hlen <= skb_headlen(skb))
-                return skb->data + offset;
-
-        if (unlikely(!skb_shinfo(skb)->nr_frags ||
-                     skb_shinfo(skb)->frags[0].size <=
-                     hlen - skb_headlen(skb) ||
+        if (unlikely(skb_headlen(skb) ||
+                     skb_shinfo(skb)->frags[0].size < hlen ||
                      PageHighMem(skb_shinfo(skb)->frags[0].page)))
                 return pskb_may_pull(skb, hlen) ? skb->data + offset : NULL;
 
         return page_address(skb_shinfo(skb)->frags[0].page) +
-               skb_shinfo(skb)->frags[0].page_offset +
-               offset - skb_headlen(skb);
+               skb_shinfo(skb)->frags[0].page_offset + offset;
 }
 EXPORT_SYMBOL(skb_gro_header);