net: Stop decapitating clones that have a head_frag

This change is meant ot prevent stealing the skb->head to use as a page in
the event that the skb->head was cloned.  This allows the other clones to
track each other via shinfo->dataref.

Without this we break down to two methods for tracking the reference count,
one being dataref, the other being the page count.  As a result it becomes
difficult to track how many references there are to skb->head.

Signed-off-by: Alexander Duyck <alexander.h.duyck@intel.com>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 2 insertions, 7 deletions

diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 2f696ef13dcd..c6f78e2b590f 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -4589,7 +4589,7 @@ copyfrags:
                 to->data_len += len;
                 goto merge;
         }
-        if (from->head_frag) {
+        if (from->head_frag && !skb_cloned(from)) {
                 struct page *page;
                 unsigned int offset;
 
@@ -4599,12 +4599,7 @@ copyfrags:
                 offset = from->data - (unsigned char *)page_address(page);
                 skb_fill_page_desc(to, skb_shinfo(to)->nr_frags,
                                    page, offset, skb_headlen(from));
-
-                if (skb_cloned(from))
-                        get_page(page);
-                else
-                        *fragstolen = true;
-
+                *fragstolen = true;
                 delta = len; /* we dont know real truesize... */
                 goto copyfrags;
         }