[INET]: Prevent out-of-sync truesize on ip_fragment slow path

When ip_fragment has to hit the slow path the value of skb->truesize
may go out of sync because we would have updated it without changing
the packet length.  This violates the constraints on truesize.

This patch postpones the update of skb->truesize to prevent this.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>

2 files changed, 6 insertions, 2 deletions

diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 18070ca65771..6e4d5f493bf9 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -476,6 +476,7 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff*))
         if (skb_shinfo(skb)->frag_list) {
                 struct sk_buff *frag;
                 int first_len = skb_pagelen(skb);
+                int truesizes = 0;
 
                 if (first_len - hlen > mtu ||
                     ((first_len - hlen) & 7) ||
@@ -499,7 +500,7 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff*))
                                 sock_hold(skb->sk);
                                 frag->sk = skb->sk;
                                 frag->destructor = sock_wfree;
-                                skb->truesize -= frag->truesize;
+                                truesizes += frag->truesize;
                         }
                 }
 
@@ -510,6 +511,7 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff*))
                 frag = skb_shinfo(skb)->frag_list;
                 skb_shinfo(skb)->frag_list = NULL;
                 skb->data_len = first_len - skb_headlen(skb);
+                skb->truesize -= truesizes;
                 skb->len = first_len;
                 iph->tot_len = htons(first_len);
                 iph->frag_off = htons(IP_MF);
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 15c4f6cee3e6..cfe9e707883c 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -636,6 +636,7 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
 
         if (skb_shinfo(skb)->frag_list) {
                 int first_len = skb_pagelen(skb);
+                int truesizes = 0;
 
                 if (first_len - hlen > mtu ||
                     ((first_len - hlen) & 7) ||
@@ -658,7 +659,7 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
                                 sock_hold(skb->sk);
                                 frag->sk = skb->sk;
                                 frag->destructor = sock_wfree;
-                                skb->truesize -= frag->truesize;
+                                truesizes += frag->truesize;
                         }
                 }
 
@@ -689,6 +690,7 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
 
                 first_len = skb_pagelen(skb);
                 skb->data_len = first_len - skb_headlen(skb);
+                skb->truesize -= truesizes;
                 skb->len = first_len;
                 ipv6_hdr(skb)->payload_len = htons(first_len -
                                                    sizeof(struct ipv6hdr));