1 files changed, 18 insertions, 24 deletions

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 83fee37de38e..d0732e9c8560 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -135,17 +135,13 @@ void skb_under_panic(struct sk_buff *skb, int sz, void *here)
 struct sk_buff *__alloc_skb(unsigned int size, gfp_t gfp_mask,
                             int fclone)
 {
+        struct skb_shared_info *shinfo;
         struct sk_buff *skb;
         u8 *data;
 
         /* Get the HEAD */
-        if (fclone)
-                skb = kmem_cache_alloc(skbuff_fclone_cache,
-                                       gfp_mask & ~__GFP_DMA);
-        else
-                skb = kmem_cache_alloc(skbuff_head_cache,
-                                       gfp_mask & ~__GFP_DMA);
-
+        skb = kmem_cache_alloc(fclone ? skbuff_fclone_cache : skbuff_head_cache,
+                                gfp_mask & ~__GFP_DMA);
         if (!skb)
                 goto out;
 
@@ -162,6 +158,16 @@ struct sk_buff *__alloc_skb(unsigned int size, gfp_t gfp_mask,
         skb->data = data;
         skb->tail = data;
         skb->end  = data + size;
+        /* make sure we initialize shinfo sequentially */
+        shinfo = skb_shinfo(skb);
+        atomic_set(&shinfo->dataref, 1);
+        shinfo->nr_frags  = 0;
+        shinfo->tso_size = 0;
+        shinfo->tso_segs = 0;
+        shinfo->ufo_size = 0;
+        shinfo->ip6_frag_id = 0;
+        shinfo->frag_list = NULL;
+
         if (fclone) {
                 struct sk_buff *child = skb + 1;
                 atomic_t *fclone_ref = (atomic_t *) (child + 1);
@@ -171,13 +177,6 @@ struct sk_buff *__alloc_skb(unsigned int size, gfp_t gfp_mask,
 
                 child->fclone = SKB_FCLONE_UNAVAILABLE;
         }
-        atomic_set(&(skb_shinfo(skb)->dataref), 1);
-        skb_shinfo(skb)->nr_frags  = 0;
-        skb_shinfo(skb)->tso_size = 0;
-        skb_shinfo(skb)->tso_segs = 0;
-        skb_shinfo(skb)->frag_list = NULL;
-        skb_shinfo(skb)->ufo_size = 0;
-        skb_shinfo(skb)->ip6_frag_id = 0;
 out:
         return skb;
 nodata:
@@ -792,8 +791,7 @@ int ___pskb_trim(struct sk_buff *skb, unsigned int len, int realloc)
                 int end = offset + skb_shinfo(skb)->frags[i].size;
                 if (end > len) {
                         if (skb_cloned(skb)) {
-                                if (!realloc)
-                                        BUG();
+                                BUG_ON(!realloc);
                                 if (pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
                                         return -ENOMEM;
                         }
@@ -895,8 +893,7 @@ unsigned char *__pskb_pull_tail(struct sk_buff *skb, int delta)
                 struct sk_buff *insp = NULL;
 
                 do {
-                        if (!list)
-                                BUG();
+                        BUG_ON(!list);
 
                         if (list->len <= eat) {
                                 /* Eaten as whole. */
@@ -1200,8 +1197,7 @@ unsigned int skb_checksum(const struct sk_buff *skb, int offset,
                         start = end;
                 }
         }
-        if (len)
-                BUG();
+        BUG_ON(len);
 
         return csum;
 }
@@ -1283,8 +1279,7 @@ unsigned int skb_copy_and_csum_bits(const struct sk_buff *skb, int offset,
                         start = end;
                 }
         }
-        if (len)
-                BUG();
+        BUG_ON(len);
         return csum;
 }
 
@@ -1298,8 +1293,7 @@ void skb_copy_and_csum_dev(const struct sk_buff *skb, u8 *to)
         else
                 csstart = skb_headlen(skb);
 
-        if (csstart > skb_headlen(skb))
-                BUG();
+        BUG_ON(csstart > skb_headlen(skb));
 
         memcpy(to, skb->data, csstart);