1 files changed, 25 insertions, 40 deletions

diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 3dd4a37488d5..aece3e792f84 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1279,8 +1279,6 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
                 if (dst_allfrag(rt->dst.path))
                         cork->flags |= IPCORK_ALLFRAG;
                 cork->length = 0;
-                sk->sk_sndmsg_page = NULL;
-                sk->sk_sndmsg_off = 0;
                 exthdrlen = (opt ? opt->opt_flen : 0) - rt->rt6i_nfheader_len;
                 length += exthdrlen;
                 transhdrlen += exthdrlen;
@@ -1504,48 +1502,31 @@ alloc_new_skb:
                         }
                 } else {
                         int i = skb_shinfo(skb)->nr_frags;
-                        skb_frag_t *frag = &skb_shinfo(skb)->frags[i-1];
-                        struct page *page = sk->sk_sndmsg_page;
-                        int off = sk->sk_sndmsg_off;
-                        unsigned int left;
-
-                        if (page && (left = PAGE_SIZE - off) > 0) {
-                                if (copy >= left)
-                                        copy = left;
-                                if (page != skb_frag_page(frag)) {
-                                        if (i == MAX_SKB_FRAGS) {
-                                                err = -EMSGSIZE;
-                                                goto error;
-                                        }
-                                        skb_fill_page_desc(skb, i, page, sk->sk_sndmsg_off, 0);
-                                        skb_frag_ref(skb, i);
-                                        frag = &skb_shinfo(skb)->frags[i];
-                                }
-                        } else if(i < MAX_SKB_FRAGS) {
-                                if (copy > PAGE_SIZE)
-                                        copy = PAGE_SIZE;
-                                page = alloc_pages(sk->sk_allocation, 0);
-                                if (page == NULL) {
-                                        err = -ENOMEM;
-                                        goto error;
-                                }
-                                sk->sk_sndmsg_page = page;
-                                sk->sk_sndmsg_off = 0;
+                        struct page_frag *pfrag = sk_page_frag(sk);
 
-                                skb_fill_page_desc(skb, i, page, 0, 0);
-                                frag = &skb_shinfo(skb)->frags[i];
-                        } else {
-                                err = -EMSGSIZE;
+                        err = -ENOMEM;
+                        if (!sk_page_frag_refill(sk, pfrag))
                                 goto error;
+
+                        if (!skb_can_coalesce(skb, i, pfrag->page,
+                                              pfrag->offset)) {
+                                err = -EMSGSIZE;
+                                if (i == MAX_SKB_FRAGS)
+                                        goto error;
+
+                                __skb_fill_page_desc(skb, i, pfrag->page,
+                                                     pfrag->offset, 0);
+                                skb_shinfo(skb)->nr_frags = ++i;
+                                get_page(pfrag->page);
                         }
+                        copy = min_t(int, copy, pfrag->size - pfrag->offset);
                         if (getfrag(from,
-                                    skb_frag_address(frag) + skb_frag_size(frag),
-                                    offset, copy, skb->len, skb) < 0) {
-                                err = -EFAULT;
-                                goto error;
-                        }
-                        sk->sk_sndmsg_off += copy;
-                        skb_frag_size_add(frag, copy);
+                                    page_address(pfrag->page) + pfrag->offset,
+                                    offset, copy, skb->len, skb) < 0)
+                                goto error_efault;
+
+                        pfrag->offset += copy;
+                        skb_frag_size_add(&skb_shinfo(skb)->frags[i - 1], copy);
                         skb->len += copy;
                         skb->data_len += copy;
                         skb->truesize += copy;
@@ -1554,7 +1535,11 @@ alloc_new_skb:
                 offset += copy;
                 length -= copy;
         }
+
         return 0;
+
+error_efault:
+        err = -EFAULT;
 error:
         cork->length -= length;
         IP6_INC_STATS(sock_net(sk), rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS);