1 files changed, 12 insertions, 5 deletions

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 1e556d312117..366621610e76 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -1292,12 +1292,14 @@ static int __skb_splice_bits(struct sk_buff *skb, unsigned int *offset,
 {
         unsigned int nr_pages = spd->nr_pages;
         unsigned int poff, plen, len, toff, tlen;
-        int headlen, seg;
+        int headlen, seg, error = 0;
 
         toff = *offset;
         tlen = *total_len;
-        if (!tlen)
+        if (!tlen) {
+                error = 1;
                 goto err;
+        }
 
         /*
          * if the offset is greater than the linear part, go directly to
@@ -1339,7 +1341,8 @@ static int __skb_splice_bits(struct sk_buff *skb, unsigned int *offset,
                  * just jump directly to update and return, no point
                  * in going over fragments when the output is full.
                  */
-                if (spd_fill_page(spd, virt_to_page(p), plen, poff, skb))
+                error = spd_fill_page(spd, virt_to_page(p), plen, poff, skb);
+                if (error)
                         goto done;
 
                 tlen -= plen;
@@ -1369,7 +1372,8 @@ map_frag:
                 if (!plen)
                         break;
 
-                if (spd_fill_page(spd, f->page, plen, poff, skb))
+                error = spd_fill_page(spd, f->page, plen, poff, skb);
+                if (error)
                         break;
 
                 tlen -= plen;
@@ -1382,7 +1386,10 @@ done:
                 return 0;
         }
 err:
-        return 1;
+        /* update the offset to reflect the linear part skip, if any */
+        if (!error)
+                *offset = toff;
+        return error;
 }
 
 /*