As the ip fragment offset field counts 8-byte chunks, non-final ip fragments must be multiples of 8 bytes of payload. Depending on the mtu and ip option sizes, ip_append_page wasn't respecting this, notably when running NFS under UDP.
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c index 124bf0a..21ec54e 100644 --- a/net/ipv4/ip_output.c +++ b/net/ipv4/ip_output.c @@ -1239,7 +1239,7 @@ ssize_t ip_append_page(struct sock *sk, struct flowi4 *fl4, struct page *page, if (skb->ip_summed != CHECKSUM_PARTIAL) return -EOPNOTSUPP; - skb_shinfo(skb)->gso_size = mtu - fragheaderlen; + skb_shinfo(skb)->gso_size = maxfraglen - fragheaderlen; skb_shinfo(skb)->gso_type = SKB_GSO_UDP; } cork->length += size;