On 11/11/2015 06:03 AM, Daniel Borkmann wrote: > In tpacket_fill_skb() commit c1aad275b029 ("packet: set transport > header before doing xmit") and later on 40893fd0fd4e ("net: switch > to use skb_probe_transport_header()") was probing for a transport > header on the skb from a ring buffer slot, but at a time, where > the skb has _not even_ been filled with data yet. So that call into > the flow dissector is pretty useless. Lets do it after we've set > up the skb frags. > > Fixes: c1aad275b029 ("packet: set transport header before doing xmit") > Reported-by: Eric Dumazet <eduma...@google.com> > Signed-off-by: Daniel Borkmann <dan...@iogearbox.net> > Cc: Jason Wang <jasow...@redhat.com> > --- > net/packet/af_packet.c | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) > > diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c > index af399ca..80c36c0 100644 > --- a/net/packet/af_packet.c > +++ b/net/packet/af_packet.c > @@ -2368,8 +2368,6 @@ static int tpacket_fill_skb(struct packet_sock *po, > struct sk_buff *skb, > skb_reserve(skb, hlen); > skb_reset_network_header(skb); > > - if (!packet_use_direct_xmit(po)) > - skb_probe_transport_header(skb, 0); > if (unlikely(po->tp_tx_has_off)) { > int off_min, off_max, off; > off_min = po->tp_hdrlen - sizeof(struct sockaddr_ll); > @@ -2449,6 +2447,9 @@ static int tpacket_fill_skb(struct packet_sock *po, > struct sk_buff *skb, > len = ((to_write > len_max) ? len_max : to_write); > } > > + if (!packet_use_direct_xmit(po)) > + skb_probe_transport_header(skb, 0); > + > return tp_len; > } >
Acked-by: Jason Wang <jasow...@redhat.com> -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html