| Message ID | 1354403222.20109.539.camel@edumazet-glaptop |
|---|---|
| State | Accepted, archived |
| Delegated to: | David Miller |
| Headers | show |
From: Eric Dumazet <eric.dumazet@gmail.com> Date: Sat, 01 Dec 2012 15:07:02 -0800 > From: Eric Dumazet <edumazet@google.com> > > Recent network changes allowed high order pages being used > for skb fragments. > > This uncovered a bug in do_tcp_sendpages() which was assuming its caller > provided an array of order-0 page pointers. > > We only have to deal with a single page in this function, and its order > is irrelevant. > > Reported-by: Willy Tarreau <w@1wt.eu> > Tested-by: Willy Tarreau <w@1wt.eu> > Signed-off-by: Eric Dumazet <edumazet@google.com> Applied, thanks Eric. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On Sat, 2012-12-01 at 15:07 -0800, Eric Dumazet wrote: > From: Eric Dumazet <edumazet@google.com> > > Recent network changes allowed high order pages being used > for skb fragments. > > This uncovered a bug in do_tcp_sendpages() which was assuming its caller > provided an array of order-0 page pointers. > > We only have to deal with a single page in this function, and its order > is irrelevant. [] > diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c [] > @@ -830,8 +830,8 @@ static int tcp_send_mss(struct sock *sk, int *size_goal, int flags) > return mss_now; > } > > -static ssize_t do_tcp_sendpages(struct sock *sk, struct page **pages, int poffset, > - size_t psize, int flags) > +static ssize_t do_tcp_sendpages(struct sock *sk, struct page *page, int offset, > + size_t size, int flags) Shouldn't this now be named do_tcp_sendpage ? -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c index 083092e..e457c7a 100644 --- a/net/ipv4/tcp.c +++ b/net/ipv4/tcp.c @@ -830,8 +830,8 @@ static int tcp_send_mss(struct sock *sk, int *size_goal, int flags) return mss_now; } -static ssize_t do_tcp_sendpages(struct sock *sk, struct page **pages, int poffset, - size_t psize, int flags) +static ssize_t do_tcp_sendpages(struct sock *sk, struct page *page, int offset, + size_t size, int flags) { struct tcp_sock *tp = tcp_sk(sk); int mss_now, size_goal; @@ -858,12 +858,9 @@ static ssize_t do_tcp_sendpages(struct sock *sk, struct page **pages, int poffse if (sk->sk_err || (sk->sk_shutdown & SEND_SHUTDOWN)) goto out_err; - while (psize > 0) { + while (size > 0) { struct sk_buff *skb = tcp_write_queue_tail(sk); - struct page *page = pages[poffset / PAGE_SIZE]; int copy, i; - int offset = poffset % PAGE_SIZE; - int size = min_t(size_t, psize, PAGE_SIZE - offset); bool can_coalesce; if (!tcp_send_head(sk) || (copy = size_goal - skb->len) <= 0) { @@ -912,8 +909,8 @@ new_segment: TCP_SKB_CB(skb)->tcp_flags &= ~TCPHDR_PSH; copied += copy; - poffset += copy; - if (!(psize -= copy)) + offset += copy; + if (!(size -= copy)) goto out; if (skb->len < size_goal || (flags & MSG_OOB)) @@ -960,7 +957,7 @@ int tcp_sendpage(struct sock *sk, struct page *page, int offset, flags); lock_sock(sk); - res = do_tcp_sendpages(sk, &page, offset, size, flags); + res = do_tcp_sendpages(sk, page, offset, size, flags); release_sock(sk); return res; }