1 files changed, 37 insertions, 7 deletions

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index cd759409eacb..6cca6a0c5751 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -398,7 +398,11 @@ struct sk_buff *__netdev_alloc_skb(struct net_device *dev, unsigned int len,
 
         len += NET_SKB_PAD;
 
-        if ((len > SKB_WITH_OVERHEAD(PAGE_SIZE)) ||
+        /* If requested length is either too small or too big,
+         * we use kmalloc() for skb->head allocation.
+         */
+        if (len <= SKB_WITH_OVERHEAD(1024) ||
+            len > SKB_WITH_OVERHEAD(PAGE_SIZE) ||
             (gfp_mask & (__GFP_DIRECT_RECLAIM | GFP_DMA))) {
                 skb = __alloc_skb(len, gfp_mask, SKB_ALLOC_RX, NUMA_NO_NODE);
                 if (!skb)
@@ -459,13 +463,17 @@ EXPORT_SYMBOL(__netdev_alloc_skb);
 struct sk_buff *__napi_alloc_skb(struct napi_struct *napi, unsigned int len,
                                  gfp_t gfp_mask)
 {
-        struct napi_alloc_cache *nc = this_cpu_ptr(&napi_alloc_cache);
+        struct napi_alloc_cache *nc;
         struct sk_buff *skb;
         void *data;
 
         len += NET_SKB_PAD + NET_IP_ALIGN;
 
-        if ((len > SKB_WITH_OVERHEAD(PAGE_SIZE)) ||
+        /* If requested length is either too small or too big,
+         * we use kmalloc() for skb->head allocation.
+         */
+        if (len <= SKB_WITH_OVERHEAD(1024) ||
+            len > SKB_WITH_OVERHEAD(PAGE_SIZE) ||
             (gfp_mask & (__GFP_DIRECT_RECLAIM | GFP_DMA))) {
                 skb = __alloc_skb(len, gfp_mask, SKB_ALLOC_RX, NUMA_NO_NODE);
                 if (!skb)
@@ -473,6 +481,7 @@ struct sk_buff *__napi_alloc_skb(struct napi_struct *napi, unsigned int len,
                 goto skb_success;
         }
 
+        nc = this_cpu_ptr(&napi_alloc_cache);
         len += SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
         len = SKB_DATA_ALIGN(len);
 
@@ -1853,6 +1862,12 @@ int pskb_trim_rcsum_slow(struct sk_buff *skb, unsigned int len)
                 skb->csum = csum_block_sub(skb->csum,
                                            skb_checksum(skb, len, delta, 0),
                                            len);
+        } else if (skb->ip_summed == CHECKSUM_PARTIAL) {
+                int hdlen = (len > skb_headlen(skb)) ? skb_headlen(skb) : len;
+                int offset = skb_checksum_start_offset(skb) + skb->csum_offset;
+
+                if (offset + sizeof(__sum16) > hdlen)
+                        return -EINVAL;
         }
         return __pskb_trim(skb, len);
 }
@@ -1962,7 +1977,7 @@ void *__pskb_pull_tail(struct sk_buff *skb, int delta)
                 /* Free pulled out fragments. */
                 while ((list = skb_shinfo(skb)->frag_list) != insp) {
                         skb_shinfo(skb)->frag_list = list->next;
-                        kfree_skb(list);
+                        consume_skb(list);
                 }
                 /* And insert new clone at head. */
                 if (clone) {
@@ -2690,8 +2705,11 @@ skb_zerocopy_headlen(const struct sk_buff *from)
 
         if (!from->head_frag ||
             skb_headlen(from) < L1_CACHE_BYTES ||
-            skb_shinfo(from)->nr_frags >= MAX_SKB_FRAGS)
+            skb_shinfo(from)->nr_frags >= MAX_SKB_FRAGS) {
                 hlen = skb_headlen(from);
+                if (!hlen)
+                        hlen = from->len;
+        }
 
         if (skb_has_frag_list(from))
                 hlen = from->len;
@@ -3077,7 +3095,19 @@ EXPORT_SYMBOL(skb_split);
  */
 static int skb_prepare_for_shift(struct sk_buff *skb)
 {
-        return skb_cloned(skb) && pskb_expand_head(skb, 0, 0, GFP_ATOMIC);
+        int ret = 0;
+
+        if (skb_cloned(skb)) {
+                /* Save and restore truesize: pskb_expand_head() may reallocate
+                 * memory where ksize(kmalloc(S)) != ksize(kmalloc(S)), but we
+                 * cannot change truesize at this point.
+                 */
+                unsigned int save_truesize = skb->truesize;
+
+                ret = pskb_expand_head(skb, 0, 0, GFP_ATOMIC);
+                skb->truesize = save_truesize;
+        }
+        return ret;
 }
 
 /**
@@ -5452,7 +5482,7 @@ static int pskb_carve_frag_list(struct sk_buff *skb,
         /* Free pulled out fragments. */
         while ((list = shinfo->frag_list) != insp) {
                 shinfo->frag_list = list->next;
-                kfree_skb(list);
+                consume_skb(list);
         }
         /* And insert new clone at head. */
         if (clone) {