linux.git/net/core/skbuff.c, branch v2.6.26

tcp: fix for splice receive when used with software LRO

2008-06-28T00:27:21+00:00

If an skb has nr_frags set to zero but its frag_list is not empty (as
it can happen if software LRO is enabled), and a previous
tcp_read_sock has consumed the linear part of the skb, then
__skb_splice_bits:

(a) incorrectly reports an error and

(b) forgets to update the offset to account for the linear part

Any of the two problems will cause the subsequent __skb_splice_bits
call (the one that handles the frag_list skbs) to either skip data,
or, if the unadjusted offset is greater then the size of the next skb
in the frag_list, make tcp_splice_read loop forever.

Signed-off-by: Octavian Purdila 
Signed-off-by: David S. Miller

tcp: Fix for race due to temporary drop of the socket lock in skb_splice_bits.

2008-06-04T22:45:58+00:00

skb_splice_bits temporary drops the socket lock while iterating over
the socket queue in order to break a reverse locking condition which
happens with sendfile. This, however, opens a window of opportunity
for tcp_collapse() to aggregate skbs and thus potentially free the
current skb used in skb_splice_bits and tcp_read_sock.

This patch fixes the problem by (re-)getting the same "logical skb"
after the lock has been temporary dropped.

Based on idea and initial patch from Evgeniy Polyakov.

Signed-off-by: Octavian Purdila 
Acked-by: Evgeniy Polyakov 
Signed-off-by: David S. Miller

net: Fix useless comment reference loop.

2008-05-04T03:56:42+00:00

include/linux/skbuff.h says:
        /* These elements must be at the end, see alloc_skb() for details.  */

net/core/skbuff.c says:
	* See comment in sk_buff definition, just before the 'tail' member

This patch contains my guess as to the actual reason rather than a
dead comment reference loop.

Signed-off-by: Johannes Berg 
Signed-off-by: David S. Miller

Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

2008-04-14T09:30:23+00:00

Conflicts:

	drivers/net/ehea/ehea_main.c
	drivers/net/wireless/iwlwifi/Kconfig
	drivers/net/wireless/rt2x00/rt61pci.c
	net/ipv4/inet_timewait_sock.c
	net/ipv6/raw.c
	net/mac80211/ieee80211_sta.c

[SKB]: __skb_append = __skb_queue_after

2008-04-14T07:05:09+00:00

This expresses __skb_append in terms of __skb_queue_after, exploiting that

  __skb_append(old, new, list) = __skb_queue_after(list, old, new).

Signed-off-by: Gerrit Renker 
Signed-off-by: David S. Miller

[NET]: Fix kernel-doc for skb_segment

2008-04-14T04:52:48+00:00

The kernel-doc comment for skb_segment is clearly wrong.  This states
what it actually does.

Signed-off-by: Ben Hutchings 
Signed-off-by: David S. Miller

[NET]: Fix dev_alloc_skb() typo.

2008-03-29T01:22:32+00:00

Noticed by Joe Perches.

Signed-off-by: David S. Miller

[NET]: Add inline intent commentary to dev_alloc_skb().

2008-03-28T22:57:39+00:00

Signed-off-by: Denys Vlasenko 
Signed-off-by: David S. Miller

[NET]: uninline skb_trim, de-bloats

2008-03-28T00:54:01+00:00

Allyesconfig (v2.6.24-mm1):
-10976  209 funcs, 123 +, 11099 -, diff: -10976 --- skb_trim

Without number of debug related CONFIGs (v2.6.25-rc2-mm1):
-7360  192 funcs, 131 +, 7491 -, diff: -7360 --- skb_trim
skb_trim                      |  +42

Signed-off-by: Ilpo Järvinen 
Signed-off-by: David S. Miller

[NET]: uninline skb_push, de-bloats a lot

2008-03-28T00:52:40+00:00

Allyesconfig (v2.6.24-mm1):

-21593  356 funcs, 2418 +, 24011 -, diff: -21593 --- skb_push

Without many debug related CONFIGs (v2.6.25-rc2-mm1):

-13890  341 funcs, 189 +, 14079 -, diff: -13890 --- skb_push
skb_push                      |  +46

Signed-off-by: Ilpo Järvinen 
Signed-off-by: David S. Miller