-stable review patch. If anyone has any objections, please let us know. ------------------ From: Herbert Xu This bug was unknowingly fixed the GSO patches (or rather, its effect was unknown at the time). Thanks to Marco Berizzi's persistence which is documented in the thread "ipsec tunnel asymmetrical mtu", we now know that it can have highly non-obvious symptoms. What happens is that uninitialised uso_size fields can cause packets to be incorrectly identified as UFO, which means that it does not get fragmented even if it's over the MTU. The fix is simple enough. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/core/dev.c | 1 + net/core/skbuff.c | 2 ++ 2 files changed, 3 insertions(+) --- linux-2.6.17.6.orig/net/core/dev.c +++ linux-2.6.17.6/net/core/dev.c @@ -1246,6 +1246,7 @@ int __skb_linearize(struct sk_buff *skb, atomic_set(&ninfo->dataref, 1); ninfo->tso_size = skb_shinfo(skb)->tso_size; ninfo->tso_segs = skb_shinfo(skb)->tso_segs; + ninfo->ufo_size = skb_shinfo(skb)->ufo_size; ninfo->nr_frags = 0; ninfo->frag_list = NULL; --- linux-2.6.17.6.orig/net/core/skbuff.c +++ linux-2.6.17.6/net/core/skbuff.c @@ -240,6 +240,7 @@ struct sk_buff *alloc_skb_from_cache(kme skb_shinfo(skb)->nr_frags = 0; skb_shinfo(skb)->tso_size = 0; skb_shinfo(skb)->tso_segs = 0; + skb_shinfo(skb)->ufo_size = 0; skb_shinfo(skb)->frag_list = NULL; out: return skb; @@ -529,6 +530,7 @@ static void copy_skb_header(struct sk_bu atomic_set(&new->users, 1); skb_shinfo(new)->tso_size = skb_shinfo(old)->tso_size; skb_shinfo(new)->tso_segs = skb_shinfo(old)->tso_segs; + skb_shinfo(new)->ufo_size = skb_shinfo(old)->ufo_size; } /** -- - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/