diff --git a/net/core/dev.c b/net/core/dev.c index 3721fbb..24a53d0 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -1935,6 +1935,26 @@ static inline int skb_needs_linearize(struct sk_buff *skb, illegal_highdma(dev, skb)))); } +static int skb_csum_start_bug(struct sk_buff *skb) +{ + + if (skb->ip_summed == CHECKSUM_PARTIAL) { + long csstart; + + csstart = skb->csum_start - skb_headroom(skb); + if (WARN_ON(csstart > skb_headlen(skb))) { + pr_warning("csum_start %u, offset %u, headroom %d, headlen %d, len %d\n", + skb->csum_start, + skb->csum_offset, + skb_headroom(skb), + skb_headlen(skb), + skb->len); + return 1; + } + } + return 0; +} + int dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev, struct netdev_queue *txq) { @@ -1955,11 +1975,13 @@ int dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev, skb_orphan_try(skb); if (netif_needs_gso(dev, skb)) { + skb_csum_start_bug(skb); if (unlikely(dev_gso_segment(skb))) goto out_kfree_skb; if (skb->next) goto gso; } else { + skb_csum_start_bug(skb); if (skb_needs_linearize(skb, dev) && __skb_linearize(skb)) goto out_kfree_skb; @@ -1997,7 +2019,12 @@ gso: if (dev->priv_flags & IFF_XMIT_DST_RELEASE) skb_dst_drop(nskb); - rc = ops->ndo_start_xmit(nskb, dev); + if (skb_csum_start_bug(skb)) { + kfree_skb(skb); + rc = NETDEV_TX_OK; + } else + rc = ops->ndo_start_xmit(nskb, dev); + if (unlikely(rc != NETDEV_TX_OK)) { if (rc & ~NETDEV_TX_MASK) goto out_kfree_gso_skb;