gro: Fix merging of paged packets

The previous fix to paged packets broke the merging because it
reset the skb->len before we added it to the merged packet.  This
wasn't detected because it simply resulted in the truncation of
the packet while the missing bit is subsequently retransmitted.

The fix is to store skb->len before we clobber it.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 56272ac6dfd8f5a1a2dc44866d0edf87bd8d7100..2e5f2ca3bdcdefea914cd329315ee5e1f04200ad 100644 (file)
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2585,8 +2585,9 @@ int skb_gro_receive(struct sk_buff **head, struct sk_buff *skb)
        struct sk_buff *nskb;
        unsigned int headroom;
        unsigned int hlen = p->data - skb_mac_header(p);
+       unsigned int len = skb->len;
 
-       if (hlen + p->len + skb->len >= 65536)
+       if (hlen + p->len + len >= 65536)
                return -E2BIG;
 
        if (skb_shinfo(p)->frag_list)
@@ -2648,9 +2649,9 @@ merge:
 
 done:
        NAPI_GRO_CB(p)->count++;
-       p->data_len += skb->len;
-       p->truesize += skb->len;
-       p->len += skb->len;
+       p->data_len += len;
+       p->truesize += len;
+       p->len += len;
 
        NAPI_GRO_CB(skb)->same_flow = 1;
        return 0;