It is possible for a frontend to generate a TSO request which doesn't

actually need segmentation (i.e. with size < MTU).  Make sure this
doesn't crash the backend.

diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index f8c5cff95469168127b7cd64eb09e77dabd74686..33bd270c9f81a305537cbac05facf7796f00c4e7 100644 (file)
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2214,7 +2214,7 @@ struct sk_buff *tcp_tso_segment(struct sk_buff *skb, int features)
        th = skb->h.th;
        seq = ntohl(th->seq);
 
-       do {
+       while (skb->next) {
                th->fin = th->psh = 0;
 
                th->check = ~csum_fold(th->check + delta);
@@ -2228,7 +2228,7 @@ struct sk_buff *tcp_tso_segment(struct sk_buff *skb, int features)
 
                th->seq = htonl(seq);
                th->cwr = 0;
-       } while (skb->next);
+       }
 
        delta = htonl(oldlen + (skb->tail - skb->h.raw) + skb->data_len);
        th->check = ~csum_fold(th->check + delta);