It is possible for a frontend to generate a TSO request which doesn't

actually need segmentation (i.e. with size < MTU).  Make sure this
doesn't crash the backend.

diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 036dee65ca127d1dfcc56b64e36d102b15c2a2e5..634dffc599dcbc50139f1469f81058201be03581 100644 (file)
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2439,7 +2439,7 @@ struct sk_buff *tcp_tso_segment(struct sk_buff *skb, int features)
        th = tcp_hdr(skb);
        seq = ntohl(th->seq);
 
-       do {
+       while (skb->next) {
                th->fin = th->psh = 0;
 
                th->check = ~csum_fold((__force __wsum)((__force u32)th->check +
@@ -2455,7 +2455,7 @@ struct sk_buff *tcp_tso_segment(struct sk_buff *skb, int features)
 
                th->seq = htonl(seq);
                th->cwr = 0;
-       } while (skb->next);
+       }
 
        delta = htonl(oldlen + (skb->tail - skb->transport_header) +
                      skb->data_len);