From: Eric Dumazet <eric.duma...@gmail.com>
Date: Wed, 02 Nov 2016 07:53:17 -0700
> From: Eric Dumazet <eduma...@google.com>
>
> Imagine initial value of max_skb_frags is 17, and last
> skb in write queue has 15 frags.
>
> Then max_skb_frags is lowered to 14 or smaller value.
>
> tcp_sendmsg() will then be allowed to add additional page frags
> and eventually go past MAX_SKB_FRAGS, overflowing struct
> skb_shared_info.
>
> Fixes: 5f74f82ea34c ("net:Add sysctl_max_skb_frags")
> Signed-off-by: Eric Dumazet <eduma...@google.com>
Applied and queued up for -stable, thanks.
