Most callers of pskb_trim_rcsum() simply drops the skb when it fails, however, ip_check_defrag() still continues to pass the skb up to stack. In that case, we should restore its previous csum if __pskb_trim() fails.
Found this during code review. Fixes: 88078d98d1bb ("net: pskb_trim_rcsum() and CHECKSUM_COMPLETE are friends") Cc: Eric Dumazet <eduma...@google.com> Signed-off-by: Cong Wang <xiyou.wangc...@gmail.com> --- net/core/skbuff.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/net/core/skbuff.c b/net/core/skbuff.c index 946de0e24c87..5decd6e6d2b6 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -1843,6 +1843,9 @@ EXPORT_SYMBOL(___pskb_trim); */ int pskb_trim_rcsum_slow(struct sk_buff *skb, unsigned int len) { + __wsum old_csum = skb->csum; + int ret; + if (skb->ip_summed == CHECKSUM_COMPLETE) { int delta = skb->len - len; @@ -1850,7 +1853,10 @@ int pskb_trim_rcsum_slow(struct sk_buff *skb, unsigned int len) skb_checksum(skb, len, delta, 0), len); } - return __pskb_trim(skb, len); + ret = __pskb_trim(skb, len); + if (unlikely(ret)) + skb->csum = old_csum; + return ret; } EXPORT_SYMBOL(pskb_trim_rcsum_slow); -- 2.16.4