---

yaml --- r: 203744 b: refs/heads/master c: fed6638 h: refs/heads/master v: v3
git-mirror · Jul 25, 2010 · 40e8b28 · 40e8b28
1 parent 11b84a5
commit 40e8b28
Show file tree

Hide file tree

Showing 3 changed files with 4 additions and 3 deletions.
diff --git a/[refs] b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: c1f79426e2df5ef96fe3e76de6c7606d15bf390b
+refs/heads/master: fed66381d65a35198639f564365e61a7f256bf79
diff --git a/trunk/include/linux/skbuff.h b/trunk/include/linux/skbuff.h
@@ -202,10 +202,11 @@ struct skb_shared_info {
 	 */
 	atomic_t	dataref;
 
-	skb_frag_t	frags[MAX_SKB_FRAGS];
 	/* Intermediate layers must ensure that destructor_arg
 	 * remains valid until skb destructor */
 	void *		destructor_arg;
+	/* must be last field, see pskb_expand_head() */
+	skb_frag_t	frags[MAX_SKB_FRAGS];
 };
 
 /* We divide dataref into two halves.  The higher 16 bits hold references

diff --git a/trunk/net/core/skbuff.c b/trunk/net/core/skbuff.c
@@ -817,7 +817,7 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
 	memcpy(data + nhead, skb->head, skb->tail - skb->head);
 #endif
 	memcpy(data + size, skb_end_pointer(skb),
-	       sizeof(struct skb_shared_info));
+	       offsetof(struct skb_shared_info, frags[skb_shinfo(skb)->nr_frags]));
 
 	for (i = 0; i < skb_shinfo(skb)->nr_frags; i++)
 		get_page(skb_shinfo(skb)->frags[i].page);