gro: Fix page ref count for skbs freed normally
authorHerbert Xu <herbert@gondor.apana.org.au>
Thu, 15 Jan 2009 04:40:03 +0000 (20:40 -0800)
committerDavid S. Miller <davem@davemloft.net>
Thu, 15 Jan 2009 04:40:03 +0000 (20:40 -0800)
commitf557206800801410c30e53ce7a27219b2c4cf0ba
tree0c18a5766787a9dcc038eb60c8cbdf78c585ff6b
parentfc8c7dc1b29560c016a67a34ccff32a712b5aa86
gro: Fix page ref count for skbs freed normally

When an skb with page frags is merged into an existing one, we
cannibalise its reference count.  This is OK when the skb is
reused because we set nr_frags to zero in that case.  However,
for the case where the skb is freed through kfree_skb, we didn't
clear nr_frags which causes the page to be freed prematurely.

This is fixed by moving the skb resetting into skb_gro_receive.

Reported-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/core/dev.c
net/core/skbuff.c