[IPV4/IPV6] Ensure all frag_list members have NULL sk

[linux-2.6-omap-h63xx.git] / net / ipv6 / ip6_output.c

diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 0f0711417c9da71d7595e6019033b8976d479b03..b78a535868042381dbdd42454b7a1c63f16ddffa 100644 (file)
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -552,13 +552,17 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
                            skb_headroom(frag) < hlen)
                            goto slow_path;
 
-                       /* Correct socket ownership. */
-                       if (frag->sk == NULL)
-                               goto slow_path;
-
                        /* Partially cloned skb? */
                        if (skb_shared(frag))
                                goto slow_path;
+
+                       BUG_ON(frag->sk);
+                       if (skb->sk) {
+                               sock_hold(skb->sk);
+                               frag->sk = skb->sk;
+                               frag->destructor = sock_wfree;
+                               skb->truesize -= frag->truesize;
+                       }
                }
 
                err = 0;
@@ -1116,12 +1120,10 @@ int ip6_push_pending_frames(struct sock *sk)
                tail_skb = &(tmp_skb->next);
                skb->len += tmp_skb->len;
                skb->data_len += tmp_skb->len;
-#if 0 /* Logically correct, but useless work, ip_fragment() will have to undo */
                skb->truesize += tmp_skb->truesize;
                __sock_put(tmp_skb->sk);
                tmp_skb->destructor = NULL;
                tmp_skb->sk = NULL;
-#endif
        }
 
        ipv6_addr_copy(final_dst, &fl->fl6_dst);