diff options
| author | David S. Miller <davem@davemloft.net> | 2008-06-10 02:22:26 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2008-06-10 02:22:26 -0700 |
| commit | 65b53e4cc90e59936733b3b95b9451d2ca47528d (patch) | |
| tree | 29932718192962671c48c3fd1ea017a6112459e8 /net/ipv4/tcp.c | |
| parent | 788c0a53164c05c5ccdb1472474372b72ba74644 (diff) | |
| parent | 2e761e0532a784816e7e822dbaaece8c5d4be14d (diff) | |
Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6
Conflicts:
drivers/net/tg3.c
drivers/net/wireless/rt2x00/rt2x00dev.c
net/mac80211/ieee80211_i.h
Diffstat (limited to 'net/ipv4/tcp.c')
| -rw-r--r-- | net/ipv4/tcp.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c index f8865313862..ab66683b804 100644 --- a/net/ipv4/tcp.c +++ b/net/ipv4/tcp.c @@ -1227,7 +1227,14 @@ int tcp_read_sock(struct sock *sk, read_descriptor_t *desc, copied += used; offset += used; } - if (offset != skb->len) + /* + * If recv_actor drops the lock (e.g. TCP splice + * receive) the skb pointer might be invalid when + * getting here: tcp_collapse might have deleted it + * while aggregating skbs from the socket queue. + */ + skb = tcp_recv_skb(sk, seq-1, &offset); + if (!skb || (offset+1 != skb->len)) break; } if (tcp_hdr(skb)->fin) { |