diff options
| author | Ingo Molnar <mingo@elte.hu> | 2008-06-12 11:27:22 +0200 |
|---|---|---|
| committer | Ingo Molnar <mingo@elte.hu> | 2008-06-12 11:27:22 +0200 |
| commit | bb6dfb32f90094fea647e1f27d994a8b6ddd2766 (patch) | |
| tree | e63681727543bcc3251bbc82b81a9cc822cc3f5e /net/ipv4/tcp.c | |
| parent | 4f384f8bcdb5d618a0a68fb84c809e602c798b8f (diff) | |
| parent | 5e70b7f3c24468bb1635b295945edb48ecd9656a (diff) | |
Merge branch 'linus' into x86/gart
Diffstat (limited to 'net/ipv4/tcp.c')
| -rw-r--r-- | net/ipv4/tcp.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c index f88653138621..ab66683b8043 100644 --- a/net/ipv4/tcp.c +++ b/net/ipv4/tcp.c @@ -1227,7 +1227,14 @@ int tcp_read_sock(struct sock *sk, read_descriptor_t *desc, copied += used; offset += used; } - if (offset != skb->len) + /* + * If recv_actor drops the lock (e.g. TCP splice + * receive) the skb pointer might be invalid when + * getting here: tcp_collapse might have deleted it + * while aggregating skbs from the socket queue. + */ + skb = tcp_recv_skb(sk, seq-1, &offset); + if (!skb || (offset+1 != skb->len)) break; } if (tcp_hdr(skb)->fin) { |