Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
  appletalk: Fix OOPS in atalk_release().
  mlx4: Fixing bad size of event queue buffer
  mlx4: Fixing use after free
  bonding:typo in comment
  sctp: Pass __GFP_NOWARN to hash table allocation attempts.
  connector: convert to synchronous netlink message processing
  fib: add rtnl locking in ip_fib_net_exit
  atm/solos-pci: Don't flap VCs when carrier state changes
  atm/solos-pci: Don't include frame pseudo-header on transmit hex-dump
  atm/solos-pci: Use VPI.VCI notation uniformly.
  Atheros, atl2: Fix mem leaks in error paths of atl2_set_eeprom
  netdev: fix mtu check when TSO is enabled
  net/usb: Ethernet quirks for the LG-VL600 4G modem
  phylib: phy_attach_direct: phy_init_hw can fail, add cleanup
  bridge: mcast snooping, fix length check of snooped MLDv1/2
  via-ircc: Pass PCI device pointer to dma_{alloc, free}_coherent()
  via-ircc: Use pci_{get, set}_drvdata() instead of static pointer variable
  net: gre: provide multicast mappings for ipv4 and ipv6
  bridge: Fix compilation warning in function br_stp_recalculate_bridge_id()
  net: Fix warnings caused by MAX_SKB_FRAGS change.

1 files changed, 22 insertions, 2 deletions

diff --git a/net/core/dev.c b/net/core/dev.c
index 563ddc28139..3da9fb06d47 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1454,6 +1454,27 @@ static inline void net_timestamp_check(struct sk_buff *skb)
 		__net_timestamp(skb);
 }
 
+static inline bool is_skb_forwardable(struct net_device *dev,
+				      struct sk_buff *skb)
+{
+	unsigned int len;
+
+	if (!(dev->flags & IFF_UP))
+		return false;
+
+	len = dev->mtu + dev->hard_header_len + VLAN_HLEN;
+	if (skb->len <= len)
+		return true;
+
+	/* if TSO is enabled, we don't care about the length as the packet
+	 * could be forwarded without being segmented before
+	 */
+	if (skb_is_gso(skb))
+		return true;
+
+	return false;
+}
+
 /**
  * dev_forward_skb - loopback an skb to another netif
  *
@@ -1477,8 +1498,7 @@ int dev_forward_skb(struct net_device *dev, struct sk_buff *skb)
 	skb_orphan(skb);
 	nf_reset(skb);
 
-	if (unlikely(!(dev->flags & IFF_UP) ||
-		     (skb->len > (dev->mtu + dev->hard_header_len + VLAN_HLEN)))) {
+	if (unlikely(!is_skb_forwardable(dev, skb))) {
 		atomic_long_inc(&dev->rx_dropped);
 		kfree_skb(skb);
 		return NET_RX_DROP;