qlcnic_xmit_frame() pulls the frags that don't fit in a TX descriptor into the head with __pskb_pull_tail(). It already checks the result. Switch to pskb_may_pull(), which takes the length the head should end up with and checks it against the skb, so this driver no longer calls __pskb_pull_tail() directly.
Assisted-by: LLM Signed-off-by: Josef Bacik <[email protected]> --- drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c index 761ef3bc8193..4a81d499e51c 100644 --- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c +++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c @@ -682,7 +682,7 @@ netdev_tx_t qlcnic_xmit_frame(struct sk_buff *skb, struct net_device *netdev) for (i = 0; i < (frag_count - QLCNIC_MAX_FRAGS_PER_TX); i++) delta += skb_frag_size(&skb_shinfo(skb)->frags[i]); - if (!__pskb_pull_tail(skb, delta)) + if (!pskb_may_pull(skb, skb_headlen(skb) + delta)) goto drop_packet; frag_count = 1 + skb_shinfo(skb)->nr_frags; -- 2.55.0
