netxen_nic_xmit_frame() pulls the frags that don't fit in a TX descriptor into the head with __pskb_pull_tail(). It already checks the result. Switch to pskb_may_pull(), which takes the length the head should end up with and checks it against the skb, so this driver no longer calls __pskb_pull_tail() directly.
__pskb_pull_tail() also releases empty frags, even when there's nothing to pull, so if the frags being pulled are all empty it still gets the frag count under the limit. pskb_may_pull() returns early in that case, so follow it with skb_drop_empty_frags(). Assisted-by: LLM Signed-off-by: Josef Bacik <[email protected]> --- drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c index 67d9bf69f8f2..f5f89ed87d95 100644 --- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c +++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c @@ -2045,7 +2045,8 @@ netxen_nic_xmit_frame(struct sk_buff *skb, struct net_device *netdev) delta += skb_frag_size(frag); } - if (!__pskb_pull_tail(skb, delta)) + if (!pskb_may_pull(skb, skb_headlen(skb) + delta) || + skb_drop_empty_frags(skb, GFP_ATOMIC)) goto drop_packet; frag_count = 1 + skb_shinfo(skb)->nr_frags; -- 2.55.0
