--- net/ipv4/ip_output.c

+++ net/ipv4/ip_output.c

@@ -476,9 +476,8 @@ int ip_fragment(struct sk_buff *skb, int

* we can switch to copy when see the first bad fragment.

*/

if (skb_has_frags(skb)) {

- struct sk_buff *frag;

+ struct sk_buff *frag, *frag2;

int first_len = skb_pagelen(skb);

- int truesizes = 0;

if (first_len - hlen > mtu ||

((first_len - hlen) & 7) ||

@@ -491,18 +490,18 @@ int ip_fragment(struct sk_buff *skb, int

if (frag->len > mtu ||

((frag->len & 7) && frag->next) ||

skb_headroom(frag) < hlen)

- goto slow_path;

+ goto slow_path_clean;

/* Partially cloned skb? */

if (skb_shared(frag))

- goto slow_path;

+ goto slow_path_clean;

BUG_ON(frag->sk);

if (skb->sk) {

frag->sk = skb->sk;

frag->destructor = sock_wfree;

}

- truesizes += frag->truesize;

+ skb->truesize -= frag->truesize;

}

/* Everything is OK. Generate! */

@@ -512,7 +511,6 @@ int ip_fragment(struct sk_buff *skb, int

frag = skb_shinfo(skb)->frag_list;

skb_frag_list_init(skb);

skb->data_len = first_len - skb_headlen(skb);

- skb->truesize -= truesizes;

skb->len = first_len;

iph->tot_len = htons(first_len);

iph->frag_off = htons(IP_MF);

@@ -564,6 +562,15 @@ int ip_fragment(struct sk_buff *skb, int

}

IP_INC_STATS(dev_net(dev), IPSTATS_MIB_FRAGFAILS);

return err;

+

+slow_path_clean:

+ skb_walk_frags(skb, frag2) {

+ if (frag2 == frag)

+ break;

+ frag2->sk = NULL;

+ frag2->destructor = NULL;

+ skb->truesize += frag2->truesize;

+ }

}

slow_path: