net/mlx5e: Verify inline header size do not exceed SKB linear size
authorEran Ben Elisha <>
Thu, 25 Jan 2018 09:18:09 +0000 (11:18 +0200)
committerSaeed Mahameed <>
Tue, 20 Feb 2018 20:52:55 +0000 (12:52 -0800)
Driver tries to copy at least MLX5E_MIN_INLINE bytes into the control
segment of the WQE. It assumes that the linear part contains at least
MLX5E_MIN_INLINE bytes, which can be wrong.

Cited commit verified that driver will not copy more bytes into the
inline header part that the actual size of the packet. Re-factor this
check to make sure we do not exceed the linear part as well.

This fix is aligned with the current driver's assumption that the entire
L2 will be present in the linear part of the SKB.

Fixes: 6aace17e64f4 ("net/mlx5e: Fix inline header size for small packets")
Signed-off-by: Eran Ben Elisha <>
Signed-off-by: Saeed Mahameed <>

index 569b42a010265bec16510b1a860c456b3f76a0e3..11b4f1089d1ceffc05b703118e911895d08644c8 100644 (file)
@@ -176,7 +176,7 @@ static inline u16 mlx5e_calc_min_inline(enum mlx5_inline_modes mode,
                hlen = mlx5e_skb_l2_header_offset(skb);
-       return min_t(u16, hlen, skb->len);
+       return min_t(u16, hlen, skb_headlen(skb));
 static inline void mlx5e_tx_skb_pull_inline(unsigned char **skb_data,