| @@ -277,6 +277,7 @@ static int ip_frag_reinit(struct ipq *qp) · 276 unmodified lines |
| 277 | 277 | /* Add new segment to existing queue. */ |
| 278 | 278 | static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb) |
| 279 | 279 | { |
| 280 | + struct net *net = container_of(qp->q.net, struct net, ipv4.frags); |
| 280 | 281 | struct sk_buff *prev, *next; |
| 281 | 282 | struct net_device *dev; |
| 282 | 283 | unsigned int fragsize; |
| @@ -357,65 +358,23 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb) · 74 unmodified lines |
| 357 | 358 | } |
| 358 | 359 | |
| 359 | 360 | found: |
| 360 | | − /* We found where to put this one. Check for overlap with |
| 361 | | − * preceding fragment, and, if needed, align things so that |
| 362 | | − * any overlaps are eliminated. |
| 361 | + /* RFC5722, Section 4, amended by Errata ID : 3089 |
| 362 | + * When reassembling an IPv6 datagram, if |
| 363 | + * one or more its constituent fragments is determined to be an |
| 364 | + * overlapping fragment, the entire datagram (and any constituent |
| 365 | + * fragments) MUST be silently discarded. |
| 366 | + * |
| 367 | + * We do the same here for IPv4. |
| 363 | 368 | */ |
| 364 | | − if (prev) { |
| 365 | | − int i = (prev->ip_defrag_offset + prev->len) - offset; |
| 366 | 369 | |
| 367 | | − if (i > 0) { |
| 368 | | − offset += i; |
| 369 | | − err = -EINVAL; |
| 370 | | − if (end <= offset) |
| 371 | | − goto err; |
| 372 | | − err = -ENOMEM; |
| 373 | | − if (!pskb_pull(skb, i)) |
| 374 | | − goto err; |
| 375 | | − if (skb->ip_summed != CHECKSUM_UNNECESSARY) |
| 376 | | − skb->ip_summed = CHECKSUM_NONE; |
| 377 | | − } |
| 378 | | − } |
| 370 | + /* Is there an overlap with the previous fragment? */ |
| 371 | + if (prev && |
| 372 | + (prev->ip_defrag_offset + prev->len) > offset) |
| 373 | + goto discard_qp; |
| 379 | 374 | |
| 380 | | − err = -ENOMEM; |
| 381 | | − |
| 382 | | − while (next && next->ip_defrag_offset < end) { |
| 383 | | − int i = end - next->ip_defrag_offset; /* overlap is 'i' bytes */ |
| 384 | | − |
| 385 | | − if (i < next->len) { |
| 386 | | − int delta = -next->truesize; |
| 387 | | − |
| 388 | | − /* Eat head of the next overlapped fragment |
| 389 | | − * and leave the loop. The next ones cannot overlap. |
| 390 | | − */ |
| 391 | | − if (!pskb_pull(next, i)) |
| 392 | | − goto err; |
| 393 | | − delta += next->truesize; |
| 394 | | − if (delta) |
| 395 | | − add_frag_mem_limit(qp->q.net, delta); |
| 396 | | − next->ip_defrag_offset += i; |
| 397 | | − qp->q.meat -= i; |
| 398 | | − if (next->ip_summed != CHECKSUM_UNNECESSARY) |
| 399 | | − next->ip_summed = CHECKSUM_NONE; |
| 400 | | − break; |
| 401 | | − } else { |
| 402 | | − struct sk_buff *free_it = next; |
| 403 | | − |
| 404 | | − /* Old fragment is completely overridden with |
| 405 | | − * new one drop it. |
| 406 | | − */ |
| 407 | | − next = next->next; |
| 408 | | − |
| 409 | | − if (prev) |
| 410 | | − prev->next = next; |
| 411 | | − else |
| 412 | | − qp->q.fragments = next; |
| 413 | | − |
| 414 | | − qp->q.meat -= free_it->len; |
| 415 | | − sub_frag_mem_limit(qp->q.net, free_it->truesize); |
| 416 | | − kfree_skb(free_it); |
| 417 | | − } |
| 418 | | − } |
| 375 | + /* Is there an overlap with the next fragment? */ |
| 376 | + if (next && next->ip_defrag_offset < end) |
| 377 | + goto discard_qp; |
| 419 | 378 | |
| 420 | 379 | /* Note : skb->ip_defrag_offset and skb->dev share the same location */ |
| 421 | 380 | dev = skb->dev; |
| @@ -463,6 +422,10 @@ found: · 41 unmodified lines |
| 463 | 422 | skb_dst_drop(skb); |
| 464 | 423 | return -EINPROGRESS; |
| 465 | 424 | |
| 425 | +discard_qp: |
| 426 | + inet_frag_kill(&qp->q); |
| 427 | + err = -EINVAL; |
| 428 | + __IP_INC_STATS(net, IPSTATS_MIB_REASM_OVERLAPS); |
| 466 | 429 | err: |
| 467 | 430 | kfree_skb(skb); |
| 468 | 431 | return err; |