| @@ -277,6 +277,7 @@ static int ip_frag_reinit(struct ipq *qp) · 276 unmodified lines |
| 277 | /* Add new segment to existing queue. */ | 277 | /* Add new segment to existing queue. */ |
| 278 | static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb) | 278 | static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb) |
| 279 | { | 279 | { |
| | 280 | struct net *net = container_of(qp->q.net, struct net, ipv4.frags); |
| 280 | struct sk_buff *prev, *next; | 281 | struct sk_buff *prev, *next; |
| 281 | struct net_device *dev; | 282 | struct net_device *dev; |
| 282 | unsigned int fragsize; | 283 | unsigned int fragsize; |
| @@ -357,65 +358,23 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb) · 74 unmodified lines |
| 357 | } | 358 | } |
| 358 | | 359 | |
| 359 | found: | 360 | found: |
| 360 | /* We found where to put this one. Check for overlap with | 361 | /* RFC5722, Section 4, amended by Errata ID : 3089 |
| 361 | * preceding fragment, and, if needed, align things so that | 362 | * When reassembling an IPv6 datagram, if |
| 362 | * any overlaps are eliminated. | 363 | * one or more its constituent fragments is determined to be an |
| | 364 | * overlapping fragment, the entire datagram (and any constituent |
| | 365 | * fragments) MUST be silently discarded. |
| | 366 | * |
| | 367 | * We do the same here for IPv4. |
| 363 | */ | 368 | */ |
| 364 | if (prev) { | | |
| 365 | int i = (prev->ip_defrag_offset + prev->len) - offset; | | |
| 366 | | 369 | |
| 367 | if (i > 0) { | 370 | /* Is there an overlap with the previous fragment? */ |
| 368 | offset += i; | 371 | if (prev && |
| 369 | err = -EINVAL; | 372 | (prev->ip_defrag_offset + prev->len) > offset) |
| 370 | if (end <= offset) | 373 | goto discard_qp; |
| 371 | goto err; | | |
| 372 | err = -ENOMEM; | | |
| 373 | if (!pskb_pull(skb, i)) | | |
| 374 | goto err; | | |
| 375 | if (skb->ip_summed != CHECKSUM_UNNECESSARY) | | |
| 376 | skb->ip_summed = CHECKSUM_NONE; | | |
| 377 | } | | |
| 378 | } | | |
| 379 | | 374 | |
| 380 | err = -ENOMEM; | 375 | /* Is there an overlap with the next fragment? */ |
| 381 | | 376 | if (next && next->ip_defrag_offset < end) |
| 382 | while (next && next->ip_defrag_offset < end) { | 377 | goto discard_qp; |
| 383 | int i = end - next->ip_defrag_offset; /* overlap is 'i' bytes */ | | |
| 384 | | | |
| 385 | if (i < next->len) { | | |
| 386 | int delta = -next->truesize; | | |
| 387 | | | |
| 388 | /* Eat head of the next overlapped fragment | | |
| 389 | * and leave the loop. The next ones cannot overlap. | | |
| 390 | */ | | |
| 391 | if (!pskb_pull(next, i)) | | |
| 392 | goto err; | | |
| 393 | delta += next->truesize; | | |
| 394 | if (delta) | | |
| 395 | add_frag_mem_limit(qp->q.net, delta); | | |
| 396 | next->ip_defrag_offset += i; | | |
| 397 | qp->q.meat -= i; | | |
| 398 | if (next->ip_summed != CHECKSUM_UNNECESSARY) | | |
| 399 | next->ip_summed = CHECKSUM_NONE; | | |
| 400 | break; | | |
| 401 | } else { | | |
| 402 | struct sk_buff *free_it = next; | | |
| 403 | | | |
| 404 | /* Old fragment is completely overridden with | | |
| 405 | * new one drop it. | | |
| 406 | */ | | |
| 407 | next = next->next; | | |
| 408 | | | |
| 409 | if (prev) | | |
| 410 | prev->next = next; | | |
| 411 | else | | |
| 412 | qp->q.fragments = next; | | |
| 413 | | | |
| 414 | qp->q.meat -= free_it->len; | | |
| 415 | sub_frag_mem_limit(qp->q.net, free_it->truesize); | | |
| 416 | kfree_skb(free_it); | | |
| 417 | } | | |
| 418 | } | | |
| 419 | | 378 | |
| 420 | /* Note : skb->ip_defrag_offset and skb->dev share the same location */ | 379 | /* Note : skb->ip_defrag_offset and skb->dev share the same location */ |
| 421 | dev = skb->dev; | 380 | dev = skb->dev; |
| @@ -463,6 +422,10 @@ found: · 41 unmodified lines |
| 463 | skb_dst_drop(skb); | 422 | skb_dst_drop(skb); |
| 464 | return -EINPROGRESS; | 423 | return -EINPROGRESS; |
| 465 | | 424 | |
| | 425 | discard_qp: |
| | 426 | inet_frag_kill(&qp->q); |
| | 427 | err = -EINVAL; |
| | 428 | __IP_INC_STATS(net, IPSTATS_MIB_REASM_OVERLAPS); |
| 466 | err: | 429 | err: |
| 467 | kfree_skb(skb); | 430 | kfree_skb(skb); |
| 468 | return err; | 431 | return err; |