• Eric Dumazet's avatar
    ipv4: frags: handle possible skb truesize change · 4672694b
    Eric Dumazet authored
    ip_frag_queue() might call pskb_pull() on one skb that
    is already in the fragment queue.
    
    We need to take care of possible truesize change, or we
    might have an imbalance of the netns frags memory usage.
    
    IPv6 is immune to this bug, because RFC5722, Section 4,
    amended by Errata ID 3089 states :
    
      When reassembling an IPv6 datagram, if
      one or more its constituent fragments is determined to be an
      overlapping fragment, the entire datagram (and any constituent
      fragments) MUST be silently discarded.
    
    Fixes: 158f323b ("net: adjust skb->truesize in pskb_expand_head()")
    Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    4672694b
ip_fragment.c 20.8 KB