Commit 4672694b authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller

ipv4: frags: handle possible skb truesize change

ip_frag_queue() might call pskb_pull() on one skb that
is already in the fragment queue.

We need to take care of possible truesize change, or we
might have an imbalance of the netns frags memory usage.

IPv6 is immune to this bug, because RFC5722, Section 4,
amended by Errata ID 3089 states :

  When reassembling an IPv6 datagram, if
  one or more its constituent fragments is determined to be an
  overlapping fragment, the entire datagram (and any constituent
  fragments) MUST be silently discarded.

Fixes: 158f323b ("net: adjust skb->truesize in pskb_expand_head()")
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 56e2c94f
...@@ -383,11 +383,16 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb) ...@@ -383,11 +383,16 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb)
int i = end - next->ip_defrag_offset; /* overlap is 'i' bytes */ int i = end - next->ip_defrag_offset; /* overlap is 'i' bytes */
if (i < next->len) { if (i < next->len) {
int delta = -next->truesize;
/* Eat head of the next overlapped fragment /* Eat head of the next overlapped fragment
* and leave the loop. The next ones cannot overlap. * and leave the loop. The next ones cannot overlap.
*/ */
if (!pskb_pull(next, i)) if (!pskb_pull(next, i))
goto err; goto err;
delta += next->truesize;
if (delta)
add_frag_mem_limit(qp->q.net, delta);
next->ip_defrag_offset += i; next->ip_defrag_offset += i;
qp->q.meat -= i; qp->q.meat -= i;
if (next->ip_summed != CHECKSUM_UNNECESSARY) if (next->ip_summed != CHECKSUM_UNNECESSARY)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment