ipv6: discard overlapping fragment
RFC5722 prohibits reassembling fragments when some data overlaps. Bug spotted by Zhang Zuotao <zuotao.zhang@6wind.com>. Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
deabc772f3
commit
70789d7052
|
@ -149,13 +149,6 @@ int ip6_frag_match(struct inet_frag_queue *q, void *a)
|
||||||
}
|
}
|
||||||
EXPORT_SYMBOL(ip6_frag_match);
|
EXPORT_SYMBOL(ip6_frag_match);
|
||||||
|
|
||||||
/* Memory Tracking Functions. */
|
|
||||||
static void frag_kfree_skb(struct netns_frags *nf, struct sk_buff *skb)
|
|
||||||
{
|
|
||||||
atomic_sub(skb->truesize, &nf->mem);
|
|
||||||
kfree_skb(skb);
|
|
||||||
}
|
|
||||||
|
|
||||||
void ip6_frag_init(struct inet_frag_queue *q, void *a)
|
void ip6_frag_init(struct inet_frag_queue *q, void *a)
|
||||||
{
|
{
|
||||||
struct frag_queue *fq = container_of(q, struct frag_queue, q);
|
struct frag_queue *fq = container_of(q, struct frag_queue, q);
|
||||||
|
@ -346,58 +339,22 @@ static int ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb,
|
||||||
}
|
}
|
||||||
|
|
||||||
found:
|
found:
|
||||||
/* We found where to put this one. Check for overlap with
|
/* RFC5722, Section 4:
|
||||||
* preceding fragment, and, if needed, align things so that
|
* When reassembling an IPv6 datagram, if
|
||||||
* any overlaps are eliminated.
|
* one or more its constituent fragments is determined to be an
|
||||||
|
* overlapping fragment, the entire datagram (and any constituent
|
||||||
|
* fragments, including those not yet received) MUST be silently
|
||||||
|
* discarded.
|
||||||
*/
|
*/
|
||||||
if (prev) {
|
|
||||||
int i = (FRAG6_CB(prev)->offset + prev->len) - offset;
|
|
||||||
|
|
||||||
if (i > 0) {
|
/* Check for overlap with preceding fragment. */
|
||||||
offset += i;
|
if (prev &&
|
||||||
if (end <= offset)
|
(FRAG6_CB(prev)->offset + prev->len) - offset > 0)
|
||||||
goto err;
|
goto discard_fq;
|
||||||
if (!pskb_pull(skb, i))
|
|
||||||
goto err;
|
|
||||||
if (skb->ip_summed != CHECKSUM_UNNECESSARY)
|
|
||||||
skb->ip_summed = CHECKSUM_NONE;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
/* Look for overlap with succeeding segments.
|
/* Look for overlap with succeeding segment. */
|
||||||
* If we can merge fragments, do it.
|
if (next && FRAG6_CB(next)->offset < end)
|
||||||
*/
|
goto discard_fq;
|
||||||
while (next && FRAG6_CB(next)->offset < end) {
|
|
||||||
int i = end - FRAG6_CB(next)->offset; /* overlap is 'i' bytes */
|
|
||||||
|
|
||||||
if (i < next->len) {
|
|
||||||
/* Eat head of the next overlapped fragment
|
|
||||||
* and leave the loop. The next ones cannot overlap.
|
|
||||||
*/
|
|
||||||
if (!pskb_pull(next, i))
|
|
||||||
goto err;
|
|
||||||
FRAG6_CB(next)->offset += i; /* next fragment */
|
|
||||||
fq->q.meat -= i;
|
|
||||||
if (next->ip_summed != CHECKSUM_UNNECESSARY)
|
|
||||||
next->ip_summed = CHECKSUM_NONE;
|
|
||||||
break;
|
|
||||||
} else {
|
|
||||||
struct sk_buff *free_it = next;
|
|
||||||
|
|
||||||
/* Old fragment is completely overridden with
|
|
||||||
* new one drop it.
|
|
||||||
*/
|
|
||||||
next = next->next;
|
|
||||||
|
|
||||||
if (prev)
|
|
||||||
prev->next = next;
|
|
||||||
else
|
|
||||||
fq->q.fragments = next;
|
|
||||||
|
|
||||||
fq->q.meat -= free_it->len;
|
|
||||||
frag_kfree_skb(fq->q.net, free_it);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
FRAG6_CB(skb)->offset = offset;
|
FRAG6_CB(skb)->offset = offset;
|
||||||
|
|
||||||
|
@ -436,6 +393,8 @@ found:
|
||||||
write_unlock(&ip6_frags.lock);
|
write_unlock(&ip6_frags.lock);
|
||||||
return -1;
|
return -1;
|
||||||
|
|
||||||
|
discard_fq:
|
||||||
|
fq_kill(fq);
|
||||||
err:
|
err:
|
||||||
IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
|
IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
|
||||||
IPSTATS_MIB_REASMFAILS);
|
IPSTATS_MIB_REASMFAILS);
|
||||||
|
|
Loading…
Reference in a new issue