redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity

ipv6: discard overlapping fragment 

RFC5722 prohibits reassembling fragments when some data overlaps.

Bug spotted by Zhang Zuotao <zuotao.zhang@6wind.com>.

Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
hifive-unleashed-5.1
Nicolas Dichtel 2010-09-03 05:13:05 +00:00 committed by David S. Miller
parent deabc772f3
commit 70789d7052
1 changed files with 15 additions and 56 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

71
net/ipv6/reassembly.c
View File

@ -149,13 +149,6 @@ int ip6_frag_match(struct inet_frag_queue *q, void *a)
} }
EXPORT_SYMBOL(ip6_frag_match); EXPORT_SYMBOL(ip6_frag_match);
/* Memory Tracking Functions. */
static void frag_kfree_skb(struct netns_frags *nf, struct sk_buff *skb)
{
atomic_sub(skb->truesize, &nf->mem);
kfree_skb(skb);
}
void ip6_frag_init(struct inet_frag_queue *q, void *a) void ip6_frag_init(struct inet_frag_queue *q, void *a)
{ {
struct frag_queue *fq = container_of(q, struct frag_queue, q); struct frag_queue *fq = container_of(q, struct frag_queue, q);
@ -346,58 +339,22 @@ static int ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb,
} }
found: found:
/* We found where to put this one. Check for overlap with /* RFC5722, Section 4:
* preceding fragment, and, if needed, align things so that * When reassembling an IPv6 datagram, if
* any overlaps are eliminated. * one or more its constituent fragments is determined to be an
* overlapping fragment, the entire datagram (and any constituent
* fragments, including those not yet received) MUST be silently
* discarded.
*/ */
if (prev) {
int i = (FRAG6_CB(prev)->offset + prev->len) - offset;
if (i > 0) { /* Check for overlap with preceding fragment. */
offset += i; if (prev &&
if (end <= offset) (FRAG6_CB(prev)->offset + prev->len) - offset > 0)
goto err; goto discard_fq;
if (!pskb_pull(skb, i))
goto err;
if (skb->ip_summed != CHECKSUM_UNNECESSARY)
skb->ip_summed = CHECKSUM_NONE;
}
}
/* Look for overlap with succeeding segments. /* Look for overlap with succeeding segment. */
* If we can merge fragments, do it. if (next && FRAG6_CB(next)->offset < end)
*/ goto discard_fq;
while (next && FRAG6_CB(next)->offset < end) {
int i = end - FRAG6_CB(next)->offset; /* overlap is 'i' bytes */
if (i < next->len) {
/* Eat head of the next overlapped fragment
* and leave the loop. The next ones cannot overlap.
*/
if (!pskb_pull(next, i))
goto err;
FRAG6_CB(next)->offset += i; /* next fragment */
fq->q.meat -= i;
if (next->ip_summed != CHECKSUM_UNNECESSARY)
next->ip_summed = CHECKSUM_NONE;
break;
} else {
struct sk_buff *free_it = next;
/* Old fragment is completely overridden with
* new one drop it.
*/
next = next->next;
if (prev)
prev->next = next;
else
fq->q.fragments = next;
fq->q.meat -= free_it->len;
frag_kfree_skb(fq->q.net, free_it);
}
}
FRAG6_CB(skb)->offset = offset; FRAG6_CB(skb)->offset = offset;
@ -436,6 +393,8 @@ found:
write_unlock(&ip6_frags.lock); write_unlock(&ip6_frags.lock);
return -1; return -1;
discard_fq:
fq_kill(fq);
err: err:
IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
IPSTATS_MIB_REASMFAILS); IPSTATS_MIB_REASMFAILS);