Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 70789d70 authored by Nicolas Dichtel's avatar Nicolas Dichtel Committed by David S. Miller
Browse files

ipv6: discard overlapping fragment 



RFC5722 prohibits reassembling fragments when some data overlaps.

Bug spotted by Zhang Zuotao <zuotao.zhang@6wind.com>.

Signed-off-by: default avatarNicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent deabc772

net/ipv6/reassembly.c

+15 −56
Original line number Original line Diff line number Diff line
@@ -149,13 +149,6 @@ int ip6_frag_match(struct inet_frag_queue *q, void *a) 
}

}

EXPORT_SYMBOL(ip6_frag_match);

EXPORT_SYMBOL(ip6_frag_match);





/* Memory Tracking Functions. */

static void frag_kfree_skb(struct netns_frags *nf, struct sk_buff *skb)

{

	atomic_sub(skb->truesize, &nf->mem);

	kfree_skb(skb);

}



void ip6_frag_init(struct inet_frag_queue *q, void *a)

void ip6_frag_init(struct inet_frag_queue *q, void *a)

{

{

	struct frag_queue *fq = container_of(q, struct frag_queue, q);

	struct frag_queue *fq = container_of(q, struct frag_queue, q);
@@ -346,58 +339,22 @@ static int ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb, 
	}

	}





found:

found:

	/* We found where to put this one.  Check for overlap with

	/* RFC5722, Section 4:

	 * preceding fragment, and, if needed, align things so that

	 *                                  When reassembling an IPv6 datagram, if

	 * any overlaps are eliminated.

	 *   one or more its constituent fragments is determined to be an

	 *   overlapping fragment, the entire datagram (and any constituent

	 *   fragments, including those not yet received) MUST be silently

	 *   discarded.

	 */

	 */

	if (prev) {

		int i = (FRAG6_CB(prev)->offset + prev->len) - offset;





		if (i > 0) {

	/* Check for overlap with preceding fragment. */

			offset += i;

	if (prev &&

			if (end <= offset)

	    (FRAG6_CB(prev)->offset + prev->len) - offset > 0)

				goto err;

		goto discard_fq;

			if (!pskb_pull(skb, i))

				goto err;

			if (skb->ip_summed != CHECKSUM_UNNECESSARY)

				skb->ip_summed = CHECKSUM_NONE;

		}

	}





	/* Look for overlap with succeeding segments.

	/* Look for overlap with succeeding segment. */

	 * If we can merge fragments, do it.

	if (next && FRAG6_CB(next)->offset < end)

	 */

		goto discard_fq;

	while (next && FRAG6_CB(next)->offset < end) {

		int i = end - FRAG6_CB(next)->offset; /* overlap is 'i' bytes */



		if (i < next->len) {

			/* Eat head of the next overlapped fragment

			 * and leave the loop. The next ones cannot overlap.

			 */

			if (!pskb_pull(next, i))

				goto err;

			FRAG6_CB(next)->offset += i;	/* next fragment */

			fq->q.meat -= i;

			if (next->ip_summed != CHECKSUM_UNNECESSARY)

				next->ip_summed = CHECKSUM_NONE;

			break;

		} else {

			struct sk_buff *free_it = next;



			/* Old fragment is completely overridden with

			 * new one drop it.

			 */

			next = next->next;



			if (prev)

				prev->next = next;

			else

				fq->q.fragments = next;



			fq->q.meat -= free_it->len;

			frag_kfree_skb(fq->q.net, free_it);

		}

	}





	FRAG6_CB(skb)->offset = offset;

	FRAG6_CB(skb)->offset = offset;
@@ -436,6 +393,8 @@ static int ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb, 
	write_unlock(&ip6_frags.lock);

	write_unlock(&ip6_frags.lock);

	return -1;

	return -1;





discard_fq:

	fq_kill(fq);

err:

err:

	IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),

	IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),

		      IPSTATS_MIB_REASMFAILS);

		      IPSTATS_MIB_REASMFAILS);