reassembly.c 18.8 KB
Newer Older
L
Linus Torvalds 已提交
1 2
/*
 *	IPv6 fragment reassembly
3
 *	Linux INET6 implementation
L
Linus Torvalds 已提交
4 5
 *
 *	Authors:
6
 *	Pedro Roque		<roque@di.fc.ul.pt>
L
Linus Torvalds 已提交
7 8 9 10 11 12 13 14 15 16 17
 *
 *	$Id: reassembly.c,v 1.26 2001/03/07 22:00:57 davem Exp $
 *
 *	Based on: net/ipv4/ip_fragment.c
 *
 *	This program is free software; you can redistribute it and/or
 *      modify it under the terms of the GNU General Public License
 *      as published by the Free Software Foundation; either version
 *      2 of the License, or (at your option) any later version.
 */

18 19
/*
 *	Fixes:
L
Linus Torvalds 已提交
20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44
 *	Andi Kleen	Make it work with multiple hosts.
 *			More RFC compliance.
 *
 *      Horst von Brand Add missing #include <linux/string.h>
 *	Alexey Kuznetsov	SMP races, threading, cleanup.
 *	Patrick McHardy		LRU queue of frag heads for evictor.
 *	Mitsuru KANDA @USAGI	Register inet6_protocol{}.
 *	David Stevens and
 *	YOSHIFUJI,H. @USAGI	Always remove fragment header to
 *				calculate ICV correctly.
 */
#include <linux/errno.h>
#include <linux/types.h>
#include <linux/string.h>
#include <linux/socket.h>
#include <linux/sockios.h>
#include <linux/jiffies.h>
#include <linux/net.h>
#include <linux/list.h>
#include <linux/netdevice.h>
#include <linux/in6.h>
#include <linux/ipv6.h>
#include <linux/icmpv6.h>
#include <linux/random.h>
#include <linux/jhash.h>
45
#include <linux/skbuff.h>
L
Linus Torvalds 已提交
46 47 48 49 50

#include <net/sock.h>
#include <net/snmp.h>

#include <net/ipv6.h>
51
#include <net/ip6_route.h>
L
Linus Torvalds 已提交
52 53 54 55 56
#include <net/protocol.h>
#include <net/transp_v6.h>
#include <net/rawv6.h>
#include <net/ndisc.h>
#include <net/addrconf.h>
57
#include <net/inet_frag.h>
L
Linus Torvalds 已提交
58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73

struct ip6frag_skb_cb
{
	struct inet6_skb_parm	h;
	int			offset;
};

#define FRAG6_CB(skb)	((struct ip6frag_skb_cb*)((skb)->cb))


/*
 *	Equivalent of ipv4 struct ipq
 */

struct frag_queue
{
74
	struct inet_frag_queue	q;
L
Linus Torvalds 已提交
75

A
Al Viro 已提交
76
	__be32			id;		/* fragment id		*/
L
Linus Torvalds 已提交
77 78 79 80 81 82 83 84
	struct in6_addr		saddr;
	struct in6_addr		daddr;

	int			iif;
	unsigned int		csum;
	__u16			nhoffset;
};

85 86 87 88 89 90 91
struct inet_frags_ctl ip6_frags_ctl __read_mostly = {
	.high_thresh 	 = 256 * 1024,
	.low_thresh	 = 192 * 1024,
	.timeout	 = IPV6_FRAG_TIMEOUT,
	.secret_interval = 10 * 60 * HZ,
};

92
static struct inet_frags ip6_frags;
L
Linus Torvalds 已提交
93

94 95 96 97
int ip6_frag_nqueues(void)
{
	return ip6_frags.nqueues;
}
L
Linus Torvalds 已提交
98

99 100 101 102
int ip6_frag_mem(void)
{
	return atomic_read(&ip6_frags.mem);
}
L
Linus Torvalds 已提交
103

104 105 106
static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
			  struct net_device *dev);

107 108 109 110
/*
 * callers should be careful not to use the hash value outside the ipfrag_lock
 * as doing so could race with ipfrag_hash_rnd being recalculated.
 */
A
Al Viro 已提交
111
static unsigned int ip6qhashfn(__be32 id, struct in6_addr *saddr,
L
Linus Torvalds 已提交
112 113 114 115
			       struct in6_addr *daddr)
{
	u32 a, b, c;

A
Al Viro 已提交
116 117 118
	a = (__force u32)saddr->s6_addr32[0];
	b = (__force u32)saddr->s6_addr32[1];
	c = (__force u32)saddr->s6_addr32[2];
L
Linus Torvalds 已提交
119 120 121

	a += JHASH_GOLDEN_RATIO;
	b += JHASH_GOLDEN_RATIO;
122
	c += ip6_frags.rnd;
L
Linus Torvalds 已提交
123 124
	__jhash_mix(a, b, c);

A
Al Viro 已提交
125 126 127
	a += (__force u32)saddr->s6_addr32[3];
	b += (__force u32)daddr->s6_addr32[0];
	c += (__force u32)daddr->s6_addr32[1];
L
Linus Torvalds 已提交
128 129
	__jhash_mix(a, b, c);

A
Al Viro 已提交
130 131 132
	a += (__force u32)daddr->s6_addr32[2];
	b += (__force u32)daddr->s6_addr32[3];
	c += (__force u32)id;
L
Linus Torvalds 已提交
133 134
	__jhash_mix(a, b, c);

135
	return c & (INETFRAGS_HASHSZ - 1);
L
Linus Torvalds 已提交
136 137 138 139 140 141 142
}

static void ip6_frag_secret_rebuild(unsigned long dummy)
{
	unsigned long now = jiffies;
	int i;

143 144 145
	write_lock(&ip6_frags.lock);
	get_random_bytes(&ip6_frags.rnd, sizeof(u32));
	for (i = 0; i < INETFRAGS_HASHSZ; i++) {
L
Linus Torvalds 已提交
146
		struct frag_queue *q;
147
		struct hlist_node *p, *n;
L
Linus Torvalds 已提交
148

149
		hlist_for_each_entry_safe(q, p, n, &ip6_frags.hash[i], q.list) {
L
Linus Torvalds 已提交
150 151 152 153 154
			unsigned int hval = ip6qhashfn(q->id,
						       &q->saddr,
						       &q->daddr);

			if (hval != i) {
155
				hlist_del(&q->q.list);
L
Linus Torvalds 已提交
156 157

				/* Relink to new hash chain. */
158
				hlist_add_head(&q->q.list,
159
					       &ip6_frags.hash[hval]);
L
Linus Torvalds 已提交
160

161
			}
L
Linus Torvalds 已提交
162 163
		}
	}
164
	write_unlock(&ip6_frags.lock);
L
Linus Torvalds 已提交
165

166
	mod_timer(&ip6_frags.secret_timer, now + ip6_frags_ctl.secret_interval);
L
Linus Torvalds 已提交
167 168 169 170 171 172 173
}

/* Memory Tracking Functions. */
static inline void frag_kfree_skb(struct sk_buff *skb, int *work)
{
	if (work)
		*work -= skb->truesize;
174
	atomic_sub(skb->truesize, &ip6_frags.mem);
L
Linus Torvalds 已提交
175 176 177 178 179 180 181
	kfree_skb(skb);
}

static inline void frag_free_queue(struct frag_queue *fq, int *work)
{
	if (work)
		*work -= sizeof(struct frag_queue);
182
	atomic_sub(sizeof(struct frag_queue), &ip6_frags.mem);
L
Linus Torvalds 已提交
183 184 185 186 187
	kfree(fq);
}

static inline struct frag_queue *frag_alloc_queue(void)
{
188
	struct frag_queue *fq = kzalloc(sizeof(struct frag_queue), GFP_ATOMIC);
L
Linus Torvalds 已提交
189 190 191

	if(!fq)
		return NULL;
192
	atomic_add(sizeof(struct frag_queue), &ip6_frags.mem);
L
Linus Torvalds 已提交
193 194 195 196 197 198 199 200 201 202
	return fq;
}

/* Destruction primitives. */

/* Complete destruction of fq. */
static void ip6_frag_destroy(struct frag_queue *fq, int *work)
{
	struct sk_buff *fp;

203 204
	BUG_TRAP(fq->q.last_in&COMPLETE);
	BUG_TRAP(del_timer(&fq->q.timer) == 0);
L
Linus Torvalds 已提交
205 206

	/* Release all fragment data. */
207
	fp = fq->q.fragments;
L
Linus Torvalds 已提交
208 209 210 211 212 213 214 215 216 217 218 219
	while (fp) {
		struct sk_buff *xp = fp->next;

		frag_kfree_skb(fp, work);
		fp = xp;
	}

	frag_free_queue(fq, work);
}

static __inline__ void fq_put(struct frag_queue *fq, int *work)
{
220
	if (atomic_dec_and_test(&fq->q.refcnt))
L
Linus Torvalds 已提交
221 222 223 224 225 226 227 228
		ip6_frag_destroy(fq, work);
}

/* Kill fq entry. It is not destroyed immediately,
 * because caller (and someone more) holds reference count.
 */
static __inline__ void fq_kill(struct frag_queue *fq)
{
229
	inet_frag_kill(&fq->q, &ip6_frags);
L
Linus Torvalds 已提交
230 231
}

232
static void ip6_evictor(struct inet6_dev *idev)
L
Linus Torvalds 已提交
233 234 235 236 237
{
	struct frag_queue *fq;
	struct list_head *tmp;
	int work;

238
	work = atomic_read(&ip6_frags.mem) - ip6_frags_ctl.low_thresh;
L
Linus Torvalds 已提交
239 240 241 242
	if (work <= 0)
		return;

	while(work > 0) {
243 244 245
		read_lock(&ip6_frags.lock);
		if (list_empty(&ip6_frags.lru_list)) {
			read_unlock(&ip6_frags.lock);
L
Linus Torvalds 已提交
246 247
			return;
		}
248
		tmp = ip6_frags.lru_list.next;
249 250
		fq = list_entry(tmp, struct frag_queue, q.lru_list);
		atomic_inc(&fq->q.refcnt);
251
		read_unlock(&ip6_frags.lock);
L
Linus Torvalds 已提交
252

253 254
		spin_lock(&fq->q.lock);
		if (!(fq->q.last_in&COMPLETE))
L
Linus Torvalds 已提交
255
			fq_kill(fq);
256
		spin_unlock(&fq->q.lock);
L
Linus Torvalds 已提交
257 258

		fq_put(fq, &work);
259
		IP6_INC_STATS_BH(idev, IPSTATS_MIB_REASMFAILS);
L
Linus Torvalds 已提交
260 261 262 263 264 265
	}
}

static void ip6_frag_expire(unsigned long data)
{
	struct frag_queue *fq = (struct frag_queue *) data;
266
	struct net_device *dev = NULL;
L
Linus Torvalds 已提交
267

268
	spin_lock(&fq->q.lock);
L
Linus Torvalds 已提交
269

270
	if (fq->q.last_in & COMPLETE)
L
Linus Torvalds 已提交
271 272 273 274
		goto out;

	fq_kill(fq);

275
	dev = dev_get_by_index(&init_net, fq->iif);
276 277 278 279 280 281 282
	if (!dev)
		goto out;

	rcu_read_lock();
	IP6_INC_STATS_BH(__in6_dev_get(dev), IPSTATS_MIB_REASMTIMEOUT);
	IP6_INC_STATS_BH(__in6_dev_get(dev), IPSTATS_MIB_REASMFAILS);
	rcu_read_unlock();
L
Linus Torvalds 已提交
283

284
	/* Don't send error if the first segment did not arrive. */
285
	if (!(fq->q.last_in&FIRST_IN) || !fq->q.fragments)
286 287 288 289 290 291 292
		goto out;

	/*
	   But use as source device on which LAST ARRIVED
	   segment was received. And do not use fq->dev
	   pointer directly, device might already disappeared.
	 */
293 294
	fq->q.fragments->dev = dev;
	icmpv6_send(fq->q.fragments, ICMPV6_TIME_EXCEED, ICMPV6_EXC_FRAGTIME, 0, dev);
L
Linus Torvalds 已提交
295
out:
296 297
	if (dev)
		dev_put(dev);
298
	spin_unlock(&fq->q.lock);
L
Linus Torvalds 已提交
299 300 301 302 303 304
	fq_put(fq, NULL);
}

/* Creation primitives. */


305
static struct frag_queue *ip6_frag_intern(struct frag_queue *fq_in)
L
Linus Torvalds 已提交
306 307
{
	struct frag_queue *fq;
308
	unsigned int hash;
309 310 311
#ifdef CONFIG_SMP
	struct hlist_node *n;
#endif
L
Linus Torvalds 已提交
312

313
	write_lock(&ip6_frags.lock);
314
	hash = ip6qhashfn(fq_in->id, &fq_in->saddr, &fq_in->daddr);
L
Linus Torvalds 已提交
315
#ifdef CONFIG_SMP
316
	hlist_for_each_entry(fq, n, &ip6_frags.hash[hash], q.list) {
317
		if (fq->id == fq_in->id &&
L
Linus Torvalds 已提交
318 319
		    ipv6_addr_equal(&fq_in->saddr, &fq->saddr) &&
		    ipv6_addr_equal(&fq_in->daddr, &fq->daddr)) {
320
			atomic_inc(&fq->q.refcnt);
321
			write_unlock(&ip6_frags.lock);
322
			fq_in->q.last_in |= COMPLETE;
L
Linus Torvalds 已提交
323 324 325 326 327 328 329
			fq_put(fq_in, NULL);
			return fq;
		}
	}
#endif
	fq = fq_in;

330
	if (!mod_timer(&fq->q.timer, jiffies + ip6_frags_ctl.timeout))
331
		atomic_inc(&fq->q.refcnt);
L
Linus Torvalds 已提交
332

333
	atomic_inc(&fq->q.refcnt);
334
	hlist_add_head(&fq->q.list, &ip6_frags.hash[hash]);
335
	INIT_LIST_HEAD(&fq->q.lru_list);
336 337 338
	list_add_tail(&fq->q.lru_list, &ip6_frags.lru_list);
	ip6_frags.nqueues++;
	write_unlock(&ip6_frags.lock);
L
Linus Torvalds 已提交
339 340 341 342 343
	return fq;
}


static struct frag_queue *
A
Al Viro 已提交
344
ip6_frag_create(__be32 id, struct in6_addr *src, struct in6_addr *dst,
345
		struct inet6_dev *idev)
L
Linus Torvalds 已提交
346 347 348 349 350 351 352 353 354 355
{
	struct frag_queue *fq;

	if ((fq = frag_alloc_queue()) == NULL)
		goto oom;

	fq->id = id;
	ipv6_addr_copy(&fq->saddr, src);
	ipv6_addr_copy(&fq->daddr, dst);

356 357 358 359 360
	init_timer(&fq->q.timer);
	fq->q.timer.function = ip6_frag_expire;
	fq->q.timer.data = (long) fq;
	spin_lock_init(&fq->q.lock);
	atomic_set(&fq->q.refcnt, 1);
L
Linus Torvalds 已提交
361

362
	return ip6_frag_intern(fq);
L
Linus Torvalds 已提交
363 364

oom:
365
	IP6_INC_STATS_BH(idev, IPSTATS_MIB_REASMFAILS);
L
Linus Torvalds 已提交
366 367 368 369
	return NULL;
}

static __inline__ struct frag_queue *
A
Al Viro 已提交
370
fq_find(__be32 id, struct in6_addr *src, struct in6_addr *dst,
371
	struct inet6_dev *idev)
L
Linus Torvalds 已提交
372 373
{
	struct frag_queue *fq;
374
	struct hlist_node *n;
375
	unsigned int hash;
L
Linus Torvalds 已提交
376

377
	read_lock(&ip6_frags.lock);
378
	hash = ip6qhashfn(id, src, dst);
379
	hlist_for_each_entry(fq, n, &ip6_frags.hash[hash], q.list) {
380
		if (fq->id == id &&
L
Linus Torvalds 已提交
381 382
		    ipv6_addr_equal(src, &fq->saddr) &&
		    ipv6_addr_equal(dst, &fq->daddr)) {
383
			atomic_inc(&fq->q.refcnt);
384
			read_unlock(&ip6_frags.lock);
L
Linus Torvalds 已提交
385 386 387
			return fq;
		}
	}
388
	read_unlock(&ip6_frags.lock);
L
Linus Torvalds 已提交
389

390
	return ip6_frag_create(id, src, dst, idev);
L
Linus Torvalds 已提交
391 392 393
}


394
static int ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb,
L
Linus Torvalds 已提交
395 396 397
			   struct frag_hdr *fhdr, int nhoff)
{
	struct sk_buff *prev, *next;
398
	struct net_device *dev;
L
Linus Torvalds 已提交
399 400
	int offset, end;

401
	if (fq->q.last_in & COMPLETE)
L
Linus Torvalds 已提交
402 403 404
		goto err;

	offset = ntohs(fhdr->frag_off) & ~0x7;
405 406
	end = offset + (ntohs(ipv6_hdr(skb)->payload_len) -
			((u8 *)(fhdr + 1) - (u8 *)(ipv6_hdr(skb) + 1)));
L
Linus Torvalds 已提交
407 408

	if ((unsigned int)end > IPV6_MAXPLEN) {
409 410
		IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
				 IPSTATS_MIB_INHDRERRORS);
411 412 413
		icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
				  ((u8 *)&fhdr->frag_off -
				   skb_network_header(skb)));
414
		return -1;
L
Linus Torvalds 已提交
415 416
	}

417 418
	if (skb->ip_summed == CHECKSUM_COMPLETE) {
		const unsigned char *nh = skb_network_header(skb);
419
		skb->csum = csum_sub(skb->csum,
420 421 422
				     csum_partial(nh, (u8 *)(fhdr + 1) - nh,
						  0));
	}
L
Linus Torvalds 已提交
423 424 425 426 427 428

	/* Is this the final fragment? */
	if (!(fhdr->frag_off & htons(IP6_MF))) {
		/* If we already have some bits beyond end
		 * or have different end, the segment is corrupted.
		 */
429 430
		if (end < fq->q.len ||
		    ((fq->q.last_in & LAST_IN) && end != fq->q.len))
L
Linus Torvalds 已提交
431
			goto err;
432 433
		fq->q.last_in |= LAST_IN;
		fq->q.len = end;
L
Linus Torvalds 已提交
434 435 436 437 438 439 440 441
	} else {
		/* Check if the fragment is rounded to 8 bytes.
		 * Required by the RFC.
		 */
		if (end & 0x7) {
			/* RFC2460 says always send parameter problem in
			 * this case. -DaveM
			 */
442 443
			IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
					 IPSTATS_MIB_INHDRERRORS);
444
			icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
L
Linus Torvalds 已提交
445
					  offsetof(struct ipv6hdr, payload_len));
446
			return -1;
L
Linus Torvalds 已提交
447
		}
448
		if (end > fq->q.len) {
L
Linus Torvalds 已提交
449
			/* Some bits beyond end -> corruption. */
450
			if (fq->q.last_in & LAST_IN)
L
Linus Torvalds 已提交
451
				goto err;
452
			fq->q.len = end;
L
Linus Torvalds 已提交
453 454 455 456 457 458 459 460 461
		}
	}

	if (end == offset)
		goto err;

	/* Point into the IP datagram 'data' part. */
	if (!pskb_pull(skb, (u8 *) (fhdr + 1) - skb->data))
		goto err;
462

463 464
	if (pskb_trim_rcsum(skb, end - offset))
		goto err;
L
Linus Torvalds 已提交
465 466 467 468 469 470

	/* Find out which fragments are in front and at the back of us
	 * in the chain of fragments so far.  We must know where to put
	 * this fragment, right?
	 */
	prev = NULL;
471
	for(next = fq->q.fragments; next != NULL; next = next->next) {
L
Linus Torvalds 已提交
472 473 474 475 476 477 478 479 480 481 482 483 484 485 486 487 488 489 490 491 492 493 494 495 496 497 498 499 500 501 502 503 504 505 506 507
		if (FRAG6_CB(next)->offset >= offset)
			break;	/* bingo! */
		prev = next;
	}

	/* We found where to put this one.  Check for overlap with
	 * preceding fragment, and, if needed, align things so that
	 * any overlaps are eliminated.
	 */
	if (prev) {
		int i = (FRAG6_CB(prev)->offset + prev->len) - offset;

		if (i > 0) {
			offset += i;
			if (end <= offset)
				goto err;
			if (!pskb_pull(skb, i))
				goto err;
			if (skb->ip_summed != CHECKSUM_UNNECESSARY)
				skb->ip_summed = CHECKSUM_NONE;
		}
	}

	/* Look for overlap with succeeding segments.
	 * If we can merge fragments, do it.
	 */
	while (next && FRAG6_CB(next)->offset < end) {
		int i = end - FRAG6_CB(next)->offset; /* overlap is 'i' bytes */

		if (i < next->len) {
			/* Eat head of the next overlapped fragment
			 * and leave the loop. The next ones cannot overlap.
			 */
			if (!pskb_pull(next, i))
				goto err;
			FRAG6_CB(next)->offset += i;	/* next fragment */
508
			fq->q.meat -= i;
L
Linus Torvalds 已提交
509 510 511 512 513 514 515 516 517 518 519 520 521 522
			if (next->ip_summed != CHECKSUM_UNNECESSARY)
				next->ip_summed = CHECKSUM_NONE;
			break;
		} else {
			struct sk_buff *free_it = next;

			/* Old fragment is completely overridden with
			 * new one drop it.
			 */
			next = next->next;

			if (prev)
				prev->next = next;
			else
523
				fq->q.fragments = next;
L
Linus Torvalds 已提交
524

525
			fq->q.meat -= free_it->len;
L
Linus Torvalds 已提交
526 527 528 529 530 531 532 533 534 535 536
			frag_kfree_skb(free_it, NULL);
		}
	}

	FRAG6_CB(skb)->offset = offset;

	/* Insert this fragment in the chain of fragments. */
	skb->next = next;
	if (prev)
		prev->next = skb;
	else
537
		fq->q.fragments = skb;
L
Linus Torvalds 已提交
538

539 540 541 542 543
	dev = skb->dev;
	if (dev) {
		fq->iif = dev->ifindex;
		skb->dev = NULL;
	}
544 545
	fq->q.stamp = skb->tstamp;
	fq->q.meat += skb->len;
546
	atomic_add(skb->truesize, &ip6_frags.mem);
L
Linus Torvalds 已提交
547 548 549 550 551 552

	/* The first fragment.
	 * nhoffset is obtained from the first fragment, of course.
	 */
	if (offset == 0) {
		fq->nhoffset = nhoff;
553
		fq->q.last_in |= FIRST_IN;
L
Linus Torvalds 已提交
554
	}
555

556
	if (fq->q.last_in == (FIRST_IN | LAST_IN) && fq->q.meat == fq->q.len)
557 558
		return ip6_frag_reasm(fq, prev, dev);

559 560 561
	write_lock(&ip6_frags.lock);
	list_move_tail(&fq->q.lru_list, &ip6_frags.lru_list);
	write_unlock(&ip6_frags.lock);
562
	return -1;
L
Linus Torvalds 已提交
563 564

err:
565
	IP6_INC_STATS(ip6_dst_idev(skb->dst), IPSTATS_MIB_REASMFAILS);
L
Linus Torvalds 已提交
566
	kfree_skb(skb);
567
	return -1;
L
Linus Torvalds 已提交
568 569 570 571 572 573 574 575 576 577 578
}

/*
 *	Check if this packet is complete.
 *	Returns NULL on failure by any reason, and pointer
 *	to current nexthdr field in reassembled frame.
 *
 *	It is called with locked fq, and caller must check that
 *	queue is eligible for reassembly i.e. it is not COMPLETE,
 *	the last and the first frames arrived and all the bits are here.
 */
579
static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
L
Linus Torvalds 已提交
580 581
			  struct net_device *dev)
{
582
	struct sk_buff *fp, *head = fq->q.fragments;
L
Linus Torvalds 已提交
583 584 585 586 587
	int    payload_len;
	unsigned int nhoff;

	fq_kill(fq);

588 589 590 591 592 593 594 595 596 597 598
	/* Make the one we just received the head. */
	if (prev) {
		head = prev->next;
		fp = skb_clone(head, GFP_ATOMIC);

		if (!fp)
			goto out_oom;

		fp->next = head->next;
		prev->next = fp;

599 600
		skb_morph(head, fq->q.fragments);
		head->next = fq->q.fragments->next;
601

602 603
		kfree_skb(fq->q.fragments);
		fq->q.fragments = head;
604 605
	}

L
Linus Torvalds 已提交
606 607 608 609
	BUG_TRAP(head != NULL);
	BUG_TRAP(FRAG6_CB(head)->offset == 0);

	/* Unfragmented part is taken from the first segment. */
610
	payload_len = ((head->data - skb_network_header(head)) -
611
		       sizeof(struct ipv6hdr) + fq->q.len -
612
		       sizeof(struct frag_hdr));
L
Linus Torvalds 已提交
613 614 615 616 617 618 619 620 621 622 623 624 625 626 627 628 629 630 631 632 633 634 635 636 637 638 639
	if (payload_len > IPV6_MAXPLEN)
		goto out_oversize;

	/* Head of list must not be cloned. */
	if (skb_cloned(head) && pskb_expand_head(head, 0, 0, GFP_ATOMIC))
		goto out_oom;

	/* If the first fragment is fragmented itself, we split
	 * it to two chunks: the first with data and paged part
	 * and the second, holding only fragments. */
	if (skb_shinfo(head)->frag_list) {
		struct sk_buff *clone;
		int i, plen = 0;

		if ((clone = alloc_skb(0, GFP_ATOMIC)) == NULL)
			goto out_oom;
		clone->next = head->next;
		head->next = clone;
		skb_shinfo(clone)->frag_list = skb_shinfo(head)->frag_list;
		skb_shinfo(head)->frag_list = NULL;
		for (i=0; i<skb_shinfo(head)->nr_frags; i++)
			plen += skb_shinfo(head)->frags[i].size;
		clone->len = clone->data_len = head->data_len - plen;
		head->data_len -= clone->len;
		head->len -= clone->len;
		clone->csum = 0;
		clone->ip_summed = head->ip_summed;
640
		atomic_add(clone->truesize, &ip6_frags.mem);
L
Linus Torvalds 已提交
641 642 643 644 645
	}

	/* We have to remove fragment header from datagram and to relocate
	 * header in order to calculate ICV correctly. */
	nhoff = fq->nhoffset;
646
	skb_network_header(head)[nhoff] = skb_transport_header(head)[0];
647
	memmove(head->head + sizeof(struct frag_hdr), head->head,
L
Linus Torvalds 已提交
648
		(head->data - head->head) - sizeof(struct frag_hdr));
649 650
	head->mac_header += sizeof(struct frag_hdr);
	head->network_header += sizeof(struct frag_hdr);
L
Linus Torvalds 已提交
651 652

	skb_shinfo(head)->frag_list = head->next;
653
	skb_reset_transport_header(head);
654
	skb_push(head, head->data - skb_network_header(head));
655
	atomic_sub(head->truesize, &ip6_frags.mem);
L
Linus Torvalds 已提交
656 657 658 659 660 661

	for (fp=head->next; fp; fp = fp->next) {
		head->data_len += fp->len;
		head->len += fp->len;
		if (head->ip_summed != fp->ip_summed)
			head->ip_summed = CHECKSUM_NONE;
662
		else if (head->ip_summed == CHECKSUM_COMPLETE)
L
Linus Torvalds 已提交
663 664
			head->csum = csum_add(head->csum, fp->csum);
		head->truesize += fp->truesize;
665
		atomic_sub(fp->truesize, &ip6_frags.mem);
L
Linus Torvalds 已提交
666 667 668 669
	}

	head->next = NULL;
	head->dev = dev;
670
	head->tstamp = fq->q.stamp;
671
	ipv6_hdr(head)->payload_len = htons(payload_len);
672
	IP6CB(head)->nhoff = nhoff;
L
Linus Torvalds 已提交
673 674

	/* Yes, and fold redundant checksum back. 8) */
675
	if (head->ip_summed == CHECKSUM_COMPLETE)
676
		head->csum = csum_partial(skb_network_header(head),
677
					  skb_network_header_len(head),
678
					  head->csum);
L
Linus Torvalds 已提交
679

680 681 682
	rcu_read_lock();
	IP6_INC_STATS_BH(__in6_dev_get(dev), IPSTATS_MIB_REASMOKS);
	rcu_read_unlock();
683
	fq->q.fragments = NULL;
L
Linus Torvalds 已提交
684 685 686 687 688 689 690 691 692 693
	return 1;

out_oversize:
	if (net_ratelimit())
		printk(KERN_DEBUG "ip6_frag_reasm: payload len = %d\n", payload_len);
	goto out_fail;
out_oom:
	if (net_ratelimit())
		printk(KERN_DEBUG "ip6_frag_reasm: no memory for reassembly\n");
out_fail:
694 695 696
	rcu_read_lock();
	IP6_INC_STATS_BH(__in6_dev_get(dev), IPSTATS_MIB_REASMFAILS);
	rcu_read_unlock();
L
Linus Torvalds 已提交
697 698 699
	return -1;
}

700
static int ipv6_frag_rcv(struct sk_buff **skbp)
L
Linus Torvalds 已提交
701
{
702
	struct sk_buff *skb = *skbp;
L
Linus Torvalds 已提交
703 704
	struct frag_hdr *fhdr;
	struct frag_queue *fq;
705
	struct ipv6hdr *hdr = ipv6_hdr(skb);
L
Linus Torvalds 已提交
706

707
	IP6_INC_STATS_BH(ip6_dst_idev(skb->dst), IPSTATS_MIB_REASMREQDS);
L
Linus Torvalds 已提交
708 709 710

	/* Jumbo payload inhibits frag. header */
	if (hdr->payload_len==0) {
711
		IP6_INC_STATS(ip6_dst_idev(skb->dst), IPSTATS_MIB_INHDRERRORS);
712 713
		icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
				  skb_network_header_len(skb));
L
Linus Torvalds 已提交
714 715
		return -1;
	}
716 717
	if (!pskb_may_pull(skb, (skb_transport_offset(skb) +
				 sizeof(struct frag_hdr)))) {
718
		IP6_INC_STATS(ip6_dst_idev(skb->dst), IPSTATS_MIB_INHDRERRORS);
719 720
		icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
				  skb_network_header_len(skb));
L
Linus Torvalds 已提交
721 722 723
		return -1;
	}

724
	hdr = ipv6_hdr(skb);
725
	fhdr = (struct frag_hdr *)skb_transport_header(skb);
L
Linus Torvalds 已提交
726 727 728

	if (!(fhdr->frag_off & htons(0xFFF9))) {
		/* It is not a fragmented frame */
729
		skb->transport_header += sizeof(struct frag_hdr);
730
		IP6_INC_STATS_BH(ip6_dst_idev(skb->dst), IPSTATS_MIB_REASMOKS);
L
Linus Torvalds 已提交
731

732
		IP6CB(skb)->nhoff = (u8 *)fhdr - skb_network_header(skb);
L
Linus Torvalds 已提交
733 734 735
		return 1;
	}

736
	if (atomic_read(&ip6_frags.mem) > ip6_frags_ctl.high_thresh)
737
		ip6_evictor(ip6_dst_idev(skb->dst));
L
Linus Torvalds 已提交
738

739 740
	if ((fq = fq_find(fhdr->identification, &hdr->saddr, &hdr->daddr,
			  ip6_dst_idev(skb->dst))) != NULL) {
741
		int ret;
L
Linus Torvalds 已提交
742

743
		spin_lock(&fq->q.lock);
L
Linus Torvalds 已提交
744

745
		ret = ip6_frag_queue(fq, skb, fhdr, IP6CB(skb)->nhoff);
L
Linus Torvalds 已提交
746

747
		spin_unlock(&fq->q.lock);
L
Linus Torvalds 已提交
748 749 750 751
		fq_put(fq, NULL);
		return ret;
	}

752
	IP6_INC_STATS_BH(ip6_dst_idev(skb->dst), IPSTATS_MIB_REASMFAILS);
L
Linus Torvalds 已提交
753 754 755 756 757 758 759 760 761 762 763 764 765 766 767
	kfree_skb(skb);
	return -1;
}

static struct inet6_protocol frag_protocol =
{
	.handler	=	ipv6_frag_rcv,
	.flags		=	INET6_PROTO_NOPOLICY,
};

void __init ipv6_frag_init(void)
{
	if (inet6_add_protocol(&frag_protocol, IPPROTO_FRAGMENT) < 0)
		printk(KERN_ERR "ipv6_frag_init: Could not register protocol\n");

768 769
	init_timer(&ip6_frags.secret_timer);
	ip6_frags.secret_timer.function = ip6_frag_secret_rebuild;
770
	ip6_frags.secret_timer.expires = jiffies + ip6_frags_ctl.secret_interval;
771
	add_timer(&ip6_frags.secret_timer);
L
Linus Torvalds 已提交
772

773
	ip6_frags.ctl = &ip6_frags_ctl;
774
	inet_frags_init(&ip6_frags);
L
Linus Torvalds 已提交
775
}