xref: /openbmc/linux/net/ipv4/ip_fragment.c (revision 64c70b1c) 
1 /*
2  * INET		An implementation of the TCP/IP protocol suite for the LINUX
3  *		operating system.  INET is implemented using the  BSD Socket
4  *		interface as the means of communication with the user level.
5  *
6  *		The IP fragmentation functionality.
7  *
8  * Version:	$Id: ip_fragment.c,v 1.59 2002/01/12 07:54:56 davem Exp $
9  *
10  * Authors:	Fred N. van Kempen <waltje@uWalt.NL.Mugnet.ORG>
11  *		Alan Cox <Alan.Cox@linux.org>
12  *
13  * Fixes:
14  *		Alan Cox	:	Split from ip.c , see ip_input.c for history.
15  *		David S. Miller :	Begin massive cleanup...
16  *		Andi Kleen	:	Add sysctls.
17  *		xxxx		:	Overlapfrag bug.
18  *		Ultima          :       ip_expire() kernel panic.
19  *		Bill Hawes	:	Frag accounting and evictor fixes.
20  *		John McDonald	:	0 length frag bug.
21  *		Alexey Kuznetsov:	SMP races, threading, cleanup.
22  *		Patrick McHardy :	LRU queue of frag heads for evictor.
23  */
24 
25 #include <linux/compiler.h>
26 #include <linux/module.h>
27 #include <linux/types.h>
28 #include <linux/mm.h>
29 #include <linux/jiffies.h>
30 #include <linux/skbuff.h>
31 #include <linux/list.h>
32 #include <linux/ip.h>
33 #include <linux/icmp.h>
34 #include <linux/netdevice.h>
35 #include <linux/jhash.h>
36 #include <linux/random.h>
37 #include <net/sock.h>
38 #include <net/ip.h>
39 #include <net/icmp.h>
40 #include <net/checksum.h>
41 #include <net/inetpeer.h>
42 #include <linux/tcp.h>
43 #include <linux/udp.h>
44 #include <linux/inet.h>
45 #include <linux/netfilter_ipv4.h>
46 
47 /* NOTE. Logic of IP defragmentation is parallel to corresponding IPv6
48  * code now. If you change something here, _PLEASE_ update ipv6/reassembly.c
49  * as well. Or notify me, at least. --ANK
50  */
51 
52 /* Fragment cache limits. We will commit 256K at one time. Should we
53  * cross that limit we will prune down to 192K. This should cope with
54  * even the most extreme cases without allowing an attacker to measurably
55  * harm machine performance.
56  */
57 int sysctl_ipfrag_high_thresh __read_mostly = 256*1024;
58 int sysctl_ipfrag_low_thresh __read_mostly = 192*1024;
59 
60 int sysctl_ipfrag_max_dist __read_mostly = 64;
61 
62 /* Important NOTE! Fragment queue must be destroyed before MSL expires.
63  * RFC791 is wrong proposing to prolongate timer each fragment arrival by TTL.
64  */
65 int sysctl_ipfrag_time __read_mostly = IP_FRAG_TIME;
66 
67 struct ipfrag_skb_cb
68 {
69 	struct inet_skb_parm	h;
70 	int			offset;
71 };
72 
73 #define FRAG_CB(skb)	((struct ipfrag_skb_cb*)((skb)->cb))
74 
75 /* Describe an entry in the "incomplete datagrams" queue. */
76 struct ipq {
77 	struct hlist_node list;
78 	struct list_head lru_list;	/* lru list member 			*/
79 	u32		user;
80 	__be32		saddr;
81 	__be32		daddr;
82 	__be16		id;
83 	u8		protocol;
84 	u8		last_in;
85 #define COMPLETE		4
86 #define FIRST_IN		2
87 #define LAST_IN			1
88 
89 	struct sk_buff	*fragments;	/* linked list of received fragments	*/
90 	int		len;		/* total length of original datagram	*/
91 	int		meat;
92 	spinlock_t	lock;
93 	atomic_t	refcnt;
94 	struct timer_list timer;	/* when will this queue expire?		*/
95 	ktime_t		stamp;
96 	int             iif;
97 	unsigned int    rid;
98 	struct inet_peer *peer;
99 };
100 
101 /* Hash table. */
102 
103 #define IPQ_HASHSZ	64
104 
105 /* Per-bucket lock is easy to add now. */
106 static struct hlist_head ipq_hash[IPQ_HASHSZ];
107 static DEFINE_RWLOCK(ipfrag_lock);
108 static u32 ipfrag_hash_rnd;
109 static LIST_HEAD(ipq_lru_list);
110 int ip_frag_nqueues = 0;
111 
112 static __inline__ void __ipq_unlink(struct ipq *qp)
113 {
114 	hlist_del(&qp->list);
115 	list_del(&qp->lru_list);
116 	ip_frag_nqueues--;
117 }
118 
119 static __inline__ void ipq_unlink(struct ipq *ipq)
120 {
121 	write_lock(&ipfrag_lock);
122 	__ipq_unlink(ipq);
123 	write_unlock(&ipfrag_lock);
124 }
125 
126 static unsigned int ipqhashfn(__be16 id, __be32 saddr, __be32 daddr, u8 prot)
127 {
128 	return jhash_3words((__force u32)id << 16 | prot,
129 			    (__force u32)saddr, (__force u32)daddr,
130 			    ipfrag_hash_rnd) & (IPQ_HASHSZ - 1);
131 }
132 
133 static struct timer_list ipfrag_secret_timer;
134 int sysctl_ipfrag_secret_interval __read_mostly = 10 * 60 * HZ;
135 
136 static void ipfrag_secret_rebuild(unsigned long dummy)
137 {
138 	unsigned long now = jiffies;
139 	int i;
140 
141 	write_lock(&ipfrag_lock);
142 	get_random_bytes(&ipfrag_hash_rnd, sizeof(u32));
143 	for (i = 0; i < IPQ_HASHSZ; i++) {
144 		struct ipq *q;
145 		struct hlist_node *p, *n;
146 
147 		hlist_for_each_entry_safe(q, p, n, &ipq_hash[i], list) {
148 			unsigned int hval = ipqhashfn(q->id, q->saddr,
149 						      q->daddr, q->protocol);
150 
151 			if (hval != i) {
152 				hlist_del(&q->list);
153 
154 				/* Relink to new hash chain. */
155 				hlist_add_head(&q->list, &ipq_hash[hval]);
156 			}
157 		}
158 	}
159 	write_unlock(&ipfrag_lock);
160 
161 	mod_timer(&ipfrag_secret_timer, now + sysctl_ipfrag_secret_interval);
162 }
163 
164 atomic_t ip_frag_mem = ATOMIC_INIT(0);	/* Memory used for fragments */
165 
166 /* Memory Tracking Functions. */
167 static __inline__ void frag_kfree_skb(struct sk_buff *skb, int *work)
168 {
169 	if (work)
170 		*work -= skb->truesize;
171 	atomic_sub(skb->truesize, &ip_frag_mem);
172 	kfree_skb(skb);
173 }
174 
175 static __inline__ void frag_free_queue(struct ipq *qp, int *work)
176 {
177 	if (work)
178 		*work -= sizeof(struct ipq);
179 	atomic_sub(sizeof(struct ipq), &ip_frag_mem);
180 	kfree(qp);
181 }
182 
183 static __inline__ struct ipq *frag_alloc_queue(void)
184 {
185 	struct ipq *qp = kmalloc(sizeof(struct ipq), GFP_ATOMIC);
186 
187 	if (!qp)
188 		return NULL;
189 	atomic_add(sizeof(struct ipq), &ip_frag_mem);
190 	return qp;
191 }
192 
193 
194 /* Destruction primitives. */
195 
196 /* Complete destruction of ipq. */
197 static void ip_frag_destroy(struct ipq *qp, int *work)
198 {
199 	struct sk_buff *fp;
200 
201 	BUG_TRAP(qp->last_in&COMPLETE);
202 	BUG_TRAP(del_timer(&qp->timer) == 0);
203 
204 	if (qp->peer)
205 		inet_putpeer(qp->peer);
206 
207 	/* Release all fragment data. */
208 	fp = qp->fragments;
209 	while (fp) {
210 		struct sk_buff *xp = fp->next;
211 
212 		frag_kfree_skb(fp, work);
213 		fp = xp;
214 	}
215 
216 	/* Finally, release the queue descriptor itself. */
217 	frag_free_queue(qp, work);
218 }
219 
220 static __inline__ void ipq_put(struct ipq *ipq, int *work)
221 {
222 	if (atomic_dec_and_test(&ipq->refcnt))
223 		ip_frag_destroy(ipq, work);
224 }
225 
226 /* Kill ipq entry. It is not destroyed immediately,
227  * because caller (and someone more) holds reference count.
228  */
229 static void ipq_kill(struct ipq *ipq)
230 {
231 	if (del_timer(&ipq->timer))
232 		atomic_dec(&ipq->refcnt);
233 
234 	if (!(ipq->last_in & COMPLETE)) {
235 		ipq_unlink(ipq);
236 		atomic_dec(&ipq->refcnt);
237 		ipq->last_in |= COMPLETE;
238 	}
239 }
240 
241 /* Memory limiting on fragments.  Evictor trashes the oldest
242  * fragment queue until we are back under the threshold.
243  */
244 static void ip_evictor(void)
245 {
246 	struct ipq *qp;
247 	struct list_head *tmp;
248 	int work;
249 
250 	work = atomic_read(&ip_frag_mem) - sysctl_ipfrag_low_thresh;
251 	if (work <= 0)
252 		return;
253 
254 	while (work > 0) {
255 		read_lock(&ipfrag_lock);
256 		if (list_empty(&ipq_lru_list)) {
257 			read_unlock(&ipfrag_lock);
258 			return;
259 		}
260 		tmp = ipq_lru_list.next;
261 		qp = list_entry(tmp, struct ipq, lru_list);
262 		atomic_inc(&qp->refcnt);
263 		read_unlock(&ipfrag_lock);
264 
265 		spin_lock(&qp->lock);
266 		if (!(qp->last_in&COMPLETE))
267 			ipq_kill(qp);
268 		spin_unlock(&qp->lock);
269 
270 		ipq_put(qp, &work);
271 		IP_INC_STATS_BH(IPSTATS_MIB_REASMFAILS);
272 	}
273 }
274 
275 /*
276  * Oops, a fragment queue timed out.  Kill it and send an ICMP reply.
277  */
278 static void ip_expire(unsigned long arg)
279 {
280 	struct ipq *qp = (struct ipq *) arg;
281 
282 	spin_lock(&qp->lock);
283 
284 	if (qp->last_in & COMPLETE)
285 		goto out;
286 
287 	ipq_kill(qp);
288 
289 	IP_INC_STATS_BH(IPSTATS_MIB_REASMTIMEOUT);
290 	IP_INC_STATS_BH(IPSTATS_MIB_REASMFAILS);
291 
292 	if ((qp->last_in&FIRST_IN) && qp->fragments != NULL) {
293 		struct sk_buff *head = qp->fragments;
294 		/* Send an ICMP "Fragment Reassembly Timeout" message. */
295 		if ((head->dev = dev_get_by_index(qp->iif)) != NULL) {
296 			icmp_send(head, ICMP_TIME_EXCEEDED, ICMP_EXC_FRAGTIME, 0);
297 			dev_put(head->dev);
298 		}
299 	}
300 out:
301 	spin_unlock(&qp->lock);
302 	ipq_put(qp, NULL);
303 }
304 
305 /* Creation primitives. */
306 
307 static struct ipq *ip_frag_intern(struct ipq *qp_in)
308 {
309 	struct ipq *qp;
310 #ifdef CONFIG_SMP
311 	struct hlist_node *n;
312 #endif
313 	unsigned int hash;
314 
315 	write_lock(&ipfrag_lock);
316 	hash = ipqhashfn(qp_in->id, qp_in->saddr, qp_in->daddr,
317 			 qp_in->protocol);
318 #ifdef CONFIG_SMP
319 	/* With SMP race we have to recheck hash table, because
320 	 * such entry could be created on other cpu, while we
321 	 * promoted read lock to write lock.
322 	 */
323 	hlist_for_each_entry(qp, n, &ipq_hash[hash], list) {
324 		if (qp->id == qp_in->id		&&
325 		    qp->saddr == qp_in->saddr	&&
326 		    qp->daddr == qp_in->daddr	&&
327 		    qp->protocol == qp_in->protocol &&
328 		    qp->user == qp_in->user) {
329 			atomic_inc(&qp->refcnt);
330 			write_unlock(&ipfrag_lock);
331 			qp_in->last_in |= COMPLETE;
332 			ipq_put(qp_in, NULL);
333 			return qp;
334 		}
335 	}
336 #endif
337 	qp = qp_in;
338 
339 	if (!mod_timer(&qp->timer, jiffies + sysctl_ipfrag_time))
340 		atomic_inc(&qp->refcnt);
341 
342 	atomic_inc(&qp->refcnt);
343 	hlist_add_head(&qp->list, &ipq_hash[hash]);
344 	INIT_LIST_HEAD(&qp->lru_list);
345 	list_add_tail(&qp->lru_list, &ipq_lru_list);
346 	ip_frag_nqueues++;
347 	write_unlock(&ipfrag_lock);
348 	return qp;
349 }
350 
351 /* Add an entry to the 'ipq' queue for a newly received IP datagram. */
352 static struct ipq *ip_frag_create(struct iphdr *iph, u32 user)
353 {
354 	struct ipq *qp;
355 
356 	if ((qp = frag_alloc_queue()) == NULL)
357 		goto out_nomem;
358 
359 	qp->protocol = iph->protocol;
360 	qp->last_in = 0;
361 	qp->id = iph->id;
362 	qp->saddr = iph->saddr;
363 	qp->daddr = iph->daddr;
364 	qp->user = user;
365 	qp->len = 0;
366 	qp->meat = 0;
367 	qp->fragments = NULL;
368 	qp->iif = 0;
369 	qp->peer = sysctl_ipfrag_max_dist ? inet_getpeer(iph->saddr, 1) : NULL;
370 
371 	/* Initialize a timer for this entry. */
372 	init_timer(&qp->timer);
373 	qp->timer.data = (unsigned long) qp;	/* pointer to queue	*/
374 	qp->timer.function = ip_expire;		/* expire function	*/
375 	spin_lock_init(&qp->lock);
376 	atomic_set(&qp->refcnt, 1);
377 
378 	return ip_frag_intern(qp);
379 
380 out_nomem:
381 	LIMIT_NETDEBUG(KERN_ERR "ip_frag_create: no memory left !\n");
382 	return NULL;
383 }
384 
385 /* Find the correct entry in the "incomplete datagrams" queue for
386  * this IP datagram, and create new one, if nothing is found.
387  */
388 static inline struct ipq *ip_find(struct iphdr *iph, u32 user)
389 {
390 	__be16 id = iph->id;
391 	__be32 saddr = iph->saddr;
392 	__be32 daddr = iph->daddr;
393 	__u8 protocol = iph->protocol;
394 	unsigned int hash;
395 	struct ipq *qp;
396 	struct hlist_node *n;
397 
398 	read_lock(&ipfrag_lock);
399 	hash = ipqhashfn(id, saddr, daddr, protocol);
400 	hlist_for_each_entry(qp, n, &ipq_hash[hash], list) {
401 		if (qp->id == id		&&
402 		    qp->saddr == saddr	&&
403 		    qp->daddr == daddr	&&
404 		    qp->protocol == protocol &&
405 		    qp->user == user) {
406 			atomic_inc(&qp->refcnt);
407 			read_unlock(&ipfrag_lock);
408 			return qp;
409 		}
410 	}
411 	read_unlock(&ipfrag_lock);
412 
413 	return ip_frag_create(iph, user);
414 }
415 
416 /* Is the fragment too far ahead to be part of ipq? */
417 static inline int ip_frag_too_far(struct ipq *qp)
418 {
419 	struct inet_peer *peer = qp->peer;
420 	unsigned int max = sysctl_ipfrag_max_dist;
421 	unsigned int start, end;
422 
423 	int rc;
424 
425 	if (!peer || !max)
426 		return 0;
427 
428 	start = qp->rid;
429 	end = atomic_inc_return(&peer->rid);
430 	qp->rid = end;
431 
432 	rc = qp->fragments && (end - start) > max;
433 
434 	if (rc) {
435 		IP_INC_STATS_BH(IPSTATS_MIB_REASMFAILS);
436 	}
437 
438 	return rc;
439 }
440 
441 static int ip_frag_reinit(struct ipq *qp)
442 {
443 	struct sk_buff *fp;
444 
445 	if (!mod_timer(&qp->timer, jiffies + sysctl_ipfrag_time)) {
446 		atomic_inc(&qp->refcnt);
447 		return -ETIMEDOUT;
448 	}
449 
450 	fp = qp->fragments;
451 	do {
452 		struct sk_buff *xp = fp->next;
453 		frag_kfree_skb(fp, NULL);
454 		fp = xp;
455 	} while (fp);
456 
457 	qp->last_in = 0;
458 	qp->len = 0;
459 	qp->meat = 0;
460 	qp->fragments = NULL;
461 	qp->iif = 0;
462 
463 	return 0;
464 }
465 
466 /* Add new segment to existing queue. */
467 static void ip_frag_queue(struct ipq *qp, struct sk_buff *skb)
468 {
469 	struct sk_buff *prev, *next;
470 	int flags, offset;
471 	int ihl, end;
472 
473 	if (qp->last_in & COMPLETE)
474 		goto err;
475 
476 	if (!(IPCB(skb)->flags & IPSKB_FRAG_COMPLETE) &&
477 	    unlikely(ip_frag_too_far(qp)) && unlikely(ip_frag_reinit(qp))) {
478 		ipq_kill(qp);
479 		goto err;
480 	}
481 
482 	offset = ntohs(ip_hdr(skb)->frag_off);
483 	flags = offset & ~IP_OFFSET;
484 	offset &= IP_OFFSET;
485 	offset <<= 3;		/* offset is in 8-byte chunks */
486 	ihl = ip_hdrlen(skb);
487 
488 	/* Determine the position of this fragment. */
489 	end = offset + skb->len - ihl;
490 
491 	/* Is this the final fragment? */
492 	if ((flags & IP_MF) == 0) {
493 		/* If we already have some bits beyond end
494 		 * or have different end, the segment is corrrupted.
495 		 */
496 		if (end < qp->len ||
497 		    ((qp->last_in & LAST_IN) && end != qp->len))
498 			goto err;
499 		qp->last_in |= LAST_IN;
500 		qp->len = end;
501 	} else {
502 		if (end&7) {
503 			end &= ~7;
504 			if (skb->ip_summed != CHECKSUM_UNNECESSARY)
505 				skb->ip_summed = CHECKSUM_NONE;
506 		}
507 		if (end > qp->len) {
508 			/* Some bits beyond end -> corruption. */
509 			if (qp->last_in & LAST_IN)
510 				goto err;
511 			qp->len = end;
512 		}
513 	}
514 	if (end == offset)
515 		goto err;
516 
517 	if (pskb_pull(skb, ihl) == NULL)
518 		goto err;
519 	if (pskb_trim_rcsum(skb, end-offset))
520 		goto err;
521 
522 	/* Find out which fragments are in front and at the back of us
523 	 * in the chain of fragments so far.  We must know where to put
524 	 * this fragment, right?
525 	 */
526 	prev = NULL;
527 	for (next = qp->fragments; next != NULL; next = next->next) {
528 		if (FRAG_CB(next)->offset >= offset)
529 			break;	/* bingo! */
530 		prev = next;
531 	}
532 
533 	/* We found where to put this one.  Check for overlap with
534 	 * preceding fragment, and, if needed, align things so that
535 	 * any overlaps are eliminated.
536 	 */
537 	if (prev) {
538 		int i = (FRAG_CB(prev)->offset + prev->len) - offset;
539 
540 		if (i > 0) {
541 			offset += i;
542 			if (end <= offset)
543 				goto err;
544 			if (!pskb_pull(skb, i))
545 				goto err;
546 			if (skb->ip_summed != CHECKSUM_UNNECESSARY)
547 				skb->ip_summed = CHECKSUM_NONE;
548 		}
549 	}
550 
551 	while (next && FRAG_CB(next)->offset < end) {
552 		int i = end - FRAG_CB(next)->offset; /* overlap is 'i' bytes */
553 
554 		if (i < next->len) {
555 			/* Eat head of the next overlapped fragment
556 			 * and leave the loop. The next ones cannot overlap.
557 			 */
558 			if (!pskb_pull(next, i))
559 				goto err;
560 			FRAG_CB(next)->offset += i;
561 			qp->meat -= i;
562 			if (next->ip_summed != CHECKSUM_UNNECESSARY)
563 				next->ip_summed = CHECKSUM_NONE;
564 			break;
565 		} else {
566 			struct sk_buff *free_it = next;
567 
568 			/* Old fragment is completely overridden with
569 			 * new one drop it.
570 			 */
571 			next = next->next;
572 
573 			if (prev)
574 				prev->next = next;
575 			else
576 				qp->fragments = next;
577 
578 			qp->meat -= free_it->len;
579 			frag_kfree_skb(free_it, NULL);
580 		}
581 	}
582 
583 	FRAG_CB(skb)->offset = offset;
584 
585 	/* Insert this fragment in the chain of fragments. */
586 	skb->next = next;
587 	if (prev)
588 		prev->next = skb;
589 	else
590 		qp->fragments = skb;
591 
592 	if (skb->dev)
593 		qp->iif = skb->dev->ifindex;
594 	skb->dev = NULL;
595 	qp->stamp = skb->tstamp;
596 	qp->meat += skb->len;
597 	atomic_add(skb->truesize, &ip_frag_mem);
598 	if (offset == 0)
599 		qp->last_in |= FIRST_IN;
600 
601 	write_lock(&ipfrag_lock);
602 	list_move_tail(&qp->lru_list, &ipq_lru_list);
603 	write_unlock(&ipfrag_lock);
604 
605 	return;
606 
607 err:
608 	kfree_skb(skb);
609 }
610 
611 
612 /* Build a new IP datagram from all its fragments. */
613 
614 static struct sk_buff *ip_frag_reasm(struct ipq *qp, struct net_device *dev)
615 {
616 	struct iphdr *iph;
617 	struct sk_buff *fp, *head = qp->fragments;
618 	int len;
619 	int ihlen;
620 
621 	ipq_kill(qp);
622 
623 	BUG_TRAP(head != NULL);
624 	BUG_TRAP(FRAG_CB(head)->offset == 0);
625 
626 	/* Allocate a new buffer for the datagram. */
627 	ihlen = ip_hdrlen(head);
628 	len = ihlen + qp->len;
629 
630 	if (len > 65535)
631 		goto out_oversize;
632 
633 	/* Head of list must not be cloned. */
634 	if (skb_cloned(head) && pskb_expand_head(head, 0, 0, GFP_ATOMIC))
635 		goto out_nomem;
636 
637 	/* If the first fragment is fragmented itself, we split
638 	 * it to two chunks: the first with data and paged part
639 	 * and the second, holding only fragments. */
640 	if (skb_shinfo(head)->frag_list) {
641 		struct sk_buff *clone;
642 		int i, plen = 0;
643 
644 		if ((clone = alloc_skb(0, GFP_ATOMIC)) == NULL)
645 			goto out_nomem;
646 		clone->next = head->next;
647 		head->next = clone;
648 		skb_shinfo(clone)->frag_list = skb_shinfo(head)->frag_list;
649 		skb_shinfo(head)->frag_list = NULL;
650 		for (i=0; i<skb_shinfo(head)->nr_frags; i++)
651 			plen += skb_shinfo(head)->frags[i].size;
652 		clone->len = clone->data_len = head->data_len - plen;
653 		head->data_len -= clone->len;
654 		head->len -= clone->len;
655 		clone->csum = 0;
656 		clone->ip_summed = head->ip_summed;
657 		atomic_add(clone->truesize, &ip_frag_mem);
658 	}
659 
660 	skb_shinfo(head)->frag_list = head->next;
661 	skb_push(head, head->data - skb_network_header(head));
662 	atomic_sub(head->truesize, &ip_frag_mem);
663 
664 	for (fp=head->next; fp; fp = fp->next) {
665 		head->data_len += fp->len;
666 		head->len += fp->len;
667 		if (head->ip_summed != fp->ip_summed)
668 			head->ip_summed = CHECKSUM_NONE;
669 		else if (head->ip_summed == CHECKSUM_COMPLETE)
670 			head->csum = csum_add(head->csum, fp->csum);
671 		head->truesize += fp->truesize;
672 		atomic_sub(fp->truesize, &ip_frag_mem);
673 	}
674 
675 	head->next = NULL;
676 	head->dev = dev;
677 	head->tstamp = qp->stamp;
678 
679 	iph = ip_hdr(head);
680 	iph->frag_off = 0;
681 	iph->tot_len = htons(len);
682 	IP_INC_STATS_BH(IPSTATS_MIB_REASMOKS);
683 	qp->fragments = NULL;
684 	return head;
685 
686 out_nomem:
687 	LIMIT_NETDEBUG(KERN_ERR "IP: queue_glue: no memory for gluing "
688 			      "queue %p\n", qp);
689 	goto out_fail;
690 out_oversize:
691 	if (net_ratelimit())
692 		printk(KERN_INFO
693 			"Oversized IP packet from %d.%d.%d.%d.\n",
694 			NIPQUAD(qp->saddr));
695 out_fail:
696 	IP_INC_STATS_BH(IPSTATS_MIB_REASMFAILS);
697 	return NULL;
698 }
699 
700 /* Process an incoming IP datagram fragment. */
701 struct sk_buff *ip_defrag(struct sk_buff *skb, u32 user)
702 {
703 	struct ipq *qp;
704 	struct net_device *dev;
705 
706 	IP_INC_STATS_BH(IPSTATS_MIB_REASMREQDS);
707 
708 	/* Start by cleaning up the memory. */
709 	if (atomic_read(&ip_frag_mem) > sysctl_ipfrag_high_thresh)
710 		ip_evictor();
711 
712 	dev = skb->dev;
713 
714 	/* Lookup (or create) queue header */
715 	if ((qp = ip_find(ip_hdr(skb), user)) != NULL) {
716 		struct sk_buff *ret = NULL;
717 
718 		spin_lock(&qp->lock);
719 
720 		ip_frag_queue(qp, skb);
721 
722 		if (qp->last_in == (FIRST_IN|LAST_IN) &&
723 		    qp->meat == qp->len)
724 			ret = ip_frag_reasm(qp, dev);
725 
726 		spin_unlock(&qp->lock);
727 		ipq_put(qp, NULL);
728 		return ret;
729 	}
730 
731 	IP_INC_STATS_BH(IPSTATS_MIB_REASMFAILS);
732 	kfree_skb(skb);
733 	return NULL;
734 }
735 
736 void __init ipfrag_init(void)
737 {
738 	ipfrag_hash_rnd = (u32) ((num_physpages ^ (num_physpages>>7)) ^
739 				 (jiffies ^ (jiffies >> 6)));
740 
741 	init_timer(&ipfrag_secret_timer);
742 	ipfrag_secret_timer.function = ipfrag_secret_rebuild;
743 	ipfrag_secret_timer.expires = jiffies + sysctl_ipfrag_secret_interval;
744 	add_timer(&ipfrag_secret_timer);
745 }
746 
747 EXPORT_SYMBOL(ip_defrag);
748