xref: /openbmc/linux/net/ipv4/ip_fragment.c (revision da2ef666)
1 // SPDX-License-Identifier: GPL-2.0
2 /*
3  * INET		An implementation of the TCP/IP protocol suite for the LINUX
4  *		operating system.  INET is implemented using the  BSD Socket
5  *		interface as the means of communication with the user level.
6  *
7  *		The IP fragmentation functionality.
8  *
9  * Authors:	Fred N. van Kempen <waltje@uWalt.NL.Mugnet.ORG>
10  *		Alan Cox <alan@lxorguk.ukuu.org.uk>
11  *
12  * Fixes:
13  *		Alan Cox	:	Split from ip.c , see ip_input.c for history.
14  *		David S. Miller :	Begin massive cleanup...
15  *		Andi Kleen	:	Add sysctls.
16  *		xxxx		:	Overlapfrag bug.
17  *		Ultima          :       ip_expire() kernel panic.
18  *		Bill Hawes	:	Frag accounting and evictor fixes.
19  *		John McDonald	:	0 length frag bug.
20  *		Alexey Kuznetsov:	SMP races, threading, cleanup.
21  *		Patrick McHardy :	LRU queue of frag heads for evictor.
22  */
23 
24 #define pr_fmt(fmt) "IPv4: " fmt
25 
26 #include <linux/compiler.h>
27 #include <linux/module.h>
28 #include <linux/types.h>
29 #include <linux/mm.h>
30 #include <linux/jiffies.h>
31 #include <linux/skbuff.h>
32 #include <linux/list.h>
33 #include <linux/ip.h>
34 #include <linux/icmp.h>
35 #include <linux/netdevice.h>
36 #include <linux/jhash.h>
37 #include <linux/random.h>
38 #include <linux/slab.h>
39 #include <net/route.h>
40 #include <net/dst.h>
41 #include <net/sock.h>
42 #include <net/ip.h>
43 #include <net/icmp.h>
44 #include <net/checksum.h>
45 #include <net/inetpeer.h>
46 #include <net/inet_frag.h>
47 #include <linux/tcp.h>
48 #include <linux/udp.h>
49 #include <linux/inet.h>
50 #include <linux/netfilter_ipv4.h>
51 #include <net/inet_ecn.h>
52 #include <net/l3mdev.h>
53 
54 /* NOTE. Logic of IP defragmentation is parallel to corresponding IPv6
55  * code now. If you change something here, _PLEASE_ update ipv6/reassembly.c
56  * as well. Or notify me, at least. --ANK
57  */
58 static const char ip_frag_cache_name[] = "ip4-frags";
59 
60 /* Use skb->cb to track consecutive/adjacent fragments coming at
61  * the end of the queue. Nodes in the rb-tree queue will
62  * contain "runs" of one or more adjacent fragments.
63  *
64  * Invariants:
65  * - next_frag is NULL at the tail of a "run";
66  * - the head of a "run" has the sum of all fragment lengths in frag_run_len.
67  */
68 struct ipfrag_skb_cb {
69 	struct inet_skb_parm	h;
70 	struct sk_buff		*next_frag;
71 	int			frag_run_len;
72 };
73 
74 #define FRAG_CB(skb)		((struct ipfrag_skb_cb *)((skb)->cb))
75 
76 static void ip4_frag_init_run(struct sk_buff *skb)
77 {
78 	BUILD_BUG_ON(sizeof(struct ipfrag_skb_cb) > sizeof(skb->cb));
79 
80 	FRAG_CB(skb)->next_frag = NULL;
81 	FRAG_CB(skb)->frag_run_len = skb->len;
82 }
83 
84 /* Append skb to the last "run". */
85 static void ip4_frag_append_to_last_run(struct inet_frag_queue *q,
86 					struct sk_buff *skb)
87 {
88 	RB_CLEAR_NODE(&skb->rbnode);
89 	FRAG_CB(skb)->next_frag = NULL;
90 
91 	FRAG_CB(q->last_run_head)->frag_run_len += skb->len;
92 	FRAG_CB(q->fragments_tail)->next_frag = skb;
93 	q->fragments_tail = skb;
94 }
95 
96 /* Create a new "run" with the skb. */
97 static void ip4_frag_create_run(struct inet_frag_queue *q, struct sk_buff *skb)
98 {
99 	if (q->last_run_head)
100 		rb_link_node(&skb->rbnode, &q->last_run_head->rbnode,
101 			     &q->last_run_head->rbnode.rb_right);
102 	else
103 		rb_link_node(&skb->rbnode, NULL, &q->rb_fragments.rb_node);
104 	rb_insert_color(&skb->rbnode, &q->rb_fragments);
105 
106 	ip4_frag_init_run(skb);
107 	q->fragments_tail = skb;
108 	q->last_run_head = skb;
109 }
110 
111 /* Describe an entry in the "incomplete datagrams" queue. */
112 struct ipq {
113 	struct inet_frag_queue q;
114 
115 	u8		ecn; /* RFC3168 support */
116 	u16		max_df_size; /* largest frag with DF set seen */
117 	int             iif;
118 	unsigned int    rid;
119 	struct inet_peer *peer;
120 };
121 
122 static u8 ip4_frag_ecn(u8 tos)
123 {
124 	return 1 << (tos & INET_ECN_MASK);
125 }
126 
127 static struct inet_frags ip4_frags;
128 
129 static int ip_frag_reasm(struct ipq *qp, struct sk_buff *skb,
130 			 struct sk_buff *prev_tail, struct net_device *dev);
131 
132 
133 static void ip4_frag_init(struct inet_frag_queue *q, const void *a)
134 {
135 	struct ipq *qp = container_of(q, struct ipq, q);
136 	struct netns_ipv4 *ipv4 = container_of(q->net, struct netns_ipv4,
137 					       frags);
138 	struct net *net = container_of(ipv4, struct net, ipv4);
139 
140 	const struct frag_v4_compare_key *key = a;
141 
142 	q->key.v4 = *key;
143 	qp->ecn = 0;
144 	qp->peer = q->net->max_dist ?
145 		inet_getpeer_v4(net->ipv4.peers, key->saddr, key->vif, 1) :
146 		NULL;
147 }
148 
149 static void ip4_frag_free(struct inet_frag_queue *q)
150 {
151 	struct ipq *qp;
152 
153 	qp = container_of(q, struct ipq, q);
154 	if (qp->peer)
155 		inet_putpeer(qp->peer);
156 }
157 
158 
159 /* Destruction primitives. */
160 
161 static void ipq_put(struct ipq *ipq)
162 {
163 	inet_frag_put(&ipq->q);
164 }
165 
166 /* Kill ipq entry. It is not destroyed immediately,
167  * because caller (and someone more) holds reference count.
168  */
169 static void ipq_kill(struct ipq *ipq)
170 {
171 	inet_frag_kill(&ipq->q);
172 }
173 
174 static bool frag_expire_skip_icmp(u32 user)
175 {
176 	return user == IP_DEFRAG_AF_PACKET ||
177 	       ip_defrag_user_in_between(user, IP_DEFRAG_CONNTRACK_IN,
178 					 __IP_DEFRAG_CONNTRACK_IN_END) ||
179 	       ip_defrag_user_in_between(user, IP_DEFRAG_CONNTRACK_BRIDGE_IN,
180 					 __IP_DEFRAG_CONNTRACK_BRIDGE_IN);
181 }
182 
183 /*
184  * Oops, a fragment queue timed out.  Kill it and send an ICMP reply.
185  */
186 static void ip_expire(struct timer_list *t)
187 {
188 	struct inet_frag_queue *frag = from_timer(frag, t, timer);
189 	const struct iphdr *iph;
190 	struct sk_buff *head = NULL;
191 	struct net *net;
192 	struct ipq *qp;
193 	int err;
194 
195 	qp = container_of(frag, struct ipq, q);
196 	net = container_of(qp->q.net, struct net, ipv4.frags);
197 
198 	rcu_read_lock();
199 	spin_lock(&qp->q.lock);
200 
201 	if (qp->q.flags & INET_FRAG_COMPLETE)
202 		goto out;
203 
204 	ipq_kill(qp);
205 	__IP_INC_STATS(net, IPSTATS_MIB_REASMFAILS);
206 	__IP_INC_STATS(net, IPSTATS_MIB_REASMTIMEOUT);
207 
208 	if (!(qp->q.flags & INET_FRAG_FIRST_IN))
209 		goto out;
210 
211 	/* sk_buff::dev and sk_buff::rbnode are unionized. So we
212 	 * pull the head out of the tree in order to be able to
213 	 * deal with head->dev.
214 	 */
215 	if (qp->q.fragments) {
216 		head = qp->q.fragments;
217 		qp->q.fragments = head->next;
218 	} else {
219 		head = skb_rb_first(&qp->q.rb_fragments);
220 		if (!head)
221 			goto out;
222 		if (FRAG_CB(head)->next_frag)
223 			rb_replace_node(&head->rbnode,
224 					&FRAG_CB(head)->next_frag->rbnode,
225 					&qp->q.rb_fragments);
226 		else
227 			rb_erase(&head->rbnode, &qp->q.rb_fragments);
228 		memset(&head->rbnode, 0, sizeof(head->rbnode));
229 		barrier();
230 	}
231 	if (head == qp->q.fragments_tail)
232 		qp->q.fragments_tail = NULL;
233 
234 	sub_frag_mem_limit(qp->q.net, head->truesize);
235 
236 	head->dev = dev_get_by_index_rcu(net, qp->iif);
237 	if (!head->dev)
238 		goto out;
239 
240 
241 	/* skb has no dst, perform route lookup again */
242 	iph = ip_hdr(head);
243 	err = ip_route_input_noref(head, iph->daddr, iph->saddr,
244 					   iph->tos, head->dev);
245 	if (err)
246 		goto out;
247 
248 	/* Only an end host needs to send an ICMP
249 	 * "Fragment Reassembly Timeout" message, per RFC792.
250 	 */
251 	if (frag_expire_skip_icmp(qp->q.key.v4.user) &&
252 	    (skb_rtable(head)->rt_type != RTN_LOCAL))
253 		goto out;
254 
255 	spin_unlock(&qp->q.lock);
256 	icmp_send(head, ICMP_TIME_EXCEEDED, ICMP_EXC_FRAGTIME, 0);
257 	goto out_rcu_unlock;
258 
259 out:
260 	spin_unlock(&qp->q.lock);
261 out_rcu_unlock:
262 	rcu_read_unlock();
263 	if (head)
264 		kfree_skb(head);
265 	ipq_put(qp);
266 }
267 
268 /* Find the correct entry in the "incomplete datagrams" queue for
269  * this IP datagram, and create new one, if nothing is found.
270  */
271 static struct ipq *ip_find(struct net *net, struct iphdr *iph,
272 			   u32 user, int vif)
273 {
274 	struct frag_v4_compare_key key = {
275 		.saddr = iph->saddr,
276 		.daddr = iph->daddr,
277 		.user = user,
278 		.vif = vif,
279 		.id = iph->id,
280 		.protocol = iph->protocol,
281 	};
282 	struct inet_frag_queue *q;
283 
284 	q = inet_frag_find(&net->ipv4.frags, &key);
285 	if (!q)
286 		return NULL;
287 
288 	return container_of(q, struct ipq, q);
289 }
290 
291 /* Is the fragment too far ahead to be part of ipq? */
292 static int ip_frag_too_far(struct ipq *qp)
293 {
294 	struct inet_peer *peer = qp->peer;
295 	unsigned int max = qp->q.net->max_dist;
296 	unsigned int start, end;
297 
298 	int rc;
299 
300 	if (!peer || !max)
301 		return 0;
302 
303 	start = qp->rid;
304 	end = atomic_inc_return(&peer->rid);
305 	qp->rid = end;
306 
307 	rc = qp->q.fragments_tail && (end - start) > max;
308 
309 	if (rc) {
310 		struct net *net;
311 
312 		net = container_of(qp->q.net, struct net, ipv4.frags);
313 		__IP_INC_STATS(net, IPSTATS_MIB_REASMFAILS);
314 	}
315 
316 	return rc;
317 }
318 
319 static int ip_frag_reinit(struct ipq *qp)
320 {
321 	unsigned int sum_truesize = 0;
322 
323 	if (!mod_timer(&qp->q.timer, jiffies + qp->q.net->timeout)) {
324 		refcount_inc(&qp->q.refcnt);
325 		return -ETIMEDOUT;
326 	}
327 
328 	sum_truesize = inet_frag_rbtree_purge(&qp->q.rb_fragments);
329 	sub_frag_mem_limit(qp->q.net, sum_truesize);
330 
331 	qp->q.flags = 0;
332 	qp->q.len = 0;
333 	qp->q.meat = 0;
334 	qp->q.fragments = NULL;
335 	qp->q.rb_fragments = RB_ROOT;
336 	qp->q.fragments_tail = NULL;
337 	qp->q.last_run_head = NULL;
338 	qp->iif = 0;
339 	qp->ecn = 0;
340 
341 	return 0;
342 }
343 
344 /* Add new segment to existing queue. */
345 static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb)
346 {
347 	struct net *net = container_of(qp->q.net, struct net, ipv4.frags);
348 	struct rb_node **rbn, *parent;
349 	struct sk_buff *skb1, *prev_tail;
350 	struct net_device *dev;
351 	unsigned int fragsize;
352 	int flags, offset;
353 	int ihl, end;
354 	int err = -ENOENT;
355 	u8 ecn;
356 
357 	if (qp->q.flags & INET_FRAG_COMPLETE)
358 		goto err;
359 
360 	if (!(IPCB(skb)->flags & IPSKB_FRAG_COMPLETE) &&
361 	    unlikely(ip_frag_too_far(qp)) &&
362 	    unlikely(err = ip_frag_reinit(qp))) {
363 		ipq_kill(qp);
364 		goto err;
365 	}
366 
367 	ecn = ip4_frag_ecn(ip_hdr(skb)->tos);
368 	offset = ntohs(ip_hdr(skb)->frag_off);
369 	flags = offset & ~IP_OFFSET;
370 	offset &= IP_OFFSET;
371 	offset <<= 3;		/* offset is in 8-byte chunks */
372 	ihl = ip_hdrlen(skb);
373 
374 	/* Determine the position of this fragment. */
375 	end = offset + skb->len - skb_network_offset(skb) - ihl;
376 	err = -EINVAL;
377 
378 	/* Is this the final fragment? */
379 	if ((flags & IP_MF) == 0) {
380 		/* If we already have some bits beyond end
381 		 * or have different end, the segment is corrupted.
382 		 */
383 		if (end < qp->q.len ||
384 		    ((qp->q.flags & INET_FRAG_LAST_IN) && end != qp->q.len))
385 			goto err;
386 		qp->q.flags |= INET_FRAG_LAST_IN;
387 		qp->q.len = end;
388 	} else {
389 		if (end&7) {
390 			end &= ~7;
391 			if (skb->ip_summed != CHECKSUM_UNNECESSARY)
392 				skb->ip_summed = CHECKSUM_NONE;
393 		}
394 		if (end > qp->q.len) {
395 			/* Some bits beyond end -> corruption. */
396 			if (qp->q.flags & INET_FRAG_LAST_IN)
397 				goto err;
398 			qp->q.len = end;
399 		}
400 	}
401 	if (end == offset)
402 		goto err;
403 
404 	err = -ENOMEM;
405 	if (!pskb_pull(skb, skb_network_offset(skb) + ihl))
406 		goto err;
407 
408 	err = pskb_trim_rcsum(skb, end - offset);
409 	if (err)
410 		goto err;
411 
412 	/* Note : skb->rbnode and skb->dev share the same location. */
413 	dev = skb->dev;
414 	/* Makes sure compiler wont do silly aliasing games */
415 	barrier();
416 
417 	/* RFC5722, Section 4, amended by Errata ID : 3089
418 	 *                          When reassembling an IPv6 datagram, if
419 	 *   one or more its constituent fragments is determined to be an
420 	 *   overlapping fragment, the entire datagram (and any constituent
421 	 *   fragments) MUST be silently discarded.
422 	 *
423 	 * We do the same here for IPv4 (and increment an snmp counter).
424 	 */
425 
426 	/* Find out where to put this fragment.  */
427 	prev_tail = qp->q.fragments_tail;
428 	if (!prev_tail)
429 		ip4_frag_create_run(&qp->q, skb);  /* First fragment. */
430 	else if (prev_tail->ip_defrag_offset + prev_tail->len < end) {
431 		/* This is the common case: skb goes to the end. */
432 		/* Detect and discard overlaps. */
433 		if (offset < prev_tail->ip_defrag_offset + prev_tail->len)
434 			goto discard_qp;
435 		if (offset == prev_tail->ip_defrag_offset + prev_tail->len)
436 			ip4_frag_append_to_last_run(&qp->q, skb);
437 		else
438 			ip4_frag_create_run(&qp->q, skb);
439 	} else {
440 		/* Binary search. Note that skb can become the first fragment,
441 		 * but not the last (covered above).
442 		 */
443 		rbn = &qp->q.rb_fragments.rb_node;
444 		do {
445 			parent = *rbn;
446 			skb1 = rb_to_skb(parent);
447 			if (end <= skb1->ip_defrag_offset)
448 				rbn = &parent->rb_left;
449 			else if (offset >= skb1->ip_defrag_offset +
450 						FRAG_CB(skb1)->frag_run_len)
451 				rbn = &parent->rb_right;
452 			else /* Found an overlap with skb1. */
453 				goto discard_qp;
454 		} while (*rbn);
455 		/* Here we have parent properly set, and rbn pointing to
456 		 * one of its NULL left/right children. Insert skb.
457 		 */
458 		ip4_frag_init_run(skb);
459 		rb_link_node(&skb->rbnode, parent, rbn);
460 		rb_insert_color(&skb->rbnode, &qp->q.rb_fragments);
461 	}
462 
463 	if (dev)
464 		qp->iif = dev->ifindex;
465 	skb->ip_defrag_offset = offset;
466 
467 	qp->q.stamp = skb->tstamp;
468 	qp->q.meat += skb->len;
469 	qp->ecn |= ecn;
470 	add_frag_mem_limit(qp->q.net, skb->truesize);
471 	if (offset == 0)
472 		qp->q.flags |= INET_FRAG_FIRST_IN;
473 
474 	fragsize = skb->len + ihl;
475 
476 	if (fragsize > qp->q.max_size)
477 		qp->q.max_size = fragsize;
478 
479 	if (ip_hdr(skb)->frag_off & htons(IP_DF) &&
480 	    fragsize > qp->max_df_size)
481 		qp->max_df_size = fragsize;
482 
483 	if (qp->q.flags == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) &&
484 	    qp->q.meat == qp->q.len) {
485 		unsigned long orefdst = skb->_skb_refdst;
486 
487 		skb->_skb_refdst = 0UL;
488 		err = ip_frag_reasm(qp, skb, prev_tail, dev);
489 		skb->_skb_refdst = orefdst;
490 		return err;
491 	}
492 
493 	skb_dst_drop(skb);
494 	return -EINPROGRESS;
495 
496 discard_qp:
497 	inet_frag_kill(&qp->q);
498 	err = -EINVAL;
499 	__IP_INC_STATS(net, IPSTATS_MIB_REASM_OVERLAPS);
500 err:
501 	kfree_skb(skb);
502 	return err;
503 }
504 
505 /* Build a new IP datagram from all its fragments. */
506 static int ip_frag_reasm(struct ipq *qp, struct sk_buff *skb,
507 			 struct sk_buff *prev_tail, struct net_device *dev)
508 {
509 	struct net *net = container_of(qp->q.net, struct net, ipv4.frags);
510 	struct iphdr *iph;
511 	struct sk_buff *fp, *head = skb_rb_first(&qp->q.rb_fragments);
512 	struct sk_buff **nextp; /* To build frag_list. */
513 	struct rb_node *rbn;
514 	int len;
515 	int ihlen;
516 	int err;
517 	u8 ecn;
518 
519 	ipq_kill(qp);
520 
521 	ecn = ip_frag_ecn_table[qp->ecn];
522 	if (unlikely(ecn == 0xff)) {
523 		err = -EINVAL;
524 		goto out_fail;
525 	}
526 	/* Make the one we just received the head. */
527 	if (head != skb) {
528 		fp = skb_clone(skb, GFP_ATOMIC);
529 		if (!fp)
530 			goto out_nomem;
531 		FRAG_CB(fp)->next_frag = FRAG_CB(skb)->next_frag;
532 		if (RB_EMPTY_NODE(&skb->rbnode))
533 			FRAG_CB(prev_tail)->next_frag = fp;
534 		else
535 			rb_replace_node(&skb->rbnode, &fp->rbnode,
536 					&qp->q.rb_fragments);
537 		if (qp->q.fragments_tail == skb)
538 			qp->q.fragments_tail = fp;
539 		skb_morph(skb, head);
540 		FRAG_CB(skb)->next_frag = FRAG_CB(head)->next_frag;
541 		rb_replace_node(&head->rbnode, &skb->rbnode,
542 				&qp->q.rb_fragments);
543 		consume_skb(head);
544 		head = skb;
545 	}
546 
547 	WARN_ON(head->ip_defrag_offset != 0);
548 
549 	/* Allocate a new buffer for the datagram. */
550 	ihlen = ip_hdrlen(head);
551 	len = ihlen + qp->q.len;
552 
553 	err = -E2BIG;
554 	if (len > 65535)
555 		goto out_oversize;
556 
557 	/* Head of list must not be cloned. */
558 	if (skb_unclone(head, GFP_ATOMIC))
559 		goto out_nomem;
560 
561 	/* If the first fragment is fragmented itself, we split
562 	 * it to two chunks: the first with data and paged part
563 	 * and the second, holding only fragments. */
564 	if (skb_has_frag_list(head)) {
565 		struct sk_buff *clone;
566 		int i, plen = 0;
567 
568 		clone = alloc_skb(0, GFP_ATOMIC);
569 		if (!clone)
570 			goto out_nomem;
571 		skb_shinfo(clone)->frag_list = skb_shinfo(head)->frag_list;
572 		skb_frag_list_init(head);
573 		for (i = 0; i < skb_shinfo(head)->nr_frags; i++)
574 			plen += skb_frag_size(&skb_shinfo(head)->frags[i]);
575 		clone->len = clone->data_len = head->data_len - plen;
576 		head->truesize += clone->truesize;
577 		clone->csum = 0;
578 		clone->ip_summed = head->ip_summed;
579 		add_frag_mem_limit(qp->q.net, clone->truesize);
580 		skb_shinfo(head)->frag_list = clone;
581 		nextp = &clone->next;
582 	} else {
583 		nextp = &skb_shinfo(head)->frag_list;
584 	}
585 
586 	skb_push(head, head->data - skb_network_header(head));
587 
588 	/* Traverse the tree in order, to build frag_list. */
589 	fp = FRAG_CB(head)->next_frag;
590 	rbn = rb_next(&head->rbnode);
591 	rb_erase(&head->rbnode, &qp->q.rb_fragments);
592 	while (rbn || fp) {
593 		/* fp points to the next sk_buff in the current run;
594 		 * rbn points to the next run.
595 		 */
596 		/* Go through the current run. */
597 		while (fp) {
598 			*nextp = fp;
599 			nextp = &fp->next;
600 			fp->prev = NULL;
601 			memset(&fp->rbnode, 0, sizeof(fp->rbnode));
602 			head->data_len += fp->len;
603 			head->len += fp->len;
604 			if (head->ip_summed != fp->ip_summed)
605 				head->ip_summed = CHECKSUM_NONE;
606 			else if (head->ip_summed == CHECKSUM_COMPLETE)
607 				head->csum = csum_add(head->csum, fp->csum);
608 			head->truesize += fp->truesize;
609 			fp = FRAG_CB(fp)->next_frag;
610 		}
611 		/* Move to the next run. */
612 		if (rbn) {
613 			struct rb_node *rbnext = rb_next(rbn);
614 
615 			fp = rb_to_skb(rbn);
616 			rb_erase(rbn, &qp->q.rb_fragments);
617 			rbn = rbnext;
618 		}
619 	}
620 	sub_frag_mem_limit(qp->q.net, head->truesize);
621 
622 	*nextp = NULL;
623 	head->next = NULL;
624 	head->prev = NULL;
625 	head->dev = dev;
626 	head->tstamp = qp->q.stamp;
627 	IPCB(head)->frag_max_size = max(qp->max_df_size, qp->q.max_size);
628 
629 	iph = ip_hdr(head);
630 	iph->tot_len = htons(len);
631 	iph->tos |= ecn;
632 
633 	/* When we set IP_DF on a refragmented skb we must also force a
634 	 * call to ip_fragment to avoid forwarding a DF-skb of size s while
635 	 * original sender only sent fragments of size f (where f < s).
636 	 *
637 	 * We only set DF/IPSKB_FRAG_PMTU if such DF fragment was the largest
638 	 * frag seen to avoid sending tiny DF-fragments in case skb was built
639 	 * from one very small df-fragment and one large non-df frag.
640 	 */
641 	if (qp->max_df_size == qp->q.max_size) {
642 		IPCB(head)->flags |= IPSKB_FRAG_PMTU;
643 		iph->frag_off = htons(IP_DF);
644 	} else {
645 		iph->frag_off = 0;
646 	}
647 
648 	ip_send_check(iph);
649 
650 	__IP_INC_STATS(net, IPSTATS_MIB_REASMOKS);
651 	qp->q.fragments = NULL;
652 	qp->q.rb_fragments = RB_ROOT;
653 	qp->q.fragments_tail = NULL;
654 	qp->q.last_run_head = NULL;
655 	return 0;
656 
657 out_nomem:
658 	net_dbg_ratelimited("queue_glue: no memory for gluing queue %p\n", qp);
659 	err = -ENOMEM;
660 	goto out_fail;
661 out_oversize:
662 	net_info_ratelimited("Oversized IP packet from %pI4\n", &qp->q.key.v4.saddr);
663 out_fail:
664 	__IP_INC_STATS(net, IPSTATS_MIB_REASMFAILS);
665 	return err;
666 }
667 
668 /* Process an incoming IP datagram fragment. */
669 int ip_defrag(struct net *net, struct sk_buff *skb, u32 user)
670 {
671 	struct net_device *dev = skb->dev ? : skb_dst(skb)->dev;
672 	int vif = l3mdev_master_ifindex_rcu(dev);
673 	struct ipq *qp;
674 
675 	__IP_INC_STATS(net, IPSTATS_MIB_REASMREQDS);
676 	skb_orphan(skb);
677 
678 	/* Lookup (or create) queue header */
679 	qp = ip_find(net, ip_hdr(skb), user, vif);
680 	if (qp) {
681 		int ret;
682 
683 		spin_lock(&qp->q.lock);
684 
685 		ret = ip_frag_queue(qp, skb);
686 
687 		spin_unlock(&qp->q.lock);
688 		ipq_put(qp);
689 		return ret;
690 	}
691 
692 	__IP_INC_STATS(net, IPSTATS_MIB_REASMFAILS);
693 	kfree_skb(skb);
694 	return -ENOMEM;
695 }
696 EXPORT_SYMBOL(ip_defrag);
697 
698 struct sk_buff *ip_check_defrag(struct net *net, struct sk_buff *skb, u32 user)
699 {
700 	struct iphdr iph;
701 	int netoff;
702 	u32 len;
703 
704 	if (skb->protocol != htons(ETH_P_IP))
705 		return skb;
706 
707 	netoff = skb_network_offset(skb);
708 
709 	if (skb_copy_bits(skb, netoff, &iph, sizeof(iph)) < 0)
710 		return skb;
711 
712 	if (iph.ihl < 5 || iph.version != 4)
713 		return skb;
714 
715 	len = ntohs(iph.tot_len);
716 	if (skb->len < netoff + len || len < (iph.ihl * 4))
717 		return skb;
718 
719 	if (ip_is_fragment(&iph)) {
720 		skb = skb_share_check(skb, GFP_ATOMIC);
721 		if (skb) {
722 			if (!pskb_may_pull(skb, netoff + iph.ihl * 4))
723 				return skb;
724 			if (pskb_trim_rcsum(skb, netoff + len))
725 				return skb;
726 			memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
727 			if (ip_defrag(net, skb, user))
728 				return NULL;
729 			skb_clear_hash(skb);
730 		}
731 	}
732 	return skb;
733 }
734 EXPORT_SYMBOL(ip_check_defrag);
735 
736 unsigned int inet_frag_rbtree_purge(struct rb_root *root)
737 {
738 	struct rb_node *p = rb_first(root);
739 	unsigned int sum = 0;
740 
741 	while (p) {
742 		struct sk_buff *skb = rb_entry(p, struct sk_buff, rbnode);
743 
744 		p = rb_next(p);
745 		rb_erase(&skb->rbnode, root);
746 		while (skb) {
747 			struct sk_buff *next = FRAG_CB(skb)->next_frag;
748 
749 			sum += skb->truesize;
750 			kfree_skb(skb);
751 			skb = next;
752 		}
753 	}
754 	return sum;
755 }
756 EXPORT_SYMBOL(inet_frag_rbtree_purge);
757 
758 #ifdef CONFIG_SYSCTL
759 static int dist_min;
760 
761 static struct ctl_table ip4_frags_ns_ctl_table[] = {
762 	{
763 		.procname	= "ipfrag_high_thresh",
764 		.data		= &init_net.ipv4.frags.high_thresh,
765 		.maxlen		= sizeof(unsigned long),
766 		.mode		= 0644,
767 		.proc_handler	= proc_doulongvec_minmax,
768 		.extra1		= &init_net.ipv4.frags.low_thresh
769 	},
770 	{
771 		.procname	= "ipfrag_low_thresh",
772 		.data		= &init_net.ipv4.frags.low_thresh,
773 		.maxlen		= sizeof(unsigned long),
774 		.mode		= 0644,
775 		.proc_handler	= proc_doulongvec_minmax,
776 		.extra2		= &init_net.ipv4.frags.high_thresh
777 	},
778 	{
779 		.procname	= "ipfrag_time",
780 		.data		= &init_net.ipv4.frags.timeout,
781 		.maxlen		= sizeof(int),
782 		.mode		= 0644,
783 		.proc_handler	= proc_dointvec_jiffies,
784 	},
785 	{
786 		.procname	= "ipfrag_max_dist",
787 		.data		= &init_net.ipv4.frags.max_dist,
788 		.maxlen		= sizeof(int),
789 		.mode		= 0644,
790 		.proc_handler	= proc_dointvec_minmax,
791 		.extra1		= &dist_min,
792 	},
793 	{ }
794 };
795 
796 /* secret interval has been deprecated */
797 static int ip4_frags_secret_interval_unused;
798 static struct ctl_table ip4_frags_ctl_table[] = {
799 	{
800 		.procname	= "ipfrag_secret_interval",
801 		.data		= &ip4_frags_secret_interval_unused,
802 		.maxlen		= sizeof(int),
803 		.mode		= 0644,
804 		.proc_handler	= proc_dointvec_jiffies,
805 	},
806 	{ }
807 };
808 
809 static int __net_init ip4_frags_ns_ctl_register(struct net *net)
810 {
811 	struct ctl_table *table;
812 	struct ctl_table_header *hdr;
813 
814 	table = ip4_frags_ns_ctl_table;
815 	if (!net_eq(net, &init_net)) {
816 		table = kmemdup(table, sizeof(ip4_frags_ns_ctl_table), GFP_KERNEL);
817 		if (!table)
818 			goto err_alloc;
819 
820 		table[0].data = &net->ipv4.frags.high_thresh;
821 		table[0].extra1 = &net->ipv4.frags.low_thresh;
822 		table[0].extra2 = &init_net.ipv4.frags.high_thresh;
823 		table[1].data = &net->ipv4.frags.low_thresh;
824 		table[1].extra2 = &net->ipv4.frags.high_thresh;
825 		table[2].data = &net->ipv4.frags.timeout;
826 		table[3].data = &net->ipv4.frags.max_dist;
827 	}
828 
829 	hdr = register_net_sysctl(net, "net/ipv4", table);
830 	if (!hdr)
831 		goto err_reg;
832 
833 	net->ipv4.frags_hdr = hdr;
834 	return 0;
835 
836 err_reg:
837 	if (!net_eq(net, &init_net))
838 		kfree(table);
839 err_alloc:
840 	return -ENOMEM;
841 }
842 
843 static void __net_exit ip4_frags_ns_ctl_unregister(struct net *net)
844 {
845 	struct ctl_table *table;
846 
847 	table = net->ipv4.frags_hdr->ctl_table_arg;
848 	unregister_net_sysctl_table(net->ipv4.frags_hdr);
849 	kfree(table);
850 }
851 
852 static void __init ip4_frags_ctl_register(void)
853 {
854 	register_net_sysctl(&init_net, "net/ipv4", ip4_frags_ctl_table);
855 }
856 #else
857 static int ip4_frags_ns_ctl_register(struct net *net)
858 {
859 	return 0;
860 }
861 
862 static void ip4_frags_ns_ctl_unregister(struct net *net)
863 {
864 }
865 
866 static void __init ip4_frags_ctl_register(void)
867 {
868 }
869 #endif
870 
871 static int __net_init ipv4_frags_init_net(struct net *net)
872 {
873 	int res;
874 
875 	/* Fragment cache limits.
876 	 *
877 	 * The fragment memory accounting code, (tries to) account for
878 	 * the real memory usage, by measuring both the size of frag
879 	 * queue struct (inet_frag_queue (ipv4:ipq/ipv6:frag_queue))
880 	 * and the SKB's truesize.
881 	 *
882 	 * A 64K fragment consumes 129736 bytes (44*2944)+200
883 	 * (1500 truesize == 2944, sizeof(struct ipq) == 200)
884 	 *
885 	 * We will commit 4MB at one time. Should we cross that limit
886 	 * we will prune down to 3MB, making room for approx 8 big 64K
887 	 * fragments 8x128k.
888 	 */
889 	net->ipv4.frags.high_thresh = 4 * 1024 * 1024;
890 	net->ipv4.frags.low_thresh  = 3 * 1024 * 1024;
891 	/*
892 	 * Important NOTE! Fragment queue must be destroyed before MSL expires.
893 	 * RFC791 is wrong proposing to prolongate timer each fragment arrival
894 	 * by TTL.
895 	 */
896 	net->ipv4.frags.timeout = IP_FRAG_TIME;
897 
898 	net->ipv4.frags.max_dist = 64;
899 	net->ipv4.frags.f = &ip4_frags;
900 
901 	res = inet_frags_init_net(&net->ipv4.frags);
902 	if (res < 0)
903 		return res;
904 	res = ip4_frags_ns_ctl_register(net);
905 	if (res < 0)
906 		inet_frags_exit_net(&net->ipv4.frags);
907 	return res;
908 }
909 
910 static void __net_exit ipv4_frags_exit_net(struct net *net)
911 {
912 	ip4_frags_ns_ctl_unregister(net);
913 	inet_frags_exit_net(&net->ipv4.frags);
914 }
915 
916 static struct pernet_operations ip4_frags_ops = {
917 	.init = ipv4_frags_init_net,
918 	.exit = ipv4_frags_exit_net,
919 };
920 
921 
922 static u32 ip4_key_hashfn(const void *data, u32 len, u32 seed)
923 {
924 	return jhash2(data,
925 		      sizeof(struct frag_v4_compare_key) / sizeof(u32), seed);
926 }
927 
928 static u32 ip4_obj_hashfn(const void *data, u32 len, u32 seed)
929 {
930 	const struct inet_frag_queue *fq = data;
931 
932 	return jhash2((const u32 *)&fq->key.v4,
933 		      sizeof(struct frag_v4_compare_key) / sizeof(u32), seed);
934 }
935 
936 static int ip4_obj_cmpfn(struct rhashtable_compare_arg *arg, const void *ptr)
937 {
938 	const struct frag_v4_compare_key *key = arg->key;
939 	const struct inet_frag_queue *fq = ptr;
940 
941 	return !!memcmp(&fq->key, key, sizeof(*key));
942 }
943 
944 static const struct rhashtable_params ip4_rhash_params = {
945 	.head_offset		= offsetof(struct inet_frag_queue, node),
946 	.key_offset		= offsetof(struct inet_frag_queue, key),
947 	.key_len		= sizeof(struct frag_v4_compare_key),
948 	.hashfn			= ip4_key_hashfn,
949 	.obj_hashfn		= ip4_obj_hashfn,
950 	.obj_cmpfn		= ip4_obj_cmpfn,
951 	.automatic_shrinking	= true,
952 };
953 
954 void __init ipfrag_init(void)
955 {
956 	ip4_frags.constructor = ip4_frag_init;
957 	ip4_frags.destructor = ip4_frag_free;
958 	ip4_frags.qsize = sizeof(struct ipq);
959 	ip4_frags.frag_expire = ip_expire;
960 	ip4_frags.frags_cache_name = ip_frag_cache_name;
961 	ip4_frags.rhash_params = ip4_rhash_params;
962 	if (inet_frags_init(&ip4_frags))
963 		panic("IP: failed to allocate ip4_frags cache\n");
964 	ip4_frags_ctl_register();
965 	register_pernet_subsys(&ip4_frags_ops);
966 }
967