diff options
| author |   Peter Oskolkov <posk@google.com> | 2018-09-21 11:17:15 -0700 |
|---|---|---|
| committer |   David S. Miller <davem@davemloft.net> | 2018-09-21 19:45:52 -0700 |
| commit | 2475f59c618ea58e9f72ae5ded2db392ee47810d (patch) | |
| tree | 6851320faef684008259e7ad9897f9d7338da7cb /net/ipv6 | |
| parent | net/ipv4: avoid compile error in fib_info_nh_uses_dev (diff) | |
| download | linux-dev-2475f59c618ea58e9f72ae5ded2db392ee47810d.tar.xz linux-dev-2475f59c618ea58e9f72ae5ded2db392ee47810d.zip | |
ipv6: discard IP frag queue on more errors
This is similar to how ipv4 now behaves:
commit 0ff89efb5246 ("ip: fail fast on IP defrag errors").
Signed-off-by: Peter Oskolkov <posk@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv6')
| -rw-r--r-- | net/ipv6/reassembly.c | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c index f1b1ff30fe5b..536c1d172cba 100644 --- a/net/ipv6/reassembly.c +++ b/net/ipv6/reassembly.c @@ -145,7 +145,7 @@ static int ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb, */ if (end < fq->q.len || ((fq->q.flags & INET_FRAG_LAST_IN) && end != fq->q.len)) - goto err; + goto discard_fq; fq->q.flags |= INET_FRAG_LAST_IN; fq->q.len = end; } else { @@ -162,20 +162,20 @@ static int ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb, if (end > fq->q.len) { /* Some bits beyond end -> corruption. */ if (fq->q.flags & INET_FRAG_LAST_IN) - goto err; + goto discard_fq; fq->q.len = end; } } if (end == offset) - goto err; + goto discard_fq; /* Point into the IP datagram 'data' part. */ if (!pskb_pull(skb, (u8 *) (fhdr + 1) - skb->data)) - goto err; + goto discard_fq; if (pskb_trim_rcsum(skb, end - offset)) - goto err; + goto discard_fq; /* Find out which fragments are in front and at the back of us * in the chain of fragments so far. We must know where to put @@ -418,6 +418,7 @@ out_fail: rcu_read_lock(); __IP6_INC_STATS(net, __in6_dev_get(dev), IPSTATS_MIB_REASMFAILS); rcu_read_unlock(); + inet_frag_kill(&fq->q); return -1; } |