^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1) // SPDX-License-Identifier: GPL-2.0-or-later
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 3) * inet fragments management
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 4) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 5) * Authors: Pavel Emelyanov <xemul@openvz.org>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 6) * Started as consolidation of ipv4/ip_fragment.c,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 7) * ipv6/reassembly. and ipv6 nf conntrack reassembly
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 8) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 9)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 10) #include <linux/list.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 11) #include <linux/spinlock.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 12) #include <linux/module.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 13) #include <linux/timer.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 14) #include <linux/mm.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 15) #include <linux/random.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 16) #include <linux/skbuff.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 17) #include <linux/rtnetlink.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 18) #include <linux/slab.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 19) #include <linux/rhashtable.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 20)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 21) #include <net/sock.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 22) #include <net/inet_frag.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 23) #include <net/inet_ecn.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 24) #include <net/ip.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 25) #include <net/ipv6.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 26)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 27) /* Use skb->cb to track consecutive/adjacent fragments coming at
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 28) * the end of the queue. Nodes in the rb-tree queue will
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 29) * contain "runs" of one or more adjacent fragments.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 30) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 31) * Invariants:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 32) * - next_frag is NULL at the tail of a "run";
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 33) * - the head of a "run" has the sum of all fragment lengths in frag_run_len.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 34) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 35) struct ipfrag_skb_cb {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 36) union {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 37) struct inet_skb_parm h4;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 38) struct inet6_skb_parm h6;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 39) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 40) struct sk_buff *next_frag;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 41) int frag_run_len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 42) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 43)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 44) #define FRAG_CB(skb) ((struct ipfrag_skb_cb *)((skb)->cb))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 45)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 46) static void fragcb_clear(struct sk_buff *skb)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 47) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 48) RB_CLEAR_NODE(&skb->rbnode);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 49) FRAG_CB(skb)->next_frag = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 50) FRAG_CB(skb)->frag_run_len = skb->len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 51) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 52)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 53) /* Append skb to the last "run". */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 54) static void fragrun_append_to_last(struct inet_frag_queue *q,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 55) struct sk_buff *skb)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 56) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 57) fragcb_clear(skb);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 58)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 59) FRAG_CB(q->last_run_head)->frag_run_len += skb->len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 60) FRAG_CB(q->fragments_tail)->next_frag = skb;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 61) q->fragments_tail = skb;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 62) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 63)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 64) /* Create a new "run" with the skb. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 65) static void fragrun_create(struct inet_frag_queue *q, struct sk_buff *skb)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 66) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 67) BUILD_BUG_ON(sizeof(struct ipfrag_skb_cb) > sizeof(skb->cb));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 68) fragcb_clear(skb);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 69)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 70) if (q->last_run_head)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 71) rb_link_node(&skb->rbnode, &q->last_run_head->rbnode,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 72) &q->last_run_head->rbnode.rb_right);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 73) else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 74) rb_link_node(&skb->rbnode, NULL, &q->rb_fragments.rb_node);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 75) rb_insert_color(&skb->rbnode, &q->rb_fragments);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 76)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 77) q->fragments_tail = skb;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 78) q->last_run_head = skb;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 79) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 80)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 81) /* Given the OR values of all fragments, apply RFC 3168 5.3 requirements
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 82) * Value : 0xff if frame should be dropped.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 83) * 0 or INET_ECN_CE value, to be ORed in to final iph->tos field
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 84) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 85) const u8 ip_frag_ecn_table[16] = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 86) /* at least one fragment had CE, and others ECT_0 or ECT_1 */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 87) [IPFRAG_ECN_CE | IPFRAG_ECN_ECT_0] = INET_ECN_CE,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 88) [IPFRAG_ECN_CE | IPFRAG_ECN_ECT_1] = INET_ECN_CE,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 89) [IPFRAG_ECN_CE | IPFRAG_ECN_ECT_0 | IPFRAG_ECN_ECT_1] = INET_ECN_CE,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 90)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 91) /* invalid combinations : drop frame */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 92) [IPFRAG_ECN_NOT_ECT | IPFRAG_ECN_CE] = 0xff,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 93) [IPFRAG_ECN_NOT_ECT | IPFRAG_ECN_ECT_0] = 0xff,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 94) [IPFRAG_ECN_NOT_ECT | IPFRAG_ECN_ECT_1] = 0xff,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 95) [IPFRAG_ECN_NOT_ECT | IPFRAG_ECN_ECT_0 | IPFRAG_ECN_ECT_1] = 0xff,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 96) [IPFRAG_ECN_NOT_ECT | IPFRAG_ECN_CE | IPFRAG_ECN_ECT_0] = 0xff,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 97) [IPFRAG_ECN_NOT_ECT | IPFRAG_ECN_CE | IPFRAG_ECN_ECT_1] = 0xff,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 98) [IPFRAG_ECN_NOT_ECT | IPFRAG_ECN_CE | IPFRAG_ECN_ECT_0 | IPFRAG_ECN_ECT_1] = 0xff,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 99) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 100) EXPORT_SYMBOL(ip_frag_ecn_table);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 101)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 102) int inet_frags_init(struct inet_frags *f)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 103) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 104) f->frags_cachep = kmem_cache_create(f->frags_cache_name, f->qsize, 0, 0,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 105) NULL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 106) if (!f->frags_cachep)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 107) return -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 108)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 109) refcount_set(&f->refcnt, 1);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 110) init_completion(&f->completion);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 111) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 112) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 113) EXPORT_SYMBOL(inet_frags_init);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 114)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 115) void inet_frags_fini(struct inet_frags *f)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 116) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 117) if (refcount_dec_and_test(&f->refcnt))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 118) complete(&f->completion);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 119)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 120) wait_for_completion(&f->completion);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 121)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 122) kmem_cache_destroy(f->frags_cachep);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 123) f->frags_cachep = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 124) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 125) EXPORT_SYMBOL(inet_frags_fini);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 126)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 127) /* called from rhashtable_free_and_destroy() at netns_frags dismantle */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 128) static void inet_frags_free_cb(void *ptr, void *arg)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 129) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 130) struct inet_frag_queue *fq = ptr;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 131) int count;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 132)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 133) count = del_timer_sync(&fq->timer) ? 1 : 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 134)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 135) spin_lock_bh(&fq->lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 136) if (!(fq->flags & INET_FRAG_COMPLETE)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 137) fq->flags |= INET_FRAG_COMPLETE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 138) count++;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 139) } else if (fq->flags & INET_FRAG_HASH_DEAD) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 140) count++;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 141) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 142) spin_unlock_bh(&fq->lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 143)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 144) if (refcount_sub_and_test(count, &fq->refcnt))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 145) inet_frag_destroy(fq);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 146) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 147)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 148) static void fqdir_work_fn(struct work_struct *work)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 149) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 150) struct fqdir *fqdir = container_of(work, struct fqdir, destroy_work);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 151) struct inet_frags *f = fqdir->f;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 152)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 153) rhashtable_free_and_destroy(&fqdir->rhashtable, inet_frags_free_cb, NULL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 154)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 155) /* We need to make sure all ongoing call_rcu(..., inet_frag_destroy_rcu)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 156) * have completed, since they need to dereference fqdir.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 157) * Would it not be nice to have kfree_rcu_barrier() ? :)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 158) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 159) rcu_barrier();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 160)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 161) if (refcount_dec_and_test(&f->refcnt))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 162) complete(&f->completion);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 163)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 164) kfree(fqdir);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 165) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 166)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 167) int fqdir_init(struct fqdir **fqdirp, struct inet_frags *f, struct net *net)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 168) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 169) struct fqdir *fqdir = kzalloc(sizeof(*fqdir), GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 170) int res;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 171)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 172) if (!fqdir)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 173) return -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 174) fqdir->f = f;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 175) fqdir->net = net;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 176) res = rhashtable_init(&fqdir->rhashtable, &fqdir->f->rhash_params);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 177) if (res < 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 178) kfree(fqdir);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 179) return res;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 180) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 181) refcount_inc(&f->refcnt);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 182) *fqdirp = fqdir;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 183) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 184) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 185) EXPORT_SYMBOL(fqdir_init);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 186)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 187) void fqdir_exit(struct fqdir *fqdir)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 188) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 189) INIT_WORK(&fqdir->destroy_work, fqdir_work_fn);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 190) queue_work(system_wq, &fqdir->destroy_work);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 191) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 192) EXPORT_SYMBOL(fqdir_exit);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 193)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 194) void inet_frag_kill(struct inet_frag_queue *fq)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 195) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 196) if (del_timer(&fq->timer))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 197) refcount_dec(&fq->refcnt);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 198)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 199) if (!(fq->flags & INET_FRAG_COMPLETE)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 200) struct fqdir *fqdir = fq->fqdir;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 201)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 202) fq->flags |= INET_FRAG_COMPLETE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 203) rcu_read_lock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 204) /* The RCU read lock provides a memory barrier
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 205) * guaranteeing that if fqdir->dead is false then
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 206) * the hash table destruction will not start until
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 207) * after we unlock. Paired with fqdir_pre_exit().
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 208) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 209) if (!READ_ONCE(fqdir->dead)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 210) rhashtable_remove_fast(&fqdir->rhashtable, &fq->node,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 211) fqdir->f->rhash_params);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 212) refcount_dec(&fq->refcnt);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 213) } else {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 214) fq->flags |= INET_FRAG_HASH_DEAD;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 215) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 216) rcu_read_unlock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 217) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 218) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 219) EXPORT_SYMBOL(inet_frag_kill);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 220)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 221) static void inet_frag_destroy_rcu(struct rcu_head *head)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 222) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 223) struct inet_frag_queue *q = container_of(head, struct inet_frag_queue,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 224) rcu);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 225) struct inet_frags *f = q->fqdir->f;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 226)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 227) if (f->destructor)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 228) f->destructor(q);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 229) kmem_cache_free(f->frags_cachep, q);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 230) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 231)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 232) unsigned int inet_frag_rbtree_purge(struct rb_root *root)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 233) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 234) struct rb_node *p = rb_first(root);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 235) unsigned int sum = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 236)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 237) while (p) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 238) struct sk_buff *skb = rb_entry(p, struct sk_buff, rbnode);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 239)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 240) p = rb_next(p);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 241) rb_erase(&skb->rbnode, root);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 242) while (skb) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 243) struct sk_buff *next = FRAG_CB(skb)->next_frag;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 244)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 245) sum += skb->truesize;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 246) kfree_skb(skb);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 247) skb = next;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 248) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 249) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 250) return sum;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 251) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 252) EXPORT_SYMBOL(inet_frag_rbtree_purge);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 253)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 254) void inet_frag_destroy(struct inet_frag_queue *q)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 255) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 256) struct fqdir *fqdir;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 257) unsigned int sum, sum_truesize = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 258) struct inet_frags *f;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 259)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 260) WARN_ON(!(q->flags & INET_FRAG_COMPLETE));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 261) WARN_ON(del_timer(&q->timer) != 0);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 262)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 263) /* Release all fragment data. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 264) fqdir = q->fqdir;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 265) f = fqdir->f;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 266) sum_truesize = inet_frag_rbtree_purge(&q->rb_fragments);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 267) sum = sum_truesize + f->qsize;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 268)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 269) call_rcu(&q->rcu, inet_frag_destroy_rcu);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 270)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 271) sub_frag_mem_limit(fqdir, sum);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 272) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 273) EXPORT_SYMBOL(inet_frag_destroy);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 274)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 275) static struct inet_frag_queue *inet_frag_alloc(struct fqdir *fqdir,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 276) struct inet_frags *f,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 277) void *arg)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 278) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 279) struct inet_frag_queue *q;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 280)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 281) q = kmem_cache_zalloc(f->frags_cachep, GFP_ATOMIC);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 282) if (!q)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 283) return NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 284)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 285) q->fqdir = fqdir;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 286) f->constructor(q, arg);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 287) add_frag_mem_limit(fqdir, f->qsize);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 288)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 289) timer_setup(&q->timer, f->frag_expire, 0);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 290) spin_lock_init(&q->lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 291) refcount_set(&q->refcnt, 3);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 292)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 293) return q;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 294) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 295)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 296) static struct inet_frag_queue *inet_frag_create(struct fqdir *fqdir,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 297) void *arg,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 298) struct inet_frag_queue **prev)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 299) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 300) struct inet_frags *f = fqdir->f;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 301) struct inet_frag_queue *q;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 302)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 303) q = inet_frag_alloc(fqdir, f, arg);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 304) if (!q) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 305) *prev = ERR_PTR(-ENOMEM);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 306) return NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 307) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 308) mod_timer(&q->timer, jiffies + fqdir->timeout);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 309)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 310) *prev = rhashtable_lookup_get_insert_key(&fqdir->rhashtable, &q->key,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 311) &q->node, f->rhash_params);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 312) if (*prev) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 313) q->flags |= INET_FRAG_COMPLETE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 314) inet_frag_kill(q);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 315) inet_frag_destroy(q);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 316) return NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 317) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 318) return q;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 319) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 320)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 321) /* TODO : call from rcu_read_lock() and no longer use refcount_inc_not_zero() */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 322) struct inet_frag_queue *inet_frag_find(struct fqdir *fqdir, void *key)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 323) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 324) /* This pairs with WRITE_ONCE() in fqdir_pre_exit(). */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 325) long high_thresh = READ_ONCE(fqdir->high_thresh);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 326) struct inet_frag_queue *fq = NULL, *prev;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 327)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 328) if (!high_thresh || frag_mem_limit(fqdir) > high_thresh)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 329) return NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 330)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 331) rcu_read_lock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 332)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 333) prev = rhashtable_lookup(&fqdir->rhashtable, key, fqdir->f->rhash_params);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 334) if (!prev)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 335) fq = inet_frag_create(fqdir, key, &prev);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 336) if (!IS_ERR_OR_NULL(prev)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 337) fq = prev;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 338) if (!refcount_inc_not_zero(&fq->refcnt))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 339) fq = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 340) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 341) rcu_read_unlock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 342) return fq;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 343) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 344) EXPORT_SYMBOL(inet_frag_find);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 345)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 346) int inet_frag_queue_insert(struct inet_frag_queue *q, struct sk_buff *skb,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 347) int offset, int end)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 348) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 349) struct sk_buff *last = q->fragments_tail;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 350)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 351) /* RFC5722, Section 4, amended by Errata ID : 3089
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 352) * When reassembling an IPv6 datagram, if
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 353) * one or more its constituent fragments is determined to be an
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 354) * overlapping fragment, the entire datagram (and any constituent
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 355) * fragments) MUST be silently discarded.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 356) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 357) * Duplicates, however, should be ignored (i.e. skb dropped, but the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 358) * queue/fragments kept for later reassembly).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 359) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 360) if (!last)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 361) fragrun_create(q, skb); /* First fragment. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 362) else if (last->ip_defrag_offset + last->len < end) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 363) /* This is the common case: skb goes to the end. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 364) /* Detect and discard overlaps. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 365) if (offset < last->ip_defrag_offset + last->len)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 366) return IPFRAG_OVERLAP;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 367) if (offset == last->ip_defrag_offset + last->len)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 368) fragrun_append_to_last(q, skb);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 369) else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 370) fragrun_create(q, skb);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 371) } else {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 372) /* Binary search. Note that skb can become the first fragment,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 373) * but not the last (covered above).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 374) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 375) struct rb_node **rbn, *parent;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 376)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 377) rbn = &q->rb_fragments.rb_node;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 378) do {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 379) struct sk_buff *curr;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 380) int curr_run_end;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 381)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 382) parent = *rbn;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 383) curr = rb_to_skb(parent);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 384) curr_run_end = curr->ip_defrag_offset +
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 385) FRAG_CB(curr)->frag_run_len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 386) if (end <= curr->ip_defrag_offset)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 387) rbn = &parent->rb_left;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 388) else if (offset >= curr_run_end)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 389) rbn = &parent->rb_right;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 390) else if (offset >= curr->ip_defrag_offset &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 391) end <= curr_run_end)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 392) return IPFRAG_DUP;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 393) else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 394) return IPFRAG_OVERLAP;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 395) } while (*rbn);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 396) /* Here we have parent properly set, and rbn pointing to
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 397) * one of its NULL left/right children. Insert skb.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 398) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 399) fragcb_clear(skb);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 400) rb_link_node(&skb->rbnode, parent, rbn);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 401) rb_insert_color(&skb->rbnode, &q->rb_fragments);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 402) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 403)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 404) skb->ip_defrag_offset = offset;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 405)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 406) return IPFRAG_OK;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 407) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 408) EXPORT_SYMBOL(inet_frag_queue_insert);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 409)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 410) void *inet_frag_reasm_prepare(struct inet_frag_queue *q, struct sk_buff *skb,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 411) struct sk_buff *parent)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 412) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 413) struct sk_buff *fp, *head = skb_rb_first(&q->rb_fragments);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 414) struct sk_buff **nextp;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 415) int delta;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 416)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 417) if (head != skb) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 418) fp = skb_clone(skb, GFP_ATOMIC);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 419) if (!fp)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 420) return NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 421) FRAG_CB(fp)->next_frag = FRAG_CB(skb)->next_frag;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 422) if (RB_EMPTY_NODE(&skb->rbnode))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 423) FRAG_CB(parent)->next_frag = fp;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 424) else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 425) rb_replace_node(&skb->rbnode, &fp->rbnode,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 426) &q->rb_fragments);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 427) if (q->fragments_tail == skb)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 428) q->fragments_tail = fp;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 429) skb_morph(skb, head);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 430) FRAG_CB(skb)->next_frag = FRAG_CB(head)->next_frag;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 431) rb_replace_node(&head->rbnode, &skb->rbnode,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 432) &q->rb_fragments);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 433) consume_skb(head);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 434) head = skb;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 435) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 436) WARN_ON(head->ip_defrag_offset != 0);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 437)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 438) delta = -head->truesize;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 439)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 440) /* Head of list must not be cloned. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 441) if (skb_unclone(head, GFP_ATOMIC))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 442) return NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 443)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 444) delta += head->truesize;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 445) if (delta)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 446) add_frag_mem_limit(q->fqdir, delta);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 447)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 448) /* If the first fragment is fragmented itself, we split
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 449) * it to two chunks: the first with data and paged part
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 450) * and the second, holding only fragments.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 451) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 452) if (skb_has_frag_list(head)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 453) struct sk_buff *clone;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 454) int i, plen = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 455)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 456) clone = alloc_skb(0, GFP_ATOMIC);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 457) if (!clone)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 458) return NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 459) skb_shinfo(clone)->frag_list = skb_shinfo(head)->frag_list;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 460) skb_frag_list_init(head);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 461) for (i = 0; i < skb_shinfo(head)->nr_frags; i++)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 462) plen += skb_frag_size(&skb_shinfo(head)->frags[i]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 463) clone->data_len = head->data_len - plen;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 464) clone->len = clone->data_len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 465) head->truesize += clone->truesize;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 466) clone->csum = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 467) clone->ip_summed = head->ip_summed;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 468) add_frag_mem_limit(q->fqdir, clone->truesize);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 469) skb_shinfo(head)->frag_list = clone;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 470) nextp = &clone->next;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 471) } else {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 472) nextp = &skb_shinfo(head)->frag_list;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 473) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 474)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 475) return nextp;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 476) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 477) EXPORT_SYMBOL(inet_frag_reasm_prepare);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 478)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 479) void inet_frag_reasm_finish(struct inet_frag_queue *q, struct sk_buff *head,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 480) void *reasm_data, bool try_coalesce)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 481) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 482) struct sk_buff **nextp = (struct sk_buff **)reasm_data;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 483) struct rb_node *rbn;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 484) struct sk_buff *fp;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 485) int sum_truesize;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 486)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 487) skb_push(head, head->data - skb_network_header(head));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 488)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 489) /* Traverse the tree in order, to build frag_list. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 490) fp = FRAG_CB(head)->next_frag;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 491) rbn = rb_next(&head->rbnode);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 492) rb_erase(&head->rbnode, &q->rb_fragments);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 493)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 494) sum_truesize = head->truesize;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 495) while (rbn || fp) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 496) /* fp points to the next sk_buff in the current run;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 497) * rbn points to the next run.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 498) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 499) /* Go through the current run. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 500) while (fp) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 501) struct sk_buff *next_frag = FRAG_CB(fp)->next_frag;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 502) bool stolen;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 503) int delta;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 504)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 505) sum_truesize += fp->truesize;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 506) if (head->ip_summed != fp->ip_summed)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 507) head->ip_summed = CHECKSUM_NONE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 508) else if (head->ip_summed == CHECKSUM_COMPLETE)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 509) head->csum = csum_add(head->csum, fp->csum);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 510)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 511) if (try_coalesce && skb_try_coalesce(head, fp, &stolen,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 512) &delta)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 513) kfree_skb_partial(fp, stolen);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 514) } else {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 515) fp->prev = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 516) memset(&fp->rbnode, 0, sizeof(fp->rbnode));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 517) fp->sk = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 518)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 519) head->data_len += fp->len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 520) head->len += fp->len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 521) head->truesize += fp->truesize;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 522)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 523) *nextp = fp;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 524) nextp = &fp->next;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 525) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 526)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 527) fp = next_frag;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 528) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 529) /* Move to the next run. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 530) if (rbn) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 531) struct rb_node *rbnext = rb_next(rbn);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 532)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 533) fp = rb_to_skb(rbn);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 534) rb_erase(rbn, &q->rb_fragments);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 535) rbn = rbnext;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 536) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 537) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 538) sub_frag_mem_limit(q->fqdir, sum_truesize);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 539)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 540) *nextp = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 541) skb_mark_not_on_list(head);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 542) head->prev = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 543) head->tstamp = q->stamp;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 544) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 545) EXPORT_SYMBOL(inet_frag_reasm_finish);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 546)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 547) struct sk_buff *inet_frag_pull_head(struct inet_frag_queue *q)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 548) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 549) struct sk_buff *head, *skb;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 550)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 551) head = skb_rb_first(&q->rb_fragments);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 552) if (!head)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 553) return NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 554) skb = FRAG_CB(head)->next_frag;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 555) if (skb)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 556) rb_replace_node(&head->rbnode, &skb->rbnode,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 557) &q->rb_fragments);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 558) else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 559) rb_erase(&head->rbnode, &q->rb_fragments);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 560) memset(&head->rbnode, 0, sizeof(head->rbnode));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 561) barrier();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 562)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 563) if (head == q->fragments_tail)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 564) q->fragments_tail = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 565)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 566) sub_frag_mem_limit(q->fqdir, head->truesize);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 567)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 568) return head;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 569) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 570) EXPORT_SYMBOL(inet_frag_pull_head);
Orange Pi5 kernel
Deprecated Linux kernel 5.10.110 for OrangePi 5/5B/5+ boards
3 Commits
0 Branches
0 Tags