Doug / smarc-fsl-linux-kernel

Download as
Browse Code ยป

Commit 182777700d912a69824245e9ee99148ac0aa57d7

Authored by Al Viro
Committed by David S. Miller
1 parent 53576d9b99
Exists in master and in 7 other branches imx_3.0.35_4.1.0, imx_3.10.17_1.0.1_ga, imx_3.10.53_1.1.0_ga, imx_3.14.28_1.0.0_ga, smarc-imx_3.10.53_1.1.0_ga, smarc-imx_3.14.28_1.0.0_ga, smarc-l5.0.0_1.0.0-ga

[IPV4]: ip_fragment.c endianness annotations 

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>

Showing 1 changed file with 8 additions and 7 deletions Inline Diff

net/ipv4/ip_fragment.c
Diff comments   View file @ 1827777
1 /* 1 /*
2 * INET An implementation of the TCP/IP protocol suite for the LINUX 2 * INET An implementation of the TCP/IP protocol suite for the LINUX
3 * operating system. INET is implemented using the BSD Socket 3 * operating system. INET is implemented using the BSD Socket
4 * interface as the means of communication with the user level. 4 * interface as the means of communication with the user level.
5 * 5 *
6 * The IP fragmentation functionality. 6 * The IP fragmentation functionality.
7 * 7 *
8 * Version: $Id: ip_fragment.c,v 1.59 2002/01/12 07:54:56 davem Exp $ 8 * Version: $Id: ip_fragment.c,v 1.59 2002/01/12 07:54:56 davem Exp $
9 * 9 *
10 * Authors: Fred N. van Kempen <waltje@uWalt.NL.Mugnet.ORG> 10 * Authors: Fred N. van Kempen <waltje@uWalt.NL.Mugnet.ORG>
11 * Alan Cox <Alan.Cox@linux.org> 11 * Alan Cox <Alan.Cox@linux.org>
12 * 12 *
13 * Fixes: 13 * Fixes:
14 * Alan Cox : Split from ip.c , see ip_input.c for history. 14 * Alan Cox : Split from ip.c , see ip_input.c for history.
15 * David S. Miller : Begin massive cleanup... 15 * David S. Miller : Begin massive cleanup...
16 * Andi Kleen : Add sysctls. 16 * Andi Kleen : Add sysctls.
17 * xxxx : Overlapfrag bug. 17 * xxxx : Overlapfrag bug.
18 * Ultima : ip_expire() kernel panic. 18 * Ultima : ip_expire() kernel panic.
19 * Bill Hawes : Frag accounting and evictor fixes. 19 * Bill Hawes : Frag accounting and evictor fixes.
20 * John McDonald : 0 length frag bug. 20 * John McDonald : 0 length frag bug.
21 * Alexey Kuznetsov: SMP races, threading, cleanup. 21 * Alexey Kuznetsov: SMP races, threading, cleanup.
22 * Patrick McHardy : LRU queue of frag heads for evictor. 22 * Patrick McHardy : LRU queue of frag heads for evictor.
23 */ 23 */
24 24
25 #include <linux/compiler.h> 25 #include <linux/compiler.h>
26 #include <linux/module.h> 26 #include <linux/module.h>
27 #include <linux/types.h> 27 #include <linux/types.h>
28 #include <linux/mm.h> 28 #include <linux/mm.h>
29 #include <linux/jiffies.h> 29 #include <linux/jiffies.h>
30 #include <linux/skbuff.h> 30 #include <linux/skbuff.h>
31 #include <linux/list.h> 31 #include <linux/list.h>
32 #include <linux/ip.h> 32 #include <linux/ip.h>
33 #include <linux/icmp.h> 33 #include <linux/icmp.h>
34 #include <linux/netdevice.h> 34 #include <linux/netdevice.h>
35 #include <linux/jhash.h> 35 #include <linux/jhash.h>
36 #include <linux/random.h> 36 #include <linux/random.h>
37 #include <net/sock.h> 37 #include <net/sock.h>
38 #include <net/ip.h> 38 #include <net/ip.h>
39 #include <net/icmp.h> 39 #include <net/icmp.h>
40 #include <net/checksum.h> 40 #include <net/checksum.h>
41 #include <net/inetpeer.h> 41 #include <net/inetpeer.h>
42 #include <linux/tcp.h> 42 #include <linux/tcp.h>
43 #include <linux/udp.h> 43 #include <linux/udp.h>
44 #include <linux/inet.h> 44 #include <linux/inet.h>
45 #include <linux/netfilter_ipv4.h> 45 #include <linux/netfilter_ipv4.h>
46 46
47 /* NOTE. Logic of IP defragmentation is parallel to corresponding IPv6 47 /* NOTE. Logic of IP defragmentation is parallel to corresponding IPv6
48 * code now. If you change something here, _PLEASE_ update ipv6/reassembly.c 48 * code now. If you change something here, _PLEASE_ update ipv6/reassembly.c
49 * as well. Or notify me, at least. --ANK 49 * as well. Or notify me, at least. --ANK
50 */ 50 */
51 51
52 /* Fragment cache limits. We will commit 256K at one time. Should we 52 /* Fragment cache limits. We will commit 256K at one time. Should we
53 * cross that limit we will prune down to 192K. This should cope with 53 * cross that limit we will prune down to 192K. This should cope with
54 * even the most extreme cases without allowing an attacker to measurably 54 * even the most extreme cases without allowing an attacker to measurably
55 * harm machine performance. 55 * harm machine performance.
56 */ 56 */
57 int sysctl_ipfrag_high_thresh __read_mostly = 256*1024; 57 int sysctl_ipfrag_high_thresh __read_mostly = 256*1024;
58 int sysctl_ipfrag_low_thresh __read_mostly = 192*1024; 58 int sysctl_ipfrag_low_thresh __read_mostly = 192*1024;
59 59
60 int sysctl_ipfrag_max_dist __read_mostly = 64; 60 int sysctl_ipfrag_max_dist __read_mostly = 64;
61 61
62 /* Important NOTE! Fragment queue must be destroyed before MSL expires. 62 /* Important NOTE! Fragment queue must be destroyed before MSL expires.
63 * RFC791 is wrong proposing to prolongate timer each fragment arrival by TTL. 63 * RFC791 is wrong proposing to prolongate timer each fragment arrival by TTL.
64 */ 64 */
65 int sysctl_ipfrag_time __read_mostly = IP_FRAG_TIME; 65 int sysctl_ipfrag_time __read_mostly = IP_FRAG_TIME;
66 66
67 struct ipfrag_skb_cb 67 struct ipfrag_skb_cb
68 { 68 {
69 struct inet_skb_parm h; 69 struct inet_skb_parm h;
70 int offset; 70 int offset;
71 }; 71 };
72 72
73 #define FRAG_CB(skb) ((struct ipfrag_skb_cb*)((skb)->cb)) 73 #define FRAG_CB(skb) ((struct ipfrag_skb_cb*)((skb)->cb))
74 74
75 /* Describe an entry in the "incomplete datagrams" queue. */ 75 /* Describe an entry in the "incomplete datagrams" queue. */
76 struct ipq { 76 struct ipq {
77 struct hlist_node list; 77 struct hlist_node list;
78 struct list_head lru_list; /* lru list member */ 78 struct list_head lru_list; /* lru list member */
79 u32 user; 79 u32 user;
80 u32 saddr; 80 __be32 saddr;
81 u32 daddr; 81 __be32 daddr;
82 u16 id; 82 __be16 id;
83 u8 protocol; 83 u8 protocol;
84 u8 last_in; 84 u8 last_in;
85 #define COMPLETE 4 85 #define COMPLETE 4
86 #define FIRST_IN 2 86 #define FIRST_IN 2
87 #define LAST_IN 1 87 #define LAST_IN 1
88 88
89 struct sk_buff *fragments; /* linked list of received fragments */ 89 struct sk_buff *fragments; /* linked list of received fragments */
90 int len; /* total length of original datagram */ 90 int len; /* total length of original datagram */
91 int meat; 91 int meat;
92 spinlock_t lock; 92 spinlock_t lock;
93 atomic_t refcnt; 93 atomic_t refcnt;
94 struct timer_list timer; /* when will this queue expire? */ 94 struct timer_list timer; /* when will this queue expire? */
95 struct timeval stamp; 95 struct timeval stamp;
96 int iif; 96 int iif;
97 unsigned int rid; 97 unsigned int rid;
98 struct inet_peer *peer; 98 struct inet_peer *peer;
99 }; 99 };
100 100
101 /* Hash table. */ 101 /* Hash table. */
102 102
103 #define IPQ_HASHSZ 64 103 #define IPQ_HASHSZ 64
104 104
105 /* Per-bucket lock is easy to add now. */ 105 /* Per-bucket lock is easy to add now. */
106 static struct hlist_head ipq_hash[IPQ_HASHSZ]; 106 static struct hlist_head ipq_hash[IPQ_HASHSZ];
107 static DEFINE_RWLOCK(ipfrag_lock); 107 static DEFINE_RWLOCK(ipfrag_lock);
108 static u32 ipfrag_hash_rnd; 108 static u32 ipfrag_hash_rnd;
109 static LIST_HEAD(ipq_lru_list); 109 static LIST_HEAD(ipq_lru_list);
110 int ip_frag_nqueues = 0; 110 int ip_frag_nqueues = 0;
111 111
112 static __inline__ void __ipq_unlink(struct ipq *qp) 112 static __inline__ void __ipq_unlink(struct ipq *qp)
113 { 113 {
114 hlist_del(&qp->list); 114 hlist_del(&qp->list);
115 list_del(&qp->lru_list); 115 list_del(&qp->lru_list);
116 ip_frag_nqueues--; 116 ip_frag_nqueues--;
117 } 117 }
118 118
119 static __inline__ void ipq_unlink(struct ipq *ipq) 119 static __inline__ void ipq_unlink(struct ipq *ipq)
120 { 120 {
121 write_lock(&ipfrag_lock); 121 write_lock(&ipfrag_lock);
122 __ipq_unlink(ipq); 122 __ipq_unlink(ipq);
123 write_unlock(&ipfrag_lock); 123 write_unlock(&ipfrag_lock);
124 } 124 }
125 125
126 static unsigned int ipqhashfn(u16 id, u32 saddr, u32 daddr, u8 prot) 126 static unsigned int ipqhashfn(__be16 id, __be32 saddr, __be32 daddr, u8 prot)
127 { 127 {
128 return jhash_3words((u32)id << 16 | prot, saddr, daddr, 128 return jhash_3words((__force u32)id << 16 | prot,
129 (__force u32)saddr, (__force u32)daddr,
129 ipfrag_hash_rnd) & (IPQ_HASHSZ - 1); 130 ipfrag_hash_rnd) & (IPQ_HASHSZ - 1);
130 } 131 }
131 132
132 static struct timer_list ipfrag_secret_timer; 133 static struct timer_list ipfrag_secret_timer;
133 int sysctl_ipfrag_secret_interval __read_mostly = 10 * 60 * HZ; 134 int sysctl_ipfrag_secret_interval __read_mostly = 10 * 60 * HZ;
134 135
135 static void ipfrag_secret_rebuild(unsigned long dummy) 136 static void ipfrag_secret_rebuild(unsigned long dummy)
136 { 137 {
137 unsigned long now = jiffies; 138 unsigned long now = jiffies;
138 int i; 139 int i;
139 140
140 write_lock(&ipfrag_lock); 141 write_lock(&ipfrag_lock);
141 get_random_bytes(&ipfrag_hash_rnd, sizeof(u32)); 142 get_random_bytes(&ipfrag_hash_rnd, sizeof(u32));
142 for (i = 0; i < IPQ_HASHSZ; i++) { 143 for (i = 0; i < IPQ_HASHSZ; i++) {
143 struct ipq *q; 144 struct ipq *q;
144 struct hlist_node *p, *n; 145 struct hlist_node *p, *n;
145 146
146 hlist_for_each_entry_safe(q, p, n, &ipq_hash[i], list) { 147 hlist_for_each_entry_safe(q, p, n, &ipq_hash[i], list) {
147 unsigned int hval = ipqhashfn(q->id, q->saddr, 148 unsigned int hval = ipqhashfn(q->id, q->saddr,
148 q->daddr, q->protocol); 149 q->daddr, q->protocol);
149 150
150 if (hval != i) { 151 if (hval != i) {
151 hlist_del(&q->list); 152 hlist_del(&q->list);
152 153
153 /* Relink to new hash chain. */ 154 /* Relink to new hash chain. */
154 hlist_add_head(&q->list, &ipq_hash[hval]); 155 hlist_add_head(&q->list, &ipq_hash[hval]);
155 } 156 }
156 } 157 }
157 } 158 }
158 write_unlock(&ipfrag_lock); 159 write_unlock(&ipfrag_lock);
159 160
160 mod_timer(&ipfrag_secret_timer, now + sysctl_ipfrag_secret_interval); 161 mod_timer(&ipfrag_secret_timer, now + sysctl_ipfrag_secret_interval);
161 } 162 }
162 163
163 atomic_t ip_frag_mem = ATOMIC_INIT(0); /* Memory used for fragments */ 164 atomic_t ip_frag_mem = ATOMIC_INIT(0); /* Memory used for fragments */
164 165
165 /* Memory Tracking Functions. */ 166 /* Memory Tracking Functions. */
166 static __inline__ void frag_kfree_skb(struct sk_buff *skb, int *work) 167 static __inline__ void frag_kfree_skb(struct sk_buff *skb, int *work)
167 { 168 {
168 if (work) 169 if (work)
169 *work -= skb->truesize; 170 *work -= skb->truesize;
170 atomic_sub(skb->truesize, &ip_frag_mem); 171 atomic_sub(skb->truesize, &ip_frag_mem);
171 kfree_skb(skb); 172 kfree_skb(skb);
172 } 173 }
173 174
174 static __inline__ void frag_free_queue(struct ipq *qp, int *work) 175 static __inline__ void frag_free_queue(struct ipq *qp, int *work)
175 { 176 {
176 if (work) 177 if (work)
177 *work -= sizeof(struct ipq); 178 *work -= sizeof(struct ipq);
178 atomic_sub(sizeof(struct ipq), &ip_frag_mem); 179 atomic_sub(sizeof(struct ipq), &ip_frag_mem);
179 kfree(qp); 180 kfree(qp);
180 } 181 }
181 182
182 static __inline__ struct ipq *frag_alloc_queue(void) 183 static __inline__ struct ipq *frag_alloc_queue(void)
183 { 184 {
184 struct ipq *qp = kmalloc(sizeof(struct ipq), GFP_ATOMIC); 185 struct ipq *qp = kmalloc(sizeof(struct ipq), GFP_ATOMIC);
185 186
186 if(!qp) 187 if(!qp)
187 return NULL; 188 return NULL;
188 atomic_add(sizeof(struct ipq), &ip_frag_mem); 189 atomic_add(sizeof(struct ipq), &ip_frag_mem);
189 return qp; 190 return qp;
190 } 191 }
191 192
192 193
193 /* Destruction primitives. */ 194 /* Destruction primitives. */
194 195
195 /* Complete destruction of ipq. */ 196 /* Complete destruction of ipq. */
196 static void ip_frag_destroy(struct ipq *qp, int *work) 197 static void ip_frag_destroy(struct ipq *qp, int *work)
197 { 198 {
198 struct sk_buff *fp; 199 struct sk_buff *fp;
199 200
200 BUG_TRAP(qp->last_in&COMPLETE); 201 BUG_TRAP(qp->last_in&COMPLETE);
201 BUG_TRAP(del_timer(&qp->timer) == 0); 202 BUG_TRAP(del_timer(&qp->timer) == 0);
202 203
203 if (qp->peer) 204 if (qp->peer)
204 inet_putpeer(qp->peer); 205 inet_putpeer(qp->peer);
205 206
206 /* Release all fragment data. */ 207 /* Release all fragment data. */
207 fp = qp->fragments; 208 fp = qp->fragments;
208 while (fp) { 209 while (fp) {
209 struct sk_buff *xp = fp->next; 210 struct sk_buff *xp = fp->next;
210 211
211 frag_kfree_skb(fp, work); 212 frag_kfree_skb(fp, work);
212 fp = xp; 213 fp = xp;
213 } 214 }
214 215
215 /* Finally, release the queue descriptor itself. */ 216 /* Finally, release the queue descriptor itself. */
216 frag_free_queue(qp, work); 217 frag_free_queue(qp, work);
217 } 218 }
218 219
219 static __inline__ void ipq_put(struct ipq *ipq, int *work) 220 static __inline__ void ipq_put(struct ipq *ipq, int *work)
220 { 221 {
221 if (atomic_dec_and_test(&ipq->refcnt)) 222 if (atomic_dec_and_test(&ipq->refcnt))
222 ip_frag_destroy(ipq, work); 223 ip_frag_destroy(ipq, work);
223 } 224 }
224 225
225 /* Kill ipq entry. It is not destroyed immediately, 226 /* Kill ipq entry. It is not destroyed immediately,
226 * because caller (and someone more) holds reference count. 227 * because caller (and someone more) holds reference count.
227 */ 228 */
228 static void ipq_kill(struct ipq *ipq) 229 static void ipq_kill(struct ipq *ipq)
229 { 230 {
230 if (del_timer(&ipq->timer)) 231 if (del_timer(&ipq->timer))
231 atomic_dec(&ipq->refcnt); 232 atomic_dec(&ipq->refcnt);
232 233
233 if (!(ipq->last_in & COMPLETE)) { 234 if (!(ipq->last_in & COMPLETE)) {
234 ipq_unlink(ipq); 235 ipq_unlink(ipq);
235 atomic_dec(&ipq->refcnt); 236 atomic_dec(&ipq->refcnt);
236 ipq->last_in |= COMPLETE; 237 ipq->last_in |= COMPLETE;
237 } 238 }
238 } 239 }
239 240
240 /* Memory limiting on fragments. Evictor trashes the oldest 241 /* Memory limiting on fragments. Evictor trashes the oldest
241 * fragment queue until we are back under the threshold. 242 * fragment queue until we are back under the threshold.
242 */ 243 */
243 static void ip_evictor(void) 244 static void ip_evictor(void)
244 { 245 {
245 struct ipq *qp; 246 struct ipq *qp;
246 struct list_head *tmp; 247 struct list_head *tmp;
247 int work; 248 int work;
248 249
249 work = atomic_read(&ip_frag_mem) - sysctl_ipfrag_low_thresh; 250 work = atomic_read(&ip_frag_mem) - sysctl_ipfrag_low_thresh;
250 if (work <= 0) 251 if (work <= 0)
251 return; 252 return;
252 253
253 while (work > 0) { 254 while (work > 0) {
254 read_lock(&ipfrag_lock); 255 read_lock(&ipfrag_lock);
255 if (list_empty(&ipq_lru_list)) { 256 if (list_empty(&ipq_lru_list)) {
256 read_unlock(&ipfrag_lock); 257 read_unlock(&ipfrag_lock);
257 return; 258 return;
258 } 259 }
259 tmp = ipq_lru_list.next; 260 tmp = ipq_lru_list.next;
260 qp = list_entry(tmp, struct ipq, lru_list); 261 qp = list_entry(tmp, struct ipq, lru_list);
261 atomic_inc(&qp->refcnt); 262 atomic_inc(&qp->refcnt);
262 read_unlock(&ipfrag_lock); 263 read_unlock(&ipfrag_lock);
263 264
264 spin_lock(&qp->lock); 265 spin_lock(&qp->lock);
265 if (!(qp->last_in&COMPLETE)) 266 if (!(qp->last_in&COMPLETE))
266 ipq_kill(qp); 267 ipq_kill(qp);
267 spin_unlock(&qp->lock); 268 spin_unlock(&qp->lock);
268 269
269 ipq_put(qp, &work); 270 ipq_put(qp, &work);
270 IP_INC_STATS_BH(IPSTATS_MIB_REASMFAILS); 271 IP_INC_STATS_BH(IPSTATS_MIB_REASMFAILS);
271 } 272 }
272 } 273 }
273 274
274 /* 275 /*
275 * Oops, a fragment queue timed out. Kill it and send an ICMP reply. 276 * Oops, a fragment queue timed out. Kill it and send an ICMP reply.
276 */ 277 */
277 static void ip_expire(unsigned long arg) 278 static void ip_expire(unsigned long arg)
278 { 279 {
279 struct ipq *qp = (struct ipq *) arg; 280 struct ipq *qp = (struct ipq *) arg;
280 281
281 spin_lock(&qp->lock); 282 spin_lock(&qp->lock);
282 283
283 if (qp->last_in & COMPLETE) 284 if (qp->last_in & COMPLETE)
284 goto out; 285 goto out;
285 286
286 ipq_kill(qp); 287 ipq_kill(qp);
287 288
288 IP_INC_STATS_BH(IPSTATS_MIB_REASMTIMEOUT); 289 IP_INC_STATS_BH(IPSTATS_MIB_REASMTIMEOUT);
289 IP_INC_STATS_BH(IPSTATS_MIB_REASMFAILS); 290 IP_INC_STATS_BH(IPSTATS_MIB_REASMFAILS);
290 291
291 if ((qp->last_in&FIRST_IN) && qp->fragments != NULL) { 292 if ((qp->last_in&FIRST_IN) && qp->fragments != NULL) {
292 struct sk_buff *head = qp->fragments; 293 struct sk_buff *head = qp->fragments;
293 /* Send an ICMP "Fragment Reassembly Timeout" message. */ 294 /* Send an ICMP "Fragment Reassembly Timeout" message. */
294 if ((head->dev = dev_get_by_index(qp->iif)) != NULL) { 295 if ((head->dev = dev_get_by_index(qp->iif)) != NULL) {
295 icmp_send(head, ICMP_TIME_EXCEEDED, ICMP_EXC_FRAGTIME, 0); 296 icmp_send(head, ICMP_TIME_EXCEEDED, ICMP_EXC_FRAGTIME, 0);
296 dev_put(head->dev); 297 dev_put(head->dev);
297 } 298 }
298 } 299 }
299 out: 300 out:
300 spin_unlock(&qp->lock); 301 spin_unlock(&qp->lock);
301 ipq_put(qp, NULL); 302 ipq_put(qp, NULL);
302 } 303 }
303 304
304 /* Creation primitives. */ 305 /* Creation primitives. */
305 306
306 static struct ipq *ip_frag_intern(struct ipq *qp_in) 307 static struct ipq *ip_frag_intern(struct ipq *qp_in)
307 { 308 {
308 struct ipq *qp; 309 struct ipq *qp;
309 #ifdef CONFIG_SMP 310 #ifdef CONFIG_SMP
310 struct hlist_node *n; 311 struct hlist_node *n;
311 #endif 312 #endif
312 unsigned int hash; 313 unsigned int hash;
313 314
314 write_lock(&ipfrag_lock); 315 write_lock(&ipfrag_lock);
315 hash = ipqhashfn(qp_in->id, qp_in->saddr, qp_in->daddr, 316 hash = ipqhashfn(qp_in->id, qp_in->saddr, qp_in->daddr,
316 qp_in->protocol); 317 qp_in->protocol);
317 #ifdef CONFIG_SMP 318 #ifdef CONFIG_SMP
318 /* With SMP race we have to recheck hash table, because 319 /* With SMP race we have to recheck hash table, because
319 * such entry could be created on other cpu, while we 320 * such entry could be created on other cpu, while we
320 * promoted read lock to write lock. 321 * promoted read lock to write lock.
321 */ 322 */
322 hlist_for_each_entry(qp, n, &ipq_hash[hash], list) { 323 hlist_for_each_entry(qp, n, &ipq_hash[hash], list) {
323 if(qp->id == qp_in->id && 324 if(qp->id == qp_in->id &&
324 qp->saddr == qp_in->saddr && 325 qp->saddr == qp_in->saddr &&
325 qp->daddr == qp_in->daddr && 326 qp->daddr == qp_in->daddr &&
326 qp->protocol == qp_in->protocol && 327 qp->protocol == qp_in->protocol &&
327 qp->user == qp_in->user) { 328 qp->user == qp_in->user) {
328 atomic_inc(&qp->refcnt); 329 atomic_inc(&qp->refcnt);
329 write_unlock(&ipfrag_lock); 330 write_unlock(&ipfrag_lock);
330 qp_in->last_in |= COMPLETE; 331 qp_in->last_in |= COMPLETE;
331 ipq_put(qp_in, NULL); 332 ipq_put(qp_in, NULL);
332 return qp; 333 return qp;
333 } 334 }
334 } 335 }
335 #endif 336 #endif
336 qp = qp_in; 337 qp = qp_in;
337 338
338 if (!mod_timer(&qp->timer, jiffies + sysctl_ipfrag_time)) 339 if (!mod_timer(&qp->timer, jiffies + sysctl_ipfrag_time))
339 atomic_inc(&qp->refcnt); 340 atomic_inc(&qp->refcnt);
340 341
341 atomic_inc(&qp->refcnt); 342 atomic_inc(&qp->refcnt);
342 hlist_add_head(&qp->list, &ipq_hash[hash]); 343 hlist_add_head(&qp->list, &ipq_hash[hash]);
343 INIT_LIST_HEAD(&qp->lru_list); 344 INIT_LIST_HEAD(&qp->lru_list);
344 list_add_tail(&qp->lru_list, &ipq_lru_list); 345 list_add_tail(&qp->lru_list, &ipq_lru_list);
345 ip_frag_nqueues++; 346 ip_frag_nqueues++;
346 write_unlock(&ipfrag_lock); 347 write_unlock(&ipfrag_lock);
347 return qp; 348 return qp;
348 } 349 }
349 350
350 /* Add an entry to the 'ipq' queue for a newly received IP datagram. */ 351 /* Add an entry to the 'ipq' queue for a newly received IP datagram. */
351 static struct ipq *ip_frag_create(struct iphdr *iph, u32 user) 352 static struct ipq *ip_frag_create(struct iphdr *iph, u32 user)
352 { 353 {
353 struct ipq *qp; 354 struct ipq *qp;
354 355
355 if ((qp = frag_alloc_queue()) == NULL) 356 if ((qp = frag_alloc_queue()) == NULL)
356 goto out_nomem; 357 goto out_nomem;
357 358
358 qp->protocol = iph->protocol; 359 qp->protocol = iph->protocol;
359 qp->last_in = 0; 360 qp->last_in = 0;
360 qp->id = iph->id; 361 qp->id = iph->id;
361 qp->saddr = iph->saddr; 362 qp->saddr = iph->saddr;
362 qp->daddr = iph->daddr; 363 qp->daddr = iph->daddr;
363 qp->user = user; 364 qp->user = user;
364 qp->len = 0; 365 qp->len = 0;
365 qp->meat = 0; 366 qp->meat = 0;
366 qp->fragments = NULL; 367 qp->fragments = NULL;
367 qp->iif = 0; 368 qp->iif = 0;
368 qp->peer = sysctl_ipfrag_max_dist ? inet_getpeer(iph->saddr, 1) : NULL; 369 qp->peer = sysctl_ipfrag_max_dist ? inet_getpeer(iph->saddr, 1) : NULL;
369 370
370 /* Initialize a timer for this entry. */ 371 /* Initialize a timer for this entry. */
371 init_timer(&qp->timer); 372 init_timer(&qp->timer);
372 qp->timer.data = (unsigned long) qp; /* pointer to queue */ 373 qp->timer.data = (unsigned long) qp; /* pointer to queue */
373 qp->timer.function = ip_expire; /* expire function */ 374 qp->timer.function = ip_expire; /* expire function */
374 spin_lock_init(&qp->lock); 375 spin_lock_init(&qp->lock);
375 atomic_set(&qp->refcnt, 1); 376 atomic_set(&qp->refcnt, 1);
376 377
377 return ip_frag_intern(qp); 378 return ip_frag_intern(qp);
378 379
379 out_nomem: 380 out_nomem:
380 LIMIT_NETDEBUG(KERN_ERR "ip_frag_create: no memory left !\n"); 381 LIMIT_NETDEBUG(KERN_ERR "ip_frag_create: no memory left !\n");
381 return NULL; 382 return NULL;
382 } 383 }
383 384
384 /* Find the correct entry in the "incomplete datagrams" queue for 385 /* Find the correct entry in the "incomplete datagrams" queue for
385 * this IP datagram, and create new one, if nothing is found. 386 * this IP datagram, and create new one, if nothing is found.
386 */ 387 */
387 static inline struct ipq *ip_find(struct iphdr *iph, u32 user) 388 static inline struct ipq *ip_find(struct iphdr *iph, u32 user)
388 { 389 {
389 __be16 id = iph->id; 390 __be16 id = iph->id;
390 __u32 saddr = iph->saddr; 391 __be32 saddr = iph->saddr;
391 __u32 daddr = iph->daddr; 392 __be32 daddr = iph->daddr;
392 __u8 protocol = iph->protocol; 393 __u8 protocol = iph->protocol;
393 unsigned int hash; 394 unsigned int hash;
394 struct ipq *qp; 395 struct ipq *qp;
395 struct hlist_node *n; 396 struct hlist_node *n;
396 397
397 read_lock(&ipfrag_lock); 398 read_lock(&ipfrag_lock);
398 hash = ipqhashfn(id, saddr, daddr, protocol); 399 hash = ipqhashfn(id, saddr, daddr, protocol);
399 hlist_for_each_entry(qp, n, &ipq_hash[hash], list) { 400 hlist_for_each_entry(qp, n, &ipq_hash[hash], list) {
400 if(qp->id == id && 401 if(qp->id == id &&
401 qp->saddr == saddr && 402 qp->saddr == saddr &&
402 qp->daddr == daddr && 403 qp->daddr == daddr &&
403 qp->protocol == protocol && 404 qp->protocol == protocol &&
404 qp->user == user) { 405 qp->user == user) {
405 atomic_inc(&qp->refcnt); 406 atomic_inc(&qp->refcnt);
406 read_unlock(&ipfrag_lock); 407 read_unlock(&ipfrag_lock);
407 return qp; 408 return qp;
408 } 409 }
409 } 410 }
410 read_unlock(&ipfrag_lock); 411 read_unlock(&ipfrag_lock);
411 412
412 return ip_frag_create(iph, user); 413 return ip_frag_create(iph, user);
413 } 414 }
414 415
415 /* Is the fragment too far ahead to be part of ipq? */ 416 /* Is the fragment too far ahead to be part of ipq? */
416 static inline int ip_frag_too_far(struct ipq *qp) 417 static inline int ip_frag_too_far(struct ipq *qp)
417 { 418 {
418 struct inet_peer *peer = qp->peer; 419 struct inet_peer *peer = qp->peer;
419 unsigned int max = sysctl_ipfrag_max_dist; 420 unsigned int max = sysctl_ipfrag_max_dist;
420 unsigned int start, end; 421 unsigned int start, end;
421 422
422 int rc; 423 int rc;
423 424
424 if (!peer || !max) 425 if (!peer || !max)
425 return 0; 426 return 0;
426 427
427 start = qp->rid; 428 start = qp->rid;
428 end = atomic_inc_return(&peer->rid); 429 end = atomic_inc_return(&peer->rid);
429 qp->rid = end; 430 qp->rid = end;
430 431
431 rc = qp->fragments && (end - start) > max; 432 rc = qp->fragments && (end - start) > max;
432 433
433 if (rc) { 434 if (rc) {
434 IP_INC_STATS_BH(IPSTATS_MIB_REASMFAILS); 435 IP_INC_STATS_BH(IPSTATS_MIB_REASMFAILS);
435 } 436 }
436 437
437 return rc; 438 return rc;
438 } 439 }
439 440
440 static int ip_frag_reinit(struct ipq *qp) 441 static int ip_frag_reinit(struct ipq *qp)
441 { 442 {
442 struct sk_buff *fp; 443 struct sk_buff *fp;
443 444
444 if (!mod_timer(&qp->timer, jiffies + sysctl_ipfrag_time)) { 445 if (!mod_timer(&qp->timer, jiffies + sysctl_ipfrag_time)) {
445 atomic_inc(&qp->refcnt); 446 atomic_inc(&qp->refcnt);
446 return -ETIMEDOUT; 447 return -ETIMEDOUT;
447 } 448 }
448 449
449 fp = qp->fragments; 450 fp = qp->fragments;
450 do { 451 do {
451 struct sk_buff *xp = fp->next; 452 struct sk_buff *xp = fp->next;
452 frag_kfree_skb(fp, NULL); 453 frag_kfree_skb(fp, NULL);
453 fp = xp; 454 fp = xp;
454 } while (fp); 455 } while (fp);
455 456
456 qp->last_in = 0; 457 qp->last_in = 0;
457 qp->len = 0; 458 qp->len = 0;
458 qp->meat = 0; 459 qp->meat = 0;
459 qp->fragments = NULL; 460 qp->fragments = NULL;
460 qp->iif = 0; 461 qp->iif = 0;
461 462
462 return 0; 463 return 0;
463 } 464 }
464 465
465 /* Add new segment to existing queue. */ 466 /* Add new segment to existing queue. */
466 static void ip_frag_queue(struct ipq *qp, struct sk_buff *skb) 467 static void ip_frag_queue(struct ipq *qp, struct sk_buff *skb)
467 { 468 {
468 struct sk_buff *prev, *next; 469 struct sk_buff *prev, *next;
469 int flags, offset; 470 int flags, offset;
470 int ihl, end; 471 int ihl, end;
471 472
472 if (qp->last_in & COMPLETE) 473 if (qp->last_in & COMPLETE)
473 goto err; 474 goto err;
474 475
475 if (!(IPCB(skb)->flags & IPSKB_FRAG_COMPLETE) && 476 if (!(IPCB(skb)->flags & IPSKB_FRAG_COMPLETE) &&
476 unlikely(ip_frag_too_far(qp)) && unlikely(ip_frag_reinit(qp))) { 477 unlikely(ip_frag_too_far(qp)) && unlikely(ip_frag_reinit(qp))) {
477 ipq_kill(qp); 478 ipq_kill(qp);
478 goto err; 479 goto err;
479 } 480 }
480 481
481 offset = ntohs(skb->nh.iph->frag_off); 482 offset = ntohs(skb->nh.iph->frag_off);
482 flags = offset & ~IP_OFFSET; 483 flags = offset & ~IP_OFFSET;
483 offset &= IP_OFFSET; 484 offset &= IP_OFFSET;
484 offset <<= 3; /* offset is in 8-byte chunks */ 485 offset <<= 3; /* offset is in 8-byte chunks */
485 ihl = skb->nh.iph->ihl * 4; 486 ihl = skb->nh.iph->ihl * 4;
486 487
487 /* Determine the position of this fragment. */ 488 /* Determine the position of this fragment. */
488 end = offset + skb->len - ihl; 489 end = offset + skb->len - ihl;
489 490
490 /* Is this the final fragment? */ 491 /* Is this the final fragment? */
491 if ((flags & IP_MF) == 0) { 492 if ((flags & IP_MF) == 0) {
492 /* If we already have some bits beyond end 493 /* If we already have some bits beyond end
493 * or have different end, the segment is corrrupted. 494 * or have different end, the segment is corrrupted.
494 */ 495 */
495 if (end < qp->len || 496 if (end < qp->len ||
496 ((qp->last_in & LAST_IN) && end != qp->len)) 497 ((qp->last_in & LAST_IN) && end != qp->len))
497 goto err; 498 goto err;
498 qp->last_in |= LAST_IN; 499 qp->last_in |= LAST_IN;
499 qp->len = end; 500 qp->len = end;
500 } else { 501 } else {
501 if (end&7) { 502 if (end&7) {
502 end &= ~7; 503 end &= ~7;
503 if (skb->ip_summed != CHECKSUM_UNNECESSARY) 504 if (skb->ip_summed != CHECKSUM_UNNECESSARY)
504 skb->ip_summed = CHECKSUM_NONE; 505 skb->ip_summed = CHECKSUM_NONE;
505 } 506 }
506 if (end > qp->len) { 507 if (end > qp->len) {
507 /* Some bits beyond end -> corruption. */ 508 /* Some bits beyond end -> corruption. */
508 if (qp->last_in & LAST_IN) 509 if (qp->last_in & LAST_IN)
509 goto err; 510 goto err;
510 qp->len = end; 511 qp->len = end;
511 } 512 }
512 } 513 }
513 if (end == offset) 514 if (end == offset)
514 goto err; 515 goto err;
515 516
516 if (pskb_pull(skb, ihl) == NULL) 517 if (pskb_pull(skb, ihl) == NULL)
517 goto err; 518 goto err;
518 if (pskb_trim_rcsum(skb, end-offset)) 519 if (pskb_trim_rcsum(skb, end-offset))
519 goto err; 520 goto err;
520 521
521 /* Find out which fragments are in front and at the back of us 522 /* Find out which fragments are in front and at the back of us
522 * in the chain of fragments so far. We must know where to put 523 * in the chain of fragments so far. We must know where to put
523 * this fragment, right? 524 * this fragment, right?
524 */ 525 */
525 prev = NULL; 526 prev = NULL;
526 for(next = qp->fragments; next != NULL; next = next->next) { 527 for(next = qp->fragments; next != NULL; next = next->next) {
527 if (FRAG_CB(next)->offset >= offset) 528 if (FRAG_CB(next)->offset >= offset)
528 break; /* bingo! */ 529 break; /* bingo! */
529 prev = next; 530 prev = next;
530 } 531 }
531 532
532 /* We found where to put this one. Check for overlap with 533 /* We found where to put this one. Check for overlap with
533 * preceding fragment, and, if needed, align things so that 534 * preceding fragment, and, if needed, align things so that
534 * any overlaps are eliminated. 535 * any overlaps are eliminated.
535 */ 536 */
536 if (prev) { 537 if (prev) {
537 int i = (FRAG_CB(prev)->offset + prev->len) - offset; 538 int i = (FRAG_CB(prev)->offset + prev->len) - offset;
538 539
539 if (i > 0) { 540 if (i > 0) {
540 offset += i; 541 offset += i;
541 if (end <= offset) 542 if (end <= offset)
542 goto err; 543 goto err;
543 if (!pskb_pull(skb, i)) 544 if (!pskb_pull(skb, i))
544 goto err; 545 goto err;
545 if (skb->ip_summed != CHECKSUM_UNNECESSARY) 546 if (skb->ip_summed != CHECKSUM_UNNECESSARY)
546 skb->ip_summed = CHECKSUM_NONE; 547 skb->ip_summed = CHECKSUM_NONE;
547 } 548 }
548 } 549 }
549 550
550 while (next && FRAG_CB(next)->offset < end) { 551 while (next && FRAG_CB(next)->offset < end) {
551 int i = end - FRAG_CB(next)->offset; /* overlap is 'i' bytes */ 552 int i = end - FRAG_CB(next)->offset; /* overlap is 'i' bytes */
552 553
553 if (i < next->len) { 554 if (i < next->len) {
554 /* Eat head of the next overlapped fragment 555 /* Eat head of the next overlapped fragment
555 * and leave the loop. The next ones cannot overlap. 556 * and leave the loop. The next ones cannot overlap.
556 */ 557 */
557 if (!pskb_pull(next, i)) 558 if (!pskb_pull(next, i))
558 goto err; 559 goto err;
559 FRAG_CB(next)->offset += i; 560 FRAG_CB(next)->offset += i;
560 qp->meat -= i; 561 qp->meat -= i;
561 if (next->ip_summed != CHECKSUM_UNNECESSARY) 562 if (next->ip_summed != CHECKSUM_UNNECESSARY)
562 next->ip_summed = CHECKSUM_NONE; 563 next->ip_summed = CHECKSUM_NONE;
563 break; 564 break;
564 } else { 565 } else {
565 struct sk_buff *free_it = next; 566 struct sk_buff *free_it = next;
566 567
567 /* Old fragmnet is completely overridden with 568 /* Old fragmnet is completely overridden with
568 * new one drop it. 569 * new one drop it.
569 */ 570 */
570 next = next->next; 571 next = next->next;
571 572
572 if (prev) 573 if (prev)
573 prev->next = next; 574 prev->next = next;
574 else 575 else
575 qp->fragments = next; 576 qp->fragments = next;
576 577
577 qp->meat -= free_it->len; 578 qp->meat -= free_it->len;
578 frag_kfree_skb(free_it, NULL); 579 frag_kfree_skb(free_it, NULL);
579 } 580 }
580 } 581 }
581 582
582 FRAG_CB(skb)->offset = offset; 583 FRAG_CB(skb)->offset = offset;
583 584
584 /* Insert this fragment in the chain of fragments. */ 585 /* Insert this fragment in the chain of fragments. */
585 skb->next = next; 586 skb->next = next;
586 if (prev) 587 if (prev)
587 prev->next = skb; 588 prev->next = skb;
588 else 589 else
589 qp->fragments = skb; 590 qp->fragments = skb;
590 591
591 if (skb->dev) 592 if (skb->dev)
592 qp->iif = skb->dev->ifindex; 593 qp->iif = skb->dev->ifindex;
593 skb->dev = NULL; 594 skb->dev = NULL;
594 skb_get_timestamp(skb, &qp->stamp); 595 skb_get_timestamp(skb, &qp->stamp);
595 qp->meat += skb->len; 596 qp->meat += skb->len;
596 atomic_add(skb->truesize, &ip_frag_mem); 597 atomic_add(skb->truesize, &ip_frag_mem);
597 if (offset == 0) 598 if (offset == 0)
598 qp->last_in |= FIRST_IN; 599 qp->last_in |= FIRST_IN;
599 600
600 write_lock(&ipfrag_lock); 601 write_lock(&ipfrag_lock);
601 list_move_tail(&qp->lru_list, &ipq_lru_list); 602 list_move_tail(&qp->lru_list, &ipq_lru_list);
602 write_unlock(&ipfrag_lock); 603 write_unlock(&ipfrag_lock);
603 604
604 return; 605 return;
605 606
606 err: 607 err:
607 kfree_skb(skb); 608 kfree_skb(skb);
608 } 609 }
609 610
610 611
611 /* Build a new IP datagram from all its fragments. */ 612 /* Build a new IP datagram from all its fragments. */
612 613
613 static struct sk_buff *ip_frag_reasm(struct ipq *qp, struct net_device *dev) 614 static struct sk_buff *ip_frag_reasm(struct ipq *qp, struct net_device *dev)
614 { 615 {
615 struct iphdr *iph; 616 struct iphdr *iph;
616 struct sk_buff *fp, *head = qp->fragments; 617 struct sk_buff *fp, *head = qp->fragments;
617 int len; 618 int len;
618 int ihlen; 619 int ihlen;
619 620
620 ipq_kill(qp); 621 ipq_kill(qp);
621 622
622 BUG_TRAP(head != NULL); 623 BUG_TRAP(head != NULL);
623 BUG_TRAP(FRAG_CB(head)->offset == 0); 624 BUG_TRAP(FRAG_CB(head)->offset == 0);
624 625
625 /* Allocate a new buffer for the datagram. */ 626 /* Allocate a new buffer for the datagram. */
626 ihlen = head->nh.iph->ihl*4; 627 ihlen = head->nh.iph->ihl*4;
627 len = ihlen + qp->len; 628 len = ihlen + qp->len;
628 629
629 if(len > 65535) 630 if(len > 65535)
630 goto out_oversize; 631 goto out_oversize;
631 632
632 /* Head of list must not be cloned. */ 633 /* Head of list must not be cloned. */
633 if (skb_cloned(head) && pskb_expand_head(head, 0, 0, GFP_ATOMIC)) 634 if (skb_cloned(head) && pskb_expand_head(head, 0, 0, GFP_ATOMIC))
634 goto out_nomem; 635 goto out_nomem;
635 636
636 /* If the first fragment is fragmented itself, we split 637 /* If the first fragment is fragmented itself, we split
637 * it to two chunks: the first with data and paged part 638 * it to two chunks: the first with data and paged part
638 * and the second, holding only fragments. */ 639 * and the second, holding only fragments. */
639 if (skb_shinfo(head)->frag_list) { 640 if (skb_shinfo(head)->frag_list) {
640 struct sk_buff *clone; 641 struct sk_buff *clone;
641 int i, plen = 0; 642 int i, plen = 0;
642 643
643 if ((clone = alloc_skb(0, GFP_ATOMIC)) == NULL) 644 if ((clone = alloc_skb(0, GFP_ATOMIC)) == NULL)
644 goto out_nomem; 645 goto out_nomem;
645 clone->next = head->next; 646 clone->next = head->next;
646 head->next = clone; 647 head->next = clone;
647 skb_shinfo(clone)->frag_list = skb_shinfo(head)->frag_list; 648 skb_shinfo(clone)->frag_list = skb_shinfo(head)->frag_list;
648 skb_shinfo(head)->frag_list = NULL; 649 skb_shinfo(head)->frag_list = NULL;
649 for (i=0; i<skb_shinfo(head)->nr_frags; i++) 650 for (i=0; i<skb_shinfo(head)->nr_frags; i++)
650 plen += skb_shinfo(head)->frags[i].size; 651 plen += skb_shinfo(head)->frags[i].size;
651 clone->len = clone->data_len = head->data_len - plen; 652 clone->len = clone->data_len = head->data_len - plen;
652 head->data_len -= clone->len; 653 head->data_len -= clone->len;
653 head->len -= clone->len; 654 head->len -= clone->len;
654 clone->csum = 0; 655 clone->csum = 0;
655 clone->ip_summed = head->ip_summed; 656 clone->ip_summed = head->ip_summed;
656 atomic_add(clone->truesize, &ip_frag_mem); 657 atomic_add(clone->truesize, &ip_frag_mem);
657 } 658 }
658 659
659 skb_shinfo(head)->frag_list = head->next; 660 skb_shinfo(head)->frag_list = head->next;
660 skb_push(head, head->data - head->nh.raw); 661 skb_push(head, head->data - head->nh.raw);
661 atomic_sub(head->truesize, &ip_frag_mem); 662 atomic_sub(head->truesize, &ip_frag_mem);
662 663
663 for (fp=head->next; fp; fp = fp->next) { 664 for (fp=head->next; fp; fp = fp->next) {
664 head->data_len += fp->len; 665 head->data_len += fp->len;
665 head->len += fp->len; 666 head->len += fp->len;
666 if (head->ip_summed != fp->ip_summed) 667 if (head->ip_summed != fp->ip_summed)
667 head->ip_summed = CHECKSUM_NONE; 668 head->ip_summed = CHECKSUM_NONE;
668 else if (head->ip_summed == CHECKSUM_COMPLETE) 669 else if (head->ip_summed == CHECKSUM_COMPLETE)
669 head->csum = csum_add(head->csum, fp->csum); 670 head->csum = csum_add(head->csum, fp->csum);
670 head->truesize += fp->truesize; 671 head->truesize += fp->truesize;
671 atomic_sub(fp->truesize, &ip_frag_mem); 672 atomic_sub(fp->truesize, &ip_frag_mem);
672 } 673 }
673 674
674 head->next = NULL; 675 head->next = NULL;
675 head->dev = dev; 676 head->dev = dev;
676 skb_set_timestamp(head, &qp->stamp); 677 skb_set_timestamp(head, &qp->stamp);
677 678
678 iph = head->nh.iph; 679 iph = head->nh.iph;
679 iph->frag_off = 0; 680 iph->frag_off = 0;
680 iph->tot_len = htons(len); 681 iph->tot_len = htons(len);
681 IP_INC_STATS_BH(IPSTATS_MIB_REASMOKS); 682 IP_INC_STATS_BH(IPSTATS_MIB_REASMOKS);
682 qp->fragments = NULL; 683 qp->fragments = NULL;
683 return head; 684 return head;
684 685
685 out_nomem: 686 out_nomem:
686 LIMIT_NETDEBUG(KERN_ERR "IP: queue_glue: no memory for gluing " 687 LIMIT_NETDEBUG(KERN_ERR "IP: queue_glue: no memory for gluing "
687 "queue %p\n", qp); 688 "queue %p\n", qp);
688 goto out_fail; 689 goto out_fail;
689 out_oversize: 690 out_oversize:
690 if (net_ratelimit()) 691 if (net_ratelimit())
691 printk(KERN_INFO 692 printk(KERN_INFO
692 "Oversized IP packet from %d.%d.%d.%d.\n", 693 "Oversized IP packet from %d.%d.%d.%d.\n",
693 NIPQUAD(qp->saddr)); 694 NIPQUAD(qp->saddr));
694 out_fail: 695 out_fail:
695 IP_INC_STATS_BH(IPSTATS_MIB_REASMFAILS); 696 IP_INC_STATS_BH(IPSTATS_MIB_REASMFAILS);
696 return NULL; 697 return NULL;
697 } 698 }
698 699
699 /* Process an incoming IP datagram fragment. */ 700 /* Process an incoming IP datagram fragment. */
700 struct sk_buff *ip_defrag(struct sk_buff *skb, u32 user) 701 struct sk_buff *ip_defrag(struct sk_buff *skb, u32 user)
701 { 702 {
702 struct iphdr *iph = skb->nh.iph; 703 struct iphdr *iph = skb->nh.iph;
703 struct ipq *qp; 704 struct ipq *qp;
704 struct net_device *dev; 705 struct net_device *dev;
705 706
706 IP_INC_STATS_BH(IPSTATS_MIB_REASMREQDS); 707 IP_INC_STATS_BH(IPSTATS_MIB_REASMREQDS);
707 708
708 /* Start by cleaning up the memory. */ 709 /* Start by cleaning up the memory. */
709 if (atomic_read(&ip_frag_mem) > sysctl_ipfrag_high_thresh) 710 if (atomic_read(&ip_frag_mem) > sysctl_ipfrag_high_thresh)
710 ip_evictor(); 711 ip_evictor();
711 712
712 dev = skb->dev; 713 dev = skb->dev;
713 714
714 /* Lookup (or create) queue header */ 715 /* Lookup (or create) queue header */
715 if ((qp = ip_find(iph, user)) != NULL) { 716 if ((qp = ip_find(iph, user)) != NULL) {
716 struct sk_buff *ret = NULL; 717 struct sk_buff *ret = NULL;
717 718
718 spin_lock(&qp->lock); 719 spin_lock(&qp->lock);
719 720
720 ip_frag_queue(qp, skb); 721 ip_frag_queue(qp, skb);
721 722
722 if (qp->last_in == (FIRST_IN|LAST_IN) && 723 if (qp->last_in == (FIRST_IN|LAST_IN) &&
723 qp->meat == qp->len) 724 qp->meat == qp->len)
724 ret = ip_frag_reasm(qp, dev); 725 ret = ip_frag_reasm(qp, dev);
725 726
726 spin_unlock(&qp->lock); 727 spin_unlock(&qp->lock);
727 ipq_put(qp, NULL); 728 ipq_put(qp, NULL);
728 return ret; 729 return ret;
729 } 730 }
730 731
731 IP_INC_STATS_BH(IPSTATS_MIB_REASMFAILS); 732 IP_INC_STATS_BH(IPSTATS_MIB_REASMFAILS);
732 kfree_skb(skb); 733 kfree_skb(skb);
733 return NULL; 734 return NULL;
734 } 735 }
735 736
736 void ipfrag_init(void) 737 void ipfrag_init(void)
737 { 738 {
738 ipfrag_hash_rnd = (u32) ((num_physpages ^ (num_physpages>>7)) ^ 739 ipfrag_hash_rnd = (u32) ((num_physpages ^ (num_physpages>>7)) ^
739 (jiffies ^ (jiffies >> 6))); 740 (jiffies ^ (jiffies >> 6)));
740 741
741 init_timer(&ipfrag_secret_timer); 742 init_timer(&ipfrag_secret_timer);
742 ipfrag_secret_timer.function = ipfrag_secret_rebuild; 743 ipfrag_secret_timer.function = ipfrag_secret_rebuild;
743 ipfrag_secret_timer.expires = jiffies + sysctl_ipfrag_secret_interval; 744 ipfrag_secret_timer.expires = jiffies + sysctl_ipfrag_secret_interval;
744 add_timer(&ipfrag_secret_timer); 745 add_timer(&ipfrag_secret_timer);
745 } 746 }
746 747
747 EXPORT_SYMBOL(ip_defrag); 748 EXPORT_SYMBOL(ip_defrag);
748 749