tcp: fix corner case issue in segmentation during rexmitting

[safe/jmp/linux-2.6] / net / ipv4 / ip_fragment.c

diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index e23be5b..6659ac0 100644 (file)
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -6,7 +6,7 @@
  *             The IP fragmentation functionality.
  *
  * Authors:    Fred N. van Kempen <waltje@uWalt.NL.Mugnet.ORG>
- *             Alan Cox <Alan.Cox@linux.org>
+ *             Alan Cox <alan@lxorguk.ukuu.org.uk>
  *
  * Fixes:
  *             Alan Cox        :       Split from ip.c , see ip_input.c for history.
@@ -56,7 +56,7 @@ struct ipfrag_skb_cb
        int                     offset;
 };
 
-#define FRAG_CB(skb)   ((struct ipfrag_skb_cb*)((skb)->cb))
+#define FRAG_CB(skb)   ((struct ipfrag_skb_cb *)((skb)->cb))
 
 /* Describe an entry in the "incomplete datagrams" queue. */
 struct ipq {
@@ -178,7 +178,7 @@ static void ip_evictor(struct net *net)
 
        evicted = inet_frag_evictor(&net->ipv4.frags, &ip4_frags);
        if (evicted)
-               IP_ADD_STATS_BH(IPSTATS_MIB_REASMFAILS, evicted);
+               IP_ADD_STATS_BH(net, IPSTATS_MIB_REASMFAILS, evicted);
 }
 
 /*
@@ -199,8 +199,8 @@ static void ip_expire(unsigned long arg)
 
        ipq_kill(qp);
 
-       IP_INC_STATS_BH(IPSTATS_MIB_REASMTIMEOUT);
-       IP_INC_STATS_BH(IPSTATS_MIB_REASMFAILS);
+       IP_INC_STATS_BH(net, IPSTATS_MIB_REASMTIMEOUT);
+       IP_INC_STATS_BH(net, IPSTATS_MIB_REASMFAILS);
 
        if ((qp->q.last_in & INET_FRAG_FIRST_IN) && qp->q.fragments != NULL) {
                struct sk_buff *head = qp->q.fragments;
@@ -261,7 +261,10 @@ static inline int ip_frag_too_far(struct ipq *qp)
        rc = qp->q.fragments && (end - start) > max;
 
        if (rc) {
-               IP_INC_STATS_BH(IPSTATS_MIB_REASMFAILS);
+               struct net *net;
+
+               net = container_of(qp->q.net, struct net, ipv4.frags);
+               IP_INC_STATS_BH(net, IPSTATS_MIB_REASMFAILS);
        }
 
        return rc;
@@ -485,8 +488,8 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev,
                qp->q.fragments = head;
        }
 
-       BUG_TRAP(head != NULL);
-       BUG_TRAP(FRAG_CB(head)->offset == 0);
+       WARN_ON(head == NULL);
+       WARN_ON(FRAG_CB(head)->offset != 0);
 
        /* Allocate a new buffer for the datagram. */
        ihlen = ip_hdrlen(head);
@@ -545,7 +548,7 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev,
        iph = ip_hdr(head);
        iph->frag_off = 0;
        iph->tot_len = htons(len);
-       IP_INC_STATS_BH(IPSTATS_MIB_REASMOKS);
+       IP_INC_STATS_BH(dev_net(dev), IPSTATS_MIB_REASMOKS);
        qp->q.fragments = NULL;
        return 0;
 
@@ -556,11 +559,10 @@ out_nomem:
        goto out_fail;
 out_oversize:
        if (net_ratelimit())
-               printk(KERN_INFO
-                       "Oversized IP packet from " NIPQUAD_FMT ".\n",
-                       NIPQUAD(qp->saddr));
+               printk(KERN_INFO "Oversized IP packet from %pI4.\n",
+                       &qp->saddr);
 out_fail:
-       IP_INC_STATS_BH(IPSTATS_MIB_REASMFAILS);
+       IP_INC_STATS_BH(dev_net(dev), IPSTATS_MIB_REASMFAILS);
        return err;
 }
 
@@ -571,7 +573,7 @@ int ip_defrag(struct sk_buff *skb, u32 user)
        struct net *net;
 
        net = skb->dev ? dev_net(skb->dev) : dev_net(skb->dst->dev);
-       IP_INC_STATS_BH(IPSTATS_MIB_REASMREQDS);
+       IP_INC_STATS_BH(net, IPSTATS_MIB_REASMREQDS);
 
        /* Start by cleaning up the memory. */
        if (atomic_read(&net->ipv4.frags.mem) > net->ipv4.frags.high_thresh)
@@ -590,7 +592,7 @@ int ip_defrag(struct sk_buff *skb, u32 user)
                return ret;
        }
 
-       IP_INC_STATS_BH(IPSTATS_MIB_REASMFAILS);
+       IP_INC_STATS_BH(net, IPSTATS_MIB_REASMFAILS);
        kfree_skb(skb);
        return -ENOMEM;
 }
@@ -605,7 +607,7 @@ static struct ctl_table ip4_frags_ns_ctl_table[] = {
                .data           = &init_net.ipv4.frags.high_thresh,
                .maxlen         = sizeof(int),
                .mode           = 0644,
-               .proc_handler   = &proc_dointvec
+               .proc_handler   = proc_dointvec
        },
        {
                .ctl_name       = NET_IPV4_IPFRAG_LOW_THRESH,
@@ -613,7 +615,7 @@ static struct ctl_table ip4_frags_ns_ctl_table[] = {
                .data           = &init_net.ipv4.frags.low_thresh,
                .maxlen         = sizeof(int),
                .mode           = 0644,
-               .proc_handler   = &proc_dointvec
+               .proc_handler   = proc_dointvec
        },
        {
                .ctl_name       = NET_IPV4_IPFRAG_TIME,
@@ -621,8 +623,8 @@ static struct ctl_table ip4_frags_ns_ctl_table[] = {
                .data           = &init_net.ipv4.frags.timeout,
                .maxlen         = sizeof(int),
                .mode           = 0644,
-               .proc_handler   = &proc_dointvec_jiffies,
-               .strategy       = &sysctl_jiffies
+               .proc_handler   = proc_dointvec_jiffies,
+               .strategy       = sysctl_jiffies
        },
        { }
 };
@@ -634,15 +636,15 @@ static struct ctl_table ip4_frags_ctl_table[] = {
                .data           = &ip4_frags.secret_interval,
                .maxlen         = sizeof(int),
                .mode           = 0644,
-               .proc_handler   = &proc_dointvec_jiffies,
-               .strategy       = &sysctl_jiffies
+               .proc_handler   = proc_dointvec_jiffies,
+               .strategy       = sysctl_jiffies
        },
        {
                .procname       = "ipfrag_max_dist",
                .data           = &sysctl_ipfrag_max_dist,
                .maxlen         = sizeof(int),
                .mode           = 0644,
-               .proc_handler   = &proc_dointvec_minmax,
+               .proc_handler   = proc_dointvec_minmax,
                .extra1         = &zero
        },
        { }