Skip to content

Commit

Permalink
ipv6: add defensive check for CHECKSUM_PARTIAL skbs in ip_fragment
Browse files Browse the repository at this point in the history
CHECKSUM_PARTIAL skbs should never arrive in ip_fragment. If we get one
of those warn about them once and handle them gracefully by recalculating
the checksum.

Fixes: commit 32dce96 ("ipv6: Allow for partial checksums on non-ufo packets")
See-also: commit 72e843b ("ipv6: ip6_fragment() should check CHECKSUM_PARTIAL")
Cc: Eric Dumazet <edumazet@google.com>
Cc: Vlad Yasevich <vyasevich@gmail.com>
Cc: Benjamin Coddington <bcodding@redhat.com>
Cc: Tom Herbert <tom@herbertland.com>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
  • Loading branch information
Hannes Frederic Sowa authored and David S. Miller committed Nov 1, 2015
1 parent 682b1a9 commit 405c92f
Showing 1 changed file with 4 additions and 4 deletions.
8 changes: 4 additions & 4 deletions net/ipv6/ip6_output.c
Original file line number Diff line number Diff line change
Expand Up @@ -603,6 +603,10 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
frag_id = ipv6_select_ident(net, &ipv6_hdr(skb)->daddr,
&ipv6_hdr(skb)->saddr);

if (skb->ip_summed == CHECKSUM_PARTIAL &&
(err = skb_checksum_help(skb)))
goto fail;

hroom = LL_RESERVED_SPACE(rt->dst.dev);
if (skb_has_frag_list(skb)) {
int first_len = skb_pagelen(skb);
Expand Down Expand Up @@ -731,10 +735,6 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
}

slow_path:
if ((skb->ip_summed == CHECKSUM_PARTIAL) &&
skb_checksum_help(skb))
goto fail;

left = skb->len - hlen; /* Space per frame */
ptr = hlen; /* Where to start from */

Expand Down

0 comments on commit 405c92f

Please sign in to comment.