Merge tag 'modules-next-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git...

[firefly-linux-kernel-4.4.55.git] / net / batman-adv / fragmentation.c

diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c
index 3d1dcaa3e8b5af2040ec1cab987d98be876f35f8..c0f0d01ab244e37e6ed056e8b9f0604c7f432eee 100644 (file)
--- a/net/batman-adv/fragmentation.c
+++ b/net/batman-adv/fragmentation.c
@@ -1,4 +1,4 @@
-/* Copyright (C) 2013-2014 B.A.T.M.A.N. contributors:
+/* Copyright (C) 2013-2015 B.A.T.M.A.N. contributors:
  *
  * Martin Hundebøll <martin@hundeboll.net>
  *
@@ -15,12 +15,28 @@
  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
-#include "main.h"
 #include "fragmentation.h"
-#include "send.h"
+#include "main.h"
+
+#include <linux/atomic.h>
+#include <linux/byteorder/generic.h>
+#include <linux/etherdevice.h>
+#include <linux/fs.h>
+#include <linux/if_ether.h>
+#include <linux/jiffies.h>
+#include <linux/kernel.h>
+#include <linux/netdevice.h>
+#include <linux/pkt_sched.h>
+#include <linux/skbuff.h>
+#include <linux/slab.h>
+#include <linux/spinlock.h>
+#include <linux/string.h>
+
+#include "hard-interface.h"
 #include "originator.h"
+#include "packet.h"
 #include "routing.h"
-#include "hard-interface.h"
+#include "send.h"
 #include "soft-interface.h"
 
 /**
@@ -161,6 +177,7 @@ static bool batadv_frag_insert_packet(struct batadv_orig_node *orig_node,
                hlist_add_head(&frag_entry_new->list, &chain->head);
                chain->size = skb->len - hdr_size;
                chain->timestamp = jiffies;
+               chain->total_size = ntohs(frag_packet->total_size);
                ret = true;
                goto out;
        }
@@ -195,9 +212,11 @@ static bool batadv_frag_insert_packet(struct batadv_orig_node *orig_node,
 
 out:
        if (chain->size > batadv_frag_size_limit() ||
-           ntohs(frag_packet->total_size) > batadv_frag_size_limit()) {
+           chain->total_size != ntohs(frag_packet->total_size) ||
+           chain->total_size > batadv_frag_size_limit()) {
                /* Clear chain if total size of either the list or the packet
-                * exceeds the maximum size of one merged packet.
+                * exceeds the maximum size of one merged packet. Don't allow
+                * packets to have different total_size.
                 */
                batadv_frag_clear_chain(&chain->head);
                chain->size = 0;
@@ -228,19 +247,13 @@ err:
  * Returns the merged skb or NULL on error.
  */
 static struct sk_buff *
-batadv_frag_merge_packets(struct hlist_head *chain, struct sk_buff *skb)
+batadv_frag_merge_packets(struct hlist_head *chain)
 {
        struct batadv_frag_packet *packet;
        struct batadv_frag_list_entry *entry;
        struct sk_buff *skb_out = NULL;
        int size, hdr_size = sizeof(struct batadv_frag_packet);
 
-       /* Make sure incoming skb has non-bogus data. */
-       packet = (struct batadv_frag_packet *)skb->data;
-       size = ntohs(packet->total_size);
-       if (size > batadv_frag_size_limit())
-               goto free;
-
        /* Remove first entry, as this is the destination for the rest of the
         * fragments.
         */
@@ -249,6 +262,9 @@ batadv_frag_merge_packets(struct hlist_head *chain, struct sk_buff *skb)
        skb_out = entry->skb;
        kfree(entry);
 
+       packet = (struct batadv_frag_packet *)skb_out->data;
+       size = ntohs(packet->total_size);
+
        /* Make room for the rest of the fragments. */
        if (pskb_expand_head(skb_out, 0, size - skb_out->len, GFP_ATOMIC) < 0) {
                kfree_skb(skb_out);
@@ -304,7 +320,7 @@ bool batadv_frag_skb_buffer(struct sk_buff **skb,
        if (hlist_empty(&head))
                goto out;
 
-       skb_out = batadv_frag_merge_packets(&head, *skb);
+       skb_out = batadv_frag_merge_packets(&head);
        if (!skb_out)
                goto out_err;