129 static int ip_frag_reasm(struct ipq *qp, struct sk_buff *skb,
135 	struct ipq *qp = container_of(q, struct ipq, q);  in ip4_frag_init()  local
143 	qp->ecn = 0;  in ip4_frag_init()
144 	qp->peer = q->net->max_dist ?  in ip4_frag_init()
151 	struct ipq *qp;  in ip4_frag_free()  local
153 	qp = container_of(q, struct ipq, q);  in ip4_frag_free()
154 	if (qp->peer)  in ip4_frag_free()
155 		inet_putpeer(qp->peer);  in ip4_frag_free()
192 	struct ipq *qp;  in ip_expire()  local
195 	qp = container_of(frag, struct ipq, q);  in ip_expire()
196 	net = container_of(qp->q.net, struct net, ipv4.frags);  in ip_expire()
199 	spin_lock(&qp->q.lock);  in ip_expire()
201 	if (qp->q.flags & INET_FRAG_COMPLETE)  in ip_expire()
204 	ipq_kill(qp);  in ip_expire()
208 	if (!(qp->q.flags & INET_FRAG_FIRST_IN))  in ip_expire()
215 	if (qp->q.fragments) {  in ip_expire()
216 		head = qp->q.fragments;  in ip_expire()
217 		qp->q.fragments = head->next;  in ip_expire()
219 		head = skb_rb_first(&qp->q.rb_fragments);  in ip_expire()
225 					&qp->q.rb_fragments);  in ip_expire()
227 			rb_erase(&head->rbnode, &qp->q.rb_fragments);  in ip_expire()
231 	if (head == qp->q.fragments_tail)  in ip_expire()
232 		qp->q.fragments_tail = NULL;  in ip_expire()
234 	sub_frag_mem_limit(qp->q.net, head->truesize);  in ip_expire()
236 	head->dev = dev_get_by_index_rcu(net, qp->iif);  in ip_expire()
251 	if (frag_expire_skip_icmp(qp->q.key.v4.user) &&  in ip_expire()
255 	spin_unlock(&qp->q.lock);  in ip_expire()
260 	spin_unlock(&qp->q.lock);  in ip_expire()
265 	ipq_put(qp);  in ip_expire()
292 static int ip_frag_too_far(struct ipq *qp)  in ip_frag_too_far()  argument
294 	struct inet_peer *peer = qp->peer;  in ip_frag_too_far()
295 	unsigned int max = qp->q.net->max_dist;  in ip_frag_too_far()
303 	start = qp->rid;  in ip_frag_too_far()
305 	qp->rid = end;  in ip_frag_too_far()
307 	rc = qp->q.fragments_tail && (end - start) > max;  in ip_frag_too_far()
312 		net = container_of(qp->q.net, struct net, ipv4.frags);  in ip_frag_too_far()
319 static int ip_frag_reinit(struct ipq *qp)  in ip_frag_reinit()  argument
323 	if (!mod_timer(&qp->q.timer, jiffies + qp->q.net->timeout)) {  in ip_frag_reinit()
324 		refcount_inc(&qp->q.refcnt);  in ip_frag_reinit()
328 	sum_truesize = inet_frag_rbtree_purge(&qp->q.rb_fragments);  in ip_frag_reinit()
329 	sub_frag_mem_limit(qp->q.net, sum_truesize);  in ip_frag_reinit()
331 	qp->q.flags = 0;  in ip_frag_reinit()
332 	qp->q.len = 0;  in ip_frag_reinit()
333 	qp->q.meat = 0;  in ip_frag_reinit()
334 	qp->q.fragments = NULL;  in ip_frag_reinit()
335 	qp->q.rb_fragments = RB_ROOT;  in ip_frag_reinit()
336 	qp->q.fragments_tail = NULL;  in ip_frag_reinit()
337 	qp->q.last_run_head = NULL;  in ip_frag_reinit()
338 	qp->iif = 0;  in ip_frag_reinit()
339 	qp->ecn = 0;  in ip_frag_reinit()
345 static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb)  in ip_frag_queue()  argument
347 	struct net *net = container_of(qp->q.net, struct net, ipv4.frags);  in ip_frag_queue()
357 	if (qp->q.flags & INET_FRAG_COMPLETE)  in ip_frag_queue()
361 	    unlikely(ip_frag_too_far(qp)) &&  in ip_frag_queue()
362 	    unlikely(err = ip_frag_reinit(qp))) {  in ip_frag_queue()
363 		ipq_kill(qp);  in ip_frag_queue()
383 		if (end < qp->q.len ||  in ip_frag_queue()
384 		    ((qp->q.flags & INET_FRAG_LAST_IN) && end != qp->q.len))  in ip_frag_queue()
386 		qp->q.flags |= INET_FRAG_LAST_IN;  in ip_frag_queue()
387 		qp->q.len = end;  in ip_frag_queue()
394 		if (end > qp->q.len) {  in ip_frag_queue()
396 			if (qp->q.flags & INET_FRAG_LAST_IN)  in ip_frag_queue()
398 			qp->q.len = end;  in ip_frag_queue()
427 	prev_tail = qp->q.fragments_tail;  in ip_frag_queue()
429 		ip4_frag_create_run(&qp->q, skb);  /* First fragment. */  in ip_frag_queue()
436 			ip4_frag_append_to_last_run(&qp->q, skb);  in ip_frag_queue()
438 			ip4_frag_create_run(&qp->q, skb);  in ip_frag_queue()
443 		rbn = &qp->q.rb_fragments.rb_node;  in ip_frag_queue()
460 		rb_insert_color(&skb->rbnode, &qp->q.rb_fragments);  in ip_frag_queue()
464 		qp->iif = dev->ifindex;  in ip_frag_queue()
467 	qp->q.stamp = skb->tstamp;  in ip_frag_queue()
468 	qp->q.meat += skb->len;  in ip_frag_queue()
469 	qp->ecn |= ecn;  in ip_frag_queue()
470 	add_frag_mem_limit(qp->q.net, skb->truesize);  in ip_frag_queue()
472 		qp->q.flags |= INET_FRAG_FIRST_IN;  in ip_frag_queue()
476 	if (fragsize > qp->q.max_size)  in ip_frag_queue()
477 		qp->q.max_size = fragsize;  in ip_frag_queue()
480 	    fragsize > qp->max_df_size)  in ip_frag_queue()
481 		qp->max_df_size = fragsize;  in ip_frag_queue()
483 	if (qp->q.flags == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) &&  in ip_frag_queue()
484 	    qp->q.meat == qp->q.len) {  in ip_frag_queue()
488 		err = ip_frag_reasm(qp, skb, prev_tail, dev);  in ip_frag_queue()
497 	inet_frag_kill(&qp->q);  in ip_frag_queue()
506 static int ip_frag_reasm(struct ipq *qp, struct sk_buff *skb,  in ip_frag_reasm()  argument
509 	struct net *net = container_of(qp->q.net, struct net, ipv4.frags);  in ip_frag_reasm()
511 	struct sk_buff *fp, *head = skb_rb_first(&qp->q.rb_fragments);  in ip_frag_reasm()
519 	ipq_kill(qp);  in ip_frag_reasm()
521 	ecn = ip_frag_ecn_table[qp->ecn];  in ip_frag_reasm()
536 					&qp->q.rb_fragments);  in ip_frag_reasm()
537 		if (qp->q.fragments_tail == skb)  in ip_frag_reasm()
538 			qp->q.fragments_tail = fp;  in ip_frag_reasm()
542 				&qp->q.rb_fragments);  in ip_frag_reasm()
551 	len = ihlen + qp->q.len;  in ip_frag_reasm()
579 		add_frag_mem_limit(qp->q.net, clone->truesize);  in ip_frag_reasm()
591 	rb_erase(&head->rbnode, &qp->q.rb_fragments);  in ip_frag_reasm()
617 			rb_erase(rbn, &qp->q.rb_fragments);  in ip_frag_reasm()
621 	sub_frag_mem_limit(qp->q.net, head->truesize);  in ip_frag_reasm()
627 	head->tstamp = qp->q.stamp;  in ip_frag_reasm()
628 	IPCB(head)->frag_max_size = max(qp->max_df_size, qp->q.max_size);  in ip_frag_reasm()
642 	if (qp->max_df_size == qp->q.max_size) {  in ip_frag_reasm()
652 	qp->q.fragments = NULL;  in ip_frag_reasm()
653 	qp->q.rb_fragments = RB_ROOT;  in ip_frag_reasm()
654 	qp->q.fragments_tail = NULL;  in ip_frag_reasm()
655 	qp->q.last_run_head = NULL;  in ip_frag_reasm()
659 	net_dbg_ratelimited("queue_glue: no memory for gluing queue %p\n", qp);  in ip_frag_reasm()
663 	net_info_ratelimited("Oversized IP packet from %pI4\n", &qp->q.key.v4.saddr);  in ip_frag_reasm()
674 	struct ipq *qp;  in ip_defrag()  local
680 	qp = ip_find(net, ip_hdr(skb), user, vif);  in ip_defrag()
681 	if (qp) {  in ip_defrag()
684 		spin_lock(&qp->q.lock);  in ip_defrag()
686 		ret = ip_frag_queue(qp, skb);  in ip_defrag()
688 		spin_unlock(&qp->q.lock);  in ip_defrag()
689 		ipq_put(qp);  in ip_defrag()