78 static int ip_frag_reasm(struct ipq *qp, struct sk_buff *skb,
84 	struct ipq *qp = container_of(q, struct ipq, q);  in ip4_frag_init()  local
90 	qp->ecn = 0;  in ip4_frag_init()
91 	qp->peer = q->fqdir->max_dist ?  in ip4_frag_init()
98 	struct ipq *qp;  in ip4_frag_free()  local
100 	qp = container_of(q, struct ipq, q);  in ip4_frag_free()
101 	if (qp->peer)  in ip4_frag_free()
102 		inet_putpeer(qp->peer);  in ip4_frag_free()
139 	struct ipq *qp;  in ip_expire()  local
142 	qp = container_of(frag, struct ipq, q);  in ip_expire()
143 	net = qp->q.fqdir->net;  in ip_expire()
147 	if (qp->q.fqdir->dead)  in ip_expire()
150 	spin_lock(&qp->q.lock);  in ip_expire()
152 	if (qp->q.flags & INET_FRAG_COMPLETE)  in ip_expire()
155 	ipq_kill(qp);  in ip_expire()
159 	if (!(qp->q.flags & INET_FRAG_FIRST_IN))  in ip_expire()
166 	head = inet_frag_pull_head(&qp->q);  in ip_expire()
169 	head->dev = dev_get_by_index_rcu(net, qp->iif);  in ip_expire()
184 	if (frag_expire_skip_icmp(qp->q.key.v4.user) &&  in ip_expire()
188 	spin_unlock(&qp->q.lock);  in ip_expire()
193 	spin_unlock(&qp->q.lock);  in ip_expire()
197 	ipq_put(qp);  in ip_expire()
224 static int ip_frag_too_far(struct ipq *qp)  in ip_frag_too_far()  argument
226 	struct inet_peer *peer = qp->peer;  in ip_frag_too_far()
227 	unsigned int max = qp->q.fqdir->max_dist;  in ip_frag_too_far()
235 	start = qp->rid;  in ip_frag_too_far()
237 	qp->rid = end;  in ip_frag_too_far()
239 	rc = qp->q.fragments_tail && (end - start) > max;  in ip_frag_too_far()
242 		__IP_INC_STATS(qp->q.fqdir->net, IPSTATS_MIB_REASMFAILS);  in ip_frag_too_far()
247 static int ip_frag_reinit(struct ipq *qp)  in ip_frag_reinit()  argument
251 	if (!mod_timer(&qp->q.timer, jiffies + qp->q.fqdir->timeout)) {  in ip_frag_reinit()
252 		refcount_inc(&qp->q.refcnt);  in ip_frag_reinit()
256 	sum_truesize = inet_frag_rbtree_purge(&qp->q.rb_fragments);  in ip_frag_reinit()
257 	sub_frag_mem_limit(qp->q.fqdir, sum_truesize);  in ip_frag_reinit()
259 	qp->q.flags = 0;  in ip_frag_reinit()
260 	qp->q.len = 0;  in ip_frag_reinit()
261 	qp->q.meat = 0;  in ip_frag_reinit()
262 	qp->q.rb_fragments = RB_ROOT;  in ip_frag_reinit()
263 	qp->q.fragments_tail = NULL;  in ip_frag_reinit()
264 	qp->q.last_run_head = NULL;  in ip_frag_reinit()
265 	qp->iif = 0;  in ip_frag_reinit()
266 	qp->ecn = 0;  in ip_frag_reinit()
272 static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb)  in ip_frag_queue()  argument
274 	struct net *net = qp->q.fqdir->net;  in ip_frag_queue()
282 	if (qp->q.flags & INET_FRAG_COMPLETE)  in ip_frag_queue()
286 	    unlikely(ip_frag_too_far(qp)) &&  in ip_frag_queue()
287 	    unlikely(err = ip_frag_reinit(qp))) {  in ip_frag_queue()
288 		ipq_kill(qp);  in ip_frag_queue()
308 		if (end < qp->q.len ||  in ip_frag_queue()
309 		    ((qp->q.flags & INET_FRAG_LAST_IN) && end != qp->q.len))  in ip_frag_queue()
311 		qp->q.flags |= INET_FRAG_LAST_IN;  in ip_frag_queue()
312 		qp->q.len = end;  in ip_frag_queue()
319 		if (end > qp->q.len) {  in ip_frag_queue()
321 			if (qp->q.flags & INET_FRAG_LAST_IN)  in ip_frag_queue()
323 			qp->q.len = end;  in ip_frag_queue()
342 	prev_tail = qp->q.fragments_tail;  in ip_frag_queue()
343 	err = inet_frag_queue_insert(&qp->q, skb, offset, end);  in ip_frag_queue()
348 		qp->iif = dev->ifindex;  in ip_frag_queue()
350 	qp->q.stamp = skb->tstamp;  in ip_frag_queue()
351 	qp->q.meat += skb->len;  in ip_frag_queue()
352 	qp->ecn |= ecn;  in ip_frag_queue()
353 	add_frag_mem_limit(qp->q.fqdir, skb->truesize);  in ip_frag_queue()
355 		qp->q.flags |= INET_FRAG_FIRST_IN;  in ip_frag_queue()
359 	if (fragsize > qp->q.max_size)  in ip_frag_queue()
360 		qp->q.max_size = fragsize;  in ip_frag_queue()
363 	    fragsize > qp->max_df_size)  in ip_frag_queue()
364 		qp->max_df_size = fragsize;  in ip_frag_queue()
366 	if (qp->q.flags == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) &&  in ip_frag_queue()
367 	    qp->q.meat == qp->q.len) {  in ip_frag_queue()
371 		err = ip_frag_reasm(qp, skb, prev_tail, dev);  in ip_frag_queue()
374 			inet_frag_kill(&qp->q);  in ip_frag_queue()
389 	inet_frag_kill(&qp->q);  in ip_frag_queue()
396 static bool ip_frag_coalesce_ok(const struct ipq *qp)  in ip_frag_coalesce_ok()  argument
398 	return qp->q.key.v4.user == IP_DEFRAG_LOCAL_DELIVER;  in ip_frag_coalesce_ok()
402 static int ip_frag_reasm(struct ipq *qp, struct sk_buff *skb,  in ip_frag_reasm()  argument
405 	struct net *net = qp->q.fqdir->net;  in ip_frag_reasm()
411 	ipq_kill(qp);  in ip_frag_reasm()
413 	ecn = ip_frag_ecn_table[qp->ecn];  in ip_frag_reasm()
420 	reasm_data = inet_frag_reasm_prepare(&qp->q, skb, prev_tail);  in ip_frag_reasm()
424 	len = ip_hdrlen(skb) + qp->q.len;  in ip_frag_reasm()
429 	inet_frag_reasm_finish(&qp->q, skb, reasm_data,  in ip_frag_reasm()
430 			       ip_frag_coalesce_ok(qp));  in ip_frag_reasm()
433 	IPCB(skb)->frag_max_size = max(qp->max_df_size, qp->q.max_size);  in ip_frag_reasm()
447 	if (qp->max_df_size == qp->q.max_size) {  in ip_frag_reasm()
457 	qp->q.rb_fragments = RB_ROOT;  in ip_frag_reasm()
458 	qp->q.fragments_tail = NULL;  in ip_frag_reasm()
459 	qp->q.last_run_head = NULL;  in ip_frag_reasm()
463 	net_dbg_ratelimited("queue_glue: no memory for gluing queue %p\n", qp);  in ip_frag_reasm()
467 	net_info_ratelimited("Oversized IP packet from %pI4\n", &qp->q.key.v4.saddr);  in ip_frag_reasm()
478 	struct ipq *qp;  in ip_defrag()  local
484 	qp = ip_find(net, ip_hdr(skb), user, vif);  in ip_defrag()
485 	if (qp) {  in ip_defrag()
488 		spin_lock(&qp->q.lock);  in ip_defrag()
490 		ret = ip_frag_queue(qp, skb);  in ip_defrag()
492 		spin_unlock(&qp->q.lock);  in ip_defrag()
493 		ipq_put(qp);  in ip_defrag()