From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 68D00C4332D for ; Thu, 19 Mar 2020 13:08:36 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 41C8020789 for ; Thu, 19 Mar 2020 13:08:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1584623316; bh=ED8I+F82MzV8WjOsG+NjX3J8mODwxBnxQmNMv+YhSFM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=d7XvpJag3fwdxvl9/plh1z2+pXwBFcgKMWDBU7MIqgG0EP9g4yPWWhw4THP4GQjyg RQrYipUNASN90c2I7PyLbMy/RDAnn0nJelHUDmZrUgKX0kNpWenhcbtc/0Oy8EjGFD f6aW9Nx2esj3haDvpVvfqrvP6c59r0g+fVjv7Ugk= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727517AbgCSNIf (ORCPT ); Thu, 19 Mar 2020 09:08:35 -0400 Received: from mail.kernel.org ([198.145.29.99]:52716 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727103AbgCSNIb (ORCPT ); Thu, 19 Mar 2020 09:08:31 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id C0233214D8; Thu, 19 Mar 2020 13:08:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1584623311; bh=ED8I+F82MzV8WjOsG+NjX3J8mODwxBnxQmNMv+YhSFM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=QldzL3hUQP0sjF54iZAXhIKAfS9FoFQI8AYvPAh0XwdnmaXEmF1rMw94MK3xZNl8C 0Hsk9fIlrzUQKENgB+Nzq6zr1PBGg29IXnUn0TlDIj0uHFq7rznco45sCijouOxfnc tg+nscrotcA+k72sk2ANg/uYZZ/lUnmCMj/aS8nE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Greg Kroah-Hartman , =?UTF-8?q?Linus=20L=FCssing?= , Sven Eckelmann , Simon Wunderlich Subject: [PATCH 4.4 63/93] batman-adv: Fix transmission of final, 16th fragment Date: Thu, 19 Mar 2020 14:00:07 +0100 Message-Id: <20200319123944.858061121@linuxfoundation.org> X-Mailer: git-send-email 2.25.2 In-Reply-To: <20200319123924.795019515@linuxfoundation.org> References: <20200319123924.795019515@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Linus Lüssing commit 51c6b429c0c95e67edd1cb0b548c5cf6a6604763 upstream. Trying to split and transmit a unicast packet in 16 parts will fail for the final fragment: After having sent the 15th one with a frag_packet.no index of 14, we will increase the the index to 15 - and return with an error code immediately, even though one more fragment is due for transmission and allowed. Fixing this issue by moving the check before incrementing the index. While at it, adding an unlikely(), because the check is actually more of an assertion. Fixes: ee75ed88879a ("batman-adv: Fragment and send skbs larger than mtu") Signed-off-by: Linus Lüssing Signed-off-by: Sven Eckelmann Signed-off-by: Simon Wunderlich Signed-off-by: Sven Eckelmann Signed-off-by: Greg Kroah-Hartman --- net/batman-adv/fragmentation.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) --- a/net/batman-adv/fragmentation.c +++ b/net/batman-adv/fragmentation.c @@ -480,6 +480,10 @@ bool batadv_frag_send_packet(struct sk_b /* Eat and send fragments from the tail of skb */ while (skb->len > max_fragment_size) { + /* The initial check in this function should cover this case */ + if (frag_header.no == BATADV_FRAG_MAX_FRAGMENTS - 1) + goto out_err; + skb_fragment = batadv_frag_create(skb, &frag_header, mtu); if (!skb_fragment) goto out_err; @@ -490,10 +494,6 @@ bool batadv_frag_send_packet(struct sk_b batadv_send_skb_packet(skb_fragment, neigh_node->if_incoming, neigh_node->addr); frag_header.no++; - - /* The initial check in this function should cover this case */ - if (frag_header.no == BATADV_FRAG_MAX_FRAGMENTS - 1) - goto out_err; } /* Make room for the fragment header. */