[PATCH net] ipv4: frags: handle possible skb truesize change

[PATCH net] ipv4: frags: handle possible skb truesize change

[Eric Dumazet]

ip_frag_queue() might call pskb_pull() on one skb that
is already in the fragment queue.

We need to take care of possible truesize change, or we
might have an imbalance of the netns frags memory usage.

IPv6 is immune to this bug, because RFC5722, Section 4,
amended by Errata ID 3089 states :

  When reassembling an IPv6 datagram, if
  one or more its constituent fragments is determined to be an
  overlapping fragment, the entire datagram (and any constituent
  fragments) MUST be silently discarded.

Fixes: 158f323b9868 ("net: adjust skb->truesize in pskb_expand_head()")
Signed-off-by: Eric Dumazet <edumazet@google.com>
---
 net/ipv4/ip_fragment.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index 8e9528ebaa8e1af91172466cc161a83301a217ca..d14d741fb05e571d6d0b03248da77fd993debdee 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -383,11 +383,16 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb)
 		int i = end - next->ip_defrag_offset; /* overlap is 'i' bytes */
 
 		if (i < next->len) {
+			int delta = -next->truesize;
+
 			/* Eat head of the next overlapped fragment
 			 * and leave the loop. The next ones cannot overlap.
 			 */
 			if (!pskb_pull(next, i))
 				goto err;
+			delta += next->truesize;
+			if (delta)
+				add_frag_mem_limit(qp->q.net, delta);
 			next->ip_defrag_offset += i;
 			qp->q.meat -= i;
 			if (next->ip_summed != CHECKSUM_UNNECESSARY)
-- 
2.18.0.345.g5c9ce644c3-goog

Re: [PATCH net] ipv4: frags: handle possible skb truesize change

[David Miller]

From: Eric Dumazet <edumazet@google.com>
Date: Mon, 30 Jul 2018 21:50:29 -0700

> ip_frag_queue() might call pskb_pull() on one skb that
> is already in the fragment queue.
> 
> We need to take care of possible truesize change, or we
> might have an imbalance of the netns frags memory usage.
> 
> IPv6 is immune to this bug, because RFC5722, Section 4,
> amended by Errata ID 3089 states :
> 
>   When reassembling an IPv6 datagram, if
>   one or more its constituent fragments is determined to be an
>   overlapping fragment, the entire datagram (and any constituent
>   fragments) MUST be silently discarded.
> 
> Fixes: 158f323b9868 ("net: adjust skb->truesize in pskb_expand_head()")
> Signed-off-by: Eric Dumazet <edumazet@google.com>

Applied and queued up for -stable.

Frankly, I think we should enforce the ipv6 rules for ipv4 too.

There is absolutely no reasonable situation where overlapping fragment
queue entries should arrive.  None whatsoever.