[linux-next] LinuxNextTracking branch, master, updated. next-20141226

batman at open-mesh.org batman at open-mesh.org
Sat Dec 27 00:17:57 CET 2014


The following commit has been merged in the master branch:
commit 5b6698b0e4a37053de35cc24ee695b98a7eb712b
Author: Sven Eckelmann <sven at narfation.org>
Date:   Sat Dec 20 13:48:55 2014 +0100

    batman-adv: Calculate extra tail size based on queued fragments
    
    The fragmentation code was replaced in 610bfc6bc99bc83680d190ebc69359a05fc7f605
    ("batman-adv: Receive fragmented packets and merge"). The new code provided a
    mostly unused parameter skb for the merging function. It is used inside the
    function to calculate the additionally needed skb tailroom. But instead of
    increasing its own tailroom, it is only increasing the tailroom of the first
    queued skb. This is not correct in some situations because the first queued
    entry can be a different one than the parameter.
    
    An observed problem was:
    
    1. packet with size 104, total_size 1464, fragno 1 was received
       - packet is queued
    2. packet with size 1400, total_size 1464, fragno 0 was received
       - packet is queued at the end of the list
    3. enough data was received and can be given to the merge function
       (1464 == (1400 - 20) + (104 - 20))
       - merge functions gets 1400 byte large packet as skb argument
    4. merge function gets first entry in queue (104 byte)
       - stored as skb_out
    5. merge function calculates the required extra tail as total_size - skb->len
       - pskb_expand_head tail of skb_out with 64 bytes
    6. merge function tries to squeeze the extra 1380 bytes from the second queued
       skb (1400 byte aka skb parameter) in the 64 extra tail bytes of skb_out
    
    Instead calculate the extra required tail bytes for skb_out also using skb_out
    instead of using the parameter skb. The skb parameter is only used to get the
    total_size from the last received packet. This is also the total_size used to
    decide that all fragments were received.
    
    Reported-by: Philipp Psurek <philipp.psurek at gmail.com>
    Signed-off-by: Sven Eckelmann <sven at narfation.org>
    Acked-by: Martin Hundebøll <martin at hundeboll.net>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c
index fc1835c..8af3461 100644
--- a/net/batman-adv/fragmentation.c
+++ b/net/batman-adv/fragmentation.c
@@ -251,7 +251,7 @@ batadv_frag_merge_packets(struct hlist_head *chain, struct sk_buff *skb)
 	kfree(entry);
 
 	/* Make room for the rest of the fragments. */
-	if (pskb_expand_head(skb_out, 0, size - skb->len, GFP_ATOMIC) < 0) {
+	if (pskb_expand_head(skb_out, 0, size - skb_out->len, GFP_ATOMIC) < 0) {
 		kfree_skb(skb_out);
 		skb_out = NULL;
 		goto free;

-- 
LinuxNextTracking


More information about the linux-merge mailing list