Messages in this thread Patch in this message | | | From | Steven Caron <> | Subject | PATCH [1/1] ipv4: Prevent malformed UFO fragments in ip_append_page | Date | Fri, 10 Jun 2016 19:21:26 +0000 |
| |
As the ip fragment offset field counts 8-byte chunks, non-final ip fragments must be multiples of 8 bytes of payload. Depending on the mtu and ip option sizes, ip_append_page wasn't respecting this, notably when running NFS under UDP.
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c index 124bf0a..21ec54e 100644 --- a/net/ipv4/ip_output.c +++ b/net/ipv4/ip_output.c @@ -1239,7 +1239,7 @@ ssize_t ip_append_page(struct sock *sk, struct flowi4 *fl4, struct page *page, if (skb->ip_summed != CHECKSUM_PARTIAL) return -EOPNOTSUPP;
- skb_shinfo(skb)->gso_size = mtu - fragheaderlen; + skb_shinfo(skb)->gso_size = maxfraglen - fragheaderlen; skb_shinfo(skb)->gso_type = SKB_GSO_UDP; } cork->length += size;
| |