leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

inet: frags: get rif of inet_frag_evicting()

Browse Source 
This refactors ip_expire() since one indentation level is removed.

Note: in the future, we should try hard to avoid the skb_clone()
since this is a serious performance cost.
Under DDOS, the ICMP message wont be sent because of rate limits.

Fact that ip6_expire_frag_queue() does not use skb_clone() is
disturbing too. Presumably IPv6 should have the same
issue than the one we fixed in commit ec4fbd6475
("inet: frag: release spinlock before calling icmp_send()")

Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Eric Dumazet
2018-03-31 12:58:51 -07:00
committed by David S. Miller
parent 6befe4a78b
commit 399d1404be
3 changed files with 30 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
include/net/inet_frag.h
View File

@@ -119,11 +119,6 @@ static inline void inet_frag_put(struct inet_frag_queue *q)
inet_frag_destroy(q); inet_frag_destroy(q);
} }
static inline bool inet_frag_evicting(struct inet_frag_queue *q)
{
return false;
}
/* Memory Tracking Functions. */ /* Memory Tracking Functions. */
static inline int frag_mem_limit(struct netns_frags *nf) static inline int frag_mem_limit(struct netns_frags *nf)

61
net/ipv4/ip_fragment.c
View File

@@ -143,8 +143,11 @@ static bool frag_expire_skip_icmp(u32 user)
static void ip_expire(struct timer_list *t) static void ip_expire(struct timer_list *t)
{ {
struct inet_frag_queue *frag = from_timer(frag, t, timer); struct inet_frag_queue *frag = from_timer(frag, t, timer);
struct ipq *qp; struct sk_buff *clone, *head;
const struct iphdr *iph;
struct net *net; struct net *net;
struct ipq *qp;
int err;
qp = container_of(frag, struct ipq, q); qp = container_of(frag, struct ipq, q);
net = container_of(qp->q.net, struct net, ipv4.frags); net = container_of(qp->q.net, struct net, ipv4.frags);
@@ -158,45 +161,41 @@ static void ip_expire(struct timer_list *t)
ipq_kill(qp); ipq_kill(qp);
__IP_INC_STATS(net, IPSTATS_MIB_REASMFAILS); __IP_INC_STATS(net, IPSTATS_MIB_REASMFAILS);
if (!inet_frag_evicting(&qp->q)) { head = qp->q.fragments;
struct sk_buff *clone, *head = qp->q.fragments;
const struct iphdr *iph;
int err;
__IP_INC_STATS(net, IPSTATS_MIB_REASMTIMEOUT); __IP_INC_STATS(net, IPSTATS_MIB_REASMTIMEOUT);
if (!(qp->q.flags & INET_FRAG_FIRST_IN) || !qp->q.fragments) if (!(qp->q.flags & INET_FRAG_FIRST_IN) || !head)
goto out; goto out;
head->dev = dev_get_by_index_rcu(net, qp->iif); head->dev = dev_get_by_index_rcu(net, qp->iif);
if (!head->dev) if (!head->dev)
goto out; goto out;
/* skb has no dst, perform route lookup again */ /* skb has no dst, perform route lookup again */
iph = ip_hdr(head); iph = ip_hdr(head);
err = ip_route_input_noref(head, iph->daddr, iph->saddr, err = ip_route_input_noref(head, iph->daddr, iph->saddr,
iph->tos, head->dev); iph->tos, head->dev);
if (err) if (err)
goto out; goto out;
/* Only an end host needs to send an ICMP /* Only an end host needs to send an ICMP
* "Fragment Reassembly Timeout" message, per RFC792. * "Fragment Reassembly Timeout" message, per RFC792.
*/ */
if (frag_expire_skip_icmp(qp->q.key.v4.user) && if (frag_expire_skip_icmp(qp->q.key.v4.user) &&
(skb_rtable(head)->rt_type != RTN_LOCAL)) (skb_rtable(head)->rt_type != RTN_LOCAL))
goto out; goto out;
clone = skb_clone(head, GFP_ATOMIC); clone = skb_clone(head, GFP_ATOMIC);
/* Send an ICMP "Fragment Reassembly Timeout" message. */ /* Send an ICMP "Fragment Reassembly Timeout" message. */
if (clone) { if (clone) {
spin_unlock(&qp->q.lock); spin_unlock(&qp->q.lock);
icmp_send(clone, ICMP_TIME_EXCEEDED, icmp_send(clone, ICMP_TIME_EXCEEDED,
ICMP_EXC_FRAGTIME, 0); ICMP_EXC_FRAGTIME, 0);
consume_skb(clone); consume_skb(clone);
goto out_rcu_unlock; goto out_rcu_unlock;
}
} }
out: out:
spin_unlock(&qp->q.lock); spin_unlock(&qp->q.lock);

4
net/ipv6/reassembly.c
View File

@@ -106,10 +106,6 @@ void ip6_expire_frag_queue(struct net *net, struct frag_queue *fq)
goto out_rcu_unlock; goto out_rcu_unlock;
__IP6_INC_STATS(net, __in6_dev_get(dev), IPSTATS_MIB_REASMFAILS); __IP6_INC_STATS(net, __in6_dev_get(dev), IPSTATS_MIB_REASMFAILS);
if (inet_frag_evicting(&fq->q))
goto out_rcu_unlock;
__IP6_INC_STATS(net, __in6_dev_get(dev), IPSTATS_MIB_REASMTIMEOUT); __IP6_INC_STATS(net, __in6_dev_get(dev), IPSTATS_MIB_REASMTIMEOUT);
/* Don't send error if the first segment did not arrive. */ /* Don't send error if the first segment did not arrive. */