|
@@ -203,7 +203,7 @@ static inline void frag_free_queue(struct frag_queue *fq, int *work)
|
|
|
|
|
|
static inline struct frag_queue *frag_alloc_queue(void)
|
|
|
{
|
|
|
- struct frag_queue *fq = kmalloc(sizeof(struct frag_queue), GFP_ATOMIC);
|
|
|
+ struct frag_queue *fq = kzalloc(sizeof(struct frag_queue), GFP_ATOMIC);
|
|
|
|
|
|
if(!fq)
|
|
|
return NULL;
|
|
@@ -288,6 +288,7 @@ static void ip6_evictor(void)
|
|
|
static void ip6_frag_expire(unsigned long data)
|
|
|
{
|
|
|
struct frag_queue *fq = (struct frag_queue *) data;
|
|
|
+ struct net_device *dev;
|
|
|
|
|
|
spin_lock(&fq->lock);
|
|
|
|
|
@@ -299,22 +300,22 @@ static void ip6_frag_expire(unsigned long data)
|
|
|
IP6_INC_STATS_BH(IPSTATS_MIB_REASMTIMEOUT);
|
|
|
IP6_INC_STATS_BH(IPSTATS_MIB_REASMFAILS);
|
|
|
|
|
|
- /* Send error only if the first segment arrived. */
|
|
|
- if (fq->last_in&FIRST_IN && fq->fragments) {
|
|
|
- struct net_device *dev = dev_get_by_index(fq->iif);
|
|
|
+ /* Don't send error if the first segment did not arrive. */
|
|
|
+ if (!(fq->last_in&FIRST_IN) || !fq->fragments)
|
|
|
+ goto out;
|
|
|
|
|
|
- /*
|
|
|
- But use as source device on which LAST ARRIVED
|
|
|
- segment was received. And do not use fq->dev
|
|
|
- pointer directly, device might already disappeared.
|
|
|
- */
|
|
|
- if (dev) {
|
|
|
- fq->fragments->dev = dev;
|
|
|
- icmpv6_send(fq->fragments, ICMPV6_TIME_EXCEED, ICMPV6_EXC_FRAGTIME, 0,
|
|
|
- dev);
|
|
|
- dev_put(dev);
|
|
|
- }
|
|
|
- }
|
|
|
+ dev = dev_get_by_index(fq->iif);
|
|
|
+ if (!dev)
|
|
|
+ goto out;
|
|
|
+
|
|
|
+ /*
|
|
|
+ But use as source device on which LAST ARRIVED
|
|
|
+ segment was received. And do not use fq->dev
|
|
|
+ pointer directly, device might already disappeared.
|
|
|
+ */
|
|
|
+ fq->fragments->dev = dev;
|
|
|
+ icmpv6_send(fq->fragments, ICMPV6_TIME_EXCEED, ICMPV6_EXC_FRAGTIME, 0, dev);
|
|
|
+ dev_put(dev);
|
|
|
out:
|
|
|
spin_unlock(&fq->lock);
|
|
|
fq_put(fq, NULL);
|
|
@@ -368,8 +369,6 @@ ip6_frag_create(unsigned int hash, u32 id, struct in6_addr *src, struct in6_addr
|
|
|
if ((fq = frag_alloc_queue()) == NULL)
|
|
|
goto oom;
|
|
|
|
|
|
- memset(fq, 0, sizeof(struct frag_queue));
|
|
|
-
|
|
|
fq->id = id;
|
|
|
ipv6_addr_copy(&fq->saddr, src);
|
|
|
ipv6_addr_copy(&fq->daddr, dst);
|