diff options
| author | Benjamin Herrenschmidt <benh@kernel.crashing.org> | 2013-04-24 14:43:36 +1000 |
|---|---|---|
| committer | Benjamin Herrenschmidt <benh@kernel.crashing.org> | 2013-04-24 14:43:36 +1000 |
| commit | 234d15def96ac49027dc869f7bc250d5cb0eb5d7 (patch) | |
| tree | 51fba17fa3949138c73640ba7cd53988ac712340 /net/ipv4/ip_fragment.c | |
| parent | 6747e83235caecd30b186d1282e4eba7679f81b7 (diff) | |
| parent | 60d509fa6a9c4653a86ad830e4c4b30360b23f0e (diff) | |
Merge remote-tracking branch 'origin/master' into next
Merge upstream to get the audit fixes
Diffstat (limited to 'net/ipv4/ip_fragment.c')
| -rw-r--r-- | net/ipv4/ip_fragment.c | 14 |
1 files changed, 10 insertions, 4 deletions
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c index a6445b843ef4..52c273ea05c3 100644 --- a/net/ipv4/ip_fragment.c +++ b/net/ipv4/ip_fragment.c @@ -248,8 +248,7 @@ static void ip_expire(unsigned long arg) if (!head->dev) goto out_rcu_unlock; - /* skb dst is stale, drop it, and perform route lookup again */ - skb_dst_drop(head); + /* skb has no dst, perform route lookup again */ iph = ip_hdr(head); err = ip_route_input_noref(head, iph->daddr, iph->saddr, iph->tos, head->dev); @@ -523,9 +522,16 @@ found: qp->q.max_size = skb->len + ihl; if (qp->q.last_in == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) && - qp->q.meat == qp->q.len) - return ip_frag_reasm(qp, prev, dev); + qp->q.meat == qp->q.len) { + unsigned long orefdst = skb->_skb_refdst; + skb->_skb_refdst = 0UL; + err = ip_frag_reasm(qp, prev, dev); + skb->_skb_refdst = orefdst; + return err; + } + + skb_dst_drop(skb); inet_frag_lru_move(&qp->q); return -EINPROGRESS; |