From: Eric Dumazet <[email protected]>
Date: Mon, 30 Jul 2018 21:50:29 -0700
> ip_frag_queue() might call pskb_pull() on one skb that
> is already in the fragment queue.
>
> We need to take care of possible truesize change, or we
> might have an imbalance of the netns frags memory usage.
>
> IPv6 is immune to this bug, because RFC5722, Section 4,
> amended by Errata ID 3089 states :
>
> When reassembling an IPv6 datagram, if
> one or more its constituent fragments is determined to be an
> overlapping fragment, the entire datagram (and any constituent
> fragments) MUST be silently discarded.
>
> Fixes: 158f323b9868 ("net: adjust skb->truesize in pskb_expand_head()")
> Signed-off-by: Eric Dumazet <[email protected]>
Applied and queued up for -stable.
Frankly, I think we should enforce the ipv6 rules for ipv4 too.
There is absolutely no reasonable situation where overlapping fragment
queue entries should arrive. None whatsoever.
