xref: /freebsd/sys/netinet/ip_reass.c (revision 3416500aef140042c64bc149cb1ec6620483bc44)
1 /*-
2  * Copyright (c) 2015 Gleb Smirnoff <glebius@FreeBSD.org>
3  * Copyright (c) 2015 Adrian Chadd <adrian@FreeBSD.org>
4  * Copyright (c) 1982, 1986, 1988, 1993
5  *	The Regents of the University of California.  All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. Neither the name of the University nor the names of its contributors
16  *    may be used to endorse or promote products derived from this software
17  *    without specific prior written permission.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29  * SUCH DAMAGE.
30  *
31  *	@(#)ip_input.c	8.2 (Berkeley) 1/4/94
32  */
33 
34 #include <sys/cdefs.h>
35 __FBSDID("$FreeBSD$");
36 
37 #include "opt_rss.h"
38 
39 #include <sys/param.h>
40 #include <sys/systm.h>
41 #include <sys/eventhandler.h>
42 #include <sys/hash.h>
43 #include <sys/mbuf.h>
44 #include <sys/malloc.h>
45 #include <sys/lock.h>
46 #include <sys/mutex.h>
47 #include <sys/sysctl.h>
48 
49 #include <net/rss_config.h>
50 #include <net/netisr.h>
51 #include <net/vnet.h>
52 
53 #include <netinet/in.h>
54 #include <netinet/ip.h>
55 #include <netinet/ip_var.h>
56 #include <netinet/in_rss.h>
57 #ifdef MAC
58 #include <security/mac/mac_framework.h>
59 #endif
60 
61 SYSCTL_DECL(_net_inet_ip);
62 
63 /*
64  * Reassembly headers are stored in hash buckets.
65  */
66 #define	IPREASS_NHASH_LOG2	6
67 #define	IPREASS_NHASH		(1 << IPREASS_NHASH_LOG2)
68 #define	IPREASS_HMASK		(IPREASS_NHASH - 1)
69 
70 struct ipqbucket {
71 	TAILQ_HEAD(ipqhead, ipq) head;
72 	struct mtx		 lock;
73 };
74 
75 static VNET_DEFINE(struct ipqbucket, ipq[IPREASS_NHASH]);
76 #define	V_ipq		VNET(ipq)
77 static VNET_DEFINE(uint32_t, ipq_hashseed);
78 #define V_ipq_hashseed   VNET(ipq_hashseed)
79 
80 #define	IPQ_LOCK(i)	mtx_lock(&V_ipq[i].lock)
81 #define	IPQ_TRYLOCK(i)	mtx_trylock(&V_ipq[i].lock)
82 #define	IPQ_UNLOCK(i)	mtx_unlock(&V_ipq[i].lock)
83 #define	IPQ_LOCK_ASSERT(i)	mtx_assert(&V_ipq[i].lock, MA_OWNED)
84 
85 void		ipreass_init(void);
86 void		ipreass_drain(void);
87 void		ipreass_slowtimo(void);
88 #ifdef VIMAGE
89 void		ipreass_destroy(void);
90 #endif
91 static int	sysctl_maxfragpackets(SYSCTL_HANDLER_ARGS);
92 static void	ipreass_zone_change(void *);
93 static void	ipreass_drain_tomax(void);
94 static void	ipq_free(struct ipqhead *, struct ipq *);
95 static struct ipq * ipq_reuse(int);
96 
97 static inline void
98 ipq_timeout(struct ipqhead *head, struct ipq *fp)
99 {
100 
101 	IPSTAT_ADD(ips_fragtimeout, fp->ipq_nfrags);
102 	ipq_free(head, fp);
103 }
104 
105 static inline void
106 ipq_drop(struct ipqhead *head, struct ipq *fp)
107 {
108 
109 	IPSTAT_ADD(ips_fragdropped, fp->ipq_nfrags);
110 	ipq_free(head, fp);
111 }
112 
113 static VNET_DEFINE(uma_zone_t, ipq_zone);
114 #define	V_ipq_zone	VNET(ipq_zone)
115 SYSCTL_PROC(_net_inet_ip, OID_AUTO, maxfragpackets, CTLFLAG_VNET |
116     CTLTYPE_INT | CTLFLAG_RW, NULL, 0, sysctl_maxfragpackets, "I",
117     "Maximum number of IPv4 fragment reassembly queue entries");
118 SYSCTL_UMA_CUR(_net_inet_ip, OID_AUTO, fragpackets, CTLFLAG_VNET,
119     &VNET_NAME(ipq_zone),
120     "Current number of IPv4 fragment reassembly queue entries");
121 
122 static VNET_DEFINE(int, noreass);
123 #define	V_noreass	VNET(noreass)
124 
125 static VNET_DEFINE(int, maxfragsperpacket);
126 #define	V_maxfragsperpacket	VNET(maxfragsperpacket)
127 SYSCTL_INT(_net_inet_ip, OID_AUTO, maxfragsperpacket, CTLFLAG_VNET | CTLFLAG_RW,
128     &VNET_NAME(maxfragsperpacket), 0,
129     "Maximum number of IPv4 fragments allowed per packet");
130 
131 /*
132  * Take incoming datagram fragment and try to reassemble it into
133  * whole datagram.  If the argument is the first fragment or one
134  * in between the function will return NULL and store the mbuf
135  * in the fragment chain.  If the argument is the last fragment
136  * the packet will be reassembled and the pointer to the new
137  * mbuf returned for further processing.  Only m_tags attached
138  * to the first packet/fragment are preserved.
139  * The IP header is *NOT* adjusted out of iplen.
140  */
141 #define	M_IP_FRAG	M_PROTO9
142 struct mbuf *
143 ip_reass(struct mbuf *m)
144 {
145 	struct ip *ip;
146 	struct mbuf *p, *q, *nq, *t;
147 	struct ipq *fp;
148 	struct ipqhead *head;
149 	int i, hlen, next;
150 	u_int8_t ecn, ecn0;
151 	uint32_t hash;
152 #ifdef	RSS
153 	uint32_t rss_hash, rss_type;
154 #endif
155 
156 	/*
157 	 * If no reassembling or maxfragsperpacket are 0,
158 	 * never accept fragments.
159 	 */
160 	if (V_noreass == 1 || V_maxfragsperpacket == 0) {
161 		IPSTAT_INC(ips_fragments);
162 		IPSTAT_INC(ips_fragdropped);
163 		m_freem(m);
164 		return (NULL);
165 	}
166 
167 	ip = mtod(m, struct ip *);
168 	hlen = ip->ip_hl << 2;
169 
170 	/*
171 	 * Adjust ip_len to not reflect header,
172 	 * convert offset of this to bytes.
173 	 */
174 	ip->ip_len = htons(ntohs(ip->ip_len) - hlen);
175 	if (ip->ip_off & htons(IP_MF)) {
176 		/*
177 		 * Make sure that fragments have a data length
178 		 * that's a non-zero multiple of 8 bytes.
179 		 */
180 		if (ip->ip_len == htons(0) || (ntohs(ip->ip_len) & 0x7) != 0) {
181 			IPSTAT_INC(ips_toosmall); /* XXX */
182 			IPSTAT_INC(ips_fragdropped);
183 			m_freem(m);
184 			return (NULL);
185 		}
186 		m->m_flags |= M_IP_FRAG;
187 	} else
188 		m->m_flags &= ~M_IP_FRAG;
189 	ip->ip_off = htons(ntohs(ip->ip_off) << 3);
190 
191 	/*
192 	 * Attempt reassembly; if it succeeds, proceed.
193 	 * ip_reass() will return a different mbuf.
194 	 */
195 	IPSTAT_INC(ips_fragments);
196 	m->m_pkthdr.PH_loc.ptr = ip;
197 
198 	/*
199 	 * Presence of header sizes in mbufs
200 	 * would confuse code below.
201 	 */
202 	m->m_data += hlen;
203 	m->m_len -= hlen;
204 
205 	hash = ip->ip_src.s_addr ^ ip->ip_id;
206 	hash = jenkins_hash32(&hash, 1, V_ipq_hashseed) & IPREASS_HMASK;
207 	head = &V_ipq[hash].head;
208 	IPQ_LOCK(hash);
209 
210 	/*
211 	 * Look for queue of fragments
212 	 * of this datagram.
213 	 */
214 	TAILQ_FOREACH(fp, head, ipq_list)
215 		if (ip->ip_id == fp->ipq_id &&
216 		    ip->ip_src.s_addr == fp->ipq_src.s_addr &&
217 		    ip->ip_dst.s_addr == fp->ipq_dst.s_addr &&
218 #ifdef MAC
219 		    mac_ipq_match(m, fp) &&
220 #endif
221 		    ip->ip_p == fp->ipq_p)
222 			break;
223 	/*
224 	 * If first fragment to arrive, create a reassembly queue.
225 	 */
226 	if (fp == NULL) {
227 		fp = uma_zalloc(V_ipq_zone, M_NOWAIT);
228 		if (fp == NULL)
229 			fp = ipq_reuse(hash);
230 #ifdef MAC
231 		if (mac_ipq_init(fp, M_NOWAIT) != 0) {
232 			uma_zfree(V_ipq_zone, fp);
233 			fp = NULL;
234 			goto dropfrag;
235 		}
236 		mac_ipq_create(m, fp);
237 #endif
238 		TAILQ_INSERT_HEAD(head, fp, ipq_list);
239 		fp->ipq_nfrags = 1;
240 		fp->ipq_ttl = IPFRAGTTL;
241 		fp->ipq_p = ip->ip_p;
242 		fp->ipq_id = ip->ip_id;
243 		fp->ipq_src = ip->ip_src;
244 		fp->ipq_dst = ip->ip_dst;
245 		fp->ipq_frags = m;
246 		m->m_nextpkt = NULL;
247 		goto done;
248 	} else {
249 		fp->ipq_nfrags++;
250 #ifdef MAC
251 		mac_ipq_update(m, fp);
252 #endif
253 	}
254 
255 #define GETIP(m)	((struct ip*)((m)->m_pkthdr.PH_loc.ptr))
256 
257 	/*
258 	 * Handle ECN by comparing this segment with the first one;
259 	 * if CE is set, do not lose CE.
260 	 * drop if CE and not-ECT are mixed for the same packet.
261 	 */
262 	ecn = ip->ip_tos & IPTOS_ECN_MASK;
263 	ecn0 = GETIP(fp->ipq_frags)->ip_tos & IPTOS_ECN_MASK;
264 	if (ecn == IPTOS_ECN_CE) {
265 		if (ecn0 == IPTOS_ECN_NOTECT)
266 			goto dropfrag;
267 		if (ecn0 != IPTOS_ECN_CE)
268 			GETIP(fp->ipq_frags)->ip_tos |= IPTOS_ECN_CE;
269 	}
270 	if (ecn == IPTOS_ECN_NOTECT && ecn0 != IPTOS_ECN_NOTECT)
271 		goto dropfrag;
272 
273 	/*
274 	 * Find a segment which begins after this one does.
275 	 */
276 	for (p = NULL, q = fp->ipq_frags; q; p = q, q = q->m_nextpkt)
277 		if (ntohs(GETIP(q)->ip_off) > ntohs(ip->ip_off))
278 			break;
279 
280 	/*
281 	 * If there is a preceding segment, it may provide some of
282 	 * our data already.  If so, drop the data from the incoming
283 	 * segment.  If it provides all of our data, drop us, otherwise
284 	 * stick new segment in the proper place.
285 	 *
286 	 * If some of the data is dropped from the preceding
287 	 * segment, then it's checksum is invalidated.
288 	 */
289 	if (p) {
290 		i = ntohs(GETIP(p)->ip_off) + ntohs(GETIP(p)->ip_len) -
291 		    ntohs(ip->ip_off);
292 		if (i > 0) {
293 			if (i >= ntohs(ip->ip_len))
294 				goto dropfrag;
295 			m_adj(m, i);
296 			m->m_pkthdr.csum_flags = 0;
297 			ip->ip_off = htons(ntohs(ip->ip_off) + i);
298 			ip->ip_len = htons(ntohs(ip->ip_len) - i);
299 		}
300 		m->m_nextpkt = p->m_nextpkt;
301 		p->m_nextpkt = m;
302 	} else {
303 		m->m_nextpkt = fp->ipq_frags;
304 		fp->ipq_frags = m;
305 	}
306 
307 	/*
308 	 * While we overlap succeeding segments trim them or,
309 	 * if they are completely covered, dequeue them.
310 	 */
311 	for (; q != NULL && ntohs(ip->ip_off) + ntohs(ip->ip_len) >
312 	    ntohs(GETIP(q)->ip_off); q = nq) {
313 		i = (ntohs(ip->ip_off) + ntohs(ip->ip_len)) -
314 		    ntohs(GETIP(q)->ip_off);
315 		if (i < ntohs(GETIP(q)->ip_len)) {
316 			GETIP(q)->ip_len = htons(ntohs(GETIP(q)->ip_len) - i);
317 			GETIP(q)->ip_off = htons(ntohs(GETIP(q)->ip_off) + i);
318 			m_adj(q, i);
319 			q->m_pkthdr.csum_flags = 0;
320 			break;
321 		}
322 		nq = q->m_nextpkt;
323 		m->m_nextpkt = nq;
324 		IPSTAT_INC(ips_fragdropped);
325 		fp->ipq_nfrags--;
326 		m_freem(q);
327 	}
328 
329 	/*
330 	 * Check for complete reassembly and perform frag per packet
331 	 * limiting.
332 	 *
333 	 * Frag limiting is performed here so that the nth frag has
334 	 * a chance to complete the packet before we drop the packet.
335 	 * As a result, n+1 frags are actually allowed per packet, but
336 	 * only n will ever be stored. (n = maxfragsperpacket.)
337 	 *
338 	 */
339 	next = 0;
340 	for (p = NULL, q = fp->ipq_frags; q; p = q, q = q->m_nextpkt) {
341 		if (ntohs(GETIP(q)->ip_off) != next) {
342 			if (fp->ipq_nfrags > V_maxfragsperpacket)
343 				ipq_drop(head, fp);
344 			goto done;
345 		}
346 		next += ntohs(GETIP(q)->ip_len);
347 	}
348 	/* Make sure the last packet didn't have the IP_MF flag */
349 	if (p->m_flags & M_IP_FRAG) {
350 		if (fp->ipq_nfrags > V_maxfragsperpacket)
351 			ipq_drop(head, fp);
352 		goto done;
353 	}
354 
355 	/*
356 	 * Reassembly is complete.  Make sure the packet is a sane size.
357 	 */
358 	q = fp->ipq_frags;
359 	ip = GETIP(q);
360 	if (next + (ip->ip_hl << 2) > IP_MAXPACKET) {
361 		IPSTAT_INC(ips_toolong);
362 		ipq_drop(head, fp);
363 		goto done;
364 	}
365 
366 	/*
367 	 * Concatenate fragments.
368 	 */
369 	m = q;
370 	t = m->m_next;
371 	m->m_next = NULL;
372 	m_cat(m, t);
373 	nq = q->m_nextpkt;
374 	q->m_nextpkt = NULL;
375 	for (q = nq; q != NULL; q = nq) {
376 		nq = q->m_nextpkt;
377 		q->m_nextpkt = NULL;
378 		m->m_pkthdr.csum_flags &= q->m_pkthdr.csum_flags;
379 		m->m_pkthdr.csum_data += q->m_pkthdr.csum_data;
380 		m_cat(m, q);
381 	}
382 	/*
383 	 * In order to do checksumming faster we do 'end-around carry' here
384 	 * (and not in for{} loop), though it implies we are not going to
385 	 * reassemble more than 64k fragments.
386 	 */
387 	while (m->m_pkthdr.csum_data & 0xffff0000)
388 		m->m_pkthdr.csum_data = (m->m_pkthdr.csum_data & 0xffff) +
389 		    (m->m_pkthdr.csum_data >> 16);
390 #ifdef MAC
391 	mac_ipq_reassemble(fp, m);
392 	mac_ipq_destroy(fp);
393 #endif
394 
395 	/*
396 	 * Create header for new ip packet by modifying header of first
397 	 * packet;  dequeue and discard fragment reassembly header.
398 	 * Make header visible.
399 	 */
400 	ip->ip_len = htons((ip->ip_hl << 2) + next);
401 	ip->ip_src = fp->ipq_src;
402 	ip->ip_dst = fp->ipq_dst;
403 	TAILQ_REMOVE(head, fp, ipq_list);
404 	uma_zfree(V_ipq_zone, fp);
405 	m->m_len += (ip->ip_hl << 2);
406 	m->m_data -= (ip->ip_hl << 2);
407 	/* some debugging cruft by sklower, below, will go away soon */
408 	if (m->m_flags & M_PKTHDR)	/* XXX this should be done elsewhere */
409 		m_fixhdr(m);
410 	IPSTAT_INC(ips_reassembled);
411 	IPQ_UNLOCK(hash);
412 
413 #ifdef	RSS
414 	/*
415 	 * Query the RSS layer for the flowid / flowtype for the
416 	 * mbuf payload.
417 	 *
418 	 * For now, just assume we have to calculate a new one.
419 	 * Later on we should check to see if the assigned flowid matches
420 	 * what RSS wants for the given IP protocol and if so, just keep it.
421 	 *
422 	 * We then queue into the relevant netisr so it can be dispatched
423 	 * to the correct CPU.
424 	 *
425 	 * Note - this may return 1, which means the flowid in the mbuf
426 	 * is correct for the configured RSS hash types and can be used.
427 	 */
428 	if (rss_mbuf_software_hash_v4(m, 0, &rss_hash, &rss_type) == 0) {
429 		m->m_pkthdr.flowid = rss_hash;
430 		M_HASHTYPE_SET(m, rss_type);
431 	}
432 
433 	/*
434 	 * Queue/dispatch for reprocessing.
435 	 *
436 	 * Note: this is much slower than just handling the frame in the
437 	 * current receive context.  It's likely worth investigating
438 	 * why this is.
439 	 */
440 	netisr_dispatch(NETISR_IP_DIRECT, m);
441 	return (NULL);
442 #endif
443 
444 	/* Handle in-line */
445 	return (m);
446 
447 dropfrag:
448 	IPSTAT_INC(ips_fragdropped);
449 	if (fp != NULL)
450 		fp->ipq_nfrags--;
451 	m_freem(m);
452 done:
453 	IPQ_UNLOCK(hash);
454 	return (NULL);
455 
456 #undef GETIP
457 }
458 
459 /*
460  * Initialize IP reassembly structures.
461  */
462 void
463 ipreass_init(void)
464 {
465 
466 	for (int i = 0; i < IPREASS_NHASH; i++) {
467 		TAILQ_INIT(&V_ipq[i].head);
468 		mtx_init(&V_ipq[i].lock, "IP reassembly", NULL,
469 		    MTX_DEF | MTX_DUPOK);
470 	}
471 	V_ipq_hashseed = arc4random();
472 	V_maxfragsperpacket = 16;
473 	V_ipq_zone = uma_zcreate("ipq", sizeof(struct ipq), NULL, NULL, NULL,
474 	    NULL, UMA_ALIGN_PTR, 0);
475 	uma_zone_set_max(V_ipq_zone, nmbclusters / 32);
476 
477 	if (IS_DEFAULT_VNET(curvnet))
478 		EVENTHANDLER_REGISTER(nmbclusters_change, ipreass_zone_change,
479 		    NULL, EVENTHANDLER_PRI_ANY);
480 }
481 
482 /*
483  * If a timer expires on a reassembly queue, discard it.
484  */
485 void
486 ipreass_slowtimo(void)
487 {
488 	struct ipq *fp, *tmp;
489 
490 	for (int i = 0; i < IPREASS_NHASH; i++) {
491 		IPQ_LOCK(i);
492 		TAILQ_FOREACH_SAFE(fp, &V_ipq[i].head, ipq_list, tmp)
493 		if (--fp->ipq_ttl == 0)
494 				ipq_timeout(&V_ipq[i].head, fp);
495 		IPQ_UNLOCK(i);
496 	}
497 }
498 
499 /*
500  * Drain off all datagram fragments.
501  */
502 void
503 ipreass_drain(void)
504 {
505 
506 	for (int i = 0; i < IPREASS_NHASH; i++) {
507 		IPQ_LOCK(i);
508 		while(!TAILQ_EMPTY(&V_ipq[i].head))
509 			ipq_drop(&V_ipq[i].head, TAILQ_FIRST(&V_ipq[i].head));
510 		IPQ_UNLOCK(i);
511 	}
512 }
513 
514 #ifdef VIMAGE
515 /*
516  * Destroy IP reassembly structures.
517  */
518 void
519 ipreass_destroy(void)
520 {
521 
522 	ipreass_drain();
523 	uma_zdestroy(V_ipq_zone);
524 	for (int i = 0; i < IPREASS_NHASH; i++)
525 		mtx_destroy(&V_ipq[i].lock);
526 }
527 #endif
528 
529 /*
530  * After maxnipq has been updated, propagate the change to UMA.  The UMA zone
531  * max has slightly different semantics than the sysctl, for historical
532  * reasons.
533  */
534 static void
535 ipreass_drain_tomax(void)
536 {
537 	int target;
538 
539 	/*
540 	 * If we are over the maximum number of fragments,
541 	 * drain off enough to get down to the new limit,
542 	 * stripping off last elements on queues.  Every
543 	 * run we strip the oldest element from each bucket.
544 	 */
545 	target = uma_zone_get_max(V_ipq_zone);
546 	while (uma_zone_get_cur(V_ipq_zone) > target) {
547 		struct ipq *fp;
548 
549 		for (int i = 0; i < IPREASS_NHASH; i++) {
550 			IPQ_LOCK(i);
551 			fp = TAILQ_LAST(&V_ipq[i].head, ipqhead);
552 			if (fp != NULL)
553 				ipq_timeout(&V_ipq[i].head, fp);
554 			IPQ_UNLOCK(i);
555 		}
556 	}
557 }
558 
559 static void
560 ipreass_zone_change(void *tag)
561 {
562 
563 	uma_zone_set_max(V_ipq_zone, nmbclusters / 32);
564 	ipreass_drain_tomax();
565 }
566 
567 /*
568  * Change the limit on the UMA zone, or disable the fragment allocation
569  * at all.  Since 0 and -1 is a special values here, we need our own handler,
570  * instead of sysctl_handle_uma_zone_max().
571  */
572 static int
573 sysctl_maxfragpackets(SYSCTL_HANDLER_ARGS)
574 {
575 	int error, max;
576 
577 	if (V_noreass == 0) {
578 		max = uma_zone_get_max(V_ipq_zone);
579 		if (max == 0)
580 			max = -1;
581 	} else
582 		max = 0;
583 	error = sysctl_handle_int(oidp, &max, 0, req);
584 	if (error || !req->newptr)
585 		return (error);
586 	if (max > 0) {
587 		/*
588 		 * XXXRW: Might be a good idea to sanity check the argument
589 		 * and place an extreme upper bound.
590 		 */
591 		max = uma_zone_set_max(V_ipq_zone, max);
592 		ipreass_drain_tomax();
593 		V_noreass = 0;
594 	} else if (max == 0) {
595 		V_noreass = 1;
596 		ipreass_drain();
597 	} else if (max == -1) {
598 		V_noreass = 0;
599 		uma_zone_set_max(V_ipq_zone, 0);
600 	} else
601 		return (EINVAL);
602 	return (0);
603 }
604 
605 /*
606  * Seek for old fragment queue header that can be reused.  Try to
607  * reuse a header from currently locked hash bucket.
608  */
609 static struct ipq *
610 ipq_reuse(int start)
611 {
612 	struct ipq *fp;
613 	int i;
614 
615 	IPQ_LOCK_ASSERT(start);
616 
617 	for (i = start;; i++) {
618 		if (i == IPREASS_NHASH)
619 			i = 0;
620 		if (i != start && IPQ_TRYLOCK(i) == 0)
621 			continue;
622 		fp = TAILQ_LAST(&V_ipq[i].head, ipqhead);
623 		if (fp) {
624 			struct mbuf *m;
625 
626 			IPSTAT_ADD(ips_fragtimeout, fp->ipq_nfrags);
627 			while (fp->ipq_frags) {
628 				m = fp->ipq_frags;
629 				fp->ipq_frags = m->m_nextpkt;
630 				m_freem(m);
631 			}
632 			TAILQ_REMOVE(&V_ipq[i].head, fp, ipq_list);
633 			if (i != start)
634 				IPQ_UNLOCK(i);
635 			IPQ_LOCK_ASSERT(start);
636 			return (fp);
637 		}
638 		if (i != start)
639 			IPQ_UNLOCK(i);
640 	}
641 }
642 
643 /*
644  * Free a fragment reassembly header and all associated datagrams.
645  */
646 static void
647 ipq_free(struct ipqhead *fhp, struct ipq *fp)
648 {
649 	struct mbuf *q;
650 
651 	while (fp->ipq_frags) {
652 		q = fp->ipq_frags;
653 		fp->ipq_frags = q->m_nextpkt;
654 		m_freem(q);
655 	}
656 	TAILQ_REMOVE(fhp, fp, ipq_list);
657 	uma_zfree(V_ipq_zone, fp);
658 }
659