xref: /freebsd/sys/netinet/ip_reass.c (revision eb69d1f144a6fcc765d1b9d44a5ae8082353e70b)
1 /*-
2  * Copyright (c) 2015 Gleb Smirnoff <glebius@FreeBSD.org>
3  * Copyright (c) 2015 Adrian Chadd <adrian@FreeBSD.org>
4  * Copyright (c) 1982, 1986, 1988, 1993
5  *	The Regents of the University of California.  All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. Neither the name of the University nor the names of its contributors
16  *    may be used to endorse or promote products derived from this software
17  *    without specific prior written permission.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29  * SUCH DAMAGE.
30  *
31  *	@(#)ip_input.c	8.2 (Berkeley) 1/4/94
32  */
33 
34 #include <sys/cdefs.h>
35 __FBSDID("$FreeBSD$");
36 
37 #include "opt_rss.h"
38 
39 #include <sys/param.h>
40 #include <sys/systm.h>
41 #include <sys/eventhandler.h>
42 #include <sys/hash.h>
43 #include <sys/mbuf.h>
44 #include <sys/malloc.h>
45 #include <sys/lock.h>
46 #include <sys/mutex.h>
47 #include <sys/sysctl.h>
48 
49 #include <net/rss_config.h>
50 #include <net/netisr.h>
51 #include <net/vnet.h>
52 
53 #include <netinet/in.h>
54 #include <netinet/ip.h>
55 #include <netinet/ip_var.h>
56 #include <netinet/in_rss.h>
57 #ifdef MAC
58 #include <security/mac/mac_framework.h>
59 #endif
60 
61 SYSCTL_DECL(_net_inet_ip);
62 
63 /*
64  * Reassembly headers are stored in hash buckets.
65  */
66 #define	IPREASS_NHASH_LOG2	6
67 #define	IPREASS_NHASH		(1 << IPREASS_NHASH_LOG2)
68 #define	IPREASS_HMASK		(IPREASS_NHASH - 1)
69 
70 struct ipqbucket {
71 	TAILQ_HEAD(ipqhead, ipq) head;
72 	struct mtx		 lock;
73 };
74 
75 static VNET_DEFINE(struct ipqbucket, ipq[IPREASS_NHASH]);
76 #define	V_ipq		VNET(ipq)
77 static VNET_DEFINE(uint32_t, ipq_hashseed);
78 #define V_ipq_hashseed   VNET(ipq_hashseed)
79 
80 #define	IPQ_LOCK(i)	mtx_lock(&V_ipq[i].lock)
81 #define	IPQ_TRYLOCK(i)	mtx_trylock(&V_ipq[i].lock)
82 #define	IPQ_UNLOCK(i)	mtx_unlock(&V_ipq[i].lock)
83 #define	IPQ_LOCK_ASSERT(i)	mtx_assert(&V_ipq[i].lock, MA_OWNED)
84 
85 void		ipreass_init(void);
86 void		ipreass_drain(void);
87 void		ipreass_slowtimo(void);
88 #ifdef VIMAGE
89 void		ipreass_destroy(void);
90 #endif
91 static int	sysctl_maxfragpackets(SYSCTL_HANDLER_ARGS);
92 static void	ipreass_zone_change(void *);
93 static void	ipreass_drain_tomax(void);
94 static void	ipq_free(struct ipqhead *, struct ipq *);
95 static struct ipq * ipq_reuse(int);
96 
97 static inline void
98 ipq_timeout(struct ipqhead *head, struct ipq *fp)
99 {
100 
101 	IPSTAT_ADD(ips_fragtimeout, fp->ipq_nfrags);
102 	ipq_free(head, fp);
103 }
104 
105 static inline void
106 ipq_drop(struct ipqhead *head, struct ipq *fp)
107 {
108 
109 	IPSTAT_ADD(ips_fragdropped, fp->ipq_nfrags);
110 	ipq_free(head, fp);
111 }
112 
113 static VNET_DEFINE(uma_zone_t, ipq_zone);
114 #define	V_ipq_zone	VNET(ipq_zone)
115 SYSCTL_PROC(_net_inet_ip, OID_AUTO, maxfragpackets, CTLFLAG_VNET |
116     CTLTYPE_INT | CTLFLAG_RW, NULL, 0, sysctl_maxfragpackets, "I",
117     "Maximum number of IPv4 fragment reassembly queue entries");
118 SYSCTL_UMA_CUR(_net_inet_ip, OID_AUTO, fragpackets, CTLFLAG_VNET,
119     &VNET_NAME(ipq_zone),
120     "Current number of IPv4 fragment reassembly queue entries");
121 
122 static VNET_DEFINE(int, noreass);
123 #define	V_noreass	VNET(noreass)
124 
125 static VNET_DEFINE(int, maxfragsperpacket);
126 #define	V_maxfragsperpacket	VNET(maxfragsperpacket)
127 SYSCTL_INT(_net_inet_ip, OID_AUTO, maxfragsperpacket, CTLFLAG_VNET | CTLFLAG_RW,
128     &VNET_NAME(maxfragsperpacket), 0,
129     "Maximum number of IPv4 fragments allowed per packet");
130 
131 /*
132  * Take incoming datagram fragment and try to reassemble it into
133  * whole datagram.  If the argument is the first fragment or one
134  * in between the function will return NULL and store the mbuf
135  * in the fragment chain.  If the argument is the last fragment
136  * the packet will be reassembled and the pointer to the new
137  * mbuf returned for further processing.  Only m_tags attached
138  * to the first packet/fragment are preserved.
139  * The IP header is *NOT* adjusted out of iplen.
140  */
141 #define	M_IP_FRAG	M_PROTO9
142 struct mbuf *
143 ip_reass(struct mbuf *m)
144 {
145 	struct ip *ip;
146 	struct mbuf *p, *q, *nq, *t;
147 	struct ipq *fp;
148 	struct ipqhead *head;
149 	int i, hlen, next;
150 	u_int8_t ecn, ecn0;
151 	uint32_t hash;
152 #ifdef	RSS
153 	uint32_t rss_hash, rss_type;
154 #endif
155 
156 	/*
157 	 * If no reassembling or maxfragsperpacket are 0,
158 	 * never accept fragments.
159 	 */
160 	if (V_noreass == 1 || V_maxfragsperpacket == 0) {
161 		IPSTAT_INC(ips_fragments);
162 		IPSTAT_INC(ips_fragdropped);
163 		m_freem(m);
164 		return (NULL);
165 	}
166 
167 	ip = mtod(m, struct ip *);
168 	hlen = ip->ip_hl << 2;
169 
170 	/*
171 	 * Adjust ip_len to not reflect header,
172 	 * convert offset of this to bytes.
173 	 */
174 	ip->ip_len = htons(ntohs(ip->ip_len) - hlen);
175 	if (ip->ip_off & htons(IP_MF)) {
176 		/*
177 		 * Make sure that fragments have a data length
178 		 * that's a non-zero multiple of 8 bytes.
179 		 */
180 		if (ip->ip_len == htons(0) || (ntohs(ip->ip_len) & 0x7) != 0) {
181 			IPSTAT_INC(ips_toosmall); /* XXX */
182 			IPSTAT_INC(ips_fragdropped);
183 			m_freem(m);
184 			return (NULL);
185 		}
186 		m->m_flags |= M_IP_FRAG;
187 	} else
188 		m->m_flags &= ~M_IP_FRAG;
189 	ip->ip_off = htons(ntohs(ip->ip_off) << 3);
190 
191 	/*
192 	 * Attempt reassembly; if it succeeds, proceed.
193 	 * ip_reass() will return a different mbuf.
194 	 */
195 	IPSTAT_INC(ips_fragments);
196 	m->m_pkthdr.PH_loc.ptr = ip;
197 
198 	/*
199 	 * Presence of header sizes in mbufs
200 	 * would confuse code below.
201 	 */
202 	m->m_data += hlen;
203 	m->m_len -= hlen;
204 
205 	hash = ip->ip_src.s_addr ^ ip->ip_id;
206 	hash = jenkins_hash32(&hash, 1, V_ipq_hashseed) & IPREASS_HMASK;
207 	head = &V_ipq[hash].head;
208 	IPQ_LOCK(hash);
209 
210 	/*
211 	 * Look for queue of fragments
212 	 * of this datagram.
213 	 */
214 	TAILQ_FOREACH(fp, head, ipq_list)
215 		if (ip->ip_id == fp->ipq_id &&
216 		    ip->ip_src.s_addr == fp->ipq_src.s_addr &&
217 		    ip->ip_dst.s_addr == fp->ipq_dst.s_addr &&
218 #ifdef MAC
219 		    mac_ipq_match(m, fp) &&
220 #endif
221 		    ip->ip_p == fp->ipq_p)
222 			break;
223 	/*
224 	 * If first fragment to arrive, create a reassembly queue.
225 	 */
226 	if (fp == NULL) {
227 		fp = uma_zalloc(V_ipq_zone, M_NOWAIT);
228 		if (fp == NULL)
229 			fp = ipq_reuse(hash);
230 #ifdef MAC
231 		if (mac_ipq_init(fp, M_NOWAIT) != 0) {
232 			uma_zfree(V_ipq_zone, fp);
233 			fp = NULL;
234 			goto dropfrag;
235 		}
236 		mac_ipq_create(m, fp);
237 #endif
238 		TAILQ_INSERT_HEAD(head, fp, ipq_list);
239 		fp->ipq_nfrags = 1;
240 		fp->ipq_ttl = IPFRAGTTL;
241 		fp->ipq_p = ip->ip_p;
242 		fp->ipq_id = ip->ip_id;
243 		fp->ipq_src = ip->ip_src;
244 		fp->ipq_dst = ip->ip_dst;
245 		fp->ipq_frags = m;
246 		m->m_nextpkt = NULL;
247 		goto done;
248 	} else {
249 		fp->ipq_nfrags++;
250 #ifdef MAC
251 		mac_ipq_update(m, fp);
252 #endif
253 	}
254 
255 #define GETIP(m)	((struct ip*)((m)->m_pkthdr.PH_loc.ptr))
256 
257 	/*
258 	 * Handle ECN by comparing this segment with the first one;
259 	 * if CE is set, do not lose CE.
260 	 * drop if CE and not-ECT are mixed for the same packet.
261 	 */
262 	ecn = ip->ip_tos & IPTOS_ECN_MASK;
263 	ecn0 = GETIP(fp->ipq_frags)->ip_tos & IPTOS_ECN_MASK;
264 	if (ecn == IPTOS_ECN_CE) {
265 		if (ecn0 == IPTOS_ECN_NOTECT)
266 			goto dropfrag;
267 		if (ecn0 != IPTOS_ECN_CE)
268 			GETIP(fp->ipq_frags)->ip_tos |= IPTOS_ECN_CE;
269 	}
270 	if (ecn == IPTOS_ECN_NOTECT && ecn0 != IPTOS_ECN_NOTECT)
271 		goto dropfrag;
272 
273 	/*
274 	 * Find a segment which begins after this one does.
275 	 */
276 	for (p = NULL, q = fp->ipq_frags; q; p = q, q = q->m_nextpkt)
277 		if (ntohs(GETIP(q)->ip_off) > ntohs(ip->ip_off))
278 			break;
279 
280 	/*
281 	 * If there is a preceding segment, it may provide some of
282 	 * our data already.  If so, drop the data from the incoming
283 	 * segment.  If it provides all of our data, drop us, otherwise
284 	 * stick new segment in the proper place.
285 	 *
286 	 * If some of the data is dropped from the preceding
287 	 * segment, then it's checksum is invalidated.
288 	 */
289 	if (p) {
290 		i = ntohs(GETIP(p)->ip_off) + ntohs(GETIP(p)->ip_len) -
291 		    ntohs(ip->ip_off);
292 		if (i > 0) {
293 			if (i >= ntohs(ip->ip_len))
294 				goto dropfrag;
295 			m_adj(m, i);
296 			m->m_pkthdr.csum_flags = 0;
297 			ip->ip_off = htons(ntohs(ip->ip_off) + i);
298 			ip->ip_len = htons(ntohs(ip->ip_len) - i);
299 		}
300 		m->m_nextpkt = p->m_nextpkt;
301 		p->m_nextpkt = m;
302 	} else {
303 		m->m_nextpkt = fp->ipq_frags;
304 		fp->ipq_frags = m;
305 	}
306 
307 	/*
308 	 * While we overlap succeeding segments trim them or,
309 	 * if they are completely covered, dequeue them.
310 	 */
311 	for (; q != NULL && ntohs(ip->ip_off) + ntohs(ip->ip_len) >
312 	    ntohs(GETIP(q)->ip_off); q = nq) {
313 		i = (ntohs(ip->ip_off) + ntohs(ip->ip_len)) -
314 		    ntohs(GETIP(q)->ip_off);
315 		if (i < ntohs(GETIP(q)->ip_len)) {
316 			GETIP(q)->ip_len = htons(ntohs(GETIP(q)->ip_len) - i);
317 			GETIP(q)->ip_off = htons(ntohs(GETIP(q)->ip_off) + i);
318 			m_adj(q, i);
319 			q->m_pkthdr.csum_flags = 0;
320 			break;
321 		}
322 		nq = q->m_nextpkt;
323 		m->m_nextpkt = nq;
324 		IPSTAT_INC(ips_fragdropped);
325 		fp->ipq_nfrags--;
326 		m_freem(q);
327 	}
328 
329 	/*
330 	 * Check for complete reassembly and perform frag per packet
331 	 * limiting.
332 	 *
333 	 * Frag limiting is performed here so that the nth frag has
334 	 * a chance to complete the packet before we drop the packet.
335 	 * As a result, n+1 frags are actually allowed per packet, but
336 	 * only n will ever be stored. (n = maxfragsperpacket.)
337 	 *
338 	 */
339 	next = 0;
340 	for (p = NULL, q = fp->ipq_frags; q; p = q, q = q->m_nextpkt) {
341 		if (ntohs(GETIP(q)->ip_off) != next) {
342 			if (fp->ipq_nfrags > V_maxfragsperpacket)
343 				ipq_drop(head, fp);
344 			goto done;
345 		}
346 		next += ntohs(GETIP(q)->ip_len);
347 	}
348 	/* Make sure the last packet didn't have the IP_MF flag */
349 	if (p->m_flags & M_IP_FRAG) {
350 		if (fp->ipq_nfrags > V_maxfragsperpacket)
351 			ipq_drop(head, fp);
352 		goto done;
353 	}
354 
355 	/*
356 	 * Reassembly is complete.  Make sure the packet is a sane size.
357 	 */
358 	q = fp->ipq_frags;
359 	ip = GETIP(q);
360 	if (next + (ip->ip_hl << 2) > IP_MAXPACKET) {
361 		IPSTAT_INC(ips_toolong);
362 		ipq_drop(head, fp);
363 		goto done;
364 	}
365 
366 	/*
367 	 * Concatenate fragments.
368 	 */
369 	m = q;
370 	t = m->m_next;
371 	m->m_next = NULL;
372 	m_cat(m, t);
373 	nq = q->m_nextpkt;
374 	q->m_nextpkt = NULL;
375 	for (q = nq; q != NULL; q = nq) {
376 		nq = q->m_nextpkt;
377 		q->m_nextpkt = NULL;
378 		m->m_pkthdr.csum_flags &= q->m_pkthdr.csum_flags;
379 		m->m_pkthdr.csum_data += q->m_pkthdr.csum_data;
380 		m_demote_pkthdr(q);
381 		m_cat(m, q);
382 	}
383 	/*
384 	 * In order to do checksumming faster we do 'end-around carry' here
385 	 * (and not in for{} loop), though it implies we are not going to
386 	 * reassemble more than 64k fragments.
387 	 */
388 	while (m->m_pkthdr.csum_data & 0xffff0000)
389 		m->m_pkthdr.csum_data = (m->m_pkthdr.csum_data & 0xffff) +
390 		    (m->m_pkthdr.csum_data >> 16);
391 #ifdef MAC
392 	mac_ipq_reassemble(fp, m);
393 	mac_ipq_destroy(fp);
394 #endif
395 
396 	/*
397 	 * Create header for new ip packet by modifying header of first
398 	 * packet;  dequeue and discard fragment reassembly header.
399 	 * Make header visible.
400 	 */
401 	ip->ip_len = htons((ip->ip_hl << 2) + next);
402 	ip->ip_src = fp->ipq_src;
403 	ip->ip_dst = fp->ipq_dst;
404 	TAILQ_REMOVE(head, fp, ipq_list);
405 	uma_zfree(V_ipq_zone, fp);
406 	m->m_len += (ip->ip_hl << 2);
407 	m->m_data -= (ip->ip_hl << 2);
408 	/* some debugging cruft by sklower, below, will go away soon */
409 	if (m->m_flags & M_PKTHDR)	/* XXX this should be done elsewhere */
410 		m_fixhdr(m);
411 	IPSTAT_INC(ips_reassembled);
412 	IPQ_UNLOCK(hash);
413 
414 #ifdef	RSS
415 	/*
416 	 * Query the RSS layer for the flowid / flowtype for the
417 	 * mbuf payload.
418 	 *
419 	 * For now, just assume we have to calculate a new one.
420 	 * Later on we should check to see if the assigned flowid matches
421 	 * what RSS wants for the given IP protocol and if so, just keep it.
422 	 *
423 	 * We then queue into the relevant netisr so it can be dispatched
424 	 * to the correct CPU.
425 	 *
426 	 * Note - this may return 1, which means the flowid in the mbuf
427 	 * is correct for the configured RSS hash types and can be used.
428 	 */
429 	if (rss_mbuf_software_hash_v4(m, 0, &rss_hash, &rss_type) == 0) {
430 		m->m_pkthdr.flowid = rss_hash;
431 		M_HASHTYPE_SET(m, rss_type);
432 	}
433 
434 	/*
435 	 * Queue/dispatch for reprocessing.
436 	 *
437 	 * Note: this is much slower than just handling the frame in the
438 	 * current receive context.  It's likely worth investigating
439 	 * why this is.
440 	 */
441 	netisr_dispatch(NETISR_IP_DIRECT, m);
442 	return (NULL);
443 #endif
444 
445 	/* Handle in-line */
446 	return (m);
447 
448 dropfrag:
449 	IPSTAT_INC(ips_fragdropped);
450 	if (fp != NULL)
451 		fp->ipq_nfrags--;
452 	m_freem(m);
453 done:
454 	IPQ_UNLOCK(hash);
455 	return (NULL);
456 
457 #undef GETIP
458 }
459 
460 /*
461  * Initialize IP reassembly structures.
462  */
463 void
464 ipreass_init(void)
465 {
466 
467 	for (int i = 0; i < IPREASS_NHASH; i++) {
468 		TAILQ_INIT(&V_ipq[i].head);
469 		mtx_init(&V_ipq[i].lock, "IP reassembly", NULL,
470 		    MTX_DEF | MTX_DUPOK);
471 	}
472 	V_ipq_hashseed = arc4random();
473 	V_maxfragsperpacket = 16;
474 	V_ipq_zone = uma_zcreate("ipq", sizeof(struct ipq), NULL, NULL, NULL,
475 	    NULL, UMA_ALIGN_PTR, 0);
476 	uma_zone_set_max(V_ipq_zone, nmbclusters / 32);
477 
478 	if (IS_DEFAULT_VNET(curvnet))
479 		EVENTHANDLER_REGISTER(nmbclusters_change, ipreass_zone_change,
480 		    NULL, EVENTHANDLER_PRI_ANY);
481 }
482 
483 /*
484  * If a timer expires on a reassembly queue, discard it.
485  */
486 void
487 ipreass_slowtimo(void)
488 {
489 	struct ipq *fp, *tmp;
490 
491 	for (int i = 0; i < IPREASS_NHASH; i++) {
492 		IPQ_LOCK(i);
493 		TAILQ_FOREACH_SAFE(fp, &V_ipq[i].head, ipq_list, tmp)
494 		if (--fp->ipq_ttl == 0)
495 				ipq_timeout(&V_ipq[i].head, fp);
496 		IPQ_UNLOCK(i);
497 	}
498 }
499 
500 /*
501  * Drain off all datagram fragments.
502  */
503 void
504 ipreass_drain(void)
505 {
506 
507 	for (int i = 0; i < IPREASS_NHASH; i++) {
508 		IPQ_LOCK(i);
509 		while(!TAILQ_EMPTY(&V_ipq[i].head))
510 			ipq_drop(&V_ipq[i].head, TAILQ_FIRST(&V_ipq[i].head));
511 		IPQ_UNLOCK(i);
512 	}
513 }
514 
515 #ifdef VIMAGE
516 /*
517  * Destroy IP reassembly structures.
518  */
519 void
520 ipreass_destroy(void)
521 {
522 
523 	ipreass_drain();
524 	uma_zdestroy(V_ipq_zone);
525 	for (int i = 0; i < IPREASS_NHASH; i++)
526 		mtx_destroy(&V_ipq[i].lock);
527 }
528 #endif
529 
530 /*
531  * After maxnipq has been updated, propagate the change to UMA.  The UMA zone
532  * max has slightly different semantics than the sysctl, for historical
533  * reasons.
534  */
535 static void
536 ipreass_drain_tomax(void)
537 {
538 	int target;
539 
540 	/*
541 	 * If we are over the maximum number of fragments,
542 	 * drain off enough to get down to the new limit,
543 	 * stripping off last elements on queues.  Every
544 	 * run we strip the oldest element from each bucket.
545 	 */
546 	target = uma_zone_get_max(V_ipq_zone);
547 	while (uma_zone_get_cur(V_ipq_zone) > target) {
548 		struct ipq *fp;
549 
550 		for (int i = 0; i < IPREASS_NHASH; i++) {
551 			IPQ_LOCK(i);
552 			fp = TAILQ_LAST(&V_ipq[i].head, ipqhead);
553 			if (fp != NULL)
554 				ipq_timeout(&V_ipq[i].head, fp);
555 			IPQ_UNLOCK(i);
556 		}
557 	}
558 }
559 
560 static void
561 ipreass_zone_change(void *tag)
562 {
563 
564 	uma_zone_set_max(V_ipq_zone, nmbclusters / 32);
565 	ipreass_drain_tomax();
566 }
567 
568 /*
569  * Change the limit on the UMA zone, or disable the fragment allocation
570  * at all.  Since 0 and -1 is a special values here, we need our own handler,
571  * instead of sysctl_handle_uma_zone_max().
572  */
573 static int
574 sysctl_maxfragpackets(SYSCTL_HANDLER_ARGS)
575 {
576 	int error, max;
577 
578 	if (V_noreass == 0) {
579 		max = uma_zone_get_max(V_ipq_zone);
580 		if (max == 0)
581 			max = -1;
582 	} else
583 		max = 0;
584 	error = sysctl_handle_int(oidp, &max, 0, req);
585 	if (error || !req->newptr)
586 		return (error);
587 	if (max > 0) {
588 		/*
589 		 * XXXRW: Might be a good idea to sanity check the argument
590 		 * and place an extreme upper bound.
591 		 */
592 		max = uma_zone_set_max(V_ipq_zone, max);
593 		ipreass_drain_tomax();
594 		V_noreass = 0;
595 	} else if (max == 0) {
596 		V_noreass = 1;
597 		ipreass_drain();
598 	} else if (max == -1) {
599 		V_noreass = 0;
600 		uma_zone_set_max(V_ipq_zone, 0);
601 	} else
602 		return (EINVAL);
603 	return (0);
604 }
605 
606 /*
607  * Seek for old fragment queue header that can be reused.  Try to
608  * reuse a header from currently locked hash bucket.
609  */
610 static struct ipq *
611 ipq_reuse(int start)
612 {
613 	struct ipq *fp;
614 	int i;
615 
616 	IPQ_LOCK_ASSERT(start);
617 
618 	for (i = start;; i++) {
619 		if (i == IPREASS_NHASH)
620 			i = 0;
621 		if (i != start && IPQ_TRYLOCK(i) == 0)
622 			continue;
623 		fp = TAILQ_LAST(&V_ipq[i].head, ipqhead);
624 		if (fp) {
625 			struct mbuf *m;
626 
627 			IPSTAT_ADD(ips_fragtimeout, fp->ipq_nfrags);
628 			while (fp->ipq_frags) {
629 				m = fp->ipq_frags;
630 				fp->ipq_frags = m->m_nextpkt;
631 				m_freem(m);
632 			}
633 			TAILQ_REMOVE(&V_ipq[i].head, fp, ipq_list);
634 			if (i != start)
635 				IPQ_UNLOCK(i);
636 			IPQ_LOCK_ASSERT(start);
637 			return (fp);
638 		}
639 		if (i != start)
640 			IPQ_UNLOCK(i);
641 	}
642 }
643 
644 /*
645  * Free a fragment reassembly header and all associated datagrams.
646  */
647 static void
648 ipq_free(struct ipqhead *fhp, struct ipq *fp)
649 {
650 	struct mbuf *q;
651 
652 	while (fp->ipq_frags) {
653 		q = fp->ipq_frags;
654 		fp->ipq_frags = q->m_nextpkt;
655 		m_freem(q);
656 	}
657 	TAILQ_REMOVE(fhp, fp, ipq_list);
658 	uma_zfree(V_ipq_zone, fp);
659 }
660