1 /* 2 * INET An implementation of the TCP/IP protocol suite for the LINUX 3 * operating system. INET is implemented using the BSD Socket 4 * interface as the means of communication with the user level. 5 * 6 * The IP fragmentation functionality. 7 * 8 * Version: $Id: ip_fragment.c,v 1.59 2002/01/12 07:54:56 davem Exp $ 9 * 10 * Authors: Fred N. van Kempen <waltje@uWalt.NL.Mugnet.ORG> 11 * Alan Cox <Alan.Cox@linux.org> 12 * 13 * Fixes: 14 * Alan Cox : Split from ip.c , see ip_input.c for history. 15 * David S. Miller : Begin massive cleanup... 16 * Andi Kleen : Add sysctls. 17 * xxxx : Overlapfrag bug. 18 * Ultima : ip_expire() kernel panic. 19 * Bill Hawes : Frag accounting and evictor fixes. 20 * John McDonald : 0 length frag bug. 21 * Alexey Kuznetsov: SMP races, threading, cleanup. 22 * Patrick McHardy : LRU queue of frag heads for evictor. 23 */ 24 25 #include <linux/compiler.h> 26 #include <linux/module.h> 27 #include <linux/types.h> 28 #include <linux/mm.h> 29 #include <linux/jiffies.h> 30 #include <linux/skbuff.h> 31 #include <linux/list.h> 32 #include <linux/ip.h> 33 #include <linux/icmp.h> 34 #include <linux/netdevice.h> 35 #include <linux/jhash.h> 36 #include <linux/random.h> 37 #include <net/sock.h> 38 #include <net/ip.h> 39 #include <net/icmp.h> 40 #include <net/checksum.h> 41 #include <net/inetpeer.h> 42 #include <linux/tcp.h> 43 #include <linux/udp.h> 44 #include <linux/inet.h> 45 #include <linux/netfilter_ipv4.h> 46 47 /* NOTE. Logic of IP defragmentation is parallel to corresponding IPv6 48 * code now. If you change something here, _PLEASE_ update ipv6/reassembly.c 49 * as well. Or notify me, at least. --ANK 50 */ 51 52 /* Fragment cache limits. We will commit 256K at one time. Should we 53 * cross that limit we will prune down to 192K. This should cope with 54 * even the most extreme cases without allowing an attacker to measurably 55 * harm machine performance. 56 */ 57 int sysctl_ipfrag_high_thresh = 256*1024; 58 int sysctl_ipfrag_low_thresh = 192*1024; 59 60 int sysctl_ipfrag_max_dist = 64; 61 62 /* Important NOTE! Fragment queue must be destroyed before MSL expires. 63 * RFC791 is wrong proposing to prolongate timer each fragment arrival by TTL. 64 */ 65 int sysctl_ipfrag_time = IP_FRAG_TIME; 66 67 struct ipfrag_skb_cb 68 { 69 struct inet_skb_parm h; 70 int offset; 71 }; 72 73 #define FRAG_CB(skb) ((struct ipfrag_skb_cb*)((skb)->cb)) 74 75 /* Describe an entry in the "incomplete datagrams" queue. */ 76 struct ipq { 77 struct hlist_node list; 78 struct list_head lru_list; /* lru list member */ 79 u32 user; 80 u32 saddr; 81 u32 daddr; 82 u16 id; 83 u8 protocol; 84 u8 last_in; 85 #define COMPLETE 4 86 #define FIRST_IN 2 87 #define LAST_IN 1 88 89 struct sk_buff *fragments; /* linked list of received fragments */ 90 int len; /* total length of original datagram */ 91 int meat; 92 spinlock_t lock; 93 atomic_t refcnt; 94 struct timer_list timer; /* when will this queue expire? */ 95 struct timeval stamp; 96 int iif; 97 unsigned int rid; 98 struct inet_peer *peer; 99 }; 100 101 /* Hash table. */ 102 103 #define IPQ_HASHSZ 64 104 105 /* Per-bucket lock is easy to add now. */ 106 static struct hlist_head ipq_hash[IPQ_HASHSZ]; 107 static DEFINE_RWLOCK(ipfrag_lock); 108 static u32 ipfrag_hash_rnd; 109 static LIST_HEAD(ipq_lru_list); 110 int ip_frag_nqueues = 0; 111 112 static __inline__ void __ipq_unlink(struct ipq *qp) 113 { 114 hlist_del(&qp->list); 115 list_del(&qp->lru_list); 116 ip_frag_nqueues--; 117 } 118 119 static __inline__ void ipq_unlink(struct ipq *ipq) 120 { 121 write_lock(&ipfrag_lock); 122 __ipq_unlink(ipq); 123 write_unlock(&ipfrag_lock); 124 } 125 126 static unsigned int ipqhashfn(u16 id, u32 saddr, u32 daddr, u8 prot) 127 { 128 return jhash_3words((u32)id << 16 | prot, saddr, daddr, 129 ipfrag_hash_rnd) & (IPQ_HASHSZ - 1); 130 } 131 132 static struct timer_list ipfrag_secret_timer; 133 int sysctl_ipfrag_secret_interval = 10 * 60 * HZ; 134 135 static void ipfrag_secret_rebuild(unsigned long dummy) 136 { 137 unsigned long now = jiffies; 138 int i; 139 140 write_lock(&ipfrag_lock); 141 get_random_bytes(&ipfrag_hash_rnd, sizeof(u32)); 142 for (i = 0; i < IPQ_HASHSZ; i++) { 143 struct ipq *q; 144 struct hlist_node *p, *n; 145 146 hlist_for_each_entry_safe(q, p, n, &ipq_hash[i], list) { 147 unsigned int hval = ipqhashfn(q->id, q->saddr, 148 q->daddr, q->protocol); 149 150 if (hval != i) { 151 hlist_del(&q->list); 152 153 /* Relink to new hash chain. */ 154 hlist_add_head(&q->list, &ipq_hash[hval]); 155 } 156 } 157 } 158 write_unlock(&ipfrag_lock); 159 160 mod_timer(&ipfrag_secret_timer, now + sysctl_ipfrag_secret_interval); 161 } 162 163 atomic_t ip_frag_mem = ATOMIC_INIT(0); /* Memory used for fragments */ 164 165 /* Memory Tracking Functions. */ 166 static __inline__ void frag_kfree_skb(struct sk_buff *skb, int *work) 167 { 168 if (work) 169 *work -= skb->truesize; 170 atomic_sub(skb->truesize, &ip_frag_mem); 171 kfree_skb(skb); 172 } 173 174 static __inline__ void frag_free_queue(struct ipq *qp, int *work) 175 { 176 if (work) 177 *work -= sizeof(struct ipq); 178 atomic_sub(sizeof(struct ipq), &ip_frag_mem); 179 kfree(qp); 180 } 181 182 static __inline__ struct ipq *frag_alloc_queue(void) 183 { 184 struct ipq *qp = kmalloc(sizeof(struct ipq), GFP_ATOMIC); 185 186 if(!qp) 187 return NULL; 188 atomic_add(sizeof(struct ipq), &ip_frag_mem); 189 return qp; 190 } 191 192 193 /* Destruction primitives. */ 194 195 /* Complete destruction of ipq. */ 196 static void ip_frag_destroy(struct ipq *qp, int *work) 197 { 198 struct sk_buff *fp; 199 200 BUG_TRAP(qp->last_in&COMPLETE); 201 BUG_TRAP(del_timer(&qp->timer) == 0); 202 203 if (qp->peer) 204 inet_putpeer(qp->peer); 205 206 /* Release all fragment data. */ 207 fp = qp->fragments; 208 while (fp) { 209 struct sk_buff *xp = fp->next; 210 211 frag_kfree_skb(fp, work); 212 fp = xp; 213 } 214 215 /* Finally, release the queue descriptor itself. */ 216 frag_free_queue(qp, work); 217 } 218 219 static __inline__ void ipq_put(struct ipq *ipq, int *work) 220 { 221 if (atomic_dec_and_test(&ipq->refcnt)) 222 ip_frag_destroy(ipq, work); 223 } 224 225 /* Kill ipq entry. It is not destroyed immediately, 226 * because caller (and someone more) holds reference count. 227 */ 228 static void ipq_kill(struct ipq *ipq) 229 { 230 if (del_timer(&ipq->timer)) 231 atomic_dec(&ipq->refcnt); 232 233 if (!(ipq->last_in & COMPLETE)) { 234 ipq_unlink(ipq); 235 atomic_dec(&ipq->refcnt); 236 ipq->last_in |= COMPLETE; 237 } 238 } 239 240 /* Memory limiting on fragments. Evictor trashes the oldest 241 * fragment queue until we are back under the threshold. 242 */ 243 static void ip_evictor(void) 244 { 245 struct ipq *qp; 246 struct list_head *tmp; 247 int work; 248 249 work = atomic_read(&ip_frag_mem) - sysctl_ipfrag_low_thresh; 250 if (work <= 0) 251 return; 252 253 while (work > 0) { 254 read_lock(&ipfrag_lock); 255 if (list_empty(&ipq_lru_list)) { 256 read_unlock(&ipfrag_lock); 257 return; 258 } 259 tmp = ipq_lru_list.next; 260 qp = list_entry(tmp, struct ipq, lru_list); 261 atomic_inc(&qp->refcnt); 262 read_unlock(&ipfrag_lock); 263 264 spin_lock(&qp->lock); 265 if (!(qp->last_in&COMPLETE)) 266 ipq_kill(qp); 267 spin_unlock(&qp->lock); 268 269 ipq_put(qp, &work); 270 IP_INC_STATS_BH(IPSTATS_MIB_REASMFAILS); 271 } 272 } 273 274 /* 275 * Oops, a fragment queue timed out. Kill it and send an ICMP reply. 276 */ 277 static void ip_expire(unsigned long arg) 278 { 279 struct ipq *qp = (struct ipq *) arg; 280 281 spin_lock(&qp->lock); 282 283 if (qp->last_in & COMPLETE) 284 goto out; 285 286 ipq_kill(qp); 287 288 IP_INC_STATS_BH(IPSTATS_MIB_REASMTIMEOUT); 289 IP_INC_STATS_BH(IPSTATS_MIB_REASMFAILS); 290 291 if ((qp->last_in&FIRST_IN) && qp->fragments != NULL) { 292 struct sk_buff *head = qp->fragments; 293 /* Send an ICMP "Fragment Reassembly Timeout" message. */ 294 if ((head->dev = dev_get_by_index(qp->iif)) != NULL) { 295 icmp_send(head, ICMP_TIME_EXCEEDED, ICMP_EXC_FRAGTIME, 0); 296 dev_put(head->dev); 297 } 298 } 299 out: 300 spin_unlock(&qp->lock); 301 ipq_put(qp, NULL); 302 } 303 304 /* Creation primitives. */ 305 306 static struct ipq *ip_frag_intern(struct ipq *qp_in) 307 { 308 struct ipq *qp; 309 #ifdef CONFIG_SMP 310 struct hlist_node *n; 311 #endif 312 unsigned int hash; 313 314 write_lock(&ipfrag_lock); 315 hash = ipqhashfn(qp_in->id, qp_in->saddr, qp_in->daddr, 316 qp_in->protocol); 317 #ifdef CONFIG_SMP 318 /* With SMP race we have to recheck hash table, because 319 * such entry could be created on other cpu, while we 320 * promoted read lock to write lock. 321 */ 322 hlist_for_each_entry(qp, n, &ipq_hash[hash], list) { 323 if(qp->id == qp_in->id && 324 qp->saddr == qp_in->saddr && 325 qp->daddr == qp_in->daddr && 326 qp->protocol == qp_in->protocol && 327 qp->user == qp_in->user) { 328 atomic_inc(&qp->refcnt); 329 write_unlock(&ipfrag_lock); 330 qp_in->last_in |= COMPLETE; 331 ipq_put(qp_in, NULL); 332 return qp; 333 } 334 } 335 #endif 336 qp = qp_in; 337 338 if (!mod_timer(&qp->timer, jiffies + sysctl_ipfrag_time)) 339 atomic_inc(&qp->refcnt); 340 341 atomic_inc(&qp->refcnt); 342 hlist_add_head(&qp->list, &ipq_hash[hash]); 343 INIT_LIST_HEAD(&qp->lru_list); 344 list_add_tail(&qp->lru_list, &ipq_lru_list); 345 ip_frag_nqueues++; 346 write_unlock(&ipfrag_lock); 347 return qp; 348 } 349 350 /* Add an entry to the 'ipq' queue for a newly received IP datagram. */ 351 static struct ipq *ip_frag_create(struct iphdr *iph, u32 user) 352 { 353 struct ipq *qp; 354 355 if ((qp = frag_alloc_queue()) == NULL) 356 goto out_nomem; 357 358 qp->protocol = iph->protocol; 359 qp->last_in = 0; 360 qp->id = iph->id; 361 qp->saddr = iph->saddr; 362 qp->daddr = iph->daddr; 363 qp->user = user; 364 qp->len = 0; 365 qp->meat = 0; 366 qp->fragments = NULL; 367 qp->iif = 0; 368 qp->peer = sysctl_ipfrag_max_dist ? inet_getpeer(iph->saddr, 1) : NULL; 369 370 /* Initialize a timer for this entry. */ 371 init_timer(&qp->timer); 372 qp->timer.data = (unsigned long) qp; /* pointer to queue */ 373 qp->timer.function = ip_expire; /* expire function */ 374 spin_lock_init(&qp->lock); 375 atomic_set(&qp->refcnt, 1); 376 377 return ip_frag_intern(qp); 378 379 out_nomem: 380 LIMIT_NETDEBUG(KERN_ERR "ip_frag_create: no memory left !\n"); 381 return NULL; 382 } 383 384 /* Find the correct entry in the "incomplete datagrams" queue for 385 * this IP datagram, and create new one, if nothing is found. 386 */ 387 static inline struct ipq *ip_find(struct iphdr *iph, u32 user) 388 { 389 __be16 id = iph->id; 390 __u32 saddr = iph->saddr; 391 __u32 daddr = iph->daddr; 392 __u8 protocol = iph->protocol; 393 unsigned int hash; 394 struct ipq *qp; 395 struct hlist_node *n; 396 397 read_lock(&ipfrag_lock); 398 hash = ipqhashfn(id, saddr, daddr, protocol); 399 hlist_for_each_entry(qp, n, &ipq_hash[hash], list) { 400 if(qp->id == id && 401 qp->saddr == saddr && 402 qp->daddr == daddr && 403 qp->protocol == protocol && 404 qp->user == user) { 405 atomic_inc(&qp->refcnt); 406 read_unlock(&ipfrag_lock); 407 return qp; 408 } 409 } 410 read_unlock(&ipfrag_lock); 411 412 return ip_frag_create(iph, user); 413 } 414 415 /* Is the fragment too far ahead to be part of ipq? */ 416 static inline int ip_frag_too_far(struct ipq *qp) 417 { 418 struct inet_peer *peer = qp->peer; 419 unsigned int max = sysctl_ipfrag_max_dist; 420 unsigned int start, end; 421 422 int rc; 423 424 if (!peer || !max) 425 return 0; 426 427 start = qp->rid; 428 end = atomic_inc_return(&peer->rid); 429 qp->rid = end; 430 431 rc = qp->fragments && (end - start) > max; 432 433 if (rc) { 434 IP_INC_STATS_BH(IPSTATS_MIB_REASMFAILS); 435 } 436 437 return rc; 438 } 439 440 static int ip_frag_reinit(struct ipq *qp) 441 { 442 struct sk_buff *fp; 443 444 if (!mod_timer(&qp->timer, jiffies + sysctl_ipfrag_time)) { 445 atomic_inc(&qp->refcnt); 446 return -ETIMEDOUT; 447 } 448 449 fp = qp->fragments; 450 do { 451 struct sk_buff *xp = fp->next; 452 frag_kfree_skb(fp, NULL); 453 fp = xp; 454 } while (fp); 455 456 qp->last_in = 0; 457 qp->len = 0; 458 qp->meat = 0; 459 qp->fragments = NULL; 460 qp->iif = 0; 461 462 return 0; 463 } 464 465 /* Add new segment to existing queue. */ 466 static void ip_frag_queue(struct ipq *qp, struct sk_buff *skb) 467 { 468 struct sk_buff *prev, *next; 469 int flags, offset; 470 int ihl, end; 471 472 if (qp->last_in & COMPLETE) 473 goto err; 474 475 if (!(IPCB(skb)->flags & IPSKB_FRAG_COMPLETE) && 476 unlikely(ip_frag_too_far(qp)) && unlikely(ip_frag_reinit(qp))) { 477 ipq_kill(qp); 478 goto err; 479 } 480 481 offset = ntohs(skb->nh.iph->frag_off); 482 flags = offset & ~IP_OFFSET; 483 offset &= IP_OFFSET; 484 offset <<= 3; /* offset is in 8-byte chunks */ 485 ihl = skb->nh.iph->ihl * 4; 486 487 /* Determine the position of this fragment. */ 488 end = offset + skb->len - ihl; 489 490 /* Is this the final fragment? */ 491 if ((flags & IP_MF) == 0) { 492 /* If we already have some bits beyond end 493 * or have different end, the segment is corrrupted. 494 */ 495 if (end < qp->len || 496 ((qp->last_in & LAST_IN) && end != qp->len)) 497 goto err; 498 qp->last_in |= LAST_IN; 499 qp->len = end; 500 } else { 501 if (end&7) { 502 end &= ~7; 503 if (skb->ip_summed != CHECKSUM_UNNECESSARY) 504 skb->ip_summed = CHECKSUM_NONE; 505 } 506 if (end > qp->len) { 507 /* Some bits beyond end -> corruption. */ 508 if (qp->last_in & LAST_IN) 509 goto err; 510 qp->len = end; 511 } 512 } 513 if (end == offset) 514 goto err; 515 516 if (pskb_pull(skb, ihl) == NULL) 517 goto err; 518 if (pskb_trim_rcsum(skb, end-offset)) 519 goto err; 520 521 /* Find out which fragments are in front and at the back of us 522 * in the chain of fragments so far. We must know where to put 523 * this fragment, right? 524 */ 525 prev = NULL; 526 for(next = qp->fragments; next != NULL; next = next->next) { 527 if (FRAG_CB(next)->offset >= offset) 528 break; /* bingo! */ 529 prev = next; 530 } 531 532 /* We found where to put this one. Check for overlap with 533 * preceding fragment, and, if needed, align things so that 534 * any overlaps are eliminated. 535 */ 536 if (prev) { 537 int i = (FRAG_CB(prev)->offset + prev->len) - offset; 538 539 if (i > 0) { 540 offset += i; 541 if (end <= offset) 542 goto err; 543 if (!pskb_pull(skb, i)) 544 goto err; 545 if (skb->ip_summed != CHECKSUM_UNNECESSARY) 546 skb->ip_summed = CHECKSUM_NONE; 547 } 548 } 549 550 while (next && FRAG_CB(next)->offset < end) { 551 int i = end - FRAG_CB(next)->offset; /* overlap is 'i' bytes */ 552 553 if (i < next->len) { 554 /* Eat head of the next overlapped fragment 555 * and leave the loop. The next ones cannot overlap. 556 */ 557 if (!pskb_pull(next, i)) 558 goto err; 559 FRAG_CB(next)->offset += i; 560 qp->meat -= i; 561 if (next->ip_summed != CHECKSUM_UNNECESSARY) 562 next->ip_summed = CHECKSUM_NONE; 563 break; 564 } else { 565 struct sk_buff *free_it = next; 566 567 /* Old fragmnet is completely overridden with 568 * new one drop it. 569 */ 570 next = next->next; 571 572 if (prev) 573 prev->next = next; 574 else 575 qp->fragments = next; 576 577 qp->meat -= free_it->len; 578 frag_kfree_skb(free_it, NULL); 579 } 580 } 581 582 FRAG_CB(skb)->offset = offset; 583 584 /* Insert this fragment in the chain of fragments. */ 585 skb->next = next; 586 if (prev) 587 prev->next = skb; 588 else 589 qp->fragments = skb; 590 591 if (skb->dev) 592 qp->iif = skb->dev->ifindex; 593 skb->dev = NULL; 594 skb_get_timestamp(skb, &qp->stamp); 595 qp->meat += skb->len; 596 atomic_add(skb->truesize, &ip_frag_mem); 597 if (offset == 0) 598 qp->last_in |= FIRST_IN; 599 600 write_lock(&ipfrag_lock); 601 list_move_tail(&qp->lru_list, &ipq_lru_list); 602 write_unlock(&ipfrag_lock); 603 604 return; 605 606 err: 607 kfree_skb(skb); 608 } 609 610 611 /* Build a new IP datagram from all its fragments. */ 612 613 static struct sk_buff *ip_frag_reasm(struct ipq *qp, struct net_device *dev) 614 { 615 struct iphdr *iph; 616 struct sk_buff *fp, *head = qp->fragments; 617 int len; 618 int ihlen; 619 620 ipq_kill(qp); 621 622 BUG_TRAP(head != NULL); 623 BUG_TRAP(FRAG_CB(head)->offset == 0); 624 625 /* Allocate a new buffer for the datagram. */ 626 ihlen = head->nh.iph->ihl*4; 627 len = ihlen + qp->len; 628 629 if(len > 65535) 630 goto out_oversize; 631 632 /* Head of list must not be cloned. */ 633 if (skb_cloned(head) && pskb_expand_head(head, 0, 0, GFP_ATOMIC)) 634 goto out_nomem; 635 636 /* If the first fragment is fragmented itself, we split 637 * it to two chunks: the first with data and paged part 638 * and the second, holding only fragments. */ 639 if (skb_shinfo(head)->frag_list) { 640 struct sk_buff *clone; 641 int i, plen = 0; 642 643 if ((clone = alloc_skb(0, GFP_ATOMIC)) == NULL) 644 goto out_nomem; 645 clone->next = head->next; 646 head->next = clone; 647 skb_shinfo(clone)->frag_list = skb_shinfo(head)->frag_list; 648 skb_shinfo(head)->frag_list = NULL; 649 for (i=0; i<skb_shinfo(head)->nr_frags; i++) 650 plen += skb_shinfo(head)->frags[i].size; 651 clone->len = clone->data_len = head->data_len - plen; 652 head->data_len -= clone->len; 653 head->len -= clone->len; 654 clone->csum = 0; 655 clone->ip_summed = head->ip_summed; 656 atomic_add(clone->truesize, &ip_frag_mem); 657 } 658 659 skb_shinfo(head)->frag_list = head->next; 660 skb_push(head, head->data - head->nh.raw); 661 atomic_sub(head->truesize, &ip_frag_mem); 662 663 for (fp=head->next; fp; fp = fp->next) { 664 head->data_len += fp->len; 665 head->len += fp->len; 666 if (head->ip_summed != fp->ip_summed) 667 head->ip_summed = CHECKSUM_NONE; 668 else if (head->ip_summed == CHECKSUM_HW) 669 head->csum = csum_add(head->csum, fp->csum); 670 head->truesize += fp->truesize; 671 atomic_sub(fp->truesize, &ip_frag_mem); 672 } 673 674 head->next = NULL; 675 head->dev = dev; 676 skb_set_timestamp(head, &qp->stamp); 677 678 iph = head->nh.iph; 679 iph->frag_off = 0; 680 iph->tot_len = htons(len); 681 IP_INC_STATS_BH(IPSTATS_MIB_REASMOKS); 682 qp->fragments = NULL; 683 return head; 684 685 out_nomem: 686 LIMIT_NETDEBUG(KERN_ERR "IP: queue_glue: no memory for gluing " 687 "queue %p\n", qp); 688 goto out_fail; 689 out_oversize: 690 if (net_ratelimit()) 691 printk(KERN_INFO 692 "Oversized IP packet from %d.%d.%d.%d.\n", 693 NIPQUAD(qp->saddr)); 694 out_fail: 695 IP_INC_STATS_BH(IPSTATS_MIB_REASMFAILS); 696 return NULL; 697 } 698 699 /* Process an incoming IP datagram fragment. */ 700 struct sk_buff *ip_defrag(struct sk_buff *skb, u32 user) 701 { 702 struct iphdr *iph = skb->nh.iph; 703 struct ipq *qp; 704 struct net_device *dev; 705 706 IP_INC_STATS_BH(IPSTATS_MIB_REASMREQDS); 707 708 /* Start by cleaning up the memory. */ 709 if (atomic_read(&ip_frag_mem) > sysctl_ipfrag_high_thresh) 710 ip_evictor(); 711 712 dev = skb->dev; 713 714 /* Lookup (or create) queue header */ 715 if ((qp = ip_find(iph, user)) != NULL) { 716 struct sk_buff *ret = NULL; 717 718 spin_lock(&qp->lock); 719 720 ip_frag_queue(qp, skb); 721 722 if (qp->last_in == (FIRST_IN|LAST_IN) && 723 qp->meat == qp->len) 724 ret = ip_frag_reasm(qp, dev); 725 726 spin_unlock(&qp->lock); 727 ipq_put(qp, NULL); 728 return ret; 729 } 730 731 IP_INC_STATS_BH(IPSTATS_MIB_REASMFAILS); 732 kfree_skb(skb); 733 return NULL; 734 } 735 736 void ipfrag_init(void) 737 { 738 ipfrag_hash_rnd = (u32) ((num_physpages ^ (num_physpages>>7)) ^ 739 (jiffies ^ (jiffies >> 6))); 740 741 init_timer(&ipfrag_secret_timer); 742 ipfrag_secret_timer.function = ipfrag_secret_rebuild; 743 ipfrag_secret_timer.expires = jiffies + sysctl_ipfrag_secret_interval; 744 add_timer(&ipfrag_secret_timer); 745 } 746 747 EXPORT_SYMBOL(ip_defrag); 748