ipv4: Constrain UFO fragment sizes to multiples of 8 bytes

Because the ip fragment offset field counts 8-byte chunks, ip
fragments other than the last must contain a multiple of 8 bytes of
payload.  ip_ufo_append_data wasn't respecting this constraint and,
depending on the MTU and ip option sizes, could create malformed
non-final fragments.

Google-Bug-Id: 5009328
Signed-off-by: Bill Sommerfeld <wsommerfeld@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index be27e609a98b27a82e89b845fbd120808a1622b2..ccaaa851ab429ee48b0aa803fd5bf8edd5ee34ce 100644 (file)
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -734,7 +734,7 @@ static inline int ip_ufo_append_data(struct sock *sk,
                        int getfrag(void *from, char *to, int offset, int len,
                               int odd, struct sk_buff *skb),
                        void *from, int length, int hh_len, int fragheaderlen,
-                       int transhdrlen, int mtu, unsigned int flags)
+                       int transhdrlen, int maxfraglen, unsigned int flags)
 {
        struct sk_buff *skb;
        int err;
@@ -767,7 +767,7 @@ static inline int ip_ufo_append_data(struct sock *sk,
                skb->csum = 0;
 
                /* specify the length of each IP datagram fragment */
-               skb_shinfo(skb)->gso_size = mtu - fragheaderlen;
+               skb_shinfo(skb)->gso_size = maxfraglen - fragheaderlen;
                skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
                __skb_queue_tail(queue, skb);
        }
@@ -831,7 +831,7 @@ static int __ip_append_data(struct sock *sk,
            (rt->dst.dev->features & NETIF_F_UFO) && !rt->dst.header_len) {
                err = ip_ufo_append_data(sk, queue, getfrag, from, length,
                                         hh_len, fragheaderlen, transhdrlen,
-                                        mtu, flags);
+                                        maxfraglen, flags);
                if (err)
                        goto error;
                return 0;