Guillaume Nault <gnault@xxxxxxxxxx> wrote: > On Thu, Jun 06, 2019 at 06:29:30PM +0200, Florian Westphal wrote: > > Guillaume Nault <gnault@xxxxxxxxxx> wrote: > > > When fixing the skb leak introduced by the conversion to rbtree, I > > > forgot about the special case of duplicate fragments. The condition > > > under the 'insert_error' label isn't effective anymore as > > > nf_ct_frg6_gather() doesn't override the returned value anymore. So > > > duplicate fragments now get NF_DROP verdict. > > > > > > To accept duplicate fragments again, handle them specially as soon as > > > inet_frag_queue_insert() reports them. Return -EINPROGRESS which will > > > translate to NF_STOLEN verdict, like any accepted fragment. However, > > > such packets don't carry any new information and aren't queued, so we > > > just drop them immediately. > > > > Why is this patch needed? > > > > Whats the difference between > > > > NF_DROP and kfree_skb+NF_STOLEN? > > > > AFAICS this patch isn't needed, as nothing is broken, what am I missing? > > > If the fragment was generated locally, then NF_DROP propagates the EPERM > error back to the sender, which breaks the ip_defrag selftest. Indeed, I forgot about local case and error propagation, thanks for explaining.
