On Thu, Jun 06, 2019 at 06:04:00PM +0200, Guillaume Nault wrote: > When fixing the skb leak introduced by the conversion to rbtree, I > forgot about the special case of duplicate fragments. The condition > under the 'insert_error' label isn't effective anymore as > nf_ct_frg6_gather() doesn't override the returned value anymore. So > duplicate fragments now get NF_DROP verdict. > > To accept duplicate fragments again, handle them specially as soon as > inet_frag_queue_insert() reports them. Return -EINPROGRESS which will > translate to NF_STOLEN verdict, like any accepted fragment. However, > such packets don't carry any new information and aren't queued, so we > just drop them immediately. Applied, thanks.
