| Message ID | 1401701427-1082-1-git-send-email-alex.aring@gmail.com |
|---|---|
| State | Superseded, archived |
| Delegated to: | David Miller |
| Headers | show |
Hi, please ignore this one, I also detected a off by one error on a corner of a multiple fragment payload length if we have 3 fragments or above. - Alex -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/net/ieee802154/6lowpan_rtnl.c b/net/ieee802154/6lowpan_rtnl.c index 1ae8a56..9d57026 100644 --- a/net/ieee802154/6lowpan_rtnl.c +++ b/net/ieee802154/6lowpan_rtnl.c @@ -312,7 +312,7 @@ lowpan_xmit_fragmented(struct sk_buff *skb, struct net_device *dev, frag_hdr[0] |= LOWPAN_DISPATCH_FRAGN; frag_cap = round_down(payload_cap - LOWPAN_FRAGN_HEAD_SIZE, 8); - while (skb_unprocessed >= frag_cap) { + do { dgram_offset += frag_len; skb_offset += frag_len; skb_unprocessed -= frag_len; @@ -328,7 +328,7 @@ lowpan_xmit_fragmented(struct sk_buff *skb, struct net_device *dev, __func__, frag_tag, skb_offset); goto err; } - } + } while (skb_unprocessed >= frag_cap); consume_skb(skb); return NET_XMIT_SUCCESS;
This patch fix the 6LoWPAN fragmentation for the case if we have exactly two fragments. The problem is that the (skb_unprocessed >= frag_cap) condition is always false on the second fragment after sending the first fragment. A fragmentation with only one fragment doesn't make any sense. The solution is that we use a do while loop here, that ensures we sending always a minimum of two fragments if we need a fragmentation. This issue was introduced by commit d4b2816d67d6e07b2f27037f282d8db03a5829d7 ("6lowpan: fix fragmentation"). Signed-off-by: Alexander Aring <alex.aring@gmail.com> --- net/ieee802154/6lowpan_rtnl.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)