ipv6: record frag_max_size in atomic fragments in input path

[ Upstream commit e29f011e8fc04b2cdc742a2b9bbfa1b62518381a ]

Commit dbd1759e6a9c ("ipv6: on reassembly, record frag_max_size")
filled the frag_max_size field in IP6CB in the input path.
The field should also be filled in case of atomic fragments.

Fixes: dbd1759e6a9c ('ipv6: on reassembly, record frag_max_size')
Signed-off-by: Francesco Ruggeri <fruggeri@arista.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index c8cf1bbad74a241f8867ca41328406bcd06e0c35..45ee1971d9986f94a5e89a66516b175e6814b9de 100644 (file)
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -344,7 +344,7 @@ static int ipv6_frag_rcv(struct sk_buff *skb)
        hdr = ipv6_hdr(skb);
        fhdr = (struct frag_hdr *)skb_transport_header(skb);
 
-       if (!(fhdr->frag_off & htons(0xFFF9))) {
+       if (!(fhdr->frag_off & htons(IP6_OFFSET | IP6_MF))) {
                /* It is not a fragmented frame */
                skb->transport_header += sizeof(struct frag_hdr);
                __IP6_INC_STATS(net,
@@ -352,6 +352,8 @@ static int ipv6_frag_rcv(struct sk_buff *skb)
 
                IP6CB(skb)->nhoff = (u8 *)fhdr - skb_network_header(skb);
                IP6CB(skb)->flags |= IP6SKB_FRAGMENTED;
+               IP6CB(skb)->frag_max_size = ntohs(hdr->payload_len) +
+                                           sizeof(struct ipv6hdr);
                return 1;
        }