ipv4: Pass struct net into ip_defrag and ip_check_defrag

The function ip_defrag is called on both the input and the output
paths of the networking stack.  In particular conntrack when it is
tracking outbound packets from the local machine calls ip_defrag.

So add a struct net parameter and stop making ip_defrag guess which
network namespace it needs to defragment packets in.

Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

3 files changed, 11 insertions, 10 deletions

diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index 9772b789adf3..5482745d5d68 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -654,11 +654,10 @@ out_fail:
 }
 
 /* Process an incoming IP datagram fragment. */
-int ip_defrag(struct sk_buff *skb, u32 user)
+int ip_defrag(struct net *net, struct sk_buff *skb, u32 user)
 {
         struct net_device *dev = skb->dev ? : skb_dst(skb)->dev;
         int vif = l3mdev_master_ifindex_rcu(dev);
-        struct net *net = dev_net(dev);
         struct ipq *qp;
 
         IP_INC_STATS_BH(net, IPSTATS_MIB_REASMREQDS);
@@ -683,7 +682,7 @@ int ip_defrag(struct sk_buff *skb, u32 user)
 }
 EXPORT_SYMBOL(ip_defrag);
 
-struct sk_buff *ip_check_defrag(struct sk_buff *skb, u32 user)
+struct sk_buff *ip_check_defrag(struct net *net, struct sk_buff *skb, u32 user)
 {
         struct iphdr iph;
         int netoff;
@@ -712,7 +711,7 @@ struct sk_buff *ip_check_defrag(struct sk_buff *skb, u32 user)
                         if (pskb_trim_rcsum(skb, netoff + len))
                                 return skb;
                         memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
-                        if (ip_defrag(skb, user))
+                        if (ip_defrag(net, skb, user))
                                 return NULL;
                         skb_clear_hash(skb);
                 }
diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
index 804b86fd615f..b1209b63381f 100644
--- a/net/ipv4/ip_input.c
+++ b/net/ipv4/ip_input.c
@@ -170,7 +170,7 @@ bool ip_call_ra_chain(struct sk_buff *skb)
                      sk->sk_bound_dev_if == dev->ifindex) &&
                     net_eq(sock_net(sk), net)) {
                         if (ip_is_fragment(ip_hdr(skb))) {
-                                if (ip_defrag(skb, IP_DEFRAG_CALL_RA_CHAIN))
+                                if (ip_defrag(net, skb, IP_DEFRAG_CALL_RA_CHAIN))
                                         return true;
                         }
                         if (last) {
@@ -247,14 +247,15 @@ int ip_local_deliver(struct sk_buff *skb)
         /*
          *      Reassemble IP fragments.
          */
+        struct net *net = dev_net(skb->dev);
 
         if (ip_is_fragment(ip_hdr(skb))) {
-                if (ip_defrag(skb, IP_DEFRAG_LOCAL_DELIVER))
+                if (ip_defrag(net, skb, IP_DEFRAG_LOCAL_DELIVER))
                         return 0;
         }
 
         return NF_HOOK(NFPROTO_IPV4, NF_INET_LOCAL_IN,
-                       dev_net(skb->dev), NULL, skb, skb->dev, NULL,
+                       net, NULL, skb, skb->dev, NULL,
                        ip_local_deliver_finish);
 }
 
diff --git a/net/ipv4/netfilter/nf_defrag_ipv4.c b/net/ipv4/netfilter/nf_defrag_ipv4.c
index b246346ee849..bf25f45b23d2 100644
--- a/net/ipv4/netfilter/nf_defrag_ipv4.c
+++ b/net/ipv4/netfilter/nf_defrag_ipv4.c
@@ -22,14 +22,15 @@
 #endif
 #include <net/netfilter/nf_conntrack_zones.h>
 
-static int nf_ct_ipv4_gather_frags(struct sk_buff *skb, u_int32_t user)
+static int nf_ct_ipv4_gather_frags(struct net *net, struct sk_buff *skb,
+                                   u_int32_t user)
 {
         int err;
 
         skb_orphan(skb);
 
         local_bh_disable();
-        err = ip_defrag(skb, user);
+        err = ip_defrag(net, skb, user);
         local_bh_enable();
 
         if (!err) {
@@ -85,7 +86,7 @@ static unsigned int ipv4_conntrack_defrag(void *priv,
                 enum ip_defrag_users user =
                         nf_ct_defrag_user(state->hook, skb);
 
-                if (nf_ct_ipv4_gather_frags(skb, user))
+                if (nf_ct_ipv4_gather_frags(state->net, skb, user))
                         return NF_STOLEN;
         }
         return NF_ACCEPT;