batman-adv: Fix transmission of final, 16th fragment

commit 51c6b429c0c95e67edd1cb0b548c5cf6a6604763 upstream.

Trying to split and transmit a unicast packet in 16 parts will fail for
the final fragment: After having sent the 15th one with a frag_packet.no
index of 14, we will increase the the index to 15 - and return with an
error code immediately, even though one more fragment is due for
transmission and allowed.

Fixing this issue by moving the check before incrementing the index.

While at it, adding an unlikely(), because the check is actually more of
an assertion.

Fixes: ee75ed88879a ("batman-adv: Fragment and send skbs larger than mtu")
Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c
index 8605e3c7958deb7da3138b4cfbbef636ecf92acb..9751b207b01f68b939b5906e30f2c4ec0c40b8b6 100644 (file)
--- a/net/batman-adv/fragmentation.c
+++ b/net/batman-adv/fragmentation.c
@@ -480,6 +480,10 @@ bool batadv_frag_send_packet(struct sk_buff *skb,
 
        /* Eat and send fragments from the tail of skb */
        while (skb->len > max_fragment_size) {
+               /* The initial check in this function should cover this case */
+               if (frag_header.no == BATADV_FRAG_MAX_FRAGMENTS - 1)
+                       goto out_err;
+
                skb_fragment = batadv_frag_create(skb, &frag_header, mtu);
                if (!skb_fragment)
                        goto out_err;
@@ -490,10 +494,6 @@ bool batadv_frag_send_packet(struct sk_buff *skb,
                batadv_send_skb_packet(skb_fragment, neigh_node->if_incoming,
                                       neigh_node->addr);
                frag_header.no++;
-
-               /* The initial check in this function should cover this case */
-               if (frag_header.no == BATADV_FRAG_MAX_FRAGMENTS - 1)
-                       goto out_err;
        }
 
        /* Make room for the fragment header. */