Commit 99c7bc01 authored by YOSHIFUJI Hideaki's avatar YOSHIFUJI Hideaki Committed by David S. Miller
Browse files

[IPV6]: Fix kernel OOPs when setting sticky socket options. 



Bug noticed by Remi Denis-Courmont <rdenis@simphalempin.com>.

Signed-off-by: default avatarYOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent dd1a47c2

net/ipv6/exthdrs.c

+16 −13
Original line number Diff line number Diff line
@@ -635,6 +635,7 @@ ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt, 
	struct ipv6_txoptions *opt2;

	int err;



	if (opt) {

		if (newtype != IPV6_HOPOPTS && opt->hopopt)

			tot_len += CMSG_ALIGN(ipv6_optlen(opt->hopopt));

		if (newtype != IPV6_RTHDRDSTOPTS && opt->dst0opt)
@@ -643,6 +644,8 @@ ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt, 
			tot_len += CMSG_ALIGN(ipv6_optlen(opt->srcrt));

		if (newtype != IPV6_DSTOPTS && opt->dst1opt)

			tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst1opt));

	}



	if (newopt && newoptlen)

		tot_len += CMSG_ALIGN(newoptlen);
@@ -659,25 +662,25 @@ ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt, 
	opt2->tot_len = tot_len;

	p = (char *)(opt2 + 1);



	err = ipv6_renew_option(opt->hopopt, newopt, newoptlen,

	err = ipv6_renew_option(opt ? opt->hopopt : NULL, newopt, newoptlen,

				newtype != IPV6_HOPOPTS,

				&opt2->hopopt, &p);

	if (err)

		goto out;



	err = ipv6_renew_option(opt->dst0opt, newopt, newoptlen,

	err = ipv6_renew_option(opt ? opt->dst0opt : NULL, newopt, newoptlen,

				newtype != IPV6_RTHDRDSTOPTS,

				&opt2->dst0opt, &p);

	if (err)

		goto out;



	err = ipv6_renew_option(opt->srcrt, newopt, newoptlen,

	err = ipv6_renew_option(opt ? opt->srcrt : NULL, newopt, newoptlen,

				newtype != IPV6_RTHDR,

				(struct ipv6_opt_hdr **)opt2->srcrt, &p);

				(struct ipv6_opt_hdr **)&opt2->srcrt, &p);

	if (err)

		goto out;



	err = ipv6_renew_option(opt->dst1opt, newopt, newoptlen,

	err = ipv6_renew_option(opt ? opt->dst1opt : NULL, newopt, newoptlen,

				newtype != IPV6_DSTOPTS,

				&opt2->dst1opt, &p);

	if (err)