Commit cb94c62c authored by Patrick McHardy's avatar Patrick McHardy Committed by David S. Miller
Browse files

[IPV4]: Fix DST leak in icmp_push_reply() 



Based upon a bug report and initial patch by
Ollie Wild.

Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 22783649

net/ipv4/icmp.c

+6 −6
Original line number Diff line number Diff line
@@ -349,12 +349,12 @@ static void icmp_push_reply(struct icmp_bxm *icmp_param, 
{

	struct sk_buff *skb;



	ip_append_data(icmp_socket->sk, icmp_glue_bits, icmp_param,

	if (ip_append_data(icmp_socket->sk, icmp_glue_bits, icmp_param,

		           icmp_param->data_len+icmp_param->head_len,

		           icmp_param->head_len,

		       ipc, rt, MSG_DONTWAIT);



	if ((skb = skb_peek(&icmp_socket->sk->sk_write_queue)) != NULL) {

		           ipc, rt, MSG_DONTWAIT) < 0)

		ip_flush_pending_frames(icmp_socket->sk);

	else if ((skb = skb_peek(&icmp_socket->sk->sk_write_queue)) != NULL) {

		struct icmphdr *icmph = skb->h.icmph;

		unsigned int csum = 0;

		struct sk_buff *skb1;