Commit e8830aa5 authored by Ville Nuorvala's avatar Ville Nuorvala Committed by Stephen Hemminger

[IPV6]: Fix bugs in ip6ip6_tnl_xmit().

- ip6_tunnel must give its own getfrag function to ip6_append_data()
- fix dst leakage when encapsulated packet too bit
parent 611f1929
...@@ -621,6 +621,14 @@ merge_options(struct sock *sk, __u8 encap_limit, ...@@ -621,6 +621,14 @@ merge_options(struct sock *sk, __u8 encap_limit,
return opt; return opt;
} }
static int
ip6ip6_getfrag(void *from, char *to, int offset, int len, int odd,
struct sk_buff *skb)
{
memcpy(to, (char *) from + offset, len);
return 0;
}
/** /**
* ip6ip6_tnl_addr_conflict - compare packet addresses to tunnel's own * ip6ip6_tnl_addr_conflict - compare packet addresses to tunnel's own
* @t: the outgoing tunnel device * @t: the outgoing tunnel device
...@@ -755,9 +763,9 @@ int ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev) ...@@ -755,9 +763,9 @@ int ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
} }
if (skb->len > mtu) { if (skb->len > mtu) {
icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, dev); icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, dev);
goto tx_err_opt_release; goto tx_err_dst_release;
} }
err = ip6_append_data(sk, ip_generic_getfrag, skb->nh.raw, skb->len, 0, err = ip6_append_data(sk, ip6ip6_getfrag, skb->nh.raw, skb->len, 0,
t->parms.hop_limit, opt, &fl, t->parms.hop_limit, opt, &fl,
(struct rt6_info *)dst, MSG_DONTWAIT); (struct rt6_info *)dst, MSG_DONTWAIT);
...@@ -785,7 +793,6 @@ int ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev) ...@@ -785,7 +793,6 @@ int ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
return 0; return 0;
tx_err_dst_release: tx_err_dst_release:
dst_release(dst); dst_release(dst);
tx_err_opt_release:
if (opt && opt != orig_opt) if (opt && opt != orig_opt)
sock_kfree_s(sk, opt, opt->tot_len); sock_kfree_s(sk, opt, opt->tot_len);
tx_err_free_fl_lbl: tx_err_free_fl_lbl:
......
...@@ -482,10 +482,8 @@ EXPORT_SYMBOL(sysctl_tcp_tw_recycle); ...@@ -482,10 +482,8 @@ EXPORT_SYMBOL(sysctl_tcp_tw_recycle);
EXPORT_SYMBOL(sysctl_max_syn_backlog); EXPORT_SYMBOL(sysctl_max_syn_backlog);
#endif #endif
#endif
#if defined (CONFIG_IPV6_MODULE) || defined (CONFIG_IP_SCTP_MODULE) || defined (CONFIG_IPV6_TUNNEL_MODULE)
EXPORT_SYMBOL(ip_generic_getfrag); EXPORT_SYMBOL(ip_generic_getfrag);
#endif #endif
EXPORT_SYMBOL(tcp_read_sock); EXPORT_SYMBOL(tcp_read_sock);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment