Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 36d926b9 authored Jun 04, 2008 by Denis V. Lunev Committed by YOSHIFUJI Hideaki Jun 05, 2008

[IPV6]: inet_sk(sk)->cork.opt leak



IPv6 UDP sockets wth IPv4 mapped address use udp_sendmsg to send the data
actually. In this case ip_flush_pending_frames should be called instead
of ip6_flush_pending_frames.

Signed-off-by: Denis V. Lunev <den@openvz.org>
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>

parent 49d074f4

include/net/udp.h

+1 −0

Original line number	Original line	Diff line number	Diff line
	@@ -135,6 +135,7 @@ extern void udp_err(struct sk_buff *, u32);

	extern int udp_sendmsg(struct kiocb iocb, struct sock sk,		extern int udp_sendmsg(struct kiocb iocb, struct sock sk,
	struct msghdr *msg, size_t len);		struct msghdr *msg, size_t len);
			extern void udp_flush_pending_frames(struct sock *sk);

	extern int udp_rcv(struct sk_buff *skb);		extern int udp_rcv(struct sk_buff *skb);
	extern int udp_ioctl(struct sock *sk, int cmd, unsigned long arg);		extern int udp_ioctl(struct sock *sk, int cmd, unsigned long arg);

net/ipv4/udp.c

+2 −1

Original line number	Original line	Diff line number	Diff line
	@@ -420,7 +420,7 @@ void udp_err(struct sk_buff *skb, u32 info)
	/*		/*
	* Throw away all pending data and cancel the corking. Socket is locked.		* Throw away all pending data and cancel the corking. Socket is locked.
	*/		*/
	static void udp_flush_pending_frames(struct sock *sk)		void udp_flush_pending_frames(struct sock *sk)
	{		{
	struct udp_sock *up = udp_sk(sk);		struct udp_sock *up = udp_sk(sk);

	@@ -430,6 +430,7 @@ static void udp_flush_pending_frames(struct sock *sk)
	ip_flush_pending_frames(sk);		ip_flush_pending_frames(sk);
	}		}
	}		}
			EXPORT_SYMBOL(udp_flush_pending_frames);

	/**		/**
	* udp4_hwcsum_outgoing - handle outgoing HW checksumming		* udp4_hwcsum_outgoing - handle outgoing HW checksumming

net/ipv6/udp.c

+3 −1

Original line number	Original line	Diff line number	Diff line
	@@ -534,7 +534,9 @@ static void udp_v6_flush_pending_frames(struct sock *sk)
	{		{
	struct udp_sock *up = udp_sk(sk);		struct udp_sock *up = udp_sk(sk);

	if (up->pending) {		if (up->pending == AF_INET)
			udp_flush_pending_frames(sk);
			else if (up->pending) {
	up->len = 0;		up->len = 0;
	up->pending = 0;		up->pending = 0;
	ip6_flush_pending_frames(sk);		ip6_flush_pending_frames(sk);