Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2ce13576 authored by YOSHIFUJI Hideaki / 吉藤英明's avatar YOSHIFUJI Hideaki / 吉藤英明 Committed by David S. Miller
Browse files

ndisc: Calculate message body length and option length separately. 



Signed-off-by: default avatarYOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 5135e633

net/ipv6/ndisc.c

+11 −9
Original line number Diff line number Diff line
@@ -426,6 +426,7 @@ static struct sk_buff *ndisc_build_skb(struct net_device *dev, 
	struct sk_buff *skb;

	struct icmp6hdr *hdr;

	int len;

	int optlen = 0;

	u8 *opt;



	if (!dev->addr_len)
@@ -433,13 +434,13 @@ static struct sk_buff *ndisc_build_skb(struct net_device *dev, 


	len = sizeof(struct icmp6hdr) + (target ? sizeof(*target) : 0);

	if (llinfo)

		len += ndisc_opt_addr_space(dev);

		optlen += ndisc_opt_addr_space(dev);



	skb = ndisc_alloc_skb(dev, len);

	skb = ndisc_alloc_skb(dev, len + optlen);

	if (!skb)

		return NULL;



	skb_put(skb, len);

	skb_put(skb, len + optlen);



	hdr = (struct icmp6hdr *)skb_transport_header(skb);

	memcpy(hdr, icmp6h, sizeof(*hdr));
@@ -1396,7 +1397,7 @@ void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target) 
	struct net_device *dev = skb->dev;

	struct net *net = dev_net(dev);

	struct sock *sk = net->ipv6.ndisc_sk;

	int len = sizeof(struct rd_msg);

	int optlen = 0;

	struct inet_peer *peer;

	struct sk_buff *buff;

	struct rd_msg *msg;
@@ -1463,7 +1464,7 @@ void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target) 
			memcpy(ha_buf, neigh->ha, dev->addr_len);

			read_unlock_bh(&neigh->lock);

			ha = ha_buf;

			len += ndisc_opt_addr_space(dev);

			optlen += ndisc_opt_addr_space(dev);

		} else

			read_unlock_bh(&neigh->lock);
@@ -1471,15 +1472,16 @@ void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target) 
	}



	rd_len = min_t(unsigned int,

		     IPV6_MIN_MTU-sizeof(struct ipv6hdr)-len, skb->len + 8);

		       IPV6_MIN_MTU - sizeof(struct ipv6hdr) - sizeof(*msg) - optlen,

		       skb->len + 8);

	rd_len &= ~0x7;

	len += rd_len;

	optlen += rd_len;



	buff = ndisc_alloc_skb(dev, len);

	buff = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);

	if (!buff)

		goto release;



	skb_put(buff, len);

	skb_put(buff, sizeof(*msg) + optlen);

	msg = (struct rd_msg *)icmp6_hdr(buff);



	memset(&msg->icmph, 0, sizeof(struct icmp6hdr));