Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 49c5bfaf authored Oct 18, 2005 by Herbert Xu Committed by Arnaldo Carvalho de Melo Oct 20, 2005

[DCCP]: Clear the IPCB area



Turns out the problem has nothing to do with use-after-free or double-free.
It's just that we're not clearing the CB area and DCCP unlike TCP uses a CB
format that's incompatible with IP.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Ian McDonald <imcdnzl@gmail.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>

parent ffa29347

net/dccp/ipv4.c

+2 −0

Original line number	Diff line number	Diff line
		@@ -463,6 +463,7 @@ static int dccp_v4_send_response(struct sock sk, struct request_sock req,
		if (skb != NULL) {
		const struct inet_request_sock *ireq = inet_rsk(req);

		memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
		err = ip_build_and_send_pkt(skb, sk, ireq->loc_addr,
		ireq->rmt_addr,
		ireq->opt);
		@@ -647,6 +648,7 @@ int dccp_v4_send_reset(struct sock *sk, enum dccp_reset_codes code)
		if (skb != NULL) {
		const struct inet_sock *inet = inet_sk(sk);

		memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
		err = ip_build_and_send_pkt(skb, sk,
		inet->saddr, inet->daddr, NULL);
		if (err == NET_XMIT_CN)

net/dccp/output.c

+1 −0

Original line number	Diff line number	Diff line
		@@ -100,6 +100,7 @@ int dccp_transmit_skb(struct sock sk, struct sk_buff skb)

		DCCP_INC_STATS(DCCP_MIB_OUTSEGS);

		memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
		err = ip_queue_xmit(skb, 0);
		if (err <= 0)
		return err;