From e8830aa5f1f50656ff7614ae3b21e40805795786 Mon Sep 17 00:00:00 2001 From: Ville Nuorvala Date: Thu, 7 Aug 2003 07:35:35 -0700 Subject: [PATCH] [IPV6]: Fix bugs in ip6ip6_tnl_xmit(). - ip6_tunnel must give its own getfrag function to ip6_append_data() - fix dst leakage when encapsulated packet too bit --- net/ipv6/ip6_tunnel.c | 13 ++++++++++--- net/netsyms.c | 4 +--- 2 files changed, 11 insertions(+), 6 deletions(-) diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c index 221a1dd22cbcf..8aff8d51527eb 100644 --- a/net/ipv6/ip6_tunnel.c +++ b/net/ipv6/ip6_tunnel.c @@ -621,6 +621,14 @@ merge_options(struct sock *sk, __u8 encap_limit, return opt; } +static int +ip6ip6_getfrag(void *from, char *to, int offset, int len, int odd, + struct sk_buff *skb) +{ + memcpy(to, (char *) from + offset, len); + return 0; +} + /** * ip6ip6_tnl_addr_conflict - compare packet addresses to tunnel's own * @t: the outgoing tunnel device @@ -755,9 +763,9 @@ int ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev) } if (skb->len > mtu) { icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, dev); - goto tx_err_opt_release; + goto tx_err_dst_release; } - err = ip6_append_data(sk, ip_generic_getfrag, skb->nh.raw, skb->len, 0, + err = ip6_append_data(sk, ip6ip6_getfrag, skb->nh.raw, skb->len, 0, t->parms.hop_limit, opt, &fl, (struct rt6_info *)dst, MSG_DONTWAIT); @@ -785,7 +793,6 @@ int ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev) return 0; tx_err_dst_release: dst_release(dst); -tx_err_opt_release: if (opt && opt != orig_opt) sock_kfree_s(sk, opt, opt->tot_len); tx_err_free_fl_lbl: diff --git a/net/netsyms.c b/net/netsyms.c index 78efec6ffb894..9374929b8592d 100644 --- a/net/netsyms.c +++ b/net/netsyms.c @@ -482,10 +482,8 @@ EXPORT_SYMBOL(sysctl_tcp_tw_recycle); EXPORT_SYMBOL(sysctl_max_syn_backlog); #endif -#endif - -#if defined (CONFIG_IPV6_MODULE) || defined (CONFIG_IP_SCTP_MODULE) || defined (CONFIG_IPV6_TUNNEL_MODULE) EXPORT_SYMBOL(ip_generic_getfrag); + #endif EXPORT_SYMBOL(tcp_read_sock); -- 2.53.0