Commit 49c5bfaf authored by Herbert Xu's avatar Herbert Xu Committed by Arnaldo Carvalho de Melo
Browse files

[DCCP]: Clear the IPCB area 



Turns out the problem has nothing to do with use-after-free or double-free.
It's just that we're not clearing the CB area and DCCP unlike TCP uses a CB
format that's incompatible with IP.

Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: default avatarIan McDonald <imcdnzl@gmail.com>
Signed-off-by: default avatarArnaldo Carvalho de Melo <acme@mandriva.com>
parent ffa29347

net/dccp/ipv4.c

+2 −0
Original line number Diff line number Diff line
@@ -463,6 +463,7 @@ static int dccp_v4_send_response(struct sock *sk, struct request_sock *req, 
	if (skb != NULL) {

		const struct inet_request_sock *ireq = inet_rsk(req);



		memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));

		err = ip_build_and_send_pkt(skb, sk, ireq->loc_addr,

					    ireq->rmt_addr,

					    ireq->opt);
@@ -647,6 +648,7 @@ int dccp_v4_send_reset(struct sock *sk, enum dccp_reset_codes code) 
	if (skb != NULL) {

		const struct inet_sock *inet = inet_sk(sk);



		memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));

		err = ip_build_and_send_pkt(skb, sk,

					    inet->saddr, inet->daddr, NULL);

		if (err == NET_XMIT_CN)

net/dccp/output.c

+1 −0
Original line number Diff line number Diff line
@@ -100,6 +100,7 @@ int dccp_transmit_skb(struct sock *sk, struct sk_buff *skb) 


		DCCP_INC_STATS(DCCP_MIB_OUTSEGS);



		memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));

		err = ip_queue_xmit(skb, 0);

		if (err <= 0)

			return err;

CRA Git | Maintained and supported by SUSTech CRA and CCSE