Commit 8d037f92 authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'ipv6-fix-EFAULT-on-sendto-with-icmpv6-and-hdrincl' 



Olivier Matz says:

====================
ipv6: fix EFAULT on sendto with icmpv6 and hdrincl

The following code returns EFAULT (Bad address):

  s = socket(AF_INET6, SOCK_RAW, IPPROTO_ICMPV6);
  setsockopt(s, SOL_IPV6, IPV6_HDRINCL, 1);
  sendto(ipv6_icmp6_packet, addr);   /* returns -1, errno = EFAULT */

The problem is fixed in the second patch. The first one aligns the
code to ipv4, to avoid a race condition in the second patch.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 4970b42d b9aa52c4

net/ipv6/raw.c

+18 −7
Original line number Diff line number Diff line
@@ -783,6 +783,7 @@ static int rawv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) 
	struct flowi6 fl6;

	struct ipcm6_cookie ipc6;

	int addr_len = msg->msg_namelen;

	int hdrincl;

	u16 proto;

	int err;
@@ -796,6 +797,13 @@ static int rawv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) 
	if (msg->msg_flags & MSG_OOB)

		return -EOPNOTSUPP;



	/* hdrincl should be READ_ONCE(inet->hdrincl)

	 * but READ_ONCE() doesn't work with bit fields.

	 * Doing this indirectly yields the same result.

	 */

	hdrincl = inet->hdrincl;

	hdrincl = READ_ONCE(hdrincl);



	/*

	 *	Get and verify the address.

	 */
@@ -887,11 +895,14 @@ static int rawv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) 
	opt = ipv6_fixup_options(&opt_space, opt);



	fl6.flowi6_proto = proto;



	if (!hdrincl) {

		rfv.msg = msg;

		rfv.hlen = 0;

		err = rawv6_probe_proto_opt(&rfv, &fl6);

		if (err)

			goto out;

	}



	if (!ipv6_addr_any(daddr))

		fl6.daddr = *daddr;
@@ -908,7 +919,7 @@ static int rawv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) 
		fl6.flowi6_oif = np->ucast_oif;

	security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));



	if (inet->hdrincl)

	if (hdrincl)

		fl6.flowi6_flags |= FLOWI_FLAG_KNOWN_NH;



	if (ipc6.tclass < 0)
@@ -931,7 +942,7 @@ static int rawv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) 
		goto do_confirm;



back_from_confirm:

	if (inet->hdrincl)

	if (hdrincl)

		err = rawv6_send_hdrinc(sk, msg, len, &fl6, &dst,

					msg->msg_flags, &ipc6.sockc);

	else {

CRA Git | Maintained and supported by SUSTech CRA and CCSE