linux-stable.git/net/ipv6/ip6_output.c, branch linux-3.9.y

ipv6: fix possible crashes in ip6_cork_release()

2013-06-27T17:38:47+00:00

[ Upstream commit 284041ef21fdf2e0d216ab6b787bc9072b4eb58a ]

commit 0178b695fd6b4 ("ipv6: Copy cork options in ip6_append_data")
added some code duplication and bad error recovery, leading to potential
crash in ip6_cork_release() as kfree() could be called with garbage.

use kzalloc() to make sure this wont happen.

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller 
Cc: Herbert Xu 
Cc: Hideaki YOSHIFUJI 
Cc: Neal Cardwell 
Signed-off-by: Greg Kroah-Hartman

ipv6: don't let node/interface scoped multicast traffic escape on the wire

2013-02-11T19:00:54+00:00

Reported-by: Erik Hugne 
Cc: Erik Hugne 
Cc: YOSHIFUJI Hideaki 
Signed-off-by: Hannes Frederic Sowa 
Acked-by: YOSHIFUJI Hideaki 
Signed-off-by: David S. Miller

ipv6: Don't send packet to big messages to self

2013-02-06T20:12:39+00:00

Calling icmpv6_send() on a local message size error leads to an
incorrect update of the path mtu in the case when IPsec is used.
So use ipv6_local_error() instead to notify the socket about the
error.

Reported-by: Jiri Bohac 
Signed-off-by: Steffen Klassert 
Signed-off-by: David S. Miller

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2013-01-29T20:32:13+00:00

Bring in the 'net' tree so that we can get some ipv4/ipv6 bug
fixes that some net-next work will build upon.

Signed-off-by: David S. Miller

ipv6: remove duplicated declaration of ip6_fragment()

2013-01-23T04:18:59+00:00

It is declared in:
include/net/ip6_route.h:187:int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *));

and net/ip6_route.h is already included.

Cc: YOSHIFUJI Hideaki 
Cc: David S. Miller 
Signed-off-by: Cong Wang 
Signed-off-by: David S. Miller

ipv6: Unshare ip6_nd_hdr() and change return type to void.

2013-01-21T18:33:15+00:00

- move ip6_nd_hdr() to its users' source files.
  In net/ipv6/mcast.c, it will be called ip6_mc_hdr().
- make return type to void since this function never fails.

Signed-off-by: YOSHIFUJI Hideaki 
Signed-off-by: David S. Miller

ipv6: Do not depend on rt->n in ip6_finish_output2().

2013-01-17T23:38:19+00:00

If neigh is not found, create new one.

Signed-off-by: YOSHIFUJI Hideaki 
Signed-off-by: David S. Miller

ipv6: Do not depend on rt->n in ip6_dst_lookup_tail().

2013-01-17T23:38:19+00:00

Signed-off-by: YOSHIFUJI Hideaki 
Signed-off-by: David S. Miller

ipv6: fix header length calculation in ip6_append_data()

2013-01-17T08:37:13+00:00

Commit 299b0767 (ipv6: Fix IPsec slowpath fragmentation problem)
has introduced a error in the header length calculation that
provokes corrupted packets when non-fragmentable extensions
headers (Destination Option or Routing Header Type 2) are used.

rt->rt6i_nfheader_len is the length of the non-fragmentable
extension header, and it should be substracted to
rt->dst.header_len, and not to exthdrlen, as it was done before
commit 299b0767.

This patch reverts to the original and correct behavior. It has
been successfully tested with and without IPsec on packets
that include non-fragmentable extensions headers.

Signed-off-by: Romain Kuntz 
Acked-by: Steffen Klassert 
Signed-off-by: David S. Miller

ipv6: Introduce ip6_flow_hdr() to fill version, tclass and flowlabel.

2013-01-14T01:17:13+00:00

This is not only for readability but also for optimization.
What we do here is to build the 32bit word at the beginning of the ipv6
header (the "ip6_flow" virtual member of struct ip6_hdr in RFC3542) and
we do not need to read the tclass portion of the target buffer.

Signed-off-by: YOSHIFUJI Hideaki 
Signed-off-by: David S. Miller