ipv6: fix leaking uninitialized port number of offender sockaddr

[deliverable/linux.git] / net / ipv6 / datagram.c

diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index 48b6bd2a9a1451b7adf9a678ccce859003d57a79..8dfe1f4d3c1a4e5f1e90be1603a2c84311f3a95b 100644 (file)
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -107,16 +107,16 @@ ipv4_connected:
                if (err)
                        goto out;
 
-               ipv6_addr_set_v4mapped(inet->inet_daddr, &np->daddr);
+               ipv6_addr_set_v4mapped(inet->inet_daddr, &sk->sk_v6_daddr);
 
                if (ipv6_addr_any(&np->saddr) ||
                    ipv6_mapped_addr_any(&np->saddr))
                        ipv6_addr_set_v4mapped(inet->inet_saddr, &np->saddr);
 
-               if (ipv6_addr_any(&np->rcv_saddr) ||
-                   ipv6_mapped_addr_any(&np->rcv_saddr)) {
+               if (ipv6_addr_any(&sk->sk_v6_rcv_saddr) ||
+                   ipv6_mapped_addr_any(&sk->sk_v6_rcv_saddr)) {
                        ipv6_addr_set_v4mapped(inet->inet_rcv_saddr,
-                                              &np->rcv_saddr);
+                                              &sk->sk_v6_rcv_saddr);
                        if (sk->sk_prot->rehash)
                                sk->sk_prot->rehash(sk);
                }
@@ -145,7 +145,7 @@ ipv4_connected:
                }
        }
 
-       np->daddr = *daddr;
+       sk->sk_v6_daddr = *daddr;
        np->flow_label = fl6.flowlabel;
 
        inet->inet_dport = usin->sin6_port;
@@ -156,7 +156,7 @@ ipv4_connected:
         */
 
        fl6.flowi6_proto = sk->sk_protocol;
-       fl6.daddr = np->daddr;
+       fl6.daddr = sk->sk_v6_daddr;
        fl6.saddr = np->saddr;
        fl6.flowi6_oif = sk->sk_bound_dev_if;
        fl6.flowi6_mark = sk->sk_mark;
@@ -183,16 +183,16 @@ ipv4_connected:
        if (ipv6_addr_any(&np->saddr))
                np->saddr = fl6.saddr;
 
-       if (ipv6_addr_any(&np->rcv_saddr)) {
-               np->rcv_saddr = fl6.saddr;
+       if (ipv6_addr_any(&sk->sk_v6_rcv_saddr)) {
+               sk->sk_v6_rcv_saddr = fl6.saddr;
                inet->inet_rcv_saddr = LOOPBACK4_IPV6;
                if (sk->sk_prot->rehash)
                        sk->sk_prot->rehash(sk);
        }
 
        ip6_dst_store(sk, dst,
-                     ipv6_addr_equal(&fl6.daddr, &np->daddr) ?
-                     &np->daddr : NULL,
+                     ipv6_addr_equal(&fl6.daddr, &sk->sk_v6_daddr) ?
+                     &sk->sk_v6_daddr : NULL,
 #ifdef CONFIG_IPV6_SUBTREES
                      ipv6_addr_equal(&fl6.saddr, &np->saddr) ?
                      &np->saddr :
@@ -318,7 +318,7 @@ void ipv6_local_rxpmtu(struct sock *sk, struct flowi6 *fl6, u32 mtu)
 /*
  *     Handle MSG_ERRQUEUE
  */
-int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
+int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
 {
        struct ipv6_pinfo *np = inet6_sk(sk);
        struct sock_exterr_skb *serr;
@@ -369,6 +369,7 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
                                               &sin->sin6_addr);
                        sin->sin6_scope_id = 0;
                }
+               *addr_len = sizeof(*sin);
        }
 
        memcpy(&errhdr.ee, &serr->ee, sizeof(struct sock_extended_err));
@@ -377,6 +378,7 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
        if (serr->ee.ee_origin != SO_EE_ORIGIN_LOCAL) {
                sin->sin6_family = AF_INET6;
                sin->sin6_flowinfo = 0;
+               sin->sin6_port = 0;
                if (skb->protocol == htons(ETH_P_IPV6)) {
                        sin->sin6_addr = ipv6_hdr(skb)->saddr;
                        if (np->rxopt.all)
@@ -423,7 +425,8 @@ EXPORT_SYMBOL_GPL(ipv6_recv_error);
 /*
  *     Handle IPV6_RECVPATHMTU
  */
-int ipv6_recv_rxpmtu(struct sock *sk, struct msghdr *msg, int len)
+int ipv6_recv_rxpmtu(struct sock *sk, struct msghdr *msg, int len,
+                    int *addr_len)
 {
        struct ipv6_pinfo *np = inet6_sk(sk);
        struct sk_buff *skb;
@@ -457,6 +460,7 @@ int ipv6_recv_rxpmtu(struct sock *sk, struct msghdr *msg, int len)
                sin->sin6_port = 0;
                sin->sin6_scope_id = mtu_info.ip6m_addr.sin6_scope_id;
                sin->sin6_addr = mtu_info.ip6m_addr.sin6_addr;
+               *addr_len = sizeof(*sin);
        }
 
        put_cmsg(msg, SOL_IPV6, IPV6_PATHMTU, sizeof(mtu_info), &mtu_info);
@@ -883,11 +887,10 @@ EXPORT_SYMBOL_GPL(ip6_datagram_send_ctl);
 void ip6_dgram_sock_seq_show(struct seq_file *seq, struct sock *sp,
                             __u16 srcp, __u16 destp, int bucket)
 {
-       struct ipv6_pinfo *np = inet6_sk(sp);
        const struct in6_addr *dest, *src;
 
-       dest  = &np->daddr;
-       src   = &np->rcv_saddr;
+       dest  = &sp->sk_v6_daddr;
+       src   = &sp->sk_v6_rcv_saddr;
        seq_printf(seq,
                   "%5d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
                   "%02X %08X:%08X %02X:%08lX %08X %5u %8d %lu %d %pK %d\n",