1 files changed, 18 insertions, 15 deletions

diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index b07ce21983aa..896350df6423 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -746,10 +746,8 @@ static int rawv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
         struct raw6_frag_vec rfv;
         struct flowi6 fl6;
         struct sockcm_cookie sockc;
+        struct ipcm6_cookie ipc6;
         int addr_len = msg->msg_namelen;
-        int hlimit = -1;
-        int tclass = -1;
-        int dontfrag = -1;
         u16 proto;
         int err;
 
@@ -770,6 +768,11 @@ static int rawv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
 
         fl6.flowi6_mark = sk->sk_mark;
 
+        ipc6.hlimit = -1;
+        ipc6.tclass = -1;
+        ipc6.dontfrag = -1;
+        ipc6.opt = NULL;
+
         if (sin6) {
                 if (addr_len < SIN6_LEN_RFC2133)
                         return -EINVAL;
@@ -827,10 +830,9 @@ static int rawv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
                 opt = &opt_space;
                 memset(opt, 0, sizeof(struct ipv6_txoptions));
                 opt->tot_len = sizeof(struct ipv6_txoptions);
+                ipc6.opt = opt;
 
-                err = ip6_datagram_send_ctl(sock_net(sk), sk, msg, &fl6, opt,
-                                            &hlimit, &tclass, &dontfrag,
-                                            &sockc);
+                err = ip6_datagram_send_ctl(sock_net(sk), sk, msg, &fl6, &ipc6, &sockc);
                 if (err < 0) {
                         fl6_sock_release(flowlabel);
                         return err;
@@ -846,7 +848,7 @@ static int rawv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
         if (!opt) {
                 opt = txopt_get(np);
                 opt_to_free = opt;
-                }
+        }
         if (flowlabel)
                 opt = fl6_merge_options(&opt_space, flowlabel, opt);
         opt = ipv6_fixup_options(&opt_space, opt);
@@ -881,14 +883,14 @@ static int rawv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
                 err = PTR_ERR(dst);
                 goto out;
         }
-        if (hlimit < 0)
-                hlimit = ip6_sk_dst_hoplimit(np, &fl6, dst);
+        if (ipc6.hlimit < 0)
+                ipc6.hlimit = ip6_sk_dst_hoplimit(np, &fl6, dst);
 
-        if (tclass < 0)
-                tclass = np->tclass;
+        if (ipc6.tclass < 0)
+                ipc6.tclass = np->tclass;
 
-        if (dontfrag < 0)
-                dontfrag = np->dontfrag;
+        if (ipc6.dontfrag < 0)
+                ipc6.dontfrag = np->dontfrag;
 
         if (msg->msg_flags&MSG_CONFIRM)
                 goto do_confirm;
@@ -897,10 +899,11 @@ back_from_confirm:
         if (inet->hdrincl)
                 err = rawv6_send_hdrinc(sk, msg, len, &fl6, &dst, msg->msg_flags);
         else {
+                ipc6.opt = opt;
                 lock_sock(sk);
                 err = ip6_append_data(sk, raw6_getfrag, &rfv,
-                        len, 0, hlimit, tclass, opt, &fl6, (struct rt6_info *)dst,
-                        msg->msg_flags, dontfrag, &sockc);
+                        len, 0, &ipc6, &fl6, (struct rt6_info *)dst,
+                        msg->msg_flags, &sockc);
 
                 if (err)
                         ip6_flush_pending_frames(sk);