1 files changed, 35 insertions, 0 deletions

diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 3b5669a2582..4252b3cc183 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -63,6 +63,20 @@
 #include <asm/system.h>
 #include <linux/mroute6.h>
 
+#ifdef CONFIG_ANDROID_PARANOID_NETWORK
+#include <linux/android_aid.h>
+
+static inline int current_has_network(void)
+{
+        return in_egroup_p(AID_INET) || capable(CAP_NET_RAW);
+}
+#else
+static inline int current_has_network(void)
+{
+        return 1;
+}
+#endif
+
 MODULE_AUTHOR("Cast of dozens");
 MODULE_DESCRIPTION("IPv6 protocol stack for Linux");
 MODULE_LICENSE("GPL");
@@ -109,6 +123,9 @@ static int inet6_create(struct net *net, struct socket *sock, int protocol,
         int try_loading_module = 0;
         int err;
 
+        if (!current_has_network())
+                return -EACCES;
+
         if (sock->type != SOCK_RAW &&
             sock->type != SOCK_DGRAM &&
             !inet_ehash_secret)
@@ -477,6 +494,21 @@ int inet6_getname(struct socket *sock, struct sockaddr *uaddr,
 
 EXPORT_SYMBOL(inet6_getname);
 
+int inet6_killaddr_ioctl(struct net *net, void __user *arg) {
+        struct in6_ifreq ireq;
+        struct sockaddr_in6 sin6;
+
+        if (!capable(CAP_NET_ADMIN))
+                return -EACCES;
+
+        if (copy_from_user(&ireq, arg, sizeof(struct in6_ifreq)))
+                return -EFAULT;
+
+        sin6.sin6_family = AF_INET6;
+        ipv6_addr_copy(&sin6.sin6_addr, &ireq.ifr6_addr);
+        return tcp_nuke_addr(net, (struct sockaddr *) &sin6);
+}
+
 int inet6_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 {
         struct sock *sk = sock->sk;
@@ -501,6 +533,8 @@ int inet6_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
                 return addrconf_del_ifaddr(net, (void __user *) arg);
         case SIOCSIFDSTADDR:
                 return addrconf_set_dstaddr(net, (void __user *) arg);
+        case SIOCKILLADDR:
+                return inet6_killaddr_ioctl(net, (void __user *) arg);
         default:
                 if (!sk->sk_prot->ioctl)
                         return -ENOIOCTLCMD;
@@ -875,6 +909,7 @@ static struct sk_buff **ipv6_gro_receive(struct sk_buff **head,
                 skb_reset_transport_header(skb);
                 __skb_push(skb, skb_gro_offset(skb));
 
+                ops = rcu_dereference(inet6_protos[proto]);
                 if (!ops || !ops->gro_receive)
                         goto out_unlock;