[IPV6]: IPV6_CHECKSUM socket option can corrupt kernel memory

So here is a patch that introduces skb_store_bits -- the opposite of
skb_copy_bits, and uses them to read/write the csum field in rawv6.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 2 insertions, 0 deletions

diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index aa35797ebfbf..9f2d75e4f087 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -1183,6 +1183,8 @@ extern unsigned int    skb_checksum(const struct sk_buff *skb, int offset,
                                     int len, unsigned int csum);
 extern int             skb_copy_bits(const struct sk_buff *skb, int offset,
                                      void *to, int len);
+extern int             skb_store_bits(const struct sk_buff *skb, int offset,
+                                      void *from, int len);
 extern unsigned int    skb_copy_and_csum_bits(const struct sk_buff *skb,
                                               int offset, u8 *to, int len,
                                               unsigned int csum);