inet{6}_request_sock: Init ->opt and ->pktopts in the constructor

Wei Yongjun noticed that we may call reqsk_free on request sock objects where
the opt fields may not be initialized, fix it by introducing inet_reqsk_alloc
where we initialize ->opt to NULL and set ->pktopts to NULL in
inet6_reqsk_alloc.

Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

2 files changed, 1 insertions, 3 deletions

diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index c22a3780c14e..37d27bcb361f 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -589,7 +589,7 @@ int dccp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
         if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1)
                 goto drop;
 
-        req = reqsk_alloc(&dccp_request_sock_ops);
+        req = inet_reqsk_alloc(&dccp_request_sock_ops);
         if (req == NULL)
                 goto drop;
 
@@ -605,7 +605,6 @@ int dccp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
         ireq = inet_rsk(req);
         ireq->loc_addr = ip_hdr(skb)->daddr;
         ireq->rmt_addr = ip_hdr(skb)->saddr;
-        ireq->opt       = NULL;
 
         /*
          * Step 3: Process LISTEN state
diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index 9b1129bb7ece..f7fe2a572d7b 100644
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -421,7 +421,6 @@ static int dccp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
         ireq6 = inet6_rsk(req);
         ipv6_addr_copy(&ireq6->rmt_addr, &ipv6_hdr(skb)->saddr);
         ipv6_addr_copy(&ireq6->loc_addr, &ipv6_hdr(skb)->daddr);
-        ireq6->pktopts  = NULL;
 
         if (ipv6_opt_accepted(sk, skb) ||
             np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo ||