tcp: Fix IPv6 fallout from 'Port redirection support for TCP'

'tcp: Port redirection support for TCP' (a3116ac5c) added a new member
to inet_request_sock() which inet_csk_clone() makes use of but failed
to add proper initialization to the IPv6 syncookie code and missed a
couple of places where the new member should be used instead of
inet_sk(sk)->sport.

Signed-off-by: KOVACS Krisztian <hidden@sch.bme.hu>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 3 insertions, 3 deletions

diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index e5310c9b84dc..b6b356b7912a 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -476,7 +476,7 @@ static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req)
         fl.fl6_flowlabel = 0;
         fl.oif = treq->iif;
         fl.fl_ip_dport = inet_rsk(req)->rmt_port;
-        fl.fl_ip_sport = inet_sk(sk)->sport;
+        fl.fl_ip_sport = inet_rsk(req)->loc_port;
         security_req_classify_flow(req, &fl);
 
         opt = np->opt;
@@ -1309,7 +1309,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
                 ipv6_addr_copy(&fl.fl6_src, &treq->loc_addr);
                 fl.oif = sk->sk_bound_dev_if;
                 fl.fl_ip_dport = inet_rsk(req)->rmt_port;
-                fl.fl_ip_sport = inet_sk(sk)->sport;
+                fl.fl_ip_sport = inet_rsk(req)->loc_port;
                 security_req_classify_flow(req, &fl);
 
                 if (ip6_dst_lookup(sk, &dst, &fl))
@@ -1865,7 +1865,7 @@ static void get_openreq6(struct seq_file *seq,
                    i,
                    src->s6_addr32[0], src->s6_addr32[1],
                    src->s6_addr32[2], src->s6_addr32[3],
-                   ntohs(inet_sk(sk)->sport),
+                   ntohs(inet_rsk(req)->loc_port),
                    dest->s6_addr32[0], dest->s6_addr32[1],
                    dest->s6_addr32[2], dest->s6_addr32[3],
                    ntohs(inet_rsk(req)->rmt_port),