Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
  netns: Don't receive new packets in a dead network namespace.
  sctp: Make sure N * sizeof(union sctp_addr) does not overflow.
  pppoe: warning fix
  ipv6: Drop packets for loopback address from outside of the box.
  ipv6: Remove options header when setsockopt's optlen is 0
  mac80211: detect driver tx bugs

2 files changed, 16 insertions, 4 deletions

diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index 4e5c8615832c..17eb48b8e329 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -102,6 +102,15 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
         if (hdr->version != 6)
                 goto err;
 
+        /*
+         * RFC4291 2.5.3
+         * A packet received on an interface with a destination address
+         * of loopback must be dropped.
+         */
+        if (!(dev->flags & IFF_LOOPBACK) &&
+            ipv6_addr_loopback(&hdr->daddr))
+                goto err;
+
         skb->transport_header = skb->network_header + sizeof(*hdr);
         IP6CB(skb)->nhoff = offsetof(struct ipv6hdr, nexthdr);
 
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index c042ce19bd14..86e28a75267f 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -345,18 +345,21 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
         case IPV6_DSTOPTS:
         {
                 struct ipv6_txoptions *opt;
+
+                /* remove any sticky options header with a zero option
+                 * length, per RFC3542.
+                 */
                 if (optlen == 0)
                         optval = NULL;
+                else if (optlen < sizeof(struct ipv6_opt_hdr) ||
+                         optlen & 0x7 || optlen > 8 * 255)
+                        goto e_inval;
 
                 /* hop-by-hop / destination options are privileged option */
                 retv = -EPERM;
                 if (optname != IPV6_RTHDR && !capable(CAP_NET_RAW))
                         break;
 
-                if (optlen < sizeof(struct ipv6_opt_hdr) ||
-                    optlen & 0x7 || optlen > 8 * 255)
-                        goto e_inval;
-
                 opt = ipv6_renew_options(sk, np->opt, optname,
                                          (struct ipv6_opt_hdr __user *)optval,
                                          optlen);