[TCP]: Invoke tcp_sendmsg() directly, do not use inet_sendmsg().

As discovered by Evegniy Polyakov, if we try to sendmsg after
a connection reset, we can do incredibly stupid things.

The core issue is that inet_sendmsg() tries to autobind the
socket, but we should never do that for TCP.  Instead we should
just go straight into TCP's sendmsg() code which will do all
of the necessary state and pending socket error checks.

TCP's sendpage already directly vectors to tcp_sendpage(), so this
merely brings sendmsg() in line with that.

Signed-off-by: David S. Miller <davem@davemloft.net>

2 files changed, 1 insertions, 2 deletions

diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index eed09373a45d..b5f96372ad73 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -484,7 +484,7 @@ const struct proto_ops inet6_stream_ops = {
         .shutdown          = inet_shutdown,             /* ok           */
         .setsockopt        = sock_common_setsockopt,    /* ok           */
         .getsockopt        = sock_common_getsockopt,    /* ok           */
-        .sendmsg           = inet_sendmsg,              /* ok           */
+        .sendmsg           = tcp_sendmsg,               /* ok           */
         .recvmsg           = sock_common_recvmsg,       /* ok           */
         .mmap              = sock_no_mmap,
         .sendpage          = tcp_sendpage,
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index f10f3689d671..cbdb78487915 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -2115,7 +2115,6 @@ struct proto tcpv6_prot = {
         .shutdown               = tcp_shutdown,
         .setsockopt             = tcp_setsockopt,
         .getsockopt             = tcp_getsockopt,
-        .sendmsg                = tcp_sendmsg,
         .recvmsg                = tcp_recvmsg,
         .backlog_rcv            = tcp_v6_do_rcv,
         .hash                   = tcp_v6_hash,