diff options
author | Matthias Schiffer <mschiffer@universe-factory.net> | 2013-05-30 21:27:55 -0400 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2013-06-18 01:59:12 -0400 |
commit | 33be081a812098567898bbe23b581460331a986f (patch) | |
tree | 2437be01526706f1334707235425252af38825d7 /net | |
parent | 32de868cbc6bee010d2cee95b5071b25ecbec8c3 (diff) |
ipv6: ndisc: fix ndisc_send_redirect writing to the wrong skb
Since some refactoring in 5f5a011, ndisc_send_redirect called
ndisc_fill_redirect_hdr_option on the wrong skb, leading to data corruption or
in the worst case a panic when the skb_put failed.
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
Reviewed-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
-rw-r--r-- | net/ipv6/ndisc.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c index 2712ab22a174..ca4ffcc287f1 100644 --- a/net/ipv6/ndisc.c +++ b/net/ipv6/ndisc.c | |||
@@ -1493,7 +1493,7 @@ void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target) | |||
1493 | */ | 1493 | */ |
1494 | 1494 | ||
1495 | if (ha) | 1495 | if (ha) |
1496 | ndisc_fill_addr_option(skb, ND_OPT_TARGET_LL_ADDR, ha); | 1496 | ndisc_fill_addr_option(buff, ND_OPT_TARGET_LL_ADDR, ha); |
1497 | 1497 | ||
1498 | /* | 1498 | /* |
1499 | * build redirect option and copy skb over to the new packet. | 1499 | * build redirect option and copy skb over to the new packet. |