aboutsummaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
authorHerbert Xu <herbert@gondor.apana.org.au>2005-10-17 22:03:28 -0400
committerArnaldo Carvalho de Melo <acme@mandriva.com>2005-10-20 12:49:59 -0400
commit49c5bfaffe8ae6e6440dc4bf78b03800960d93f5 (patch)
treedbd4565b42697a7fdeee8d088f017eb7df8bc594 /net
parentffa29347dfbc158d1f47f5925324a6f5713659c1 (diff)
[DCCP]: Clear the IPCB area
Turns out the problem has nothing to do with use-after-free or double-free. It's just that we're not clearing the CB area and DCCP unlike TCP uses a CB format that's incompatible with IP. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: Ian McDonald <imcdnzl@gmail.com> Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>
Diffstat (limited to 'net')
-rw-r--r--net/dccp/ipv4.c2
-rw-r--r--net/dccp/output.c1
2 files changed, 3 insertions, 0 deletions
diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index ae088d1347af..6298cf58ff9e 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -463,6 +463,7 @@ static int dccp_v4_send_response(struct sock *sk, struct request_sock *req,
463 if (skb != NULL) { 463 if (skb != NULL) {
464 const struct inet_request_sock *ireq = inet_rsk(req); 464 const struct inet_request_sock *ireq = inet_rsk(req);
465 465
466 memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
466 err = ip_build_and_send_pkt(skb, sk, ireq->loc_addr, 467 err = ip_build_and_send_pkt(skb, sk, ireq->loc_addr,
467 ireq->rmt_addr, 468 ireq->rmt_addr,
468 ireq->opt); 469 ireq->opt);
@@ -647,6 +648,7 @@ int dccp_v4_send_reset(struct sock *sk, enum dccp_reset_codes code)
647 if (skb != NULL) { 648 if (skb != NULL) {
648 const struct inet_sock *inet = inet_sk(sk); 649 const struct inet_sock *inet = inet_sk(sk);
649 650
651 memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
650 err = ip_build_and_send_pkt(skb, sk, 652 err = ip_build_and_send_pkt(skb, sk,
651 inet->saddr, inet->daddr, NULL); 653 inet->saddr, inet->daddr, NULL);
652 if (err == NET_XMIT_CN) 654 if (err == NET_XMIT_CN)
diff --git a/net/dccp/output.c b/net/dccp/output.c
index 7006549f7050..29250749f16f 100644
--- a/net/dccp/output.c
+++ b/net/dccp/output.c
@@ -100,6 +100,7 @@ int dccp_transmit_skb(struct sock *sk, struct sk_buff *skb)
100 100
101 DCCP_INC_STATS(DCCP_MIB_OUTSEGS); 101 DCCP_INC_STATS(DCCP_MIB_OUTSEGS);
102 102
103 memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
103 err = ip_queue_xmit(skb, 0); 104 err = ip_queue_xmit(skb, 0);
104 if (err <= 0) 105 if (err <= 0)
105 return err; 106 return err;