aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--net/ipv6/addrconf.c3
-rw-r--r--net/ipv6/ah6.c3
-rw-r--r--net/ipv6/ip6_output.c3
-rw-r--r--net/ipv6/tcp_ipv6.c9
4 files changed, 6 insertions, 12 deletions
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index b41c5d8b2789..a5e8d207a51b 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -3969,10 +3969,9 @@ static void addrconf_sysctl_register(struct inet6_dev *idev, struct ipv6_devconf
3969 struct addrconf_sysctl_table *t; 3969 struct addrconf_sysctl_table *t;
3970 char *dev_name = NULL; 3970 char *dev_name = NULL;
3971 3971
3972 t = kmalloc(sizeof(*t), GFP_KERNEL); 3972 t = kmemdup(&addrconf_sysctl, sizeof(*t), GFP_KERNEL);
3973 if (t == NULL) 3973 if (t == NULL)
3974 return; 3974 return;
3975 memcpy(t, &addrconf_sysctl, sizeof(*t));
3976 for (i=0; t->addrconf_vars[i].data; i++) { 3975 for (i=0; t->addrconf_vars[i].data; i++) {
3977 t->addrconf_vars[i].data += (char*)p - (char*)&ipv6_devconf; 3976 t->addrconf_vars[i].data += (char*)p - (char*)&ipv6_devconf;
3978 t->addrconf_vars[i].de = NULL; 3977 t->addrconf_vars[i].de = NULL;
diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index 2d9e495cf691..12c5a4dec09e 100644
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -354,10 +354,9 @@ static int ah6_input(struct xfrm_state *x, struct sk_buff *skb)
354 if (!pskb_may_pull(skb, ah_hlen)) 354 if (!pskb_may_pull(skb, ah_hlen))
355 goto out; 355 goto out;
356 356
357 tmp_hdr = kmalloc(hdr_len, GFP_ATOMIC); 357 tmp_hdr = kmemdup(skb->nh.raw, hdr_len, GFP_ATOMIC);
358 if (!tmp_hdr) 358 if (!tmp_hdr)
359 goto out; 359 goto out;
360 memcpy(tmp_hdr, skb->nh.raw, hdr_len);
361 if (ipv6_clear_mutable_options(skb->nh.ipv6h, hdr_len, XFRM_POLICY_IN)) 360 if (ipv6_clear_mutable_options(skb->nh.ipv6h, hdr_len, XFRM_POLICY_IN))
362 goto free_out; 361 goto free_out;
363 skb->nh.ipv6h->priority = 0; 362 skb->nh.ipv6h->priority = 0;
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 85f889270492..e05ecbb1412d 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -624,14 +624,13 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
624 skb_shinfo(skb)->frag_list = NULL; 624 skb_shinfo(skb)->frag_list = NULL;
625 /* BUILD HEADER */ 625 /* BUILD HEADER */
626 626
627 tmp_hdr = kmalloc(hlen, GFP_ATOMIC); 627 tmp_hdr = kmemdup(skb->nh.raw, hlen, GFP_ATOMIC);
628 if (!tmp_hdr) { 628 if (!tmp_hdr) {
629 IP6_INC_STATS(ip6_dst_idev(skb->dst), IPSTATS_MIB_FRAGFAILS); 629 IP6_INC_STATS(ip6_dst_idev(skb->dst), IPSTATS_MIB_FRAGFAILS);
630 return -ENOMEM; 630 return -ENOMEM;
631 } 631 }
632 632
633 *prevhdr = NEXTHDR_FRAGMENT; 633 *prevhdr = NEXTHDR_FRAGMENT;
634 memcpy(tmp_hdr, skb->nh.raw, hlen);
635 __skb_pull(skb, hlen); 634 __skb_pull(skb, hlen);
636 fh = (struct frag_hdr*)__skb_push(skb, sizeof(struct frag_hdr)); 635 fh = (struct frag_hdr*)__skb_push(skb, sizeof(struct frag_hdr));
637 skb->nh.raw = __skb_push(skb, hlen); 636 skb->nh.raw = __skb_push(skb, hlen);
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 147ce499f509..d2170da77e5b 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -720,10 +720,9 @@ static int tcp_v6_parse_md5_keys (struct sock *sk, char __user *optval,
720 tp->md5sig_info = p; 720 tp->md5sig_info = p;
721 } 721 }
722 722
723 newkey = kmalloc(cmd.tcpm_keylen, GFP_KERNEL); 723 newkey = kmemdup(cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
724 if (!newkey) 724 if (!newkey)
725 return -ENOMEM; 725 return -ENOMEM;
726 memcpy(newkey, cmd.tcpm_key, cmd.tcpm_keylen);
727 if (ipv6_addr_type(&sin6->sin6_addr) & IPV6_ADDR_MAPPED) { 726 if (ipv6_addr_type(&sin6->sin6_addr) & IPV6_ADDR_MAPPED) {
728 return tcp_v4_md5_do_add(sk, sin6->sin6_addr.s6_addr32[3], 727 return tcp_v4_md5_do_add(sk, sin6->sin6_addr.s6_addr32[3],
729 newkey, cmd.tcpm_keylen); 728 newkey, cmd.tcpm_keylen);
@@ -1503,12 +1502,10 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
1503 * memory, then we end up not copying the key 1502 * memory, then we end up not copying the key
1504 * across. Shucks. 1503 * across. Shucks.
1505 */ 1504 */
1506 char *newkey = kmalloc(key->keylen, GFP_ATOMIC); 1505 char *newkey = kmemdup(key->key, key->keylen, GFP_ATOMIC);
1507 if (newkey) { 1506 if (newkey != NULL)
1508 memcpy(newkey, key->key, key->keylen);
1509 tcp_v6_md5_do_add(newsk, &inet6_sk(sk)->daddr, 1507 tcp_v6_md5_do_add(newsk, &inet6_sk(sk)->daddr,
1510 newkey, key->keylen); 1508 newkey, key->keylen);
1511 }
1512 } 1509 }
1513#endif 1510#endif
1514 1511