1 files changed, 43 insertions, 35 deletions

diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index f87a8eb76f3b..599374f65c76 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -578,7 +578,7 @@ found:
 void __udp4_lib_err(struct sk_buff *skb, u32 info, struct udp_table *udptable)
 {
         struct inet_sock *inet;
-        struct iphdr *iph = (struct iphdr *)skb->data;
+        const struct iphdr *iph = (const struct iphdr *)skb->data;
         struct udphdr *uh = (struct udphdr *)(skb->data+(iph->ihl<<2));
         const int type = icmp_hdr(skb)->type;
         const int code = icmp_hdr(skb)->code;
@@ -706,12 +706,11 @@ static void udp4_hwcsum(struct sk_buff *skb, __be32 src, __be32 dst)
         }
 }
 
-static int udp_send_skb(struct sk_buff *skb, __be32 daddr, __be32 dport)
+static int udp_send_skb(struct sk_buff *skb, struct flowi4 *fl4)
 {
         struct sock *sk = skb->sk;
         struct inet_sock *inet = inet_sk(sk);
         struct udphdr *uh;
-        struct rtable *rt = (struct rtable *)skb_dst(skb);
         int err = 0;
         int is_udplite = IS_UDPLITE(sk);
         int offset = skb_transport_offset(skb);
@@ -723,7 +722,7 @@ static int udp_send_skb(struct sk_buff *skb, __be32 daddr, __be32 dport)
          */
         uh = udp_hdr(skb);
         uh->source = inet->inet_sport;
-        uh->dest = dport;
+        uh->dest = fl4->fl4_dport;
         uh->len = htons(len);
         uh->check = 0;
 
@@ -737,14 +736,14 @@ static int udp_send_skb(struct sk_buff *skb, __be32 daddr, __be32 dport)
 
         } else if (skb->ip_summed == CHECKSUM_PARTIAL) { /* UDP hardware csum */
 
-                udp4_hwcsum(skb, rt->rt_src, daddr);
+                udp4_hwcsum(skb, fl4->saddr, fl4->daddr);
                 goto send;
 
         } else
                 csum = udp_csum(skb);
 
         /* add protocol-dependent pseudo-header */
-        uh->check = csum_tcpudp_magic(rt->rt_src, daddr, len,
+        uh->check = csum_tcpudp_magic(fl4->saddr, fl4->daddr, len,
                                       sk->sk_protocol, csum);
         if (uh->check == 0)
                 uh->check = CSUM_MANGLED_0;
@@ -774,11 +773,11 @@ static int udp_push_pending_frames(struct sock *sk)
         struct sk_buff *skb;
         int err = 0;
 
-        skb = ip_finish_skb(sk);
+        skb = ip_finish_skb(sk, fl4);
         if (!skb)
                 goto out;
 
-        err = udp_send_skb(skb, fl4->daddr, fl4->fl4_dport);
+        err = udp_send_skb(skb, fl4);
 
 out:
         up->len = 0;
@@ -791,6 +790,7 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
 {
         struct inet_sock *inet = inet_sk(sk);
         struct udp_sock *up = udp_sk(sk);
+        struct flowi4 fl4_stack;
         struct flowi4 *fl4;
         int ulen = len;
         struct ipcm_cookie ipc;
@@ -804,6 +804,7 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         int corkreq = up->corkflag || msg->msg_flags&MSG_MORE;
         int (*getfrag)(void *, char *, int, int, int, struct sk_buff *);
         struct sk_buff *skb;
+        struct ip_options_data opt_copy;
 
         if (len > 0xFFFF)
                 return -EMSGSIZE;
@@ -820,6 +821,7 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
 
         getfrag = is_udplite ? udplite_getfrag : ip_generic_getfrag;
 
+        fl4 = &inet->cork.fl.u.ip4;
         if (up->pending) {
                 /*
                  * There are pending frames.
@@ -877,22 +879,32 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                         free = 1;
                 connected = 0;
         }
-        if (!ipc.opt)
-                ipc.opt = inet->opt;
+        if (!ipc.opt) {
+                struct ip_options_rcu *inet_opt;
+
+                rcu_read_lock();
+                inet_opt = rcu_dereference(inet->inet_opt);
+                if (inet_opt) {
+                        memcpy(&opt_copy, inet_opt,
+                               sizeof(*inet_opt) + inet_opt->opt.optlen);
+                        ipc.opt = &opt_copy.opt;
+                }
+                rcu_read_unlock();
+        }
 
         saddr = ipc.addr;
         ipc.addr = faddr = daddr;
 
-        if (ipc.opt && ipc.opt->srr) {
+        if (ipc.opt && ipc.opt->opt.srr) {
                 if (!daddr)
                         return -EINVAL;
-                faddr = ipc.opt->faddr;
+                faddr = ipc.opt->opt.faddr;
                 connected = 0;
         }
         tos = RT_TOS(inet->tos);
         if (sock_flag(sk, SOCK_LOCALROUTE) ||
             (msg->msg_flags & MSG_DONTROUTE) ||
-            (ipc.opt && ipc.opt->is_strictroute)) {
+            (ipc.opt && ipc.opt->opt.is_strictroute)) {
                 tos |= RTO_ONLINK;
                 connected = 0;
         }
@@ -909,22 +921,16 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                 rt = (struct rtable *)sk_dst_check(sk, 0);
 
         if (rt == NULL) {
-                struct flowi4 fl4 = {
-                        .flowi4_oif = ipc.oif,
-                        .flowi4_mark = sk->sk_mark,
-                        .daddr = faddr,
-                        .saddr = saddr,
-                        .flowi4_tos = tos,
-                        .flowi4_proto = sk->sk_protocol,
-                        .flowi4_flags = (inet_sk_flowi_flags(sk) |
-                                         FLOWI_FLAG_CAN_SLEEP),
-                        .fl4_sport = inet->inet_sport,
-                        .fl4_dport = dport,
-                };
                 struct net *net = sock_net(sk);
 
-                security_sk_classify_flow(sk, flowi4_to_flowi(&fl4));
-                rt = ip_route_output_flow(net, &fl4, sk);
+                fl4 = &fl4_stack;
+                flowi4_init_output(fl4, ipc.oif, sk->sk_mark, tos,
+                                   RT_SCOPE_UNIVERSE, sk->sk_protocol,
+                                   inet_sk_flowi_flags(sk)|FLOWI_FLAG_CAN_SLEEP,
+                                   faddr, saddr, dport, inet->inet_sport);
+
+                security_sk_classify_flow(sk, flowi4_to_flowi(fl4));
+                rt = ip_route_output_flow(net, fl4, sk);
                 if (IS_ERR(rt)) {
                         err = PTR_ERR(rt);
                         rt = NULL;
@@ -945,18 +951,18 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                 goto do_confirm;
 back_from_confirm:
 
-        saddr = rt->rt_src;
+        saddr = fl4->saddr;
         if (!ipc.addr)
-                daddr = ipc.addr = rt->rt_dst;
+                daddr = ipc.addr = fl4->daddr;
 
         /* Lockless fast path for the non-corking case. */
         if (!corkreq) {
-                skb = ip_make_skb(sk, getfrag, msg->msg_iov, ulen,
+                skb = ip_make_skb(sk, fl4, getfrag, msg->msg_iov, ulen,
                                   sizeof(struct udphdr), &ipc, &rt,
                                   msg->msg_flags);
                 err = PTR_ERR(skb);
                 if (skb && !IS_ERR(skb))
-                        err = udp_send_skb(skb, daddr, dport);
+                        err = udp_send_skb(skb, fl4);
                 goto out;
         }
 
@@ -982,9 +988,9 @@ back_from_confirm:
 
 do_append_data:
         up->len += ulen;
-        err = ip_append_data(sk, getfrag, msg->msg_iov, ulen,
-                        sizeof(struct udphdr), &ipc, &rt,
-                        corkreq ? msg->msg_flags|MSG_MORE : msg->msg_flags);
+        err = ip_append_data(sk, fl4, getfrag, msg->msg_iov, ulen,
+                             sizeof(struct udphdr), &ipc, &rt,
+                             corkreq ? msg->msg_flags|MSG_MORE : msg->msg_flags);
         if (err)
                 udp_flush_pending_frames(sk);
         else if (!corkreq)
@@ -1024,6 +1030,7 @@ EXPORT_SYMBOL(udp_sendmsg);
 int udp_sendpage(struct sock *sk, struct page *page, int offset,
                  size_t size, int flags)
 {
+        struct inet_sock *inet = inet_sk(sk);
         struct udp_sock *up = udp_sk(sk);
         int ret;
 
@@ -1048,7 +1055,8 @@ int udp_sendpage(struct sock *sk, struct page *page, int offset,
                 return -EINVAL;
         }
 
-        ret = ip_append_page(sk, page, offset, size, flags);
+        ret = ip_append_page(sk, &inet->cork.fl.u.ip4,
+                             page, offset, size, flags);
         if (ret == -EOPNOTSUPP) {
                 release_sock(sk);
                 return sock_no_sendpage(sk->sk_socket, page, offset,