aboutsummaryrefslogtreecommitdiffstats
path: root/net/ipv6
diff options
context:
space:
mode:
Diffstat (limited to 'net/ipv6')
-rw-r--r--net/ipv6/datagram.c5
-rw-r--r--net/ipv6/ip6mr.c2
-rw-r--r--net/ipv6/ipv6_sockglue.c12
-rw-r--r--net/ipv6/raw.c4
-rw-r--r--net/ipv6/route.c8
-rw-r--r--net/ipv6/syncookies.c1
-rw-r--r--net/ipv6/tcp_ipv6.c1
7 files changed, 22 insertions, 11 deletions
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index 8cdb6b65ee96..f7b535dec860 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -703,6 +703,11 @@ int datagram_send_ctl(struct net *net,
703 } 703 }
704 704
705 *hlimit = *(int *)CMSG_DATA(cmsg); 705 *hlimit = *(int *)CMSG_DATA(cmsg);
706 if (*hlimit < -1 || *hlimit > 0xff) {
707 err = -EINVAL;
708 goto exit_f;
709 }
710
706 break; 711 break;
707 712
708 case IPV6_TCLASS: 713 case IPV6_TCLASS:
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 0b11b378d89a..90e763073dc5 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -197,7 +197,7 @@ static int ip6mr_vif_seq_show(struct seq_file *seq, void *v)
197 const char *name = vif->dev ? vif->dev->name : "none"; 197 const char *name = vif->dev ? vif->dev->name : "none";
198 198
199 seq_printf(seq, 199 seq_printf(seq,
200 "%2Zd %-10s %8ld %7ld %8ld %7ld %05X\n", 200 "%2td %-10s %8ld %7ld %8ld %7ld %05X\n",
201 vif - vif6_table, 201 vif - vif6_table,
202 name, vif->bytes_in, vif->pkt_in, 202 name, vif->bytes_in, vif->pkt_in,
203 vif->bytes_out, vif->pkt_out, 203 vif->bytes_out, vif->pkt_out,
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 237ebbb9383b..a9988841172a 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -65,7 +65,7 @@ int ip6_ra_control(struct sock *sk, int sel, void (*destructor)(struct sock *))
65 65
66 /* RA packet may be delivered ONLY to IPPROTO_RAW socket */ 66 /* RA packet may be delivered ONLY to IPPROTO_RAW socket */
67 if (sk->sk_type != SOCK_RAW || inet_sk(sk)->num != IPPROTO_RAW) 67 if (sk->sk_type != SOCK_RAW || inet_sk(sk)->num != IPPROTO_RAW)
68 return -EINVAL; 68 return -ENOPROTOOPT;
69 69
70 new_ra = (sel>=0) ? kmalloc(sizeof(*new_ra), GFP_KERNEL) : NULL; 70 new_ra = (sel>=0) ? kmalloc(sizeof(*new_ra), GFP_KERNEL) : NULL;
71 71
@@ -444,7 +444,7 @@ done:
444 444
445 case IPV6_MULTICAST_HOPS: 445 case IPV6_MULTICAST_HOPS:
446 if (sk->sk_type == SOCK_STREAM) 446 if (sk->sk_type == SOCK_STREAM)
447 goto e_inval; 447 break;
448 if (optlen < sizeof(int)) 448 if (optlen < sizeof(int))
449 goto e_inval; 449 goto e_inval;
450 if (val > 255 || val < -1) 450 if (val > 255 || val < -1)
@@ -456,13 +456,15 @@ done:
456 case IPV6_MULTICAST_LOOP: 456 case IPV6_MULTICAST_LOOP:
457 if (optlen < sizeof(int)) 457 if (optlen < sizeof(int))
458 goto e_inval; 458 goto e_inval;
459 if (val != valbool)
460 goto e_inval;
459 np->mc_loop = valbool; 461 np->mc_loop = valbool;
460 retv = 0; 462 retv = 0;
461 break; 463 break;
462 464
463 case IPV6_MULTICAST_IF: 465 case IPV6_MULTICAST_IF:
464 if (sk->sk_type == SOCK_STREAM) 466 if (sk->sk_type == SOCK_STREAM)
465 goto e_inval; 467 break;
466 if (optlen < sizeof(int)) 468 if (optlen < sizeof(int))
467 goto e_inval; 469 goto e_inval;
468 470
@@ -858,7 +860,7 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
858 if (sk->sk_protocol != IPPROTO_UDP && 860 if (sk->sk_protocol != IPPROTO_UDP &&
859 sk->sk_protocol != IPPROTO_UDPLITE && 861 sk->sk_protocol != IPPROTO_UDPLITE &&
860 sk->sk_protocol != IPPROTO_TCP) 862 sk->sk_protocol != IPPROTO_TCP)
861 return -EINVAL; 863 return -ENOPROTOOPT;
862 if (sk->sk_state != TCP_ESTABLISHED) 864 if (sk->sk_state != TCP_ESTABLISHED)
863 return -ENOTCONN; 865 return -ENOTCONN;
864 val = sk->sk_family; 866 val = sk->sk_family;
@@ -872,6 +874,8 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
872 return -EINVAL; 874 return -EINVAL;
873 if (copy_from_user(&gsf, optval, GROUP_FILTER_SIZE(0))) 875 if (copy_from_user(&gsf, optval, GROUP_FILTER_SIZE(0)))
874 return -EFAULT; 876 return -EFAULT;
877 if (gsf.gf_group.ss_family != AF_INET6)
878 return -EADDRNOTAVAIL;
875 lock_sock(sk); 879 lock_sock(sk);
876 err = ip6_mc_msfget(sk, &gsf, 880 err = ip6_mc_msfget(sk, &gsf,
877 (struct group_filter __user *)optval, optlen); 881 (struct group_filter __user *)optval, optlen);
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index e03c1898ab2e..70a57e45bf0e 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -1167,7 +1167,8 @@ static int raw6_destroy(struct sock *sk)
1167 lock_sock(sk); 1167 lock_sock(sk);
1168 ip6_flush_pending_frames(sk); 1168 ip6_flush_pending_frames(sk);
1169 release_sock(sk); 1169 release_sock(sk);
1170 return 0; 1170
1171 return inet6_destroy_sock(sk);
1171} 1172}
1172 1173
1173static int rawv6_init_sk(struct sock *sk) 1174static int rawv6_init_sk(struct sock *sk)
@@ -1198,7 +1199,6 @@ struct proto rawv6_prot = {
1198 .disconnect = udp_disconnect, 1199 .disconnect = udp_disconnect,
1199 .ioctl = rawv6_ioctl, 1200 .ioctl = rawv6_ioctl,
1200 .init = rawv6_init_sk, 1201 .init = rawv6_init_sk,
1201 .destroy = inet6_destroy_sock,
1202 .setsockopt = rawv6_setsockopt, 1202 .setsockopt = rawv6_setsockopt,
1203 .getsockopt = rawv6_getsockopt, 1203 .getsockopt = rawv6_getsockopt,
1204 .sendmsg = rawv6_sendmsg, 1204 .sendmsg = rawv6_sendmsg,
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index edae81319b51..efe036aa3dd1 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2194,8 +2194,12 @@ static int rt6_fill_node(struct sk_buff *skb, struct rt6_info *rt,
2194 2194
2195 NLA_PUT_U32(skb, RTA_PRIORITY, rt->rt6i_metric); 2195 NLA_PUT_U32(skb, RTA_PRIORITY, rt->rt6i_metric);
2196 2196
2197 expires = (rt->rt6i_flags & RTF_EXPIRES) ? 2197 if (!(rt->rt6i_flags & RTF_EXPIRES))
2198 rt->rt6i_expires - jiffies : 0; 2198 expires = 0;
2199 else if (rt->rt6i_expires - jiffies < INT_MAX)
2200 expires = rt->rt6i_expires - jiffies;
2201 else
2202 expires = INT_MAX;
2199 2203
2200 if (rtnl_put_cacheinfo(skb, &rt->u.dst, 0, 0, 0, 2204 if (rtnl_put_cacheinfo(skb, &rt->u.dst, 0, 0, 0,
2201 expires, rt->u.dst.error) < 0) 2205 expires, rt->u.dst.error) < 0)
diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
index 938ce4ecde55..3ecc1157994e 100644
--- a/net/ipv6/syncookies.c
+++ b/net/ipv6/syncookies.c
@@ -198,7 +198,6 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
198 ireq = inet_rsk(req); 198 ireq = inet_rsk(req);
199 ireq6 = inet6_rsk(req); 199 ireq6 = inet6_rsk(req);
200 treq = tcp_rsk(req); 200 treq = tcp_rsk(req);
201 ireq6->pktopts = NULL;
202 201
203 if (security_inet_conn_request(sk, skb, req)) { 202 if (security_inet_conn_request(sk, skb, req)) {
204 reqsk_free(req); 203 reqsk_free(req);
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 3fe736bead96..ebed5d3adb82 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1211,7 +1211,6 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
1211 treq = inet6_rsk(req); 1211 treq = inet6_rsk(req);
1212 ipv6_addr_copy(&treq->rmt_addr, &ipv6_hdr(skb)->saddr); 1212 ipv6_addr_copy(&treq->rmt_addr, &ipv6_hdr(skb)->saddr);
1213 ipv6_addr_copy(&treq->loc_addr, &ipv6_hdr(skb)->daddr); 1213 ipv6_addr_copy(&treq->loc_addr, &ipv6_hdr(skb)->daddr);
1214 treq->pktopts = NULL;
1215 if (!want_cookie) 1214 if (!want_cookie)
1216 TCP_ECN_create_request(req, tcp_hdr(skb)); 1215 TCP_ECN_create_request(req, tcp_hdr(skb));
1217 1216