[patch 20/31] Fix ipv6 flow label inheritance

Greg KH
2007-03-19T21:45:13Z

[-- Attachment #1: fix-ipv6-flow-label-inheritance.patch --]
[-- Type: text/plain, Size: 1072 bytes --]

-stable review patch. If anyone has any objections, please let us know.

------------------

From: Masayuki Nakagawa <nakagawa.msy@ncos.nec.co.jp>

[IPV6]: ipv6_fl_socklist is inadvertently shared.

The ipv6_fl_socklist from listening socket is inadvertently shared
with new socket created for connection. This leads to a variety of
interesting, but fatal, bugs. For example, removing one of the
sockets may lead to the other socket's encountering a page fault
when the now freed list is referenced.

The fix is to not share the flow label list with the new socket.

Signed-off-by: Masayuki Nakagawa <nakagawa.msy@ncos.nec.co.jp>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
net/ipv6/tcp_ipv6.c | 1 +
1 file changed, 1 insertion(+)

--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1453,6 +1453,7 @@ static struct sock * tcp_v6_syn_recv_soc
First: no IPv4 options.
*/
newinet->opt = NULL;
+ newnp->ipv6_fl_list = NULL;

/* Clone RX bits */
newnp->rxopt.all = np->rxopt.all;

--