diff options
| author | Denis V. Lunev <den@openvz.org> | 2008-06-04 15:49:07 +0400 |
|---|---|---|
| committer | YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> | 2008-06-05 04:02:38 +0900 |
| commit | 36d926b94a9908937593e5669162305a071b9cc3 (patch) | |
| tree | c298f82a8d8b87ab4ebf7b514b394763889108b0 /net | |
| parent | 49d074f4009a7b5ce9c17b040f978abcb4d7f6f6 (diff) | |
| download | kernel_samsung_espresso10-36d926b94a9908937593e5669162305a071b9cc3.zip kernel_samsung_espresso10-36d926b94a9908937593e5669162305a071b9cc3.tar.gz kernel_samsung_espresso10-36d926b94a9908937593e5669162305a071b9cc3.tar.bz2 | |
[IPV6]: inet_sk(sk)->cork.opt leak
IPv6 UDP sockets wth IPv4 mapped address use udp_sendmsg to send the data
actually. In this case ip_flush_pending_frames should be called instead
of ip6_flush_pending_frames.
Signed-off-by: Denis V. Lunev <den@openvz.org>
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/ipv4/udp.c | 3 | ||||
| -rw-r--r-- | net/ipv6/udp.c | 4 |
2 files changed, 5 insertions, 2 deletions
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c index db1cb7c..56fcda3 100644 --- a/net/ipv4/udp.c +++ b/net/ipv4/udp.c @@ -420,7 +420,7 @@ void udp_err(struct sk_buff *skb, u32 info) /* * Throw away all pending data and cancel the corking. Socket is locked. */ -static void udp_flush_pending_frames(struct sock *sk) +void udp_flush_pending_frames(struct sock *sk) { struct udp_sock *up = udp_sk(sk); @@ -430,6 +430,7 @@ static void udp_flush_pending_frames(struct sock *sk) ip_flush_pending_frames(sk); } } +EXPORT_SYMBOL(udp_flush_pending_frames); /** * udp4_hwcsum_outgoing - handle outgoing HW checksumming diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c index 1b35c47..dd30962 100644 --- a/net/ipv6/udp.c +++ b/net/ipv6/udp.c @@ -534,7 +534,9 @@ static void udp_v6_flush_pending_frames(struct sock *sk) { struct udp_sock *up = udp_sk(sk); - if (up->pending) { + if (up->pending == AF_INET) + udp_flush_pending_frames(sk); + else if (up->pending) { up->len = 0; up->pending = 0; ip6_flush_pending_frames(sk); |