diff options
| author | David S. Miller <davem@davemloft.net> | 2008-11-18 23:38:23 -0800 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2008-11-18 23:38:23 -0800 |
| commit | 198d6ba4d7f48c94f990f4604f0b3d73925e0ded (patch) | |
| tree | 56bbdf8ba2553c23c8099da9344a8f1d1aba97ab /net/ipv6 | |
| parent | 9a57f7fabd383920585ed8b74eacd117c6551f2d (diff) | |
| parent | 7f0f598a0069d1ab072375965a4b69137233169c (diff) | |
| download | linux-198d6ba4d7f48c94f990f4604f0b3d73925e0ded.tar.bz2 | |
Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6
Conflicts:
drivers/isdn/i4l/isdn_net.c
fs/cifs/connect.c
Diffstat (limited to 'net/ipv6')
| -rw-r--r-- | net/ipv6/datagram.c | 5 | ||||
| -rw-r--r-- | net/ipv6/ipv6_sockglue.c | 5 |
2 files changed, 10 insertions, 0 deletions
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c index 410046a8cc91..e44deb8d4df2 100644 --- a/net/ipv6/datagram.c +++ b/net/ipv6/datagram.c @@ -661,6 +661,11 @@ int datagram_send_ctl(struct net *net, switch (rthdr->type) { #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE) case IPV6_SRCRT_TYPE_2: + if (rthdr->hdrlen != 2 || + rthdr->segments_left != 1) { + err = -EINVAL; + goto exit_f; + } break; #endif default: diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c index 4e5eac301f91..2aa294be0c79 100644 --- a/net/ipv6/ipv6_sockglue.c +++ b/net/ipv6/ipv6_sockglue.c @@ -366,11 +366,16 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname, } /* routing header option needs extra check */ + retv = -EINVAL; if (optname == IPV6_RTHDR && opt && opt->srcrt) { struct ipv6_rt_hdr *rthdr = opt->srcrt; switch (rthdr->type) { #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE) case IPV6_SRCRT_TYPE_2: + if (rthdr->hdrlen != 2 || + rthdr->segments_left != 1) + goto sticky_done; + break; #endif default: |