| From stable-bounces@linux.kernel.org Sat Dec 2 21:09:10 2006 |
| Message-Id: <20061202.210406.112265194.davem@davemloft.net> |
| Date: Sat, 02 Dec 2006 21:04:06 -0800 (PST) |
| From: David Miller <davem@davemloft.net> |
| To: stable@kernel.org |
| Subject: IPV6 NDISC: Calculate packet length correctly for allocation. |
| |
| MAX_HEADER does not include the ipv6 header length in it, |
| so we need to add it in explicitly. |
| |
| With help from YOSHIFUJI Hideaki. |
| |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Chris Wright <chrisw@sous-sol.org> |
| --- |
| commit 6e38433357e2381bb278a418fb7e2fd201475101 |
| Author: David S. Miller <davem@sunset.davemloft.net> |
| Date: Sat Dec 2 21:00:06 2006 -0800 |
| |
| net/ipv6/ndisc.c | 16 ++++++++++++---- |
| 1 file changed, 12 insertions(+), 4 deletions(-) |
| |
| --- linux-2.6.19.orig/net/ipv6/ndisc.c |
| +++ linux-2.6.19/net/ipv6/ndisc.c |
| @@ -472,7 +472,9 @@ static void ndisc_send_na(struct net_dev |
| inc_opt = 0; |
| } |
| |
| - skb = sock_alloc_send_skb(sk, MAX_HEADER + len + LL_RESERVED_SPACE(dev), |
| + skb = sock_alloc_send_skb(sk, |
| + (MAX_HEADER + sizeof(struct ipv6hdr) + |
| + len + LL_RESERVED_SPACE(dev)), |
| 1, &err); |
| |
| if (skb == NULL) { |
| @@ -561,7 +563,9 @@ void ndisc_send_ns(struct net_device *de |
| if (send_llinfo) |
| len += ndisc_opt_addr_space(dev); |
| |
| - skb = sock_alloc_send_skb(sk, MAX_HEADER + len + LL_RESERVED_SPACE(dev), |
| + skb = sock_alloc_send_skb(sk, |
| + (MAX_HEADER + sizeof(struct ipv6hdr) + |
| + len + LL_RESERVED_SPACE(dev)), |
| 1, &err); |
| if (skb == NULL) { |
| ND_PRINTK0(KERN_ERR |
| @@ -636,7 +640,9 @@ void ndisc_send_rs(struct net_device *de |
| if (dev->addr_len) |
| len += ndisc_opt_addr_space(dev); |
| |
| - skb = sock_alloc_send_skb(sk, MAX_HEADER + len + LL_RESERVED_SPACE(dev), |
| + skb = sock_alloc_send_skb(sk, |
| + (MAX_HEADER + sizeof(struct ipv6hdr) + |
| + len + LL_RESERVED_SPACE(dev)), |
| 1, &err); |
| if (skb == NULL) { |
| ND_PRINTK0(KERN_ERR |
| @@ -1446,7 +1452,9 @@ void ndisc_send_redirect(struct sk_buff |
| rd_len &= ~0x7; |
| len += rd_len; |
| |
| - buff = sock_alloc_send_skb(sk, MAX_HEADER + len + LL_RESERVED_SPACE(dev), |
| + buff = sock_alloc_send_skb(sk, |
| + (MAX_HEADER + sizeof(struct ipv6hdr) + |
| + len + LL_RESERVED_SPACE(dev)), |
| 1, &err); |
| if (buff == NULL) { |
| ND_PRINTK0(KERN_ERR |
