[IPV6] Fix BUG when appending destination options headers

This patch fixes BUG when pushing IPv6 destination options over an
IPv6 raw socket.  Patch is based on one from Thomas Graf <tgr@reeler.org>.

diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 9edc73163d060058ccfd464d39d04ec98797cc21..d2a96f793a51c0ced02ec9a02fcb29f96bac6d17 100644 (file)
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1239,7 +1239,6 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to, int offse
                        memcpy(np->cork.opt, opt, opt->tot_len);
                        inet->cork.flags |= IPCORK_OPT;
                        /* need source address above miyazawa*/
-                       exthdrlen += opt->opt_flen ? opt->opt_flen : 0;
                }
                dst_hold(&rt->u.dst);
                np->cork.rt = rt;
@@ -1252,6 +1251,7 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to, int offse
                        length += exthdrlen;
                        transhdrlen += exthdrlen;
                }
+               exthdrlen += opt ? opt->opt_flen : 0;
        } else {
                rt = np->cork.rt;
                if (inet->cork.flags & IPCORK_OPT)

diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index d1b44f4b8134ad38672b2a3f997b51a73b824b2f..7102b653804ac50c77f5b62e389d3052207400ad 100644 (file)
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -624,6 +624,7 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg
        if (msg->msg_controllen) {
                opt = &opt_space;
                memset(opt, 0, sizeof(struct ipv6_txoptions));
+               opt->tot_len = sizeof(struct ipv6_txoptions);
 
                err = datagram_send_ctl(msg, &fl, opt, &hlimit);
                if (err < 0) {