From: Hideaki Yoshifuji <yoshfuji@linux-ipv6.org>
Date: Wed, 9 Jul 2003 11:23:54 +0000 (+1000)
Subject: [IPV6] Fix BUG when appending destination options headers
X-Git-Tag: v2.5.75~20^2
X-Git-Url: http://git.neil.brown.name/?a=commitdiff_plain;h=5107a69050a69b23679a1afef93579e7012d117a;p=history.git

[IPV6] Fix BUG when appending destination options headers

This patch fixes BUG when pushing IPv6 destination options over an
IPv6 raw socket.  Patch is based on one from Thomas Graf <tgr@reeler.org>.
---

diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 9edc73163d06..d2a96f793a51 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1239,7 +1239,6 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to, int offse
 			memcpy(np->cork.opt, opt, opt->tot_len);
 			inet->cork.flags |= IPCORK_OPT;
 			/* need source address above miyazawa*/
-			exthdrlen += opt->opt_flen ? opt->opt_flen : 0;
 		}
 		dst_hold(&rt->u.dst);
 		np->cork.rt = rt;
@@ -1252,6 +1251,7 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to, int offse
 			length += exthdrlen;
 			transhdrlen += exthdrlen;
 		}
+		exthdrlen += opt ? opt->opt_flen : 0;
 	} else {
 		rt = np->cork.rt;
 		if (inet->cork.flags & IPCORK_OPT)
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index d1b44f4b8134..7102b653804a 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -624,6 +624,7 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg
 	if (msg->msg_controllen) {
 		opt = &opt_space;
 		memset(opt, 0, sizeof(struct ipv6_txoptions));
+		opt->tot_len = sizeof(struct ipv6_txoptions);
 
 		err = datagram_send_ctl(msg, &fl, opt, &hlimit);
 		if (err < 0) {