[IPV6]: Check length of int/boolean optval provided by user in setsockopt().

[mv-sheeva.git] / net / ipv6 / mcast.c

diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 0a0132a1c443d3c015cb3dbfbd6094e838c2c773..54f91efdae58cdcded9923675b34ea0bec580f04 100644 (file)
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -1404,6 +1404,7 @@ static struct sk_buff *mld_newpack(struct net_device *dev, int size)
        struct sk_buff *skb;
        struct mld2_report *pmr;
        struct in6_addr addr_buf;
+       const struct in6_addr *saddr;
        int err;
        u8 ra[8] = { IPPROTO_ICMPV6, 0,
                     IPV6_TLV_ROUTERALERT, 2, 0, 0,
@@ -1422,10 +1423,11 @@ static struct sk_buff *mld_newpack(struct net_device *dev, int size)
                 * use unspecified address as the source address
                 * when a valid link-local address is not available.
                 */
-               memset(&addr_buf, 0, sizeof(addr_buf));
-       }
+               saddr = &in6addr_any;
+       } else
+               saddr = &addr_buf;
 
-       ip6_nd_hdr(sk, skb, dev, &addr_buf, &mld2_all_mcr, NEXTHDR_HOP, 0);
+       ip6_nd_hdr(sk, skb, dev, saddr, &mld2_all_mcr, NEXTHDR_HOP, 0);
 
        memcpy(skb_put(skb, sizeof(ra)), ra, sizeof(ra));
 
@@ -1766,10 +1768,9 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type)
        struct inet6_dev *idev;
        struct sk_buff *skb;
        struct icmp6hdr *hdr;
-       struct in6_addr *snd_addr;
+       const struct in6_addr *snd_addr, *saddr;
        struct in6_addr *addrp;
        struct in6_addr addr_buf;
-       struct in6_addr all_routers;
        int err, len, payload_len, full_len;
        u8 ra[8] = { IPPROTO_ICMPV6, 0,
                     IPV6_TLV_ROUTERALERT, 2, 0, 0,
@@ -1780,11 +1781,10 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type)
        IP6_INC_STATS(__in6_dev_get(dev),
                      IPSTATS_MIB_OUTREQUESTS);
        rcu_read_unlock();
-       snd_addr = addr;
-       if (type == ICMPV6_MGM_REDUCTION) {
-               snd_addr = &all_routers;
-               ipv6_addr_all_routers(&all_routers);
-       }
+       if (type == ICMPV6_MGM_REDUCTION)
+               snd_addr = &in6addr_linklocal_allrouters;
+       else
+               snd_addr = addr;
 
        len = sizeof(struct icmp6hdr) + sizeof(struct in6_addr);
        payload_len = len + sizeof(ra);
@@ -1807,10 +1807,11 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type)
                 * use unspecified address as the source address
                 * when a valid link-local address is not available.
                 */
-               memset(&addr_buf, 0, sizeof(addr_buf));
-       }
+               saddr = &in6addr_any;
+       } else
+               saddr = &addr_buf;
 
-       ip6_nd_hdr(sk, skb, dev, &addr_buf, snd_addr, NEXTHDR_HOP, payload_len);
+       ip6_nd_hdr(sk, skb, dev, saddr, snd_addr, NEXTHDR_HOP, payload_len);
 
        memcpy(skb_put(skb, sizeof(ra)), ra, sizeof(ra));
 
@@ -1821,7 +1822,7 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type)
        addrp = (struct in6_addr *) skb_put(skb, sizeof(struct in6_addr));
        ipv6_addr_copy(addrp, addr);
 
-       hdr->icmp6_cksum = csum_ipv6_magic(&addr_buf, snd_addr, len,
+       hdr->icmp6_cksum = csum_ipv6_magic(saddr, snd_addr, len,
                                           IPPROTO_ICMPV6,
                                           csum_partial((__u8 *) hdr, len, 0));
 
@@ -2309,24 +2310,19 @@ void ipv6_mc_init_dev(struct inet6_dev *idev)
 void ipv6_mc_destroy_dev(struct inet6_dev *idev)
 {
        struct ifmcaddr6 *i;
-       struct in6_addr maddr;
 
        /* Deactivate timers */
        ipv6_mc_down(idev);
 
        /* Delete all-nodes address. */
-       ipv6_addr_all_nodes(&maddr);
-
        /* We cannot call ipv6_dev_mc_dec() directly, our caller in
         * addrconf.c has NULL'd out dev->ip6_ptr so in6_dev_get() will
         * fail.
         */
-       __ipv6_dev_mc_dec(idev, &maddr);
+       __ipv6_dev_mc_dec(idev, &in6addr_linklocal_allnodes);
 
-       if (idev->cnf.forwarding) {
-               ipv6_addr_all_routers(&maddr);
-               __ipv6_dev_mc_dec(idev, &maddr);
-       }
+       if (idev->cnf.forwarding)
+               __ipv6_dev_mc_dec(idev, &in6addr_linklocal_allrouters);
 
        write_lock_bh(&idev->lock);
        while ((i = idev->mc_list) != NULL) {