[DCCP]: Clear the IPCB area

Turns out the problem has nothing to do with use-after-free or double-free.
It's just that we're not clearing the CB area and DCCP unlike TCP uses a CB
format that's incompatible with IP.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Ian McDonald <imcdnzl@gmail.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>

diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index ae088d1347af025359eb09e5a3a606386e66f948..6298cf58ff9e88b329ddba654f3c4ad79b500bcc 100644 (file)
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -463,6 +463,7 @@ static int dccp_v4_send_response(struct sock *sk, struct request_sock *req,
        if (skb != NULL) {
                const struct inet_request_sock *ireq = inet_rsk(req);
 
+               memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
                err = ip_build_and_send_pkt(skb, sk, ireq->loc_addr,
                                            ireq->rmt_addr,
                                            ireq->opt);
@@ -647,6 +648,7 @@ int dccp_v4_send_reset(struct sock *sk, enum dccp_reset_codes code)
        if (skb != NULL) {
                const struct inet_sock *inet = inet_sk(sk);
 
+               memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
                err = ip_build_and_send_pkt(skb, sk,
                                            inet->saddr, inet->daddr, NULL);
                if (err == NET_XMIT_CN)

diff --git a/net/dccp/output.c b/net/dccp/output.c
index 7006549f70504433abca2d0a1f55009bfe6e5ad3..29250749f16f86044d1f5fec4a592271fa12f856 100644 (file)
--- a/net/dccp/output.c
+++ b/net/dccp/output.c
@@ -100,6 +100,7 @@ int dccp_transmit_skb(struct sock *sk, struct sk_buff *skb)
 
                DCCP_INC_STATS(DCCP_MIB_OUTSEGS);
 
+               memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
                err = ip_queue_xmit(skb, 0);
                if (err <= 0)
                        return err;