From: Hannes Frederic Sowa <hannes@stressinduktion.org>
Date: Sun, 11 May 2014 21:01:13 +0000 (+0200)
Subject: ipv6: fix calculation of option len in ip6_append_data
X-Git-Tag: omap-for-v3.16/fixes-against-rc1~146^2~38
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=3a1cebe7e05027a1c96f2fc1a8eddf5f19b78f42;p=pandora-kernel.git

ipv6: fix calculation of option len in ip6_append_data

tot_len does specify the size of struct ipv6_txoptions. We need opt_flen +
opt_nflen to calculate the overall length of additional ipv6 extensions.

I found this while auditing the ipv6 output path for a memory corruption
reported by Alexey Preobrazhensky while he fuzzed an instrumented
AddressSanitizer kernel with trinity. This may or may not be the cause
of the original bug.

Fixes: 4df98e76cde7c6 ("ipv6: pmtudisc setting not respected with UFO/CORK")
Reported-by: Alexey Preobrazhensky <preobr@google.com>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
---

Reading git-diff-tree failed