Re: [BUG] Kernel crash from DCCP Fwd: TTCP crash

[Herbert Xu]

On Tue, Oct 18, 2005 at 02:56:21PM +1300, Ian McDonald wrote:
> 
> We also use ip_build_and_send_pkt and don't clear out that area before
> use. Going to do some tests to confirm my suspicision as I suspect it
> occurs when sending a reset packet or similar after we close failed
> session.

Good point.  Here is an updated patch to clear options for the
other relevant cases.

Signed-off-by: Herbert Xu <[EMAIL PROTECTED]>
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <[EMAIL PROTECTED]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -463,6 +463,7 @@ static int dccp_v4_send_response(struct 
        if (skb != NULL) {
                const struct inet_request_sock *ireq = inet_rsk(req);
 
+               memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
                err = ip_build_and_send_pkt(skb, sk, ireq->loc_addr,
                                            ireq->rmt_addr,
                                            ireq->opt);
@@ -647,6 +648,7 @@ int dccp_v4_send_reset(struct sock *sk, 
        if (skb != NULL) {
                const struct inet_sock *inet = inet_sk(sk);
 
+               memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
                err = ip_build_and_send_pkt(skb, sk,
                                            inet->saddr, inet->daddr, NULL);
                if (err == NET_XMIT_CN)
diff --git a/net/dccp/output.c b/net/dccp/output.c
--- a/net/dccp/output.c
+++ b/net/dccp/output.c
@@ -102,6 +102,7 @@ int dccp_transmit_skb(struct sock *sk, s
 
                DCCP_INC_STATS(DCCP_MIB_OUTSEGS);
 
+               memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
                err = ip_queue_xmit(skb, 0);
                if (err <= 0)
                        return err;