[IPV6]: inet_sk(sk)->cork.opt leak

IPv6 UDP sockets wth IPv4 mapped address use udp_sendmsg to send the data
actually. In this case ip_flush_pending_frames should be called instead
of ip6_flush_pending_frames.

Signed-off-by: Denis V. Lunev <den@openvz.org>
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>

diff --git a/include/net/udp.h b/include/net/udp.h
index 3e55a99b0ba3836441804f33b7c6880d21a3d9cb..ccce83707046ca85dd0a1d20c2c2e937342fd270 100644 (file)
--- a/include/net/udp.h
+++ b/include/net/udp.h
@@ -135,6 +135,7 @@ extern void udp_err(struct sk_buff *, u32);
 
 extern int     udp_sendmsg(struct kiocb *iocb, struct sock *sk,
                            struct msghdr *msg, size_t len);
+extern void    udp_flush_pending_frames(struct sock *sk);
 
 extern int     udp_rcv(struct sk_buff *skb);
 extern int     udp_ioctl(struct sock *sk, int cmd, unsigned long arg);

diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index db1cb7c96d63dcdb32356789eec17448aff6f97d..56fcda3694ba99d3f83523fc2a2e81fcf1d612bc 100644 (file)
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -420,7 +420,7 @@ void udp_err(struct sk_buff *skb, u32 info)
 /*
  * Throw away all pending data and cancel the corking. Socket is locked.
  */
-static void udp_flush_pending_frames(struct sock *sk)
+void udp_flush_pending_frames(struct sock *sk)
 {
        struct udp_sock *up = udp_sk(sk);
 
@@ -430,6 +430,7 @@ static void udp_flush_pending_frames(struct sock *sk)
                ip_flush_pending_frames(sk);
        }
 }
+EXPORT_SYMBOL(udp_flush_pending_frames);
 
 /**
  *     udp4_hwcsum_outgoing  -  handle outgoing HW checksumming

diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 1b35c4722004551e9b92eb498a0f1037c44ed8bf..dd309626ae9a737442aa1268c7a5f151507e7536 100644 (file)
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -534,7 +534,9 @@ static void udp_v6_flush_pending_frames(struct sock *sk)
 {
        struct udp_sock *up = udp_sk(sk);
 
-       if (up->pending) {
+       if (up->pending == AF_INET)
+               udp_flush_pending_frames(sk);
+       else if (up->pending) {
                up->len = 0;
                up->pending = 0;
                ip6_flush_pending_frames(sk);