From: David S. Miller <davem@davemloft.net>
Date: Mon, 14 Apr 2008 06:14:15 +0000 (-0700)
Subject: [IPV6]: Fix ipv6 address fetching in raw6_icmp_error().
X-Git-Tag: v2.6.25~33^2~6
X-Git-Url: https://err.no/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b45e9189c058bfa495073951ff461ee0eea968be;p=linux-2.6

[IPV6]: Fix ipv6 address fetching in raw6_icmp_error().

Fixes kernel bugzilla 10437

Based almost entirely upon a patch by Dmitry Butskoy.

When deciding what raw sockets to deliver the ICMPv6
to, we should use the addresses in the ICMPv6 quoted
IPV6 header, not the top-level one.

Signed-off-by: David S. Miller <davem@davemloft.net>
---

diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 8897ccf808..0a6fbc1d1a 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -372,8 +372,10 @@ void raw6_icmp_error(struct sk_buff *skb, int nexthdr,
 	read_lock(&raw_v6_hashinfo.lock);
 	sk = sk_head(&raw_v6_hashinfo.ht[hash]);
 	if (sk != NULL) {
-		saddr = &ipv6_hdr(skb)->saddr;
-		daddr = &ipv6_hdr(skb)->daddr;
+		struct ipv6hdr *hdr = (struct ipv6hdr *) skb->data;
+
+		saddr = &hdr->saddr;
+		daddr = &hdr->daddr;
 		net = skb->dev->nd_net;
 
 		while ((sk = __raw_v6_lookup(net, sk, nexthdr, saddr, daddr,