From: Paul Moore <[EMAIL PROTECTED]>
The inet_create() and inet6_create() functions incorrectly set the
inet_sock->is_icsk field. Both functions assume that the is_icsk field is
large enough to hold at least a INET_PROTOSW_ICSK value when it is actually
only a single bit. This patch corrects the assignment by doing a boolean
comparison whose result will safely fit into a single bit field.
Signed-off-by: Paul Moore <[EMAIL PROTECTED]>
---
net/ipv4/af_inet.c | 2 +-
net/ipv6/af_inet6.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
Index: net-2.6.20_bugfix_2/net/ipv4/af_inet.c
===================================================================
--- net-2.6.20_bugfix_2.orig/net/ipv4/af_inet.c
+++ net-2.6.20_bugfix_2/net/ipv4/af_inet.c
@@ -305,7 +305,7 @@ lookup_protocol:
sk->sk_reuse = 1;
inet = inet_sk(sk);
- inet->is_icsk = INET_PROTOSW_ICSK & answer_flags;
+ inet->is_icsk = (INET_PROTOSW_ICSK & answer_flags) == INET_PROTOSW_ICSK;
if (SOCK_RAW == sock->type) {
inet->num = protocol;
Index: net-2.6.20_bugfix_2/net/ipv6/af_inet6.c
===================================================================
--- net-2.6.20_bugfix_2.orig/net/ipv6/af_inet6.c
+++ net-2.6.20_bugfix_2/net/ipv6/af_inet6.c
@@ -171,7 +171,7 @@ lookup_protocol:
sk->sk_reuse = 1;
inet = inet_sk(sk);
- inet->is_icsk = INET_PROTOSW_ICSK & answer_flags;
+ inet->is_icsk = (INET_PROTOSW_ICSK & answer_flags) == INET_PROTOSW_ICSK;
if (SOCK_RAW == sock->type) {
inet->num = protocol;
--
paul moore
linux security @ hp
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
