Edgy CVE-2007-1592 [IPV6]: ipv6_fl_socklist is inadvertently shared.

This is a multi-part message in MIME format.

-- 
Tim Gardner tim.gardner@xxxxxxxxxx
> --- Begin Message ---
> >From 6837f82f47811ebb989180015658ee6e2bad3106 Mon Sep 17 00:00:00 2001
> From: Tim Gardner <tim.gardner@xxxxxxxxxx>
> Date: Wed, 16 May 2007 09:12:52 -0600
> Subject: [PATCH] [PATCH] [IPV6]: ipv6_fl_socklist is inadvertently shared. 
> (CVE-2007-1592)
>
> The ipv6_fl_socklist from listening socket is inadvertently shared
> with new socket created for connection.  This leads to a variety of
> interesting, but fatal, bugs. For example, removing one of the
> sockets may lead to the other socket's encountering a page fault
> when the now freed list is referenced.
>
> The fix is to not share the flow label list with the new socket.
>
> modified:   net/ipv6/tcp_ipv6.c
>
> Original Author:  Masayuki Nakagawa <nakagawa.msy@xxxxxxxxxxxxxx>
>
> Signed-off-by: Masayuki Nakagawa <nakagawa.msy@xxxxxxxxxxxxxx>
> Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
> Signed-off-by: Tim Gardner <tim.gardner@xxxxxxxxxx>
> ---
>  net/ipv6/tcp_ipv6.c |    1 +
>  1 files changed, 1 insertions(+), 0 deletions(-)
>
> diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
> index 301eee7..189ba72 100644
> --- a/net/ipv6/tcp_ipv6.c
> +++ b/net/ipv6/tcp_ipv6.c
> @@ -953,6 +953,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, 
> struct sk_buff *skb,
>            First: no IPv4 options.
>          */
>         newinet->opt = NULL;
> +       newnp->ipv6_fl_list = NULL;
>  
>         /* Clone RX bits */
>         newnp->rxopt.all = np->rxopt.all;
> -- 
> 1.4.4.2
>
>
> --- End Message ---