[IPV6]: Fix IPV6_RECVERR for connected raw sockets.

Based on patch from Dmitry Butskoy <[email protected]>.

Closes: 10437
Signed-off-by: YOSHIFUJI Hideaki <[email protected]>

diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 059298baa1dd696ad491b1d01deeda3759ba0e88..6193b124cbc764bd367df15addead75c07ae0322 100644 (file)
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -357,8 +357,10 @@ void raw6_icmp_error(struct sk_buff *skb, int nexthdr,
        read_lock(&raw_v6_hashinfo.lock);
        sk = sk_head(&raw_v6_hashinfo.ht[hash]);
        if (sk != NULL) {
-               saddr = &ipv6_hdr(skb)->saddr;
-               daddr = &ipv6_hdr(skb)->daddr;
+               /* Note: ipv6_hdr(skb) != skb->data */
+               struct ipv6hdr *ip6h = (struct ipv6hdr *)skb->data;
+               saddr = &ip6h->saddr;
+               daddr = &ip6h->daddr;
                net = dev_net(skb->dev);
 
                while ((sk = __raw_v6_lookup(net, sk, nexthdr, saddr, daddr,