[IPV6]: Fix ipv6 address fetching in raw6_icmp_error().

Fixes kernel bugzilla 10437

Based almost entirely upon a patch by Dmitry Butskoy.

When deciding what raw sockets to deliver the ICMPv6
to, we should use the addresses in the ICMPv6 quoted
IPV6 header, not the top-level one.

Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 8897ccf8086afacfc643163e89b740cc4a6df13c..0a6fbc1d1a502746eadc80345e1027de95100b03 100644 (file)
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -372,8 +372,10 @@ void raw6_icmp_error(struct sk_buff *skb, int nexthdr,
        read_lock(&raw_v6_hashinfo.lock);
        sk = sk_head(&raw_v6_hashinfo.ht[hash]);
        if (sk != NULL) {
-               saddr = &ipv6_hdr(skb)->saddr;
-               daddr = &ipv6_hdr(skb)->daddr;
+               struct ipv6hdr *hdr = (struct ipv6hdr *) skb->data;
+
+               saddr = &hdr->saddr;
+               daddr = &hdr->daddr;
                net = skb->dev->nd_net;
 
                while ((sk = __raw_v6_lookup(net, sk, nexthdr, saddr, daddr,