IPv6: Fix the data length of get destination options with short length

If get destination options with length which is not enough for that
option,getsockopt() will still return the real length of the option, which is larger then the buffer space.
This is because ipv6_getsockopt_sticky() returns the real length of
the option.

This patch fix this problem.

@@ -832,7 +832,7 @@ static int ipv6_getsockopt_sticky(struct

	len = min_t(unsigned int, len, ipv6_optlen(hdr));
	if (copy_to_user(optval, hdr, len))
		return -EFAULT;

- return ipv6_optlen(hdr);
+ return len;
}

---------
2.6.26-rc4

Yang Hongyang said the following on 2008-5-28 14:49:

In article <[email protected]> (at Wed, 28 May 2008 14:49:20 +0800), Yang Hongyang <[email protected]> says:

POSIX says that the object pointed to by the option_len argument shall be modified to indicate the actual length of the value.
Do you think this change conforms to the spec?

--yoshfuji

We use the codes below to get the destination options,the length cnt is half of the option length.

	cnt = sizeof(incmsg) / 2;
	if (getsockopt(sk, IPPROTO_IPV6, IPV6_DSTOPTS,
		       (char *)incmsg, &cnt) == -1) 

We can see from net/ipv6/ipv6_sockglue.c,the code below store half of the option length to incmsg, so the acture data length of incmsg is half of the option length.According to RFC the cnt should specfy the data length of incmsg.that is half of the option length.So we should return len instead of ipv6_optlen(hdr).
832 len = min_t(unsigned int, len, ipv6_optlen(hdr));
833 if (copy_to_user(optval, hdr, len))
834 return -EFAULT;

Regards
Yang Hongyang

We use the codes below to get the destination options,the length cnt is half of the option length.

	cnt = sizeof(incmsg) / 2;
	if (getsockopt(sk, IPPROTO_IPV6, IPV6_DSTOPTS,
		       (char *)incmsg, &cnt) == -1) 

We can see from net/ipv6/ipv6_sockglue.c,the code below store half of the option length to incmsg, so the acture data length of incmsg is half of the option length.According to RFC(as you said "option_len argument shall be modified to indicate the actual length of the value") the cnt should specify the data length of incmsg,that is half of the option length.So we should return len instead of ipv6_optlen(hdr).
832 len = min_t(unsigned int, len, ipv6_optlen(hdr));
833 if (copy_to_user(optval, hdr, len))
834 return -EFAULT;

Regards
Yang Hongyang
 
A new email address of FJWAN is launched from Apr.1 2007.
The updated address is: [email protected]
--------------------------------------------------
Yang Hongyang
Development Dept.I
Nanjing Fujitsu Nanda Software Tech. Co., Ltd.(FNST)
8/F., Civil Defense Building, No.189 Guangzhou Road,
Nanjing, 210029, China
TEL: +86+25-86630566-812
FUJITSU INTERNAL: 79955-812
FAX: +86+25-83317685
EMAIL: [email protected]
--------------------------------------------------
This communication is for use by the intended recipient(s) only and may contain information that is privileged, confidential and exempt from disclosure under applicable law. If you are not an intended recipient of this communication, you are hereby notified that any dissemination, distribution or copying hereof is strictly prohibited.  If you have received this communication in error, please notify me by reply e-mail, permanently delete this communication from your system, and destroy any hard copies you may have printed

In article <[email protected]> (at Thu, 29 May 2008 10:29:47 +0800), Yang Hongyang <[email protected]> says:

:

Well, actually I reread the spec., and I've found that option_len is undefined if option_len is not enough for the value.
Current behavior seems okay (according to the spec.), but I'm going to apply this for consistency with other sockopts if no objections.

--yoshfuji