From: Paul Moore The inet_create() and inet6_create() functions incorrectly set the inet_sock->is_icsk field. Both functions assume that the is_icsk field is large enough to hold at least a INET_PROTOSW_ICSK value when it is actually only a single bit. This patch corrects the assignment by doing a boolean comparison whose result will safely fit into a single bit field. Signed-off-by: Paul Moore --- net/ipv4/af_inet.c | 2 +- net/ipv6/af_inet6.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) Index: net-2.6.20_bugfix_2/net/ipv4/af_inet.c =================================================================== --- net-2.6.20_bugfix_2.orig/net/ipv4/af_inet.c +++ net-2.6.20_bugfix_2/net/ipv4/af_inet.c @@ -305,7 +305,7 @@ lookup_protocol: sk->sk_reuse = 1; inet = inet_sk(sk); - inet->is_icsk = INET_PROTOSW_ICSK & answer_flags; + inet->is_icsk = (INET_PROTOSW_ICSK & answer_flags) == INET_PROTOSW_ICSK; if (SOCK_RAW == sock->type) { inet->num = protocol; Index: net-2.6.20_bugfix_2/net/ipv6/af_inet6.c =================================================================== --- net-2.6.20_bugfix_2.orig/net/ipv6/af_inet6.c +++ net-2.6.20_bugfix_2/net/ipv6/af_inet6.c @@ -171,7 +171,7 @@ lookup_protocol: sk->sk_reuse = 1; inet = inet_sk(sk); - inet->is_icsk = INET_PROTOSW_ICSK & answer_flags; + inet->is_icsk = (INET_PROTOSW_ICSK & answer_flags) == INET_PROTOSW_ICSK; if (SOCK_RAW == sock->type) { inet->num = protocol; -- paul moore linux security @ hp - To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html