sctp: Fix a race between ICMP protocol unreachable and connect()

[safe/jmp/linux-2.6] / net / ipv6 / ah6.c

diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index 0f526f8..ee82d4e 100644 (file)
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -26,6 +26,7 @@
 
 #include <crypto/hash.h>
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <net/ip.h>
 #include <net/ah.h>
 #include <linux/crypto.h>
@@ -614,7 +615,7 @@ static void ah6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
            type != ICMPV6_PKT_TOOBIG)
                return;
 
-       x = xfrm_state_lookup(net, (xfrm_address_t *)&iph->daddr, ah->spi, IPPROTO_AH, AF_INET6);
+       x = xfrm_state_lookup(net, skb->mark, (xfrm_address_t *)&iph->daddr, ah->spi, IPPROTO_AH, AF_INET6);
        if (!x)
                return;
 
@@ -667,7 +668,7 @@ static int ah6_init_state(struct xfrm_state *x)
        }
 
        ahp->icv_full_len = aalg_desc->uinfo.auth.icv_fullbits/8;
-       ahp->icv_trunc_len = aalg_desc->uinfo.auth.icv_truncbits/8;
+       ahp->icv_trunc_len = x->aalg->alg_trunc_len/8;
 
        BUG_ON(ahp->icv_trunc_len > MAX_AH_AUTH_LEN);