Yep :-( :-( It is my fault, please, replace len>65535 in udp_sendmsg with
ulen>65535.
Really, it is wrong in any case. You still can kill both 2.1 and, alas,
2.0 too, only make setsockopt(IP_OPTIONS) before write :-(
The real solution is:
- to replace "unsigned short" length argument
in ip_build_xmit with "unsigned".
- to delete all the silly checks in udp.c and raw.c
sort of "if (len>SOMETHING) return -EMSGSIZE", they are wrong in any case.
- to add to ip_output.c:
maxfraglen = ((rt->u.dst.pmtu-sizeof(struct iphdr)) & ~7) + fragheaderlen;
}
+ if (length + fragheaderlen > 0xFFFF)
+ return -EMSGSIZE;
+
/*
* Start at the end of the frame by handling the remainder.
It will be true solution (well, ignoring not related bug incorrecly
accounting options length, when IP_HDRINCL is on)
Alexey Kuznetsov