Reference in a new issue

Blame

Copy permalink

Reference in a new issue

Copy permalink

Jacob Wen 4e938011d7 l2tp: copy 4 more bytes to linear part if necessary ... commit 91c524708d upstream. The size of L2TPv2 header with all optional fields is 14 bytes. l2tp_udp_recv_core only moves 10 bytes to the linear part of a skb. This may lead to l2tp_recv_common read data outside of a skb. This patch make sure that there is at least 14 bytes in the linear part of a skb to meet the maximum need of l2tp_udp_recv_core and l2tp_recv_common. The minimum size of both PPP HDLC-like frame and Ethernet frame is larger than 14 bytes, so we are safe to do so. Also remove L2TP_HDR_SIZE_NOSEQ, it is unused now. Fixes: fd558d186d ("l2tp: Split pppol2tp patch into separate l2tp and ppp parts") Suggested-by: Guillaume Nault <gnault@redhat.com> Signed-off-by: Jacob Wen <jian.w.wen@oracle.com> Acked-by: Guillaume Nault <gnault@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>		History 2019-05-02 21:41:33 +01:00
..
Kconfig	net/l2tp: remove depends on CONFIG_EXPERIMENTAL	2013-01-11 11:40:01 -08:00
l2tp_core.c	l2tp: copy 4 more bytes to linear part if necessary	2019-05-02 21:41:33 +01:00
l2tp_core.h	l2tp: hold reference on tunnels printed in l2tp/tunnels debugfs file	2018-10-21 08:45:25 +01:00
l2tp_debugfs.c	l2tp: fix {pppol2tp, l2tp_dfs}_seq_stop() in case of seq_file overflow	2018-10-21 08:45:36 +01:00
l2tp_eth.c	l2tp: initialise l2tp_eth sessions before registering them	2018-02-13 18:42:10 +00:00
l2tp_ip.c	l2tp: fix races with tunnel socket close	2018-06-16 22:22:26 +01:00
l2tp_ip6.c	l2tp: fix races with tunnel socket close	2018-06-16 22:22:26 +01:00
l2tp_netlink.c	l2tp: reject creation of non-PPP sessions on L2TPv2 tunnels	2018-11-20 18:05:15 +00:00
l2tp_ppp.c	l2tp: fix missing refcount drop in pppol2tp_tunnel_ioctl()	2018-11-20 18:05:53 +00:00
Makefile	l2tp: introduce L2TPv3 IP encapsulation support for IPv6	2012-05-01 09:30:55 -04:00