diff options
| author | Jacob Wen <jian.w.wen@oracle.com> | 2019-01-31 15:18:56 +0800 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2019-01-31 08:58:46 -0800 |
| commit | 91c524708de6207f59dd3512518d8a1c7b434ee3 (patch) | |
| tree | 5e9c1df39ce270ed192b5dfa534a9a866ff7f9c0 /lib | |
| parent | 3aa9179b2dfe06d32d4248f07cf6dd005a964507 (diff) | |
l2tp: copy 4 more bytes to linear part if necessary
The size of L2TPv2 header with all optional fields is 14 bytes.
l2tp_udp_recv_core only moves 10 bytes to the linear part of a
skb. This may lead to l2tp_recv_common read data outside of a skb.
This patch make sure that there is at least 14 bytes in the linear
part of a skb to meet the maximum need of l2tp_udp_recv_core and
l2tp_recv_common. The minimum size of both PPP HDLC-like frame and
Ethernet frame is larger than 14 bytes, so we are safe to do so.
Also remove L2TP_HDR_SIZE_NOSEQ, it is unused now.
Fixes: fd558d186df2 ("l2tp: Split pppol2tp patch into separate l2tp and ppp parts")
Suggested-by: Guillaume Nault <gnault@redhat.com>
Signed-off-by: Jacob Wen <jian.w.wen@oracle.com>
Acked-by: Guillaume Nault <gnault@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'lib')
0 files changed, 0 insertions, 0 deletions