OSDN Git Service

net pppoe: Check packet length on all receive paths
authorHerbert Xu <herbert@gondor.apana.org.au>
Tue, 10 Jun 2008 21:07:25 +0000 (14:07 -0700)
committerWilly Tarreau <w@1wt.eu>
Sat, 6 Sep 2008 11:35:24 +0000 (13:35 +0200)
commitb6b3ead344af0e047244c92435558d09bcc59f87
tree18399595592f6d42871a65ccd77c8e45b7b3e763
parentdcf072a1b618564cec29187c36924045207674bd
net pppoe: Check packet length on all receive paths

[backport of 2.6 commit 392fdb0e35055b96faa9c1cd6ab537805337cdce]

The length field in the PPPOE header wasn't checked completely.
This patch causes all packets shorter than the declared length
to be dropped.

It also changes the memcpy_toiovec call to skb_copy_datagram_iovec
so that paged packets (rare for PPPOE) are handled properly.

Thanks to Ilja of the Netric Security Team for discovering and
reporting this bug, and Chris Wright for the total_len check.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Willy Tarreau <w@1wt.eu>
drivers/net/pppoe.c