github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-09 23:23:53 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

l2tp: Fix PPP header erasure and memory leak

Browse Source 
[ Upstream commit 55b92b7a11 ]

Copy user data after PPP framing header. This prevents erasure of the
added PPP header and avoids leaking two bytes of uninitialised memory
at the end of skb's data buffer.

Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Guillaume Nault 2013-06-12 16:07:23 +02:00 committed by Greg Kroah-Hartman
parent 991e73ccb5
commit 3bf35eb3ed
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
net/l2tp/l2tp_ppp.c
View File

@ -350,12 +350,12 @@ static int pppol2tp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msgh
skb_put(skb, 2);
/* Copy user data into skb */
error = memcpy_fromiovec(skb->data, m->msg_iov, total_len);
error = memcpy_fromiovec(skb_put(skb, total_len), m->msg_iov,
total_len);
if (error < 0) {
kfree_skb(skb);
goto error_put_sess_tun;
}
skb_put(skb, total_len);
l2tp_xmit_skb(session, skb, session->hdr_len);