| commit | 6b6707a50c7598a83820077393f8823ab791abf8 | |
| author | James Chapman <jchapman@katalix.com> | |
| Tue, 10 Jun 2008 19:35:00 +0000 (10 12:35 -0700) | ||
| committer | David S. Miller <davem@davemloft.net> | |
| Tue, 10 Jun 2008 19:35:00 +0000 (10 12:35 -0700) | ||
| tree | 5a707de3b34eeaa2bad9b16d5ad006abe4a6d901 | treesnapshot (tar.gz zip) |
| parent | 2e761e0532a784816e7e822dbaaece8c5d4be14d | commitdiff |
l2tp: Fix potential memory corruption in pppol2tp_recvmsg()
This patch fixes a potential memory corruption in
pppol2tp_recvmsg(). If skb->len is bigger than the caller's buffer
length, memcpy_toiovec() will go into unintialized data on the kernel
heap, interpret it as an iovec and start modifying memory.
The fix is to change the memcpy_toiovec() call to
skb_copy_datagram_iovec() so that paged packets (rare for PPPOL2TP)
are handled properly. Also check that the caller's buffer is big
enough for the data and set the MSG_TRUNC flag if it is not so.
Reported-by: Ilja <ilja@netric.org>
Signed-off-by: James Chapman <jchapman@katalix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This patch fixes a potential memory corruption in
pppol2tp_recvmsg(). If skb->len is bigger than the caller's buffer
length, memcpy_toiovec() will go into unintialized data on the kernel
heap, interpret it as an iovec and start modifying memory.
The fix is to change the memcpy_toiovec() call to
skb_copy_datagram_iovec() so that paged packets (rare for PPPOL2TP)
are handled properly. Also check that the caller's buffer is big
enough for the data and set the MSG_TRUNC flag if it is not so.
Reported-by: Ilja <ilja@netric.org>
Signed-off-by: James Chapman <jchapman@katalix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
| drivers/net/pppol2tp.c | diffblobblamehistory |