| commit | 392fdb0e35055b96faa9c1cd6ab537805337cdce | |
| author | Herbert Xu <herbert@gondor.apana.org.au> | |
| Tue, 10 Jun 2008 21:07:25 +0000 (10 14:07 -0700) | ||
| committer | David S. Miller <davem@davemloft.net> | |
| Tue, 10 Jun 2008 21:07:25 +0000 (10 14:07 -0700) | ||
| tree | c39f1c89c575df054f60439dbffe7fc0a1f32f8b | treesnapshot (tar.gz zip) |
| parent | ea23ec26727b4df97b4965715f0519b6ddc0aa4b | commitdiff |
net pppoe: Check packet length on all receive paths
The length field in the PPPOE header wasn't checked completely.
This patch causes all packets shorter than the declared length
to be dropped.
It also changes the memcpy_toiovec call to skb_copy_datagram_iovec
so that paged packets (rare for PPPOE) are handled properly.
Thanks to Ilja of the Netric Security Team for discovering and
reporting this bug, and Chris Wright for the total_len check.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
The length field in the PPPOE header wasn't checked completely.
This patch causes all packets shorter than the declared length
to be dropped.
It also changes the memcpy_toiovec call to skb_copy_datagram_iovec
so that paged packets (rare for PPPOE) are handled properly.
Thanks to Ilja of the Netric Security Team for discovering and
reporting this bug, and Chris Wright for the total_len check.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
| drivers/net/pppoe.c | diffblobblamehistory |