linux-kernel - [PATCH] net: pppoe: use correct MTU when using Multilink PPP with PPPoE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date:	Fri, 20 Jun 2014 16:02:44 +0200
From:	Christoph Schulz <develop@...stov.de>
To:	Michal Ostrowski <mostrows@...thlink.net>
CC:	linux-kernel@...r.kernel.org
Subject: [PATCH] net: pppoe: use correct MTU when using Multilink PPP with
 PPPoE

From: Christoph Schulz <develop@...stov.de>

The PPP channel MTU is used with Multilink PPP when ppp_mp_explode() (see
ppp_generic module) tries to determine how big a fragment might be. If we
don't subtract 2 bytes (which corresponds to the PPP protocol number), the
payload becomes 1-2 bytes too big (1 byte if PPP protocol compression is
used, 2 otherwise), which causes the generated Ethernet packets to be dropped.
This is due to code in ppp_mp_explode() which says:

		/*
		 * hdrlen includes the 2-byte PPP protocol field, but the
		 * MTU counts only the payload excluding the protocol field.
		 * (RFC1661 Section 2)
		 */
		mtu = pch->chan->mtu - (hdrlen - 2);

This is correct, but the pppoe module does not account for it and includes
the 2-byte PPP protocol field into the computed MTU, which is wrong. This
error only manifests itself when using Multilink PPP, as otherwise the channel
MTU is not used anywhere.

The bug was introduced in commit c9aa6895371b2a257401f59d3393c9f7ac5a8698
("[PPPOE]: Advertise PPPoE MTU") from the very beginning. This patch applies
cleanly to 3.10 upwards but the fix can be applied (with minor modifications)
to kernels as old as 2.6.32.

Signed-off-by: Christoph Schulz <develop@...stov.de>
---
This is my second Linux kernel patch. If I made something wrong, please tell
me ;-)

Best regards,

Christoph Schulz

diff -urpN linux-3.15.1.orig/drivers/net/ppp/pppoe.c linux-3.15.1/drivers/net/ppp/pppoe.c
--- linux-3.15.1.orig/drivers/net/ppp/pppoe.c	2014-06-08 20:19:54.000000000 +0200
+++ linux-3.15.1/drivers/net/ppp/pppoe.c	2014-06-19 11:27:13.000000000 +0200
@@ -675,7 +675,7 @@ static int pppoe_connect(struct socket *
 		po->chan.hdrlen = (sizeof(struct pppoe_hdr) +
 				   dev->hard_header_len);

-		po->chan.mtu = dev->mtu - sizeof(struct pppoe_hdr);
+		po->chan.mtu = dev->mtu - sizeof(struct pppoe_hdr) - 2;
 		po->chan.private = sk;
 		po->chan.ops = &pppoe_chan_ops;

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/