netdev - Re: [PATCH net] l2tp: copy 4 more bytes to linear part if necessary

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20190131.092034.604580592356896496.davem@davemloft.net>
Date:   Thu, 31 Jan 2019 09:20:34 -0800 (PST)
From:   David Miller <davem@...emloft.net>
To:     jian.w.wen@...cle.com
Cc:     netdev@...r.kernel.org, gnault@...hat.com
Subject: Re: [PATCH net] l2tp: copy 4 more bytes to linear part if necessary

From: Jacob Wen <jian.w.wen@...cle.com>
Date: Thu, 31 Jan 2019 15:18:56 +0800

> The size of L2TPv2 header with all optional fields is 14 bytes.
> l2tp_udp_recv_core only moves 10 bytes to the linear part of a
> skb. This may lead to l2tp_recv_common read data outside of a skb.
> 
> This patch make sure that there is at least 14 bytes in the linear
> part of a skb to meet the maximum need of l2tp_udp_recv_core and
> l2tp_recv_common. The minimum size of both PPP HDLC-like frame and
> Ethernet frame is larger than 14 bytes, so we are safe to do so.
> 
> Also remove L2TP_HDR_SIZE_NOSEQ, it is unused now.
> 
> Fixes: fd558d186df2 ("l2tp: Split pppol2tp patch into separate l2tp and ppp parts")
> Suggested-by: Guillaume Nault <gnault@...hat.com>
> Signed-off-by: Jacob Wen <jian.w.wen@...cle.com>

Applied and queued up for -stable, thanks.