From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from wtarreau.pck.nerim.net ([62.212.114.60]:36253 "EHLO 1wt.eu" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S934721AbbEOIQI (ORCPT ); Fri, 15 May 2015 04:16:08 -0400 Message-Id: <20150515080531.443129837@1wt.eu> Date: Fri, 15 May 2015 10:05:57 +0200 From: Willy Tarreau To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Iain Douglas , Florian Westphal , "David S. Miller" , Ben Hutchings , Willy Tarreau Subject: [ 27/48] ppp: deflate: never return len larger than output buffer MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-15 In-Reply-To: <9c2783dfae10ef2d1e9b08bcc1e562c5@local> Sender: stable-owner@vger.kernel.org List-ID: 2.6.32-longterm review patch. If anyone has any objections, please let me know. ------------------ From: Florian Westphal [ Upstream commit e2a4800e75780ccf4e6c2487f82b688ba736eb18 ] When we've run out of space in the output buffer to store more data, we will call zlib_deflate with a NULL output buffer until we've consumed remaining input. When this happens, olen contains the size the output buffer would have consumed iff we'd have had enough room. This can later cause skb_over_panic when ppp_generic skb_put()s the returned length. Reported-by: Iain Douglas Signed-off-by: Florian Westphal Signed-off-by: David S. Miller Signed-off-by: Ben Hutchings (cherry picked from commit 8bcd64423836bad3638684677f6d740bc7c9297f) Signed-off-by: Willy Tarreau --- drivers/net/ppp_deflate.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ppp_deflate.c b/drivers/net/ppp_deflate.c index 034c1c6..09a4382 100644 --- a/drivers/net/ppp_deflate.c +++ b/drivers/net/ppp_deflate.c @@ -269,7 +269,7 @@ static int z_compress(void *arg, unsigned char *rptr, unsigned char *obuf, /* * See if we managed to reduce the size of the packet. */ - if (olen < isize) { + if (olen < isize && olen <= osize) { state->stats.comp_bytes += olen; state->stats.comp_packets++; } else { -- 1.7.12.2.21.g234cd45.dirty