From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Guillaume Nault <gnault@redhat.com>,
Jacob Wen <jian.w.wen@oracle.com>,
"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 3.18 18/31] l2tp: copy 4 more bytes to linear part if necessary
Date: Mon, 4 Feb 2019 11:36:33 +0100 [thread overview]
Message-ID: <20190204103601.630270047@linuxfoundation.org> (raw)
In-Reply-To: <20190204103557.903263774@linuxfoundation.org>
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacob Wen <jian.w.wen@oracle.com>
[ Upstream commit 91c524708de6207f59dd3512518d8a1c7b434ee3 ]
The size of L2TPv2 header with all optional fields is 14 bytes.
l2tp_udp_recv_core only moves 10 bytes to the linear part of a
skb. This may lead to l2tp_recv_common read data outside of a skb.
This patch make sure that there is at least 14 bytes in the linear
part of a skb to meet the maximum need of l2tp_udp_recv_core and
l2tp_recv_common. The minimum size of both PPP HDLC-like frame and
Ethernet frame is larger than 14 bytes, so we are safe to do so.
Also remove L2TP_HDR_SIZE_NOSEQ, it is unused now.
Fixes: fd558d186df2 ("l2tp: Split pppol2tp patch into separate l2tp and ppp parts")
Suggested-by: Guillaume Nault <gnault@redhat.com>
Signed-off-by: Jacob Wen <jian.w.wen@oracle.com>
Acked-by: Guillaume Nault <gnault@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/l2tp/l2tp_core.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -83,8 +83,7 @@
#define L2TP_SLFLAG_S 0x40000000
#define L2TP_SL_SEQ_MASK 0x00ffffff
-#define L2TP_HDR_SIZE_SEQ 10
-#define L2TP_HDR_SIZE_NOSEQ 6
+#define L2TP_HDR_SIZE_MAX 14
/* Default trace flags */
#define L2TP_DEFAULT_DEBUG_FLAGS 0
@@ -856,7 +855,7 @@ static int l2tp_udp_recv_core(struct l2t
__skb_pull(skb, sizeof(struct udphdr));
/* Short packet? */
- if (!pskb_may_pull(skb, L2TP_HDR_SIZE_SEQ)) {
+ if (!pskb_may_pull(skb, L2TP_HDR_SIZE_MAX)) {
l2tp_info(tunnel, L2TP_MSG_DATA,
"%s: recv short packet (len=%d)\n",
tunnel->name, skb->len);
next prev parent reply other threads:[~2019-02-04 11:12 UTC|newest]
Thread overview: 36+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-02-04 10:36 [PATCH 3.18 00/31] 3.18.134-stable review Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 3.18 01/31] openvswitch: Avoid OOB read when parsing flow nlattrs Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 3.18 02/31] USB: serial: simple: add Motorola Tetra TPG2200 device id Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 3.18 03/31] USB: serial: pl2303: add new PID to support PL2303TB Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 3.18 04/31] s390/smp: fix CPU hotplug deadlock with CPU rescan Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 3.18 05/31] staging: rtl8188eu: Add device code for D-Link DWA-121 rev B1 Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 3.18 06/31] tty: Handle problem if line discipline does not have receive_buf Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 3.18 07/31] tty/n_hdlc: fix __might_sleep warning Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 3.18 08/31] CIFS: Fix possible hang during async MTU reads and writes Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 3.18 09/31] Input: xpad - add support for SteelSeries Stratus Duo Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 3.18 10/31] x86/kaslr: Fix incorrect i8254 outb() parameters Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 3.18 11/31] can: dev: __can_get_echo_skb(): fix bogous check for non-existing skb by removing it Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 3.18 12/31] can: bcm: check timer values before ktime conversion Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 3.18 13/31] vt: invoke notifier on screen size change Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 3.18 14/31] perf unwind: Unwind with libdw doesnt take symfs into account Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 3.18 15/31] perf unwind: Take pgoff into account when reporting elf to libdwfl Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 3.18 16/31] f2fs: read page index before freeing Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 3.18 17/31] ipv6: Consider sk_bound_dev_if when binding a socket to an address Greg Kroah-Hartman
2019-02-04 10:36 ` Greg Kroah-Hartman [this message]
2019-02-04 10:36 ` [PATCH 3.18 19/31] netrom: switch to sock timer API Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 3.18 20/31] net/rose: fix NULL ax25_cb kernel panic Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 3.18 21/31] ucc_geth: Reset BQL queue when stopping device Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 3.18 22/31] l2tp: remove l2specific_len dependency in l2tp_core Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 3.18 23/31] l2tp: fix reading optional fields of L2TPv3 Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 3.18 24/31] CIFS: Do not count -ENODATA as failure for query directory Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 3.18 25/31] fs/dcache: Fix incorrect nr_dentry_unused accounting in shrink_dcache_sb() Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 3.18 26/31] arm64: hyp-stub: Forbid kprobing of the hyp-stub Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 3.18 27/31] gfs2: Revert "Fix loop in gfs2_rbm_find" Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 3.18 28/31] platform/x86: asus-nb-wmi: Map 0x35 to KEY_SCREENLOCK Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 3.18 29/31] platform/x86: asus-nb-wmi: Drop mapping of 0x33 and 0x34 scan codes Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 3.18 30/31] mm, oom: fix use-after-free in oom_kill_process Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 3.18 31/31] mm: migrate: dont rely on __PageMovable() of newpage after unlocking it Greg Kroah-Hartman
2019-02-04 21:44 ` [PATCH 3.18 00/31] 3.18.134-stable review Guenter Roeck
2019-02-05 8:46 ` Greg Kroah-Hartman
2019-02-05 13:54 ` Guenter Roeck
2019-02-05 14:41 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190204103601.630270047@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=davem@davemloft.net \
--cc=gnault@redhat.com \
--cc=jian.w.wen@oracle.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).