summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorGuillaume Nault <g.nault@alphalink.fr>2013-06-12 16:07:23 +0200
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2013-06-27 10:34:33 -0700
commit6e092615d27d7036832c18f1c14b691c6c1cbb1d (patch)
tree4763e679445ca470e92001a1c79215c7449d0732
parentb4d45a2af9c9ca5c14e00375366125e7c31d5293 (diff)
downloadlwn-6e092615d27d7036832c18f1c14b691c6c1cbb1d.tar.gz
lwn-6e092615d27d7036832c18f1c14b691c6c1cbb1d.zip
l2tp: Fix PPP header erasure and memory leak
[ Upstream commit 55b92b7a11690bc377b5d373872a6b650ae88e64 ] Copy user data after PPP framing header. This prevents erasure of the added PPP header and avoids leaking two bytes of uninitialised memory at the end of skb's data buffer. Signed-off-by: Guillaume Nault <g.nault@alphalink.fr> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-rw-r--r--net/l2tp/l2tp_ppp.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index 770b49762412..6af7be63a47f 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -350,12 +350,12 @@ static int pppol2tp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msgh
skb_put(skb, 2);
/* Copy user data into skb */
- error = memcpy_fromiovec(skb->data, m->msg_iov, total_len);
+ error = memcpy_fromiovec(skb_put(skb, total_len), m->msg_iov,
+ total_len);
if (error < 0) {
kfree_skb(skb);
goto error_put_sess_tun;
}
- skb_put(skb, total_len);
l2tp_xmit_skb(session, skb, session->hdr_len);