James Chapman 6b6707a50c
l2tp: Fix potential memory corruption in pppol2tp_recvmsg() ...
This patch fixes a potential memory corruption in
pppol2tp_recvmsg(). If skb->len is bigger than the caller's buffer
length, memcpy_toiovec() will go into unintialized data on the kernel
heap, interpret it as an iovec and start modifying memory.
The fix is to change the memcpy_toiovec() call to
skb_copy_datagram_iovec() so that paged packets (rare for PPPOL2TP)
are handled properly. Also check that the caller's buffer is big
enough for the data and set the MSG_TRUNC flag if it is not so.
Reported-by: Ilja <ilja@netric.org>
Signed-off-by: James Chapman <jchapman@katalix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2008-06-10 12:35:00 -07:00
2008-05-08 10:46:55 -07:00
2008-05-23 08:11:06 -07:00
2008-05-30 12:40:28 -04:00
2008-05-20 14:52:25 -07:00
2008-05-29 21:10:01 -07:00
2008-05-30 15:09:44 +10:00
2008-05-02 16:45:10 -07:00
2008-05-23 16:45:04 +10:00
2008-05-30 15:09:44 +10:00
2008-05-29 12:10:12 -04:00
2008-04-21 10:19:34 +08:00
2008-05-20 13:51:20 -07:00
2008-05-24 09:56:13 -07:00
2008-05-20 18:24:17 +02:00
2008-04-29 08:06:23 -07:00
2008-05-24 09:56:11 -07:00
2008-05-20 16:44:43 +02:00
2008-05-24 09:56:08 -07:00
2008-05-18 20:49:41 +02:00
2008-05-20 13:31:54 -07:00
2008-05-20 18:24:17 +02:00
2008-05-23 11:11:44 -07:00
2008-05-30 10:17:19 -07:00
2008-05-23 08:11:06 -07:00
2008-05-20 13:31:55 -07:00
2008-05-30 15:09:42 +10:00
2008-05-15 20:50:00 +10:00
2008-04-29 08:06:18 -07:00
2008-05-24 09:56:10 -07:00
2008-05-26 16:08:40 +02:00
2008-04-19 19:10:29 -07:00
2008-04-29 08:06:25 -07:00
2008-05-21 16:56:00 -07:00
2008-05-30 07:43:24 -07:00
2008-05-21 16:55:59 -07:00
2008-05-27 07:34:38 -07:00
2008-06-10 12:35:00 -07:00
2008-04-29 08:06:19 -07:00
2008-05-15 20:49:49 +10:00
2008-05-14 19:11:12 -07:00
2008-05-15 10:38:54 -04:00
2008-04-30 08:29:53 -07:00
2008-05-30 09:50:46 -07:00
2008-05-27 16:07:45 -05:00
2008-05-15 17:50:37 -07:00
2008-05-20 13:31:55 -07:00
2008-05-02 15:00:44 +10:00
2008-04-29 19:40:28 +10:00
2008-05-13 08:02:26 -07:00
2008-05-30 10:20:03 -07:00
2008-05-21 16:55:59 -07:00
2008-05-23 08:11:07 -07:00
2008-05-31 16:10:04 +08:00
2008-05-24 09:56:14 -07:00
2008-06-04 15:57:10 -04:00
2008-04-29 03:12:17 -04:00
2008-05-20 13:31:55 -07:00
2008-05-29 19:43:27 -07:00
2008-05-24 10:13:16 -07:00
2008-05-30 15:09:46 +10:00
2008-04-30 08:29:53 -07:00
2008-05-30 10:16:58 -07:00
2008-04-24 23:57:33 +02:00
2008-04-29 08:06:21 -07:00
2008-04-30 08:29:52 -07:00
2008-04-30 08:29:52 -07:00
6b6707a50c