Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1381218
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 3.14 23/37] ipv4: l2tp: fix a potential issue in l2tp_ip_recv |
| Date | 2016-04-18 05:50 +0200 |
| Message-ID | <rp8mf-7cT-41@gated-at.bofh.it> (permalink) |
| References | <rp76N-6cG-3@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haishuang Yan <yanhaishuang@cmss.chinamobile.com>
[ Upstream commit 5745b8232e942abd5e16e85fa9b27cc21324acf0 ]
pskb_may_pull() can change skb->data, so we have to load ptr/optr at the
right place.
Signed-off-by: Haishuang Yan <yanhaishuang@cmss.chinamobile.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/l2tp/l2tp_ip.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -123,12 +123,11 @@ static int l2tp_ip_recv(struct sk_buff *
struct l2tp_tunnel *tunnel = NULL;
int length;
- /* Point to L2TP header */
- optr = ptr = skb->data;
-
if (!pskb_may_pull(skb, 4))
goto discard;
+ /* Point to L2TP header */
+ optr = ptr = skb->data;
session_id = ntohl(*((__be32 *) ptr));
ptr += 4;
@@ -156,6 +155,9 @@ static int l2tp_ip_recv(struct sk_buff *
if (!pskb_may_pull(skb, length))
goto discard;
+ /* Point to L2TP header */
+ optr = ptr = skb->data;
+ ptr += 4;
pr_debug("%s: ip recv\n", tunnel->name);
print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, ptr, length);
}
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 3.14 00/37] 3.14.67-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 04:30 +0200 [PATCH 3.14 28/37] usb: renesas_usbhs: disable TX IRQ before starting TX DMAC transfer Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 04:30 +0200 [PATCH 3.14 09/37] net: jme: fix suspend/resume on JMC260 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:50 +0200 [PATCH 3.14 27/37] usb: renesas_usbhs: avoid NULL pointer derefernce in usbhsf_pkt_handler() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:50 +0200 [PATCH 3.14 04/37] ALSA: timer: Use mod_timer() for rearming the system timer Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:50 +0200 [PATCH 3.14 20/37] ipv4: fix broadcast packets reception Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:50 +0200 [PATCH 3.14 24/37] ipv6: l2tp: fix a potential issue in l2tp_ip6_recv Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:50 +0200 [PATCH 3.14 30/37] perf: Cure event->pending_disable race Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:50 +0200 [PATCH 3.14 11/37] ipv6: re-enable fragment header matching in ipv6_find_hdr Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:50 +0200 [PATCH 3.14 23/37] ipv4: l2tp: fix a potential issue in l2tp_ip_recv Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:50 +0200 [PATCH 3.14 06/37] drm/radeon: add a dpm quirk for sapphire Dual-X R7 370 2G D5 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:50 +0200 [PATCH 3.14 25/37] ip6_tunnel: set rtnl_link_ops before calling register_netdevice Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:50 +0200 Re: [PATCH 3.14 00/37] 3.14.67-stable review Guenter Roeck <linux@roeck-us.net> - 2016-04-18 18:40 +0200 Re: [PATCH 3.14 00/37] 3.14.67-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2016-04-18 18:40 +0200
csiph-web