]> git.baikalelectronics.ru Git - kernel.git/commit
l2tp: remove l2specific_len dependency in l2tp_core
authorLorenzo Bianconi <lorenzo.bianconi@redhat.com>
Tue, 16 Jan 2018 22:01:55 +0000 (23:01 +0100)
committerDavid S. Miller <davem@davemloft.net>
Fri, 19 Jan 2018 20:00:49 +0000 (15:00 -0500)
commitffb90ee0426c46c6b0b1bc2a73ac5a512d1d63ab
tree670832c4df1db3f15d1b51de9875f4e4a5dd0428
parentda10fcc14706c98c94cd16067b579beccbdec154
l2tp: remove l2specific_len dependency in l2tp_core

Remove l2specific_len dependency while building l2tpv3 header or
parsing the received frame since default L2-Specific Sublayer is
always four bytes long and we don't need to rely on a user supplied
value.
Moreover in l2tp netlink code there are no sanity checks to
enforce the relation between l2specific_len and l2specific_type,
so sending a malformed netlink message is possible to set
l2specific_type to L2TP_L2SPECTYPE_DEFAULT (or even
L2TP_L2SPECTYPE_NONE) and set l2specific_len to a value greater than
4 leaking memory on the wire and sending corrupted frames.

Reviewed-by: Guillaume Nault <g.nault@alphalink.fr>
Tested-by: Guillaume Nault <g.nault@alphalink.fr>
Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/l2tp/l2tp_core.c
net/l2tp/l2tp_core.h