summaryrefslogtreecommitdiff
path: root/net/l2tp
diff options
context:
space:
mode:
authorGuillaume Nault <g.nault@alphalink.fr>2013-06-12 16:07:23 +0200
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2013-06-27 11:27:33 -0700
commit3bf35eb3ed7e643b9562cf05b919b281e0f1b79a (patch)
tree6e7b6e37f667a8c5d83923ec97c69d2b0e8e1604 /net/l2tp
parent991e73ccb5a0499588565dd8b9fd06c4bd6bce81 (diff)
l2tp: Fix PPP header erasure and memory leak
[ Upstream commit 55b92b7a11690bc377b5d373872a6b650ae88e64 ] Copy user data after PPP framing header. This prevents erasure of the added PPP header and avoids leaking two bytes of uninitialised memory at the end of skb's data buffer. Signed-off-by: Guillaume Nault <g.nault@alphalink.fr> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net/l2tp')
-rw-r--r--net/l2tp/l2tp_ppp.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index 9728a7564a70..06bb5b343d54 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -350,12 +350,12 @@ static int pppol2tp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msgh
skb_put(skb, 2);
/* Copy user data into skb */
- error = memcpy_fromiovec(skb->data, m->msg_iov, total_len);
+ error = memcpy_fromiovec(skb_put(skb, total_len), m->msg_iov,
+ total_len);
if (error < 0) {
kfree_skb(skb);
goto error_put_sess_tun;
}
- skb_put(skb, total_len);
l2tp_xmit_skb(session, skb, session->hdr_len);