The patch titled
ppp: fix osize too small errors when decoding mppe
has been added to the -mm tree. Its filename is
ppp-fix-osize-too-small-errors-when-decoding.patch
*** Remember to use Documentation/SubmitChecklist when testing your code ***
See http://www.zip.com.au/~akpm/linux/patches/stuff/added-to-mm.txt to find
out what to do about this
------------------------------------------------------
Subject: ppp: fix osize too small errors when decoding mppe
From: Konstantin Sharlaimov <konstantin.sharlaimov@xxxxxxxxx>
The mppe_decompress() function required a buffer that is 1 byte too small
when receiving a message of mru size. This fixes buffer allocation to
prevent this from occurring.
As Sergey Vlasov pointed out,
ppp_mppe-account-for-osize-too-small-errors-in.patch may cause buffer
overflows on certain data. Here is another patch that should eliminate the
"osize too small" errors. Instead of patching mppe_decompress itself, I
have patched ppp_decompress_frame so it would allocate the required extra
byte when using mppe compression.
Signed-off-by: Konstantin Sharlaimov <konstantin.sharlaimov@xxxxxxxxx>
Cc: Matt Domsch <Matt_Domsch@xxxxxxxx>
Cc: James Cameron <james.cameron@xxxxxx>
Cc: "David S. Miller" <davem@xxxxxxxxxxxxx>
Cc: Paul Mackerras <paulus@xxxxxxxxx>
Cc: Sergey Vlasov <vsu@xxxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
drivers/net/ppp_generic.c | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
diff -puN drivers/net/ppp_generic.c~ppp-fix-osize-too-small-errors-when-decoding drivers/net/ppp_generic.c
--- a/drivers/net/ppp_generic.c~ppp-fix-osize-too-small-errors-when-decoding
+++ a/drivers/net/ppp_generic.c
@@ -1708,7 +1708,18 @@ ppp_decompress_frame(struct ppp *ppp, st
goto err;
if (proto == PPP_COMP) {
- ns = dev_alloc_skb(ppp->mru + PPP_HDRLEN);
+ int obuff_size;
+
+ switch(ppp->rcomp->compress_proto) {
+ case CI_MPPE:
+ obuff_size = ppp->mru + PPP_HDRLEN + 1;
+ break;
+ default:
+ obuff_size = ppp->mru + PPP_HDRLEN;
+ break;
+ }
+
+ ns = dev_alloc_skb(obuff_size);
if (ns == 0) {
printk(KERN_ERR "ppp_decompress_frame: no memory\n");
goto err;
_
Patches currently in -mm which might be from konstantin.sharlaimov@xxxxxxxxx are
ppp-fix-osize-too-small-errors-when-decoding.patch
-
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
