diff options
| author | Herbert Xu <herbert@gondor.apana.org.au> | 2008-06-10 14:07:25 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2008-06-10 14:07:25 -0700 |
| commit | 392fdb0e35055b96faa9c1cd6ab537805337cdce (patch) | |
| tree | c39f1c89c575df054f60439dbffe7fc0a1f32f8b /drivers/usb/storage/freecom.c | |
| parent | ea23ec26727b4df97b4965715f0519b6ddc0aa4b (diff) | |
net pppoe: Check packet length on all receive paths
The length field in the PPPOE header wasn't checked completely.
This patch causes all packets shorter than the declared length
to be dropped.
It also changes the memcpy_toiovec call to skb_copy_datagram_iovec
so that paged packets (rare for PPPOE) are handled properly.
Thanks to Ilja of the Netric Security Team for discovering and
reporting this bug, and Chris Wright for the total_len check.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/usb/storage/freecom.c')
0 files changed, 0 insertions, 0 deletions