net pppoe: Check packet length on all receive paths
authorHerbert Xu <herbert@gondor.apana.org.au>
Tue, 10 Jun 2008 21:07:25 +0000 (14:07 -0700)
committerDavid S. Miller <davem@davemloft.net>
Tue, 10 Jun 2008 21:07:25 +0000 (14:07 -0700)
commit392fdb0e35055b96faa9c1cd6ab537805337cdce
treec39f1c89c575df054f60439dbffe7fc0a1f32f8b
parentea23ec26727b4df97b4965715f0519b6ddc0aa4b
net pppoe: Check packet length on all receive paths

The length field in the PPPOE header wasn't checked completely.
This patch causes all packets shorter than the declared length
to be dropped.

It also changes the memcpy_toiovec call to skb_copy_datagram_iovec
so that paged packets (rare for PPPOE) are handled properly.

Thanks to Ilja of the Netric Security Team for discovering and
reporting this bug, and Chris Wright for the total_len check.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
drivers/net/pppoe.c