Re: [PATCH net-2.6] L2TP: Fix potential memory corruption in pppol2tp_recvmsg()

This patch fixes a potential memory corruption in
pppol2tp_recvmsg(). If skb->len is bigger than the caller's buffer
length, memcpy_toiovec() will go into unintialized data on the kernel
heap, interpret it as an iovec and start modifying memory.

The fix is to change the memcpy_toiovec() call to
skb_copy_datagram_iovec() so that paged packets (rare for PPPOL2TP)
are handled properly. Also check that the caller's buffer is big
enough for the data and drop it if it isn't so.

Reported-by: Ilja <ilja@netric.org>
Signed-off-by: James Chapman <jchapman@katalix.com>

--

A candidate for -stable?

Index: net-2.6/drivers/net/pppol2tp.c
===================================================================

--- net-2.6.orig/drivers/net/pppol2tp.c
+++ net-2.6/drivers/net/pppol2tp.c

@@ -773,6 +773,7 @@ static int pppol2tp_recvmsg(struct kiocb
 	int err;
 	struct sk_buff *skb;
 	struct sock *sk = sock->sk;
+	int skb_len;
 
 	err = -EIO;
 	if (sk->sk_state & PPPOX_BOUND)

@@ -783,14 +784,25 @@ static int pppol2tp_recvmsg(struct kiocb
 	err = 0;
 	skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
 				flags & MSG_DONTWAIT, &err);
-	if (skb) {
-		err = memcpy_toiovec(msg->msg_iov, (unsigned char *) skb->data,
-				     skb->len);
-		if (err < 0)
-			goto do_skb_free;
-		err = skb->len;
-	}
-do_skb_free:
+	if (!skb)
+		goto end;
+
+	skb_len = skb->len;
+
+	/* If caller did not provide a buffer big enough, drop the
+	 * frame.  This path is used only for receiving PPP control
+	 * frames (not user data) so PPP daemons should always use a
+	 * buffer big enough for the largest expected control frame.
+	 */
+	err = -EMSGSIZE;
+	if (unlikely(skb_len > len))
+		goto err_drop;
+
+	err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, skb_len);
+	if (likely(err == 0))
+		err = skb_len;
+
+err_drop:
 	kfree_skb(skb);
 end:
 	return err;