Re: ppp/l2tp doing oversized allocations ?

From: Eric Dumazet <redacted>
Date: Sat, 19 May 2012 08:25:30 +0200

On Sat, 2012-05-19 at 07:01 +0200, Eric Dumazet wrote:

quoted

On Sat, 2012-05-19 at 00:46 -0400, David Miller wrote:

quoted

So it's ESP encapsulated IPSEC over L2tp.

Eric, I wonder if session->hdr_len can take on undesirable values and
thus trip up the skb COW'ing calculations you added?

I take a look, thanks

hdr_len is u16, I have no idea how we can reach MAX_ORDER page
allocations... (more than 2 Mbytes...)

Maybe a memory corruption, or a signed/unsigned mismatch.

Yes, the trace looks really weird to me too.

It's also possible that the big length comes accidently from IPSEC
too.

If this can be readily reproduced, we can construct some debugging
patches for the user to try.