Paul Hüber 837786cbbb l2tp: avoid use-after-free caused by l2tp_ip_backlog_recv ...

[ Upstream commit 51fb60eb16 ]

l2tp_ip_backlog_recv may not return -1 if the packet gets dropped.
The return value is passed up to ip_local_deliver_finish, which treats
negative values as an IP protocol number for resubmission.

Signed-off-by: Paul Hüber <phueber@kernsp.in>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2017-03-22 12:43:32 +01:00

..

Kconfig

…

l2tp_core.c

l2tp: fix use-after-free during module unload

2016-09-02 11:44:44 -07:00

l2tp_core.h

l2tp: do not use udp_ioctl()

2017-02-18 15:11:43 +01:00

l2tp_debugfs.c

…

l2tp_eth.c

net: revert "net: l2tp: Treat NET_XMIT_CN as success in l2tp_eth_dev_xmit"

2016-11-23 20:18:36 -05:00

l2tp_ip6.c

l2tp: do not use udp_ioctl()

2017-02-18 15:11:43 +01:00

l2tp_ip.c

l2tp: avoid use-after-free caused by l2tp_ip_backlog_recv

2017-03-22 12:43:32 +01:00

l2tp_netlink.c

l2tp: make nla_policy const

2016-09-01 14:09:01 -07:00

l2tp_ppp.c

l2tp: use IS_ENABLED() instead of checking for built-in or module

2016-09-10 21:19:11 -07:00

Makefile

…