ppp: deflate: never return len larger than output buffer
authorFlorian Westphal <fw@strlen.de>
Wed, 28 Jan 2015 09:56:04 +0000 (10:56 +0100)
committerBen Hutchings <ben@decadent.org.uk>
Sat, 9 May 2015 22:16:37 +0000 (23:16 +0100)
commit8bcd64423836bad3638684677f6d740bc7c9297f
tree00d48a8be1256b7f2a7a0640fec4a58d2976f2d7
parentcfd16467dd2b98642b547df2d25121b7c1599462
ppp: deflate: never return len larger than output buffer

[ Upstream commit e2a4800e75780ccf4e6c2487f82b688ba736eb18 ]

When we've run out of space in the output buffer to store more data, we
will call zlib_deflate with a NULL output buffer until we've consumed
remaining input.

When this happens, olen contains the size the output buffer would have
consumed iff we'd have had enough room.

This can later cause skb_over_panic when ppp_generic skb_put()s
the returned length.

Reported-by: Iain Douglas <centos@1n6.org.uk>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
drivers/net/ppp/ppp_deflate.c