From: Jacob Wen <jian.w....@oracle.com> Date: Thu, 31 Jan 2019 15:18:56 +0800
> The size of L2TPv2 header with all optional fields is 14 bytes. > l2tp_udp_recv_core only moves 10 bytes to the linear part of a > skb. This may lead to l2tp_recv_common read data outside of a skb. > > This patch make sure that there is at least 14 bytes in the linear > part of a skb to meet the maximum need of l2tp_udp_recv_core and > l2tp_recv_common. The minimum size of both PPP HDLC-like frame and > Ethernet frame is larger than 14 bytes, so we are safe to do so. > > Also remove L2TP_HDR_SIZE_NOSEQ, it is unused now. > > Fixes: fd558d186df2 ("l2tp: Split pppol2tp patch into separate l2tp and ppp > parts") > Suggested-by: Guillaume Nault <gna...@redhat.com> > Signed-off-by: Jacob Wen <jian.w....@oracle.com> Applied and queued up for -stable, thanks.