diff options
| author | Tejaswi Tanikella <tejaswit@codeaurora.org> | 2018-04-13 12:56:57 +0530 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2019-03-25 05:28:57 -0700 |
| commit | 497a93c08b36ae5987ec23c122e4b792ef3f63be (patch) | |
| tree | 730ec454963aeeac5584210d4b28e074015053ef | |
| parent | e0bd9e31fd5ebddd3498960ad2d346e30a50e24c (diff) | |
pppolac: pull udp header before sock enqueueLA.UM.7.6.2.r1-07600-89xx.0
pppolac driver incorrectly enqueues the packet into the sock queue
without pulling UDP headers. The application will receive data along
with UDP header when L2TP control packets are received.
The issue was introduced after moving UDP header removal functionality
from process rcvmesg context to BH context.
Instead of pppolac driver directly queuing L2TP control packets into
socket queue, return packet to udp_queue_rcv_skb, which will deliver the
packet to the application after pulling the UDP header.
Fixes: e6afc8ace ("udp: remove headers from UDP packets before queueing")
Change-Id: Icfa0fd8da43ea9c14fa7c718746a6529651ac202
Acked-by: Sharath Chandra Vurukala <sharathv@qti.qualcomm.com>
Signed-off-by: Tejaswi Tanikella <tejaswit@codeaurora.org>
| -rw-r--r-- | drivers/net/ppp/pppolac.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/drivers/net/ppp/pppolac.c b/drivers/net/ppp/pppolac.c index 3a45cf805288..8ed809153120 100644 --- a/drivers/net/ppp/pppolac.c +++ b/drivers/net/ppp/pppolac.c @@ -83,7 +83,7 @@ static int pppolac_recv_core(struct sock *sk_udp, struct sk_buff *skb) /* Put it back if it is a control packet. */ if (skb->data[sizeof(struct udphdr)] & L2TP_CONTROL_BIT) - return opt->backlog_rcv(sk_udp, skb); + return 2; /* Skip UDP header. */ skb_pull(skb, sizeof(struct udphdr)); @@ -190,9 +190,10 @@ drop: static int pppolac_recv(struct sock *sk_udp, struct sk_buff *skb) { + int retval; sock_hold(sk_udp); - sk_receive_skb(sk_udp, skb, 0); - return 0; + retval = sk_receive_skb(sk_udp, skb, 0); + return (retval >> 1); } static struct sk_buff_head delivery_queue; |