ppp: deflate: never return len larger than output buffer
authorFlorian Westphal <fw@strlen.de>
Wed, 28 Jan 2015 09:56:04 +0000 (10:56 +0100)
committerDavid S. Miller <davem@davemloft.net>
Thu, 29 Jan 2015 22:50:01 +0000 (14:50 -0800)
commite2a4800e75780ccf4e6c2487f82b688ba736eb18
tree24ae0d44cd90ce184165ff63fccc17782b755083
parentd445d63b77577f7ecdd7eb7e9d6518493cdcd778
ppp: deflate: never return len larger than output buffer

When we've run out of space in the output buffer to store more data, we
will call zlib_deflate with a NULL output buffer until we've consumed
remaining input.

When this happens, olen contains the size the output buffer would have
consumed iff we'd have had enough room.

This can later cause skb_over_panic when ppp_generic skb_put()s
the returned length.

Reported-by: Iain Douglas <centos@1n6.org.uk>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
drivers/net/ppp/ppp_deflate.c