[PPP] generic: Call skb_cow_head before scribbling over skb

[mirror_ubuntu-bionic-kernel.git] / drivers / net / ppp_generic.c

diff --git a/drivers/net/ppp_generic.c b/drivers/net/ppp_generic.c
index 6d596ca50cfd1e469407ece20905ffa3d24f2fe1..7e21342becb2eb00175613622649ec9ff7545c4c 100644 (file)
--- a/drivers/net/ppp_generic.c
+++ b/drivers/net/ppp_generic.c
@@ -40,7 +40,6 @@
 #include <linux/ip.h>
 #include <linux/tcp.h>
 #include <linux/spinlock.h>
-#include <linux/smp_lock.h>
 #include <linux/rwsem.h>
 #include <linux/stddef.h>
 #include <linux/device.h>
@@ -900,17 +899,9 @@ ppp_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
        /* Put the 2-byte PPP protocol number on the front,
           making sure there is room for the address and control fields. */
-       if (skb_headroom(skb) < PPP_HDRLEN) {
-               struct sk_buff *ns;
-
-               ns = alloc_skb(skb->len + dev->hard_header_len, GFP_ATOMIC);
-               if (ns == 0)
-                       goto outf;
-               skb_reserve(ns, dev->hard_header_len);
-               skb_copy_bits(skb, 0, skb_put(ns, skb->len), skb->len);
-               kfree_skb(skb);
-               skb = ns;
-       }
+       if (skb_cow_head(skb, PPP_HDRLEN))
+               goto outf;
+
        pp = skb_push(skb, 2);
        proto = npindex_to_proto[npi];
        pp[0] = proto >> 8;
@@ -1709,14 +1700,25 @@ ppp_decompress_frame(struct ppp *ppp, struct sk_buff *skb)
                goto err;
 
        if (proto == PPP_COMP) {
-               ns = dev_alloc_skb(ppp->mru + PPP_HDRLEN);
+               int obuff_size;
+
+               switch(ppp->rcomp->compress_proto) {
+               case CI_MPPE:
+                       obuff_size = ppp->mru + PPP_HDRLEN + 1;
+                       break;
+               default:
+                       obuff_size = ppp->mru + PPP_HDRLEN;
+                       break;
+               }
+
+               ns = dev_alloc_skb(obuff_size);
                if (ns == 0) {
                        printk(KERN_ERR "ppp_decompress_frame: no memory\n");
                        goto err;
                }
                /* the decompressor still expects the A/C bytes in the hdr */
                len = ppp->rcomp->decompress(ppp->rc_state, skb->data - 2,
-                               skb->len + 2, ns->data, ppp->mru + PPP_HDRLEN);
+                               skb->len + 2, ns->data, obuff_size);
                if (len < 0) {
                        /* Pass the compressed frame to pppd as an
                           error indication. */
@@ -2674,8 +2676,7 @@ static void __exit ppp_cleanup(void)
        if (atomic_read(&ppp_unit_count) || atomic_read(&channel_count))
                printk(KERN_ERR "PPP: removing module but units remain!\n");
        cardmap_destroy(&all_ppp_units);
-       if (unregister_chrdev(PPP_MAJOR, "ppp") != 0)
-               printk(KERN_ERR "PPP: failed to unregister PPP device\n");
+       unregister_chrdev(PPP_MAJOR, "ppp");
        device_destroy(ppp_class, MKDEV(PPP_MAJOR, 0));
        class_destroy(ppp_class);
 }