[PPP]: Fix osize too small errors when decoding mppe.

[sfrench/cifs-2.6.git] / drivers / net / ppp_generic.c

diff --git a/drivers/net/ppp_generic.c b/drivers/net/ppp_generic.c
index 11b575f89856b55d0307c06513cc4695909cba2a..3ef0092dc09cf3f086a7ae367f42d31127bbc729 100644 (file)
--- a/drivers/net/ppp_generic.c
+++ b/drivers/net/ppp_generic.c
@@ -40,7 +40,6 @@
 #include <linux/ip.h>
 #include <linux/tcp.h>
 #include <linux/spinlock.h>
-#include <linux/smp_lock.h>
 #include <linux/rwsem.h>
 #include <linux/stddef.h>
 #include <linux/device.h>
@@ -88,8 +87,6 @@ struct ppp_file {
 #define PF_TO_PPP(pf)          PF_TO_X(pf, struct ppp)
 #define PF_TO_CHANNEL(pf)      PF_TO_X(pf, struct channel)
 
-#define ROUNDUP(n, x)          (((n) + (x) - 1) / (x))
-
 /*
  * Data structure describing one ppp unit.
  * A ppp unit corresponds to a ppp network interface device
@@ -1297,7 +1294,7 @@ static int ppp_mp_explode(struct ppp *ppp, struct sk_buff *skb)
         */
        fragsize = len;
        if (nfree > 1)
-               fragsize = ROUNDUP(fragsize, nfree);
+               fragsize = DIV_ROUND_UP(fragsize, nfree);
        /* nbigger channels get fragsize bytes, the rest get fragsize-1,
           except if nbigger==0, then they all get fragsize. */
        nbigger = len % nfree;
@@ -1685,7 +1682,7 @@ ppp_receive_nonmp_frame(struct ppp *ppp, struct sk_buff *skb)
                        skb_pull_rcsum(skb, 2);
                        skb->dev = ppp->dev;
                        skb->protocol = htons(npindex_to_ethertype[npi]);
-                       skb->mac.raw = skb->data;
+                       skb_reset_mac_header(skb);
                        netif_rx(skb);
                        ppp->dev->last_rx = jiffies;
                }
@@ -1711,7 +1708,18 @@ ppp_decompress_frame(struct ppp *ppp, struct sk_buff *skb)
                goto err;
 
        if (proto == PPP_COMP) {
-               ns = dev_alloc_skb(ppp->mru + PPP_HDRLEN);
+               int obuff_size;
+
+               switch(ppp->rcomp->compress_proto) {
+               case CI_MPPE:
+                       obuff_size = ppp->mru + PPP_HDRLEN + 1;
+                       break;
+               default:
+                       obuff_size = ppp->mru + PPP_HDRLEN;
+                       break;
+               }
+
+               ns = dev_alloc_skb(obuff_size);
                if (ns == 0) {
                        printk(KERN_ERR "ppp_decompress_frame: no memory\n");
                        goto err;
@@ -2544,6 +2552,9 @@ static void ppp_destroy_interface(struct ppp *ppp)
        ppp->active_filter = NULL;
 #endif /* CONFIG_PPP_FILTER */
 
+       if (ppp->xmit_pending)
+               kfree_skb(ppp->xmit_pending);
+
        kfree(ppp);
 }