Description of problem:
The length field in the PPPOE header wasn't checked completely. It lacks of a
lower-bound check. Also, call skb_copy_datagram_iovec instead of memcpy_toiovec
so that paged packets (rare for PPPOE) are handled properly.
Proposed upstream patch:
patch sent: http://post-office.corp.redhat.com/archives/rhkernel-list/2008-August/msg01354.html
You can download this test kernel from http://people.redhat.com/dzickus/el5
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.