From 49a94430c090068ca96f1dc38ed24cd93c2e324d Mon Sep 17 00:00:00 2001 From: Denys Fedoryshchenko Date: Sun, 9 Aug 2026 06:54:53 +0300 Subject: pptp: drop the out-of-tree kernel driver drivers/pptp is version 0.8.5 of the PPTP driver, the direct ancestor of mainline drivers/net/ppp/pptp.c. Mainline merged that code in 2.6.37 (2011) from the same author and has maintained it since; this copy received none of the subsequent fixes and is no longer worth carrying: - It cannot be built. struct flowi's nl_u union, the 3-argument ip_route_output_key(), sock_no_poll, the old ip_select_ident() signature and nf_reset() all disappeared long ago, so nothing past roughly 2.6.36 compiles and -DBUILD_PPTP_DRIVER=TRUE is a build failure everywhere. - It is not needed. The PPTP bits of accel-pppd/include/if_pppox.h are identical to the mainline UAPI header, so ctrl/pptp's socket(AF_PPPOX, SOCK_STREAM, PX_PROTO_PPTP) reaches the in-kernel module (alias net-pf-24-proto-2) unchanged. The daemon uses no interface the bundled driver added. The deleted drivers/pptp/if_pppox.h was included only by drivers/pptp/pptp.c; all other if_pppox.h includes use either the kernel UAPI header or accel-pppd's userspace copy. - It is unsafe. Among others: the pskb_may_pull() in pptp_rcv() is commented out, so the GRE header is parsed with no length validation at all; the skb->len - headersize comparison in pptp_rcv_core() underflows and leads to an out-of-bounds read and a negative skb_pull(); pptp_getname() copies uninitialised stack to userspace; and pptp_bind()/pptp_connect() never check sockaddr_len (CVE-2015-8569). Mainline fixed each of these years ago. Remove the directory along with the BUILD_PPTP_DRIVER option, the accel-pptp-kmod package and the ip_gre conflict warning, which only existed because this module claimed IPPROTO_GRE. accel-pppd/ctrl/pptp and accel-pppd/include/if_pppox.h are unaffected. PPTP now requires the kernel's own pptp module; kernels older than 2.6.37 are no longer supported. --- drivers/pptp/gre.h | 18 ------------------ 1 file changed, 18 deletions(-) delete mode 100644 drivers/pptp/gre.h (limited to 'drivers/pptp/gre.h') diff --git a/drivers/pptp/gre.h b/drivers/pptp/gre.h deleted file mode 100644 index 2ca7f749..00000000 --- a/drivers/pptp/gre.h +++ /dev/null @@ -1,18 +0,0 @@ -#ifndef __LINUX_GRE_H -#define __LINUX_GRE_H - -#include - -#define GREPROTO_CISCO 0 -#define GREPROTO_PPTP 1 -#define GREPROTO_MAX 2 - -struct gre_protocol { - int (*handler)(struct sk_buff *skb); - void (*err_handler)(struct sk_buff *skb, u32 info); -}; - -int gre_add_protocol(struct gre_protocol *proto, u8 version); -int gre_del_protocol(struct gre_protocol *proto, u8 version); - -#endif -- cgit v1.2.3