lkml.org 
[lkml]   [2018]   [Apr]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.18 11/24] l2tp: check sockaddr length in pppol2tp_connect()
    Date
    3.18-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Guillaume Nault <g.nault@alphalink.fr>


    [ Upstream commit eb1c28c05894a4b1f6b56c5bf072205e64cfa280 ]

    Check sockaddr_len before dereferencing sp->sa_protocol, to ensure that
    it actually points to valid data.

    Fixes: fd558d186df2 ("l2tp: Split pppol2tp patch into separate l2tp and ppp parts")
    Reported-by: syzbot+a70ac890b23b1bf29f5c@syzkaller.appspotmail.com
    Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/l2tp/l2tp_ppp.c | 7 +++++++
    1 file changed, 7 insertions(+)

    --- a/net/l2tp/l2tp_ppp.c
    +++ b/net/l2tp/l2tp_ppp.c
    @@ -608,6 +608,13 @@ static int pppol2tp_connect(struct socke
    lock_sock(sk);

    error = -EINVAL;
    +
    + if (sockaddr_len != sizeof(struct sockaddr_pppol2tp) &&
    + sockaddr_len != sizeof(struct sockaddr_pppol2tpv3) &&
    + sockaddr_len != sizeof(struct sockaddr_pppol2tpin6) &&
    + sockaddr_len != sizeof(struct sockaddr_pppol2tpv3in6))
    + goto end;
    +
    if (sp->sa_protocol != PX_PROTO_OL2TP)
    goto end;


    \
     
     \ /
      Last update: 2018-04-27 16:00    [W:3.226 / U:0.084 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site