| Message ID | e76f65e9826fe7591dc8bba561461c993e5643e0.1524492877.git.g.nault@alphalink.fr |
|---|---|
| State | Accepted, archived |
| Delegated to: | David Miller |
| Headers | show |
| Series | [net] l2tp: check sockaddr length in pppol2tp_connect() | expand |
From: Guillaume Nault <g.nault@alphalink.fr> Date: Mon, 23 Apr 2018 16:15:14 +0200 > Check sockaddr_len before dereferencing sp->sa_protocol, to ensure that > it actually points to valid data. > > Fixes: fd558d186df2 ("l2tp: Split pppol2tp patch into separate l2tp and ppp parts") > Reported-by: syzbot+a70ac890b23b1bf29f5c@syzkaller.appspotmail.com > Signed-off-by: Guillaume Nault <g.nault@alphalink.fr> Applied and queued up for -stable. I guess you can completely remove the "bad socket address" -EINVAL else clause later in the function as a cleanup in net-next.
On Mon, Apr 23, 2018 at 09:11:22PM -0400, David Miller wrote: > From: Guillaume Nault <g.nault@alphalink.fr> > Date: Mon, 23 Apr 2018 16:15:14 +0200 > > > Check sockaddr_len before dereferencing sp->sa_protocol, to ensure that > > it actually points to valid data. > > > > Fixes: fd558d186df2 ("l2tp: Split pppol2tp patch into separate l2tp and ppp parts") > > Reported-by: syzbot+a70ac890b23b1bf29f5c@syzkaller.appspotmail.com > > Signed-off-by: Guillaume Nault <g.nault@alphalink.fr> > > Applied and queued up for -stable. > > I guess you can completely remove the "bad socket address" -EINVAL else > clause later in the function as a cleanup in net-next. > Yes, will do. Thanks.
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c index 1404bc1c1bb7..1fd9e145076a 100644 --- a/net/l2tp/l2tp_ppp.c +++ b/net/l2tp/l2tp_ppp.c @@ -619,6 +619,13 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr, lock_sock(sk); error = -EINVAL; + + if (sockaddr_len != sizeof(struct sockaddr_pppol2tp) && + sockaddr_len != sizeof(struct sockaddr_pppol2tpv3) && + sockaddr_len != sizeof(struct sockaddr_pppol2tpin6) && + sockaddr_len != sizeof(struct sockaddr_pppol2tpv3in6)) + goto end; + if (sp->sa_protocol != PX_PROTO_OL2TP) goto end;
Check sockaddr_len before dereferencing sp->sa_protocol, to ensure that it actually points to valid data. Fixes: fd558d186df2 ("l2tp: Split pppol2tp patch into separate l2tp and ppp parts") Reported-by: syzbot+a70ac890b23b1bf29f5c@syzkaller.appspotmail.com Signed-off-by: Guillaume Nault <g.nault@alphalink.fr> --- net/l2tp/l2tp_ppp.c | 7 +++++++ 1 file changed, 7 insertions(+)