* [PATCH net] l2tp: check sockaddr length in pppol2tp_connect()
@ 2018-04-23 14:15 Guillaume Nault
2018-04-24 1:11 ` David Miller
0 siblings, 1 reply; 3+ messages in thread
From: Guillaume Nault @ 2018-04-23 14:15 UTC (permalink / raw)
To: netdev; +Cc: James Chapman
Check sockaddr_len before dereferencing sp->sa_protocol, to ensure that
it actually points to valid data.
Fixes: fd558d186df2 ("l2tp: Split pppol2tp patch into separate l2tp and ppp parts")
Reported-by: syzbot+a70ac890b23b1bf29f5c@syzkaller.appspotmail.com
Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
---
net/l2tp/l2tp_ppp.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index 1404bc1c1bb7..1fd9e145076a 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -619,6 +619,13 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
lock_sock(sk);
error = -EINVAL;
+
+ if (sockaddr_len != sizeof(struct sockaddr_pppol2tp) &&
+ sockaddr_len != sizeof(struct sockaddr_pppol2tpv3) &&
+ sockaddr_len != sizeof(struct sockaddr_pppol2tpin6) &&
+ sockaddr_len != sizeof(struct sockaddr_pppol2tpv3in6))
+ goto end;
+
if (sp->sa_protocol != PX_PROTO_OL2TP)
goto end;
--
2.17.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH net] l2tp: check sockaddr length in pppol2tp_connect()
2018-04-23 14:15 [PATCH net] l2tp: check sockaddr length in pppol2tp_connect() Guillaume Nault
@ 2018-04-24 1:11 ` David Miller
2018-04-24 8:23 ` Guillaume Nault
0 siblings, 1 reply; 3+ messages in thread
From: David Miller @ 2018-04-24 1:11 UTC (permalink / raw)
To: g.nault; +Cc: netdev, jchapman
From: Guillaume Nault <g.nault@alphalink.fr>
Date: Mon, 23 Apr 2018 16:15:14 +0200
> Check sockaddr_len before dereferencing sp->sa_protocol, to ensure that
> it actually points to valid data.
>
> Fixes: fd558d186df2 ("l2tp: Split pppol2tp patch into separate l2tp and ppp parts")
> Reported-by: syzbot+a70ac890b23b1bf29f5c@syzkaller.appspotmail.com
> Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
Applied and queued up for -stable.
I guess you can completely remove the "bad socket address" -EINVAL else
clause later in the function as a cleanup in net-next.
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH net] l2tp: check sockaddr length in pppol2tp_connect()
2018-04-24 1:11 ` David Miller
@ 2018-04-24 8:23 ` Guillaume Nault
0 siblings, 0 replies; 3+ messages in thread
From: Guillaume Nault @ 2018-04-24 8:23 UTC (permalink / raw)
To: David Miller; +Cc: netdev, jchapman
On Mon, Apr 23, 2018 at 09:11:22PM -0400, David Miller wrote:
> From: Guillaume Nault <g.nault@alphalink.fr>
> Date: Mon, 23 Apr 2018 16:15:14 +0200
>
> > Check sockaddr_len before dereferencing sp->sa_protocol, to ensure that
> > it actually points to valid data.
> >
> > Fixes: fd558d186df2 ("l2tp: Split pppol2tp patch into separate l2tp and ppp parts")
> > Reported-by: syzbot+a70ac890b23b1bf29f5c@syzkaller.appspotmail.com
> > Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
>
> Applied and queued up for -stable.
>
> I guess you can completely remove the "bad socket address" -EINVAL else
> clause later in the function as a cleanup in net-next.
>
Yes, will do. Thanks.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2018-04-24 8:23 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-04-23 14:15 [PATCH net] l2tp: check sockaddr length in pppol2tp_connect() Guillaume Nault
2018-04-24 1:11 ` David Miller
2018-04-24 8:23 ` Guillaume Nault
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.