nagai/kernel
3
0
Fork 0
forked from mirrors/linux
Code Pull requests Activity

l2tp: filter out non-PPP sessions in pppol2tp_tunnel_ioctl()

Browse source 
pppol2tp_tunnel_ioctl() can act on an L2TPv3 tunnel, in which case
'session' may be an Ethernet pseudo-wire.

However, pppol2tp_session_ioctl() expects a PPP pseudo-wire, as it
assumes l2tp_session_priv() points to a pppol2tp_session structure. For
an Ethernet pseudo-wire l2tp_session_priv() points to an l2tp_eth_sess
structure instead, making pppol2tp_session_ioctl() access invalid
memory.

Fixes: d9e31d17ce ("l2tp: Add L2TP ethernet pseudowire support")
Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Guillaume Nault 2018-06-15 15:39:19 +02:00 committed by David S. Miller
parent de9bada5d3
commit ecd012e45a
1 changed files with 1 additions and 1 deletions
repo.diff.show_diff_stats Download patch file Download diff file Expand all files Collapse all files

2
net/l2tp/l2tp_ppp.c
View file

@ -1201,7 +1201,7 @@ static int pppol2tp_tunnel_ioctl(struct l2tp_tunnel *tunnel,
l2tp_session_get(sock_net(sk), tunnel, l2tp_session_get(sock_net(sk), tunnel,
stats.session_id); stats.session_id);
if (session) { if (session && session->pwtype == L2TP_PWTYPE_PPP) {
err = pppol2tp_session_ioctl(session, cmd, err = pppol2tp_session_ioctl(session, cmd,
arg); arg);
l2tp_session_dec_refcount(session); l2tp_session_dec_refcount(session);