[Utopic/goldfish, manta, mako, flo][CVE-2014-4943] net/l2tp: don't fall back on UDP [get|set]sockopt
Luis Henriques
luis.henriques at canonical.com
Tue Sep 2 16:30:25 UTC 2014
From: Sasha Levin <sasha.levin at oracle.com>
The l2tp [get|set]sockopt() code has fallen back to the UDP functions
for socket option levels != SOL_PPPOL2TP since day one, but that has
never actually worked, since the l2tp socket isn't an inet socket.
As David Miller points out:
"If we wanted this to work, it'd have to look up the tunnel and then
use tunnel->sk, but I wonder how useful that would be"
Since this can never have worked so nobody could possibly have depended
on that functionality, just remove the broken code and return -EINVAL.
Reported-by: Sasha Levin <sasha.levin at oracle.com>
Acked-by: James Chapman <jchapman at katalix.com>
Acked-by: David Miller <davem at davemloft.net>
Cc: Phil Turnbull <phil.turnbull at oracle.com>
Cc: Vegard Nossum <vegard.nossum at oracle.com>
Cc: Willy Tarreau <w at 1wt.eu>
Cc: stable at vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
(cherry picked from commit 3cf521f7dc87c031617fd47e4b7aa2593c2f3daf)
CVE-2014-4943
BugLink: http://bugs.launchpad.net/bugs/1341472
Signed-off-by: Luis Henriques <luis.henriques at canonical.com>
---
net/l2tp/l2tp_ppp.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index 1addd9f3f40a..efb0138948b1 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -1348,7 +1348,7 @@ static int pppol2tp_setsockopt(struct socket *sock, int level, int optname,
int err;
if (level != SOL_PPPOL2TP)
- return udp_prot.setsockopt(sk, level, optname, optval, optlen);
+ return -EINVAL;
if (optlen < sizeof(int))
return -EINVAL;
@@ -1474,7 +1474,7 @@ static int pppol2tp_getsockopt(struct socket *sock, int level,
struct pppol2tp_session *ps;
if (level != SOL_PPPOL2TP)
- return udp_prot.getsockopt(sk, level, optname, optval, optlen);
+ return -EINVAL;
if (get_user(len, (int __user *) optlen))
return -EFAULT;
--
1.9.1
More information about the kernel-team
mailing list