Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e9c46600 authored by Guillaume Nault's avatar Guillaume Nault Committed by Greg Kroah-Hartman
Browse files

l2tp: check sockaddr length in pppol2tp_connect() 



[ Upstream commit eb1c28c05894a4b1f6b56c5bf072205e64cfa280 ]

Check sockaddr_len before dereferencing sp->sa_protocol, to ensure that
it actually points to valid data.

Fixes: fd558d18 ("l2tp: Split pppol2tp patch into separate l2tp and ppp parts")
Reported-by: default avatar <syzbot+a70ac890b23b1bf29f5c@syzkaller.appspotmail.com>
Signed-off-by: default avatarGuillaume Nault <g.nault@alphalink.fr>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 06a02a81

net/l2tp/l2tp_ppp.c

+7 −0
Original line number Diff line number Diff line
@@ -590,6 +590,13 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr, 
	lock_sock(sk);



	error = -EINVAL;



	if (sockaddr_len != sizeof(struct sockaddr_pppol2tp) &&

	    sockaddr_len != sizeof(struct sockaddr_pppol2tpv3) &&

	    sockaddr_len != sizeof(struct sockaddr_pppol2tpin6) &&

	    sockaddr_len != sizeof(struct sockaddr_pppol2tpv3in6))

		goto end;



	if (sp->sa_protocol != PX_PROTO_OL2TP)

		goto end;