Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit dfffc97d authored by Lorenzo Bianconi's avatar Lorenzo Bianconi Committed by David S. Miller
Browse files

l2tp: double-check l2specific_type provided by userspace 



Add sanity check on l2specific_type provided by userspace in
l2tp_nl_cmd_session_create() since just L2TP_L2SPECTYPE_DEFAULT and
L2TP_L2SPECTYPE_NONE are currently supported.
Moreover explicitly set l2specific_type to L2TP_L2SPECTYPE_DEFAULT
only if the userspace does not provide a value for it

Reviewed-by: default avatarGuillaume Nault <g.nault@alphalink.fr>
Tested-by: default avatarGuillaume Nault <g.nault@alphalink.fr>
Signed-off-by: default avatarLorenzo Bianconi <lorenzo.bianconi@redhat.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent e0e8a149

net/l2tp/l2tp_netlink.c

+9 −2
Original line number Diff line number Diff line
@@ -550,9 +550,16 @@ static int l2tp_nl_cmd_session_create(struct sk_buff *skb, struct genl_info *inf 
		if (info->attrs[L2TP_ATTR_DATA_SEQ])

			cfg.data_seq = nla_get_u8(info->attrs[L2TP_ATTR_DATA_SEQ]);



		cfg.l2specific_type = L2TP_L2SPECTYPE_DEFAULT;

		if (info->attrs[L2TP_ATTR_L2SPEC_TYPE])

		if (info->attrs[L2TP_ATTR_L2SPEC_TYPE]) {

			cfg.l2specific_type = nla_get_u8(info->attrs[L2TP_ATTR_L2SPEC_TYPE]);

			if (cfg.l2specific_type != L2TP_L2SPECTYPE_DEFAULT &&

			    cfg.l2specific_type != L2TP_L2SPECTYPE_NONE) {

				ret = -EINVAL;

				goto out_tunnel;

			}

		} else {

			cfg.l2specific_type = L2TP_L2SPECTYPE_DEFAULT;

		}



		cfg.l2specific_len = 4;

		if (info->attrs[L2TP_ATTR_L2SPEC_LEN])