linux/net/l2tp
Guillaume Nault de9bada5d3 l2tp: reject creation of non-PPP sessions on L2TPv2 tunnels
The /proc/net/pppol2tp handlers (pppol2tp_seq_*()) iterate over all
L2TPv2 tunnels, and rightfully expect that only PPP sessions can be
found there. However, l2tp_netlink accepts creating Ethernet sessions
regardless of the underlying tunnel version.

This confuses pppol2tp_seq_session_show(), which expects that
l2tp_session_priv() returns a pppol2tp_session structure. When the
session is an Ethernet pseudo-wire, a struct l2tp_eth_sess is returned
instead. This leads to invalid memory access when
pppol2tp_session_get_sock() later tries to dereference ps->sk.

Fixes: d9e31d17ce ("l2tp: Add L2TP ethernet pseudowire support")
Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-06-15 09:12:37 -07:00
..
Kconfig l2tp: Call udp_sock_create 2014-07-14 16:12:15 -07:00
l2tp_core.c l2tp: hold reference on tunnels printed in l2tp/tunnels debugfs file 2018-04-13 12:17:26 -04:00
l2tp_core.h l2tp: hold reference on tunnels printed in l2tp/tunnels debugfs file 2018-04-13 12:17:26 -04:00
l2tp_debugfs.c l2tp: consistent reference counting in procfs and debufs 2018-04-27 11:06:35 -04:00
l2tp_eth.c l2tp: remove .tunnel_sock from struct l2tp_eth 2017-11-11 22:08:23 +09:00
l2tp_ip6.c net: convert datagram_poll users tp ->poll_mask 2018-05-26 09:16:44 +02:00
l2tp_ip.c net: convert datagram_poll users tp ->poll_mask 2018-05-26 09:16:44 +02:00
l2tp_netlink.c l2tp: reject creation of non-PPP sessions on L2TPv2 tunnels 2018-06-15 09:12:37 -07:00
l2tp_ppp.c l2tp: clean up stale tunnel or session in pppol2tp_connect's error path 2018-06-14 17:10:19 -07:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00