diff options
| author | Sasha Levin <sasha.levin@oracle.com> | 2014-07-14 17:02:31 -0700 |
|---|---|---|
| committer | Willy Tarreau <w@1wt.eu> | 2014-12-13 15:16:12 +0100 |
| commit | eb406993c7b80c68b053c5d3d6431f4b8d0560eb (patch) | |
| tree | de2f2a2785b941cc2b7a0a940f7b3b30dfed9e34 | |
| parent | 1f4495612dce156f9ca8a33d8b9de134f9329be2 (diff) | |
| download | lwn-eb406993c7b80c68b053c5d3d6431f4b8d0560eb.tar.gz lwn-eb406993c7b80c68b053c5d3d6431f4b8d0560eb.zip | |
net/l2tp: don't fall back on UDP [get|set]sockopt
(commit 3cf521f7dc87c031617fd47e4b7aa2593c2f3daf upstream)
The l2tp [get|set]sockopt() code has fallen back to the UDP functions
for socket option levels != SOL_PPPOL2TP since day one, but that has
never actually worked, since the l2tp socket isn't an inet socket.
As David Miller points out:
"If we wanted this to work, it'd have to look up the tunnel and then
use tunnel->sk, but I wonder how useful that would be"
Since this can never have worked so nobody could possibly have depended
on that functionality, just remove the broken code and return -EINVAL.
Reported-by: Sasha Levin <sasha.levin@oracle.com>
Acked-by: James Chapman <jchapman@katalix.com>
Acked-by: David Miller <davem@davemloft.net>
Cc: Phil Turnbull <phil.turnbull@oracle.com>
Cc: Vegard Nossum <vegard.nossum@oracle.com>
Cc: Willy Tarreau <w@1wt.eu>
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[geissert: adjust file paths and context for 2.6.32]
[wt: fixes CVE-2014-4943]
Signed-off-by: Willy Tarreau <w@1wt.eu>
| -rw-r--r-- | drivers/net/pppol2tp.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/net/pppol2tp.c b/drivers/net/pppol2tp.c index 4cdc1cf9fb0f..4c8f019e7b9a 100644 --- a/drivers/net/pppol2tp.c +++ b/drivers/net/pppol2tp.c @@ -2190,7 +2190,7 @@ static int pppol2tp_setsockopt(struct socket *sock, int level, int optname, int err; if (level != SOL_PPPOL2TP) - return udp_prot.setsockopt(sk, level, optname, optval, optlen); + return -EINVAL; if (optlen < sizeof(int)) return -EINVAL; @@ -2314,7 +2314,7 @@ static int pppol2tp_getsockopt(struct socket *sock, int level, int err; if (level != SOL_PPPOL2TP) - return udp_prot.getsockopt(sk, level, optname, optval, optlen); + return -EINVAL; if (get_user(len, (int __user *) optlen)) return -EFAULT; |