diff options
| author | Guillaume Nault <g.nault@alphalink.fr> | 2018-06-15 16:39:19 +0300 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2018-11-20 21:05:15 +0300 |
| commit | b8d31d678a74ca67821ca31614b9da5d9093698b (patch) | |
| tree | 186a64bc4b5a55984e627ef68c1386430d6272b5 /net/l2tp | |
| parent | e38a388dfe52be6972b10793516824bd32734e96 (diff) | |
| download | linux-b8d31d678a74ca67821ca31614b9da5d9093698b.tar.xz | |
l2tp: filter out non-PPP sessions in pppol2tp_tunnel_ioctl()
commit ecd012e45ab5fd76ed57546865897ce35920f56b upstream.
pppol2tp_tunnel_ioctl() can act on an L2TPv3 tunnel, in which case
'session' may be an Ethernet pseudo-wire.
However, pppol2tp_session_ioctl() expects a PPP pseudo-wire, as it
assumes l2tp_session_priv() points to a pppol2tp_session structure. For
an Ethernet pseudo-wire l2tp_session_priv() points to an l2tp_eth_sess
structure instead, making pppol2tp_session_ioctl() access invalid
memory.
Fixes: d9e31d17ceba ("l2tp: Add L2TP ethernet pseudowire support")
Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Diffstat (limited to 'net/l2tp')
| -rw-r--r-- | net/l2tp/l2tp_ppp.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c index 50384d7ff2f2..ae8f0149afc2 100644 --- a/net/l2tp/l2tp_ppp.c +++ b/net/l2tp/l2tp_ppp.c @@ -1231,7 +1231,7 @@ static int pppol2tp_tunnel_ioctl(struct l2tp_tunnel *tunnel, l2tp_session_get(sock_net(sk), tunnel, stats.session_id, true); - if (session) { + if (session && session->pwtype == L2TP_PWTYPE_PPP) { err = pppol2tp_session_ioctl(session, cmd, arg); if (session->deref) |