diff options
| author | Sasha Levin <sasha.levin@oracle.com> | 2014-07-14 17:02:31 -0700 |
|---|---|---|
| committer | Stefan Bader <stefan.bader@canonical.com> | 2014-12-15 15:00:57 +0100 |
| commit | 487f6cb94d4122cf3510ee91784f68f8a6291bf7 (patch) | |
| tree | c9b1013bb3e87ffd488aa43bd76c1bc2df707d78 | |
| parent | 2befa65c144a58a384ba8aa354ce0172bb0ea2ae (diff) | |
| download | linux-2.6.32.y-drm33.z-487f6cb94d4122cf3510ee91784f68f8a6291bf7.tar.gz | |
net/l2tp: don't fall back on UDP [get|set]sockopt
(commit 3cf521f7dc87c031617fd47e4b7aa2593c2f3daf upstream)
The l2tp [get|set]sockopt() code has fallen back to the UDP functions
for socket option levels != SOL_PPPOL2TP since day one, but that has
never actually worked, since the l2tp socket isn't an inet socket.
As David Miller points out:
"If we wanted this to work, it'd have to look up the tunnel and then
use tunnel->sk, but I wonder how useful that would be"
Since this can never have worked so nobody could possibly have depended
on that functionality, just remove the broken code and return -EINVAL.
Reported-by: Sasha Levin <sasha.levin@oracle.com>
Acked-by: James Chapman <jchapman@katalix.com>
Acked-by: David Miller <davem@davemloft.net>
Cc: Phil Turnbull <phil.turnbull@oracle.com>
Cc: Vegard Nossum <vegard.nossum@oracle.com>
Cc: Willy Tarreau <w@1wt.eu>
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[geissert: adjust file paths and context for 2.6.32]
[wt: fixes CVE-2014-4943]
Signed-off-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
| -rw-r--r-- | drivers/net/pppol2tp.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/net/pppol2tp.c b/drivers/net/pppol2tp.c index 4cdc1cf9fb0fef..4c8f019e7b9afa 100644 --- a/drivers/net/pppol2tp.c +++ b/drivers/net/pppol2tp.c @@ -2190,7 +2190,7 @@ static int pppol2tp_setsockopt(struct socket *sock, int level, int optname, int err; if (level != SOL_PPPOL2TP) - return udp_prot.setsockopt(sk, level, optname, optval, optlen); + return -EINVAL; if (optlen < sizeof(int)) return -EINVAL; @@ -2314,7 +2314,7 @@ static int pppol2tp_getsockopt(struct socket *sock, int level, int err; if (level != SOL_PPPOL2TP) - return udp_prot.getsockopt(sk, level, optname, optval, optlen); + return -EINVAL; if (get_user(len, (int __user *) optlen)) return -EFAULT; |