From: Guillaume Nault Date: Fri, 15 Jun 2018 13:39:19 +0000 (+0200) Subject: l2tp: filter out non-PPP sessions in pppol2tp_tunnel_ioctl() X-Git-Tag: v5.15~8586^2~4^2 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=ecd012e45ab5fd76ed57546865897ce35920f56b;p=platform%2Fkernel%2Flinux-starfive.git l2tp: filter out non-PPP sessions in pppol2tp_tunnel_ioctl() pppol2tp_tunnel_ioctl() can act on an L2TPv3 tunnel, in which case 'session' may be an Ethernet pseudo-wire. However, pppol2tp_session_ioctl() expects a PPP pseudo-wire, as it assumes l2tp_session_priv() points to a pppol2tp_session structure. For an Ethernet pseudo-wire l2tp_session_priv() points to an l2tp_eth_sess structure instead, making pppol2tp_session_ioctl() access invalid memory. Fixes: d9e31d17ceba ("l2tp: Add L2TP ethernet pseudowire support") Signed-off-by: Guillaume Nault Signed-off-by: David S. Miller --- diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c index f429fed..5518838 100644 --- a/net/l2tp/l2tp_ppp.c +++ b/net/l2tp/l2tp_ppp.c @@ -1201,7 +1201,7 @@ static int pppol2tp_tunnel_ioctl(struct l2tp_tunnel *tunnel, l2tp_session_get(sock_net(sk), tunnel, stats.session_id); - if (session) { + if (session && session->pwtype == L2TP_PWTYPE_PPP) { err = pppol2tp_session_ioctl(session, cmd, arg); l2tp_session_dec_refcount(session);