• Eric Dumazet's avatar
    l2tp: do not accept arbitrary sockets · bdb1a295
    Eric Dumazet authored
    
    [ Upstream commit 17cfe79a ]
    
    syzkaller found an issue caused by lack of sufficient checks
    in l2tp_tunnel_create()
    
    RAW sockets can not be considered as UDP ones for instance.
    
    In another patch, we shall replace all pr_err() by less intrusive
    pr_debug() so that syzkaller can find other bugs faster.
    Acked-by: default avatarGuillaume Nault <g.nault@alphalink.fr>
    Acked-by: default avatarJames Chapman <jchapman@katalix.com>
    
    ==================================================================
    BUG: KASAN: slab-out-of-bounds in setup_udp_tunnel_sock+0x3ee/0x5f0 net/ipv4/udp_tunnel.c:69
    dst_release: dst:00000000d53d0d0f refcnt:-1
    Write of size 1 at addr ffff8801d013b798 by task syz-executor3/6242
    
    CPU: 1 PID: 6242 Comm: syz-executor3 Not tainted 4.16.0-rc2+ #253
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
    Call Trace:
     __dump_stack lib/dump_stack.c:17 [inline]
     dump_stack+0x194/0x24d lib/dump_stack.c:53
     print_address_description+0x73/0x250 mm/kasan/report.c:256
     kasan_report_error mm/kasan/report.c:354 [inline]
     kasan_report+0x23b/0x360 mm/kasan/report.c:412
     __asan_report_store1_noabort+0x17/0x20 mm/kasan/report.c:435
     setup_udp_tunnel_sock+0x3ee/0x5f0 net/ipv4/udp_tunnel.c:69
     l2tp_tunnel_create+0x1354/0x17f0 net/l2tp/l2tp_core.c:1596
     pppol2tp_connect+0x14b1/0x1dd0 net/l2tp/l2tp_ppp.c:707
     SYSC_connect+0x213/0x4a0 net/socket.c:1640
     SyS_connect+0x24/0x30 net/socket.c:1621
     do_syscall_64+0x280/0x940 arch/x86/entry/common.c:287
     entry_SYSCALL_64_after_hwframe+0x42/0xb7
    
    Fixes: fd558d18 ("l2tp: Split pppol2tp patch into separate l2tp and ppp parts")
    Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
    Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    bdb1a295
l2tp_core.c 51.3 KB