Skip to content

Commit

Permalink
pppoe: check sockaddr length in pppoe_connect()
Browse files Browse the repository at this point in the history
We must validate sockaddr_len, otherwise userspace can pass fewer data
than we expect and we end up accessing invalid data.

Fixes: 224cf5a ("ppp: Move the PPP drivers")
Reported-by: syzbot+4f03bdf92fdf9ef5ddab@syzkaller.appspotmail.com
Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
  • Loading branch information
Guillaume Nault authored and davem330 committed Apr 24, 2018
1 parent eb1c28c commit a49e2f5
Showing 1 changed file with 4 additions and 0 deletions.
4 changes: 4 additions & 0 deletions drivers/net/ppp/pppoe.c
Original file line number Diff line number Diff line change
Expand Up @@ -620,6 +620,10 @@ static int pppoe_connect(struct socket *sock, struct sockaddr *uservaddr,
lock_sock(sk);

error = -EINVAL;

if (sockaddr_len != sizeof(struct sockaddr_pppox))
goto end;

if (sp->sa_protocol != PX_PROTO_OE)
goto end;

Expand Down

0 comments on commit a49e2f5

Please sign in to comment.