From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1759973AbcCDQRQ (ORCPT ); Fri, 4 Mar 2016 11:17:16 -0500 Received: from wtarreau.pck.nerim.net ([62.212.114.60]:60549 "EHLO 1wt.eu" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1758743AbcCDQCZ (ORCPT ); Fri, 4 Mar 2016 11:02:25 -0500 Message-Id: <20160304153001.238015913@1wt.eu> User-Agent: quilt/0.63-1 Date: Fri, 04 Mar 2016 16:30:12 +0100 From: Willy Tarreau To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Ben Hutchings , Willy Tarreau Subject: [PATCH 2.6.32 12/55] l2tp: fix another panic in pppol2tp MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-15 In-Reply-To: <148ee355b419e9976ca727513a1405c8@local> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 2.6.32-longterm review patch. If anyone has any objections, please let me know. ------------------ From: Willy Tarreau Commit 3feec9095d1 ("l2tp: Fix oops in pppol2tp_xmit") was backported into 2.6.32.16 to fix a possible null deref in pppol2tp. But the same still exists in pppol2tp_sendmsg() possibly causing the same crash. Note that this bug doesn't appear to have any other impact than crashing the system, as the dereferenced pointer is only used to test a value against a 3-bit mask, so it can hardly be abused for anything except leaking one third of a bit of memory. This issue doesn't exist upstream because the code was replaced in 2.6.35 and the new function l2tp_xmit_skb() performs the appropriate check. Reported-by: Ben Hutchings Signed-off-by: Willy Tarreau --- drivers/net/pppol2tp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/pppol2tp.c b/drivers/net/pppol2tp.c index 4c8f019..2295c13 100644 --- a/drivers/net/pppol2tp.c +++ b/drivers/net/pppol2tp.c @@ -975,7 +975,8 @@ static int pppol2tp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msgh /* Calculate UDP checksum if configured to do so */ if (sk_tun->sk_no_check == UDP_CSUM_NOXMIT) skb->ip_summed = CHECKSUM_NONE; - else if (!(skb_dst(skb)->dev->features & NETIF_F_V4_CSUM)) { + else if ((skb_dst(skb) && skb_dst(skb)->dev) && + (!(skb_dst(skb)->dev->features & NETIF_F_V4_CSUM))) { skb->ip_summed = CHECKSUM_COMPLETE; csum = skb_checksum(skb, 0, udp_len, 0); uh->check = csum_tcpudp_magic(inet->saddr, inet->daddr, -- 1.7.12.2.21.g234cd45.dirty