l2tp: avoid use-after-free caused by l2tp_ip_backlog_recv

p-hueber · davem330 · commit 51fb60eb162a · 2017-02-26T22:57:17.000-05:00
l2tp_ip_backlog_recv may not return -1 if the packet gets dropped.
The return value is passed up to ip_local_deliver_finish, which treats
negative values as an IP protocol number for resubmission.

Signed-off-by: Paul Hüber &lt;phueber@kernsp.in&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
@@ -388,7 +388,7 @@ static int l2tp_ip_backlog_recv(struct sock *sk, struct sk_buff *skb)
 drop:
 	IP_INC_STATS(sock_net(sk), IPSTATS_MIB_INDISCARDS);
 	kfree_skb(skb);
-	return -1;
+	return 0;
 }
 
 /* Userspace will call sendmsg() on the tunnel socket to send L2TP

Original file line number	Diff line number	Diff line change
`@@ -388,7 +388,7 @@ static int l2tp_ip_backlog_recv(struct sock sk, struct sk_buff skb)`
`388`	`388`	`drop:`
`389`	`389`	`IP_INC_STATS(sock_net(sk), IPSTATS_MIB_INDISCARDS);`
`390`	`390`	`kfree_skb(skb);`
`391`		`- return -1;`
	`391`	`+ return 0;`
`392`	`392`	`}`
`393`	`393`
`394`	`394`	`/* Userspace will call sendmsg() on the tunnel socket to send L2TP`