summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorTom Parkin <tparkin@katalix.com>2013-01-31 23:43:02 +0000
committerDavid S. Miller <davem@davemloft.net>2013-02-05 14:20:30 -0500
commitcbb95e0ca92869cc94a1c5e5ac58395afbbda26e (patch)
tree7e129315b5df29e6bbb9bc590c61f9f5b5e510b8
parentb6fdfdfab0c57d4a62359277c09258bc2f5a1550 (diff)
downloadlinux-cbb95e0ca92869cc94a1c5e5ac58395afbbda26e.tar.gz
linux-cbb95e0ca92869cc94a1c5e5ac58395afbbda26e.tar.bz2
linux-cbb95e0ca92869cc94a1c5e5ac58395afbbda26e.zip
l2tp: prevent tunnel creation on netns mismatch
l2tp_tunnel_create is passed a pointer to the network namespace for the tunnel, along with an optional file descriptor for the tunnel which may be passed in from userspace via. netlink. In the case where the file descriptor is defined, ensure that the namespace associated with that socket matches the namespace explicitly passed to l2tp_tunnel_create. Signed-off-by: Tom Parkin <tparkin@katalix.com> Signed-off-by: James Chapman <jchapman@katalix.com> Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r--net/l2tp/l2tp_core.c11
1 files changed, 9 insertions, 2 deletions
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index 73988c070561..60a498a459dd 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -1593,11 +1593,18 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32
if (err < 0)
goto err;
} else {
- err = -EBADF;
sock = sockfd_lookup(fd, &err);
if (!sock) {
- pr_err("tunl %hu: sockfd_lookup(fd=%d) returned %d\n",
+ pr_err("tunl %u: sockfd_lookup(fd=%d) returned %d\n",
tunnel_id, fd, err);
+ err = -EBADF;
+ goto err;
+ }
+
+ /* Reject namespace mismatches */
+ if (!net_eq(sock_net(sock->sk), net)) {
+ pr_err("tunl %u: netns mismatch\n", tunnel_id);
+ err = -EINVAL;
goto err;
}
}