James Chapman ea1ae37f4a l2tp: fix oops in L2TP IP sockets for connect() AF_UNSPEC case ... [ Upstream commit c51ce49735 ] An application may call connect() to disconnect a socket using an address with family AF_UNSPEC. The L2TP IP sockets were not handling this case when the socket is not bound and an attempt to connect() using AF_UNSPEC in such cases would result in an oops. This patch addresses the problem by protecting the sk_prot->disconnect() call against trying to unhash the socket before it is bound. The patch also adds more checks that the sockaddr supplied to bind() and connect() calls is valid. RIP: 0010:[<ffffffff82e133b0>] [<ffffffff82e133b0>] inet_unhash+0x50/0xd0 RSP: 0018:ffff88001989be28 EFLAGS: 00010293 Stack: ffff8800407a8000 0000000000000000 ffff88001989be78 ffffffff82e3a249 ffffffff82e3a050 ffff88001989bec8 ffff88001989be88 ffff8800407a8000 0000000000000010 ffff88001989bec8 ffff88001989bea8 ffffffff82e42639 Call Trace: [<ffffffff82e3a249>] udp_disconnect+0x1f9/0x290 [<ffffffff82e42639>] inet_dgram_connect+0x29/0x80 [<ffffffff82d012fc>] sys_connect+0x9c/0x100 Reported-by: Sasha Levin <levinsasha928@gmail.com> Signed-off-by: James Chapman <jchapman@katalix.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2012-06-10 00:36:15 +09:00
..
Kconfig
l2tp_core.c	l2tp: ensure sk->dst is still valid	2011-11-26 15:57:36 -05:00
l2tp_core.h
l2tp_debugfs.c	fix return values of l2tp_dfs_seq_open()	2011-06-05 14:11:09 -07:00
l2tp_eth.c	net: replace random_ether_addr() with eth_hw_addr_random()	2012-02-15 15:34:16 -05:00
l2tp_ip.c	l2tp: fix oops in L2TP IP sockets for connect() AF_UNSPEC case	2012-06-10 00:36:15 +09:00
l2tp_netlink.c	l2tp: Fix set-but-unused variables.	2011-04-17 17:01:05 -07:00
l2tp_ppp.c	l2tp: enable automatic module loading for l2tp_ppp	2012-03-21 22:14:56 -04:00
Makefile