diff options
| author | Eric Dumazet <edumazet@google.com> | 2017-02-10 01:15:52 +0100 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2017-02-10 21:57:34 +0100 |
| commit | 72fb96e7bdbbdd4421b0726992496531060f3636 (patch) | |
| tree | edd4c429c973566b233252d3d55343a2bea7c9e9 /net/l2tp/l2tp_ip6.c | |
| parent | xen-netfront: Delete rx_refill_timer in xennet_disconnect_backend() (diff) | |
| download | linux-72fb96e7bdbbdd4421b0726992496531060f3636.tar.xz linux-72fb96e7bdbbdd4421b0726992496531060f3636.zip | |
l2tp: do not use udp_ioctl()
udp_ioctl(), as its name suggests, is used by UDP protocols,
but is also used by L2TP :(
L2TP should use its own handler, because it really does not
look the same.
SIOCINQ for instance should not assume UDP checksum or headers.
Thanks to Andrey and syzkaller team for providing the report
and a nice reproducer.
While crashes only happen on recent kernels (after commit
7c13f97ffde6 ("udp: do fwd memory scheduling on dequeue")), this
probably needs to be backported to older kernels.
Fixes: 7c13f97ffde6 ("udp: do fwd memory scheduling on dequeue")
Fixes: 85584672012e ("udp: Fix udp_poll() and ioctl()")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Acked-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/l2tp/l2tp_ip6.c')
| -rw-r--r-- | net/l2tp/l2tp_ip6.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c index 331ccf5a7bad..f47c45250f86 100644 --- a/net/l2tp/l2tp_ip6.c +++ b/net/l2tp/l2tp_ip6.c @@ -722,7 +722,7 @@ static struct proto l2tp_ip6_prot = { .bind = l2tp_ip6_bind, .connect = l2tp_ip6_connect, .disconnect = l2tp_ip6_disconnect, - .ioctl = udp_ioctl, + .ioctl = l2tp_ioctl, .destroy = l2tp_ip6_destroy_sock, .setsockopt = ipv6_setsockopt, .getsockopt = ipv6_getsockopt, |