Commit 955e9876 authored by Gavrilov Ilia's avatar Gavrilov Ilia Committed by David S. Miller

l2tp: fix incorrect parameter validation in the pppol2tp_getsockopt() function

The 'len' variable can't be negative when assigned the result of
'min_t' because all 'min_t' parameters are cast to unsigned int,
and then the minimum one is chosen.

To fix the logic, check 'len' as read from 'optlen',
where the types of relevant variables are (signed) int.

Fixes: 3557baab ("[L2TP]: PPP over L2TP driver core")
Reviewed-by: default avatarTom Parkin <tparkin@katalix.com>
Signed-off-by: default avatarGavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 5c3be3e0
......@@ -1356,11 +1356,11 @@ static int pppol2tp_getsockopt(struct socket *sock, int level, int optname,
if (get_user(len, optlen))
return -EFAULT;
len = min_t(unsigned int, len, sizeof(int));
if (len < 0)
return -EINVAL;
len = min_t(unsigned int, len, sizeof(int));
err = -ENOTCONN;
if (!sk->sk_user_data)
goto end;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment