From mboxrd@z Thu Jan 1 00:00:00 1970 From: Tom Parkin Subject: [RFC 2/3] l2tp: prevent tunnel creation on netns mismatch Date: Fri, 4 Jan 2013 17:51:47 +0000 Message-ID: <1357321908-30619-3-git-send-email-tparkin@katalix.com> References: <1357321908-30619-1-git-send-email-tparkin@katalix.com> Cc: Tom Parkin To: netdev@vger.kernel.org Return-path: Received: from katalix.com ([82.103.140.233]:53774 "EHLO mail.katalix.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755113Ab3ADRwH (ORCPT ); Fri, 4 Jan 2013 12:52:07 -0500 In-Reply-To: <1357321908-30619-1-git-send-email-tparkin@katalix.com> Sender: netdev-owner@vger.kernel.org List-ID: l2tp_tunnel_create is passed a pointer to the network namespace for the tunnel, along with an optional file descriptor for the tunnel which may be passed in from userspace via. netlink. In the case where the file descriptor is defined, ensure that the namespace associated with that socket matches the namespace explicitly passed to l2tp_tunnel_create. Signed-off-by: Tom Parkin --- net/l2tp/l2tp_core.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c index 1a9f372..75b347b 100644 --- a/net/l2tp/l2tp_core.c +++ b/net/l2tp/l2tp_core.c @@ -1521,11 +1521,18 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32 if (err < 0) goto err; } else { - err = -EBADF; sock = sockfd_lookup(fd, &err); if (!sock) { - pr_err("tunl %hu: sockfd_lookup(fd=%d) returned %d\n", + pr_err("tunl %u: sockfd_lookup(fd=%d) returned %d\n", tunnel_id, fd, err); + err = -EBADF; + goto err; + } + + /* Reject namespace mismatches */ + if (!net_eq(sock_net(sock->sk), net)) { + pr_err("tunl %u: netns mismatch\n", tunnel_id); + err = -EINVAL; goto err; } } -- 1.7.9.5