From: Cong Wang Date: Thu, 22 Aug 2024 18:25:44 +0000 (-0700) Subject: l2tp: avoid overriding sk->sk_user_data X-Git-Tag: v6.12-rc1~232^2~182 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=1461f5a3d810869e182f1d11caaac7dee0458ff7;p=thirdparty%2Flinux.git l2tp: avoid overriding sk->sk_user_data Although commit 4a4cd70369f1 ("l2tp: don't set sk_user_data in tunnel socket") removed sk->sk_user_data usage, setup_udp_tunnel_sock() still touches sk->sk_user_data, this conflicts with sockmap which also leverages sk->sk_user_data to save psock. Restore this sk->sk_user_data check to avoid such conflicts. Fixes: 4a4cd70369f1 ("l2tp: don't set sk_user_data in tunnel socket") Reported-by: syzbot+8dbe3133b840c470da0e@syzkaller.appspotmail.com Cc: Tom Parkin Signed-off-by: Cong Wang Tested-by: James Chapman Reviewed-by: James Chapman Link: https://patch.msgid.link/20240822182544.378169-1-xiyou.wangcong@gmail.com Signed-off-by: Jakub Kicinski --- diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c index af87c781d6a66..df73c35363cbf 100644 --- a/net/l2tp/l2tp_core.c +++ b/net/l2tp/l2tp_core.c @@ -1620,6 +1620,9 @@ static int l2tp_validate_socket(const struct sock *sk, const struct net *net, (encap == L2TP_ENCAPTYPE_IP && sk->sk_protocol != IPPROTO_L2TP)) return -EPROTONOSUPPORT; + if (encap == L2TP_ENCAPTYPE_UDP && sk->sk_user_data) + return -EBUSY; + tunnel = l2tp_sk_to_tunnel(sk); if (tunnel) { l2tp_tunnel_put(tunnel);