net/l2tp: don't fall back on UDP [get|set]sockopt (CVE-2014-4943)

svn path=/dists/sid/linux/; revision=21562

debian/changelog

@@ -18,6 +18,7 @@ linux (3.14.12-2) UNRELEASED; urgency=medium
 
   [ Ben Hutchings ]
   * writeback: Fix ABI change in 3.14.10 (Closes: #754902)
+  * net/l2tp: don't fall back on UDP [get|set]sockopt (CVE-2014-4943)
 
  -- Ian Campbell <ijc@hellion.org.uk>  Sat, 12 Jul 2014 21:12:17 +0100
 

debian/patches/bugfix/all/net-l2tp-don-t-fall-back-on-UDP-get-set-sockopt.patch

@@ -0,0 +1,49 @@
+From: Sasha Levin <sasha.levin@oracle.com>
+Date: Mon, 14 Jul 2014 17:02:31 -0700
+Subject: net/l2tp: don't fall back on UDP [get|set]sockopt
+Origin: https://git.kernel.org/linus/3cf521f7dc87c031617fd47e4b7aa2593c2f3daf
+
+The l2tp [get|set]sockopt() code has fallen back to the UDP functions
+for socket option levels != SOL_PPPOL2TP since day one, but that has
+never actually worked, since the l2tp socket isn't an inet socket.
+
+As David Miller points out:
+
+  "If we wanted this to work, it'd have to look up the tunnel and then
+   use tunnel->sk, but I wonder how useful that would be"
+
+Since this can never have worked so nobody could possibly have depended
+on that functionality, just remove the broken code and return -EINVAL.
+
+Reported-by: Sasha Levin <sasha.levin@oracle.com>
+Acked-by: James Chapman <jchapman@katalix.com>
+Acked-by: David Miller <davem@davemloft.net>
+Cc: Phil Turnbull <phil.turnbull@oracle.com>
+Cc: Vegard Nossum <vegard.nossum@oracle.com>
+Cc: Willy Tarreau <w@1wt.eu>
+Cc: stable@vger.kernel.org
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+---
+ net/l2tp/l2tp_ppp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/l2tp/l2tp_ppp.c
++++ b/net/l2tp/l2tp_ppp.c
+@@ -1368,7 +1368,7 @@ static int pppol2tp_setsockopt(struct so
+ 	int err;
+ 
+ 	if (level != SOL_PPPOL2TP)
+-		return udp_prot.setsockopt(sk, level, optname, optval, optlen);
++		return -EINVAL;
+ 
+ 	if (optlen < sizeof(int))
+ 		return -EINVAL;
+@@ -1494,7 +1494,7 @@ static int pppol2tp_getsockopt(struct so
+ 	struct pppol2tp_session *ps;
+ 
+ 	if (level != SOL_PPPOL2TP)
+-		return udp_prot.getsockopt(sk, level, optname, optval, optlen);
++		return -EINVAL;
+ 
+ 	if (get_user(len, optlen))
+ 		return -EFAULT;

debian/patches/series

@@ -97,3 +97,4 @@ debian/ptrace-avoid-abi-change-in-3.14.10.patch
 debian/trace-syscall-avoid-abi-change-in-3.14.11.patch
 debian/blkcg-avoid-abi-change-in-3.14.12.patch
 debian/writeback-fix-abi-change-in-3.14.10.patch
+bugfix/all/net-l2tp-don-t-fall-back-on-UDP-get-set-sockopt.patch