Commit cbb95e0c authored by Tom Parkin's avatar Tom Parkin Committed by David S. Miller
Browse files

l2tp: prevent tunnel creation on netns mismatch

l2tp_tunnel_create is passed a pointer to the network namespace for the
tunnel, along with an optional file descriptor for the tunnel which may
be passed in from userspace via. netlink.

In the case where the file descriptor is defined, ensure that the namespace
associated with that socket matches the namespace explicitly passed to
Signed-off-by: default avatarTom Parkin <>
Signed-off-by: default avatarJames Chapman <>
Signed-off-by: default avatarDavid S. Miller <>
parent b6fdfdfa
......@@ -1593,11 +1593,18 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32
if (err < 0)
goto err;
} else {
err = -EBADF;
sock = sockfd_lookup(fd, &err);
if (!sock) {
pr_err("tunl %hu: sockfd_lookup(fd=%d) returned %d\n",
pr_err("tunl %u: sockfd_lookup(fd=%d) returned %d\n",
tunnel_id, fd, err);
err = -EBADF;
goto err;
/* Reject namespace mismatches */
if (!net_eq(sock_net(sock->sk), net)) {
pr_err("tunl %u: netns mismatch\n", tunnel_id);
err = -EINVAL;
goto err;
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment