Code: static int pptp_bind(struct socket *sock, struct sockaddr *uservaddr,
	int sockaddr_len)
{
	struct sock *sk = sock->sk;
	struct sockaddr_pppox *sp = (struct sockaddr_pppox *) uservaddr;
	struct pppox_sock *po = pppox_sk(sk);
 	struct pptp_opt *opt = &po->proto.pptp;
 	int error = 0;
 
 	lock_sock(sk);
 
 	opt->src_addr = sp->sa_addr.pptp;
	if (add_chan(po))
		error = -EBUSY;

	release_sock(sk);
	return error;
}

Vulnerability Type: Bypass +Info 
CWE ID: CWE-200
Summary: The (1) pptp_bind and (2) pptp_connect functions in drivers/net/ppp/pptp.c in the Linux kernel through 4.3.3 do not verify an address length, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism via a crafted application.
Commit Message: pptp: verify sockaddr_len in pptp_bind() and pptp_connect()

Reported-by: Dmitry Vyukov <dvyukov@gmail.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>