Commit e41f0548 authored by Cong Wang's avatar Cong Wang Committed by David S. Miller
Browse files

tipc: use the right skb in tipc_sk_fill_sock_diag() 



Commit 4b2e6877 ("tipc: Fix namespace violation in tipc_sk_fill_sock_diag")
tried to fix the crash but failed, the crash is still 100% reproducible
with it.

In tipc_sk_fill_sock_diag(), skb is the diag dump we are filling, it is not
correct to retrieve its NETLINK_CB(), instead, like other protocol diag,
we should use NETLINK_CB(cb->skb).sk here.

Reported-by: default avatar <syzbot+326e587eff1074657718@syzkaller.appspotmail.com>
Fixes: 4b2e6877 ("tipc: Fix namespace violation in tipc_sk_fill_sock_diag")
Fixes: c30b70de (tipc: implement socket diagnostics for AF_TIPC)
Cc: GhantaKrishnamurthy MohanKrishna <mohan.krishna.ghanta.krishnamurthy@ericsson.com>
Cc: Jon Maloy <jon.maloy@ericsson.com>
Cc: Ying Xue <ying.xue@windriver.com>
Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 81e98370

net/tipc/diag.c

+1 −1
Original line number Diff line number Diff line
@@ -59,7 +59,7 @@ static int __tipc_add_sock_diag(struct sk_buff *skb, 
	if (!nlh)

		return -EMSGSIZE;



	err = tipc_sk_fill_sock_diag(skb, tsk, req->tidiag_states,

	err = tipc_sk_fill_sock_diag(skb, cb, tsk, req->tidiag_states,

				     __tipc_diag_gen_cookie);

	if (err)

		return err;

net/tipc/socket.c

+3 −3
Original line number Diff line number Diff line
@@ -3257,8 +3257,8 @@ out: 
}

EXPORT_SYMBOL(tipc_nl_sk_walk);



int tipc_sk_fill_sock_diag(struct sk_buff *skb, struct tipc_sock *tsk,

			   u32 sk_filter_state,

int tipc_sk_fill_sock_diag(struct sk_buff *skb, struct netlink_callback *cb,

			   struct tipc_sock *tsk, u32 sk_filter_state,

			   u64 (*tipc_diag_gen_cookie)(struct sock *sk))

{

	struct sock *sk = &tsk->sk;
@@ -3280,7 +3280,7 @@ int tipc_sk_fill_sock_diag(struct sk_buff *skb, struct tipc_sock *tsk, 
	    nla_put_u32(skb, TIPC_NLA_SOCK_TIPC_STATE, (u32)sk->sk_state) ||

	    nla_put_u32(skb, TIPC_NLA_SOCK_INO, sock_i_ino(sk)) ||

	    nla_put_u32(skb, TIPC_NLA_SOCK_UID,

			from_kuid_munged(sk_user_ns(NETLINK_CB(skb).sk),

			from_kuid_munged(sk_user_ns(NETLINK_CB(cb->skb).sk),

					 sock_i_uid(sk))) ||

	    nla_put_u64_64bit(skb, TIPC_NLA_SOCK_COOKIE,

			      tipc_diag_gen_cookie(sk),

net/tipc/socket.h

+2 −2
Original line number Diff line number Diff line
@@ -61,8 +61,8 @@ int tipc_sk_rht_init(struct net *net); 
void tipc_sk_rht_destroy(struct net *net);

int tipc_nl_sk_dump(struct sk_buff *skb, struct netlink_callback *cb);

int tipc_nl_publ_dump(struct sk_buff *skb, struct netlink_callback *cb);

int tipc_sk_fill_sock_diag(struct sk_buff *skb, struct tipc_sock *tsk,

			   u32 sk_filter_state,

int tipc_sk_fill_sock_diag(struct sk_buff *skb, struct netlink_callback *cb,

			   struct tipc_sock *tsk, u32 sk_filter_state,

			   u64 (*tipc_diag_gen_cookie)(struct sock *sk));

int tipc_nl_sk_walk(struct sk_buff *skb, struct netlink_callback *cb,

		    int (*skb_handler)(struct sk_buff *skb,

CRA Git | Maintained and supported by SUSTech CRA and CCSE