Messages in this thread | | | From | Pietro Borrello <> | Subject | [PATCH net-next 0/2] tuntap: correctly initialize socket uid | Date | Wed, 01 Feb 2023 00:35:45 +0000 |
| |
sock_init_data() assumes that the `struct socket` passed in input is contained in a `struct socket_alloc` allocated with sock_alloc(). However, tap_open() and tun_chr_open() pass a `struct socket` embedded in a `struct tap_queue` and `struct tun_file` respectively, both allocated with sk_alloc(). This causes a type confusion when issuing a container_of() with SOCK_INODE() in sock_init_data() which results in assigning a wrong sk_uid to the `struct sock` in input.
Due to the type confusion, both sockets happen to have their uid set to 0, i.e. root. While it will be often correct, as tuntap devices require CAP_NET_ADMIN, it may not always be the case. Not sure how widespread is the impact of this, it seems the socket uid may be used for network filtering and routing, thus tuntap sockets may be incorrectly managed. Additionally, it seems a socket with an incorrect uid may be returned to the vhost driver when issuing a get_socket() on a tuntap device in vhost_net_set_backend().
The proposed fix may not be the cleanest one, as it simply overrides the incorrect uid after the type confusion in sock_init_data() happens. While minimal, this may not be solid in case more logic relying on SOCK_INODE() is added to sock_init_data(). The alternative fix would be to pass a NULL sock, and manually perform the assignments after the sock_init_data() call: ``` sk_set_socket(sk, sock); // and sk->sk_type = sock->type; RCU_INIT_POINTER(sk->sk_wq, &sock->wq); sock->sk = sk; sk->sk_uid = SOCK_INODE(sock)->i_uid; ```
To: "David S. Miller" <davem@davemloft.net> To: Eric Dumazet <edumazet@google.com> To: Jakub Kicinski <kuba@kernel.org> To: Paolo Abeni <pabeni@redhat.com> To: Lorenzo Colitti <lorenzo@google.com> Cc: Cristiano Giuffrida <c.giuffrida@vu.nl> Cc: "Bos, H.J." <h.j.bos@vu.nl> Cc: Jakob Koschel <jkl820.git@gmail.com> Cc: netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it>
--- Pietro Borrello (2): tun: tun_chr_open(): correctly initialize socket uid tap: tap_open(): correctly initialize socket uid
drivers/net/tap.c | 4 ++++ drivers/net/tun.c | 5 +++++ 2 files changed, 9 insertions(+) --- base-commit: 6d796c50f84ca79f1722bb131799e5a5710c4700 change-id: 20230131-tuntap-sk-uid-78efc80f4b82
Best regards, -- Pietro Borrello <borrello@diag.uniroma1.it>
| |