Messages in this thread Patch in this message | | | From | Pietro Borrello <> | Date | Wed, 01 Feb 2023 00:35:45 +0000 | Subject | [PATCH net-next 1/2] tun: tun_chr_open(): correctly initialize socket uid |
| |
sock_init_data() assumes that the `struct socket` passed in input is contained in a `struct socket_alloc` allocated with sock_alloc(). However, tun_chr_open() passes a `struct socket` embedded in a `struct tun_file` allocated with sk_alloc(). This causes a type confusion when issuing a container_of() with SOCK_INODE() in sock_init_data() which results in assigning a wrong sk_uid to the `struct sock` in input. On default configuration, the type confused field overlaps with the high 4 bytes of `struct tun_struct __rcu *tun` of `struct tun_file`, NULL at the time of call, which makes the uid of all tun sockets 0, i.e., the root one. Fix the assignment by overriding it with the correct uid.
Fixes: 86741ec25462 ("net: core: Add a UID field to struct sock.") Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it> --- drivers/net/tun.c | 5 +++++ 1 file changed, 5 insertions(+)
diff --git a/drivers/net/tun.c b/drivers/net/tun.c index a7d17c680f4a..6713fffb1488 100644 --- a/drivers/net/tun.c +++ b/drivers/net/tun.c @@ -3450,6 +3450,11 @@ static int tun_chr_open(struct inode *inode, struct file * file) sock_init_data(&tfile->socket, &tfile->sk); + // sock_init_data initializes sk.sk_uid assuming tfile->socket is embedded + // in a struct socket_alloc and reading its corresponding inode. Since we + // pass a socket contained in a struct tun_file we have to fix this manually + tfile->sk.sk_uid = inode->i_uid; + tfile->sk.sk_write_space = tun_sock_write_space; tfile->sk.sk_sndbuf = INT_MAX; -- 2.25.1
| |