Messages in this thread Patch in this message | | | From | Pietro Borrello <> | Date | Wed, 01 Feb 2023 00:35:46 +0000 | Subject | [PATCH net-next 2/2] tap: tap_open(): correctly initialize socket uid |
| |
sock_init_data() assumes that the `struct socket` passed in input is contained in a `struct socket_alloc` allocated with sock_alloc(). However, tap_open() passes a `struct socket` embedded in a `struct tap_queue` allocated with sk_alloc(). This causes a type confusion when issuing a container_of() with SOCK_INODE() in sock_init_data() which results in assigning a wrong sk_uid to the `struct sock` in input. On default configuration, the type confused field overlaps with padding bytes between `int vnet_hdr_sz` and `struct tap_dev __rcu *tap` in `struct tap_queue`, which makes the uid of all tap sockets 0, i.e., the root one. Fix the assignment by overriding it with the correct uid.
Fixes: 86741ec25462 ("net: core: Add a UID field to struct sock.") Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it> --- drivers/net/tap.c | 4 ++++ 1 file changed, 4 insertions(+)
diff --git a/drivers/net/tap.c b/drivers/net/tap.c index a2be1994b389..9a287363d695 100644 --- a/drivers/net/tap.c +++ b/drivers/net/tap.c @@ -538,6 +538,10 @@ static int tap_open(struct inode *inode, struct file *file) q->sk.sk_destruct = tap_sock_destruct; q->flags = IFF_VNET_HDR | IFF_NO_PI | IFF_TAP; q->vnet_hdr_sz = sizeof(struct virtio_net_hdr); + // sock_init_data initializes sk.sk_uid assuming q->sock is embedded in a + // struct socket_alloc and reading its corresponding inode. Since we pass a + // socket contained in a struct tap_queue we have to fix this manually + q->sk.sk_uid = inode->i_uid; /* * so far only KVM virtio_net uses tap, enable zero copy between -- 2.25.1
| |