Merge branch 'af_unix-fix-a-null-deref-in-sk_diag_dump_uid'
Kuniyuki Iwashima says: ==================== af_unix: Fix a NULL deref in sk_diag_dump_uid(). The first patch fixes a NULL deref when we dump a AF_UNIX socket's UID, and the second patch adds a repro/test for such a case. ==================== Link: https://lore.kernel.org/r/20221127012412.37969-1-kuniyu@amazon.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
This commit is contained in:
Paolo Abeni
commit
9aff0ec5cb
@ -114,14 +114,16 @@ static int sk_diag_show_rqlen(struct sock *sk, struct sk_buff *nlskb)
|
||||
return nla_put(nlskb, UNIX_DIAG_RQLEN, sizeof(rql), &rql);
|
||||
}
|
||||
|
||||
static int sk_diag_dump_uid(struct sock *sk, struct sk_buff *nlskb)
|
||||
static int sk_diag_dump_uid(struct sock *sk, struct sk_buff *nlskb,
|
||||
struct user_namespace *user_ns)
|
||||
{
|
||||
uid_t uid = from_kuid_munged(sk_user_ns(nlskb->sk), sock_i_uid(sk));
|
||||
uid_t uid = from_kuid_munged(user_ns, sock_i_uid(sk));
|
||||
return nla_put(nlskb, UNIX_DIAG_UID, sizeof(uid_t), &uid);
|
||||
}
|
||||
|
||||
static int sk_diag_fill(struct sock *sk, struct sk_buff *skb, struct unix_diag_req *req,
|
||||
u32 portid, u32 seq, u32 flags, int sk_ino)
|
||||
struct user_namespace *user_ns,
|
||||
u32 portid, u32 seq, u32 flags, int sk_ino)
|
||||
{
|
||||
struct nlmsghdr *nlh;
|
||||
struct unix_diag_msg *rep;
|
||||
@ -167,7 +169,7 @@ static int sk_diag_fill(struct sock *sk, struct sk_buff *skb, struct unix_diag_r
|
||||
goto out_nlmsg_trim;
|
||||
|
||||
if ((req->udiag_show & UDIAG_SHOW_UID) &&
|
||||
sk_diag_dump_uid(sk, skb))
|
||||
sk_diag_dump_uid(sk, skb, user_ns))
|
||||
goto out_nlmsg_trim;
|
||||
|
||||
nlmsg_end(skb, nlh);
|
||||
@ -179,7 +181,8 @@ static int sk_diag_fill(struct sock *sk, struct sk_buff *skb, struct unix_diag_r
|
||||
}
|
||||
|
||||
static int sk_diag_dump(struct sock *sk, struct sk_buff *skb, struct unix_diag_req *req,
|
||||
u32 portid, u32 seq, u32 flags)
|
||||
struct user_namespace *user_ns,
|
||||
u32 portid, u32 seq, u32 flags)
|
||||
{
|
||||
int sk_ino;
|
||||
|
||||
@ -190,7 +193,7 @@ static int sk_diag_dump(struct sock *sk, struct sk_buff *skb, struct unix_diag_r
|
||||
if (!sk_ino)
|
||||
return 0;
|
||||
|
||||
return sk_diag_fill(sk, skb, req, portid, seq, flags, sk_ino);
|
||||
return sk_diag_fill(sk, skb, req, user_ns, portid, seq, flags, sk_ino);
|
||||
}
|
||||
|
||||
static int unix_diag_dump(struct sk_buff *skb, struct netlink_callback *cb)
|
||||
@ -214,7 +217,7 @@ static int unix_diag_dump(struct sk_buff *skb, struct netlink_callback *cb)
|
||||
goto next;
|
||||
if (!(req->udiag_states & (1 << sk->sk_state)))
|
||||
goto next;
|
||||
if (sk_diag_dump(sk, skb, req,
|
||||
if (sk_diag_dump(sk, skb, req, sk_user_ns(skb->sk),
|
||||
NETLINK_CB(cb->skb).portid,
|
||||
cb->nlh->nlmsg_seq,
|
||||
NLM_F_MULTI) < 0) {
|
||||
@ -282,7 +285,8 @@ static int unix_diag_get_exact(struct sk_buff *in_skb,
|
||||
if (!rep)
|
||||
goto out;
|
||||
|
||||
err = sk_diag_fill(sk, rep, req, NETLINK_CB(in_skb).portid,
|
||||
err = sk_diag_fill(sk, rep, req, sk_user_ns(NETLINK_CB(in_skb).sk),
|
||||
NETLINK_CB(in_skb).portid,
|
||||
nlh->nlmsg_seq, 0, req->udiag_ino);
|
||||
if (err < 0) {
|
||||
nlmsg_free(rep);
|
||||
|
||||
1
tools/testing/selftests/net/.gitignore
vendored
1
tools/testing/selftests/net/.gitignore
vendored
@ -1,6 +1,7 @@
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
bind_bhash
|
||||
cmsg_sender
|
||||
diag_uid
|
||||
fin_ack_lat
|
||||
gro
|
||||
hwtstamp_config
|
||||
|
||||
@ -1,3 +1,3 @@
|
||||
TEST_GEN_PROGS := test_unix_oob unix_connect
|
||||
TEST_GEN_PROGS := diag_uid test_unix_oob unix_connect
|
||||
|
||||
include ../../lib.mk
|
||||
|
||||
178
tools/testing/selftests/net/af_unix/diag_uid.c
Normal file
178
tools/testing/selftests/net/af_unix/diag_uid.c
Normal file
@ -0,0 +1,178 @@
|
||||
// SPDX-License-Identifier: GPL-2.0
|
||||
/* Copyright Amazon.com Inc. or its affiliates. */
|
||||
|
||||
#define _GNU_SOURCE
|
||||
#include <sched.h>
|
||||
|
||||
#include <unistd.h>
|
||||
#include <linux/netlink.h>
|
||||
#include <linux/rtnetlink.h>
|
||||
#include <linux/sock_diag.h>
|
||||
#include <linux/unix_diag.h>
|
||||
#include <sys/socket.h>
|
||||
#include <sys/stat.h>
|
||||
#include <sys/types.h>
|
||||
#include <sys/un.h>
|
||||
|
||||
#include "../../kselftest_harness.h"
|
||||
|
||||
FIXTURE(diag_uid)
|
||||
{
|
||||
int netlink_fd;
|
||||
int unix_fd;
|
||||
__u32 inode;
|
||||
__u64 cookie;
|
||||
};
|
||||
|
||||
FIXTURE_VARIANT(diag_uid)
|
||||
{
|
||||
int unshare;
|
||||
int udiag_show;
|
||||
};
|
||||
|
||||
FIXTURE_VARIANT_ADD(diag_uid, uid)
|
||||
{
|
||||
.unshare = 0,
|
||||
.udiag_show = UDIAG_SHOW_UID
|
||||
};
|
||||
|
||||
FIXTURE_VARIANT_ADD(diag_uid, uid_unshare)
|
||||
{
|
||||
.unshare = CLONE_NEWUSER,
|
||||
.udiag_show = UDIAG_SHOW_UID
|
||||
};
|
||||
|
||||
FIXTURE_SETUP(diag_uid)
|
||||
{
|
||||
struct stat file_stat;
|
||||
socklen_t optlen;
|
||||
int ret;
|
||||
|
||||
if (variant->unshare)
|
||||
ASSERT_EQ(unshare(variant->unshare), 0);
|
||||
|
||||
self->netlink_fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_SOCK_DIAG);
|
||||
ASSERT_NE(self->netlink_fd, -1);
|
||||
|
||||
self->unix_fd = socket(AF_UNIX, SOCK_STREAM, 0);
|
||||
ASSERT_NE(self->unix_fd, -1);
|
||||
|
||||
ret = fstat(self->unix_fd, &file_stat);
|
||||
ASSERT_EQ(ret, 0);
|
||||
|
||||
self->inode = file_stat.st_ino;
|
||||
|
||||
optlen = sizeof(self->cookie);
|
||||
ret = getsockopt(self->unix_fd, SOL_SOCKET, SO_COOKIE, &self->cookie, &optlen);
|
||||
ASSERT_EQ(ret, 0);
|
||||
}
|
||||
|
||||
FIXTURE_TEARDOWN(diag_uid)
|
||||
{
|
||||
close(self->netlink_fd);
|
||||
close(self->unix_fd);
|
||||
}
|
||||
|
||||
int send_request(struct __test_metadata *_metadata,
|
||||
FIXTURE_DATA(diag_uid) *self,
|
||||
const FIXTURE_VARIANT(diag_uid) *variant)
|
||||
{
|
||||
struct {
|
||||
struct nlmsghdr nlh;
|
||||
struct unix_diag_req udr;
|
||||
} req = {
|
||||
.nlh = {
|
||||
.nlmsg_len = sizeof(req),
|
||||
.nlmsg_type = SOCK_DIAG_BY_FAMILY,
|
||||
.nlmsg_flags = NLM_F_REQUEST
|
||||
},
|
||||
.udr = {
|
||||
.sdiag_family = AF_UNIX,
|
||||
.udiag_ino = self->inode,
|
||||
.udiag_cookie = {
|
||||
(__u32)self->cookie,
|
||||
(__u32)(self->cookie >> 32)
|
||||
},
|
||||
.udiag_show = variant->udiag_show
|
||||
}
|
||||
};
|
||||
struct sockaddr_nl nladdr = {
|
||||
.nl_family = AF_NETLINK
|
||||
};
|
||||
struct iovec iov = {
|
||||
.iov_base = &req,
|
||||
.iov_len = sizeof(req)
|
||||
};
|
||||
struct msghdr msg = {
|
||||
.msg_name = &nladdr,
|
||||
.msg_namelen = sizeof(nladdr),
|
||||
.msg_iov = &iov,
|
||||
.msg_iovlen = 1
|
||||
};
|
||||
|
||||
return sendmsg(self->netlink_fd, &msg, 0);
|
||||
}
|
||||
|
||||
void render_response(struct __test_metadata *_metadata,
|
||||
struct unix_diag_req *udr, __u32 len)
|
||||
{
|
||||
unsigned int rta_len = len - NLMSG_LENGTH(sizeof(*udr));
|
||||
struct rtattr *attr;
|
||||
uid_t uid;
|
||||
|
||||
ASSERT_GT(len, sizeof(*udr));
|
||||
ASSERT_EQ(udr->sdiag_family, AF_UNIX);
|
||||
|
||||
attr = (struct rtattr *)(udr + 1);
|
||||
ASSERT_NE(RTA_OK(attr, rta_len), 0);
|
||||
ASSERT_EQ(attr->rta_type, UNIX_DIAG_UID);
|
||||
|
||||
uid = *(uid_t *)RTA_DATA(attr);
|
||||
ASSERT_EQ(uid, getuid());
|
||||
}
|
||||
|
||||
void receive_response(struct __test_metadata *_metadata,
|
||||
FIXTURE_DATA(diag_uid) *self)
|
||||
{
|
||||
long buf[8192 / sizeof(long)];
|
||||
struct sockaddr_nl nladdr = {
|
||||
.nl_family = AF_NETLINK
|
||||
};
|
||||
struct iovec iov = {
|
||||
.iov_base = buf,
|
||||
.iov_len = sizeof(buf)
|
||||
};
|
||||
struct msghdr msg = {
|
||||
.msg_name = &nladdr,
|
||||
.msg_namelen = sizeof(nladdr),
|
||||
.msg_iov = &iov,
|
||||
.msg_iovlen = 1
|
||||
};
|
||||
struct unix_diag_req *udr;
|
||||
struct nlmsghdr *nlh;
|
||||
int ret;
|
||||
|
||||
ret = recvmsg(self->netlink_fd, &msg, 0);
|
||||
ASSERT_GT(ret, 0);
|
||||
|
||||
nlh = (struct nlmsghdr *)buf;
|
||||
ASSERT_NE(NLMSG_OK(nlh, ret), 0);
|
||||
ASSERT_EQ(nlh->nlmsg_type, SOCK_DIAG_BY_FAMILY);
|
||||
|
||||
render_response(_metadata, NLMSG_DATA(nlh), nlh->nlmsg_len);
|
||||
|
||||
nlh = NLMSG_NEXT(nlh, ret);
|
||||
ASSERT_EQ(NLMSG_OK(nlh, ret), 0);
|
||||
}
|
||||
|
||||
TEST_F(diag_uid, 1)
|
||||
{
|
||||
int ret;
|
||||
|
||||
ret = send_request(_metadata, self, variant);
|
||||
ASSERT_GT(ret, 0);
|
||||
|
||||
receive_response(_metadata, self);
|
||||
}
|
||||
|
||||
TEST_HARNESS_MAIN
|
||||
Loading…
Reference in New Issue
Block a user