Commit 98551a82 authored by Pietro Borrello's avatar Pietro Borrello Committed by Jialin Zhang
Browse files

net: add sock_init_data_uid() 

mainline inclusion
from mainline-v6.3-rc1
commit 584f3742
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6I7UC
CVE: CVE-2023-1076

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=584f3742890e966d2f0a1f3c418c9ead70b2d99e



--------------------------------

Add sock_init_data_uid() to explicitly initialize the socket uid.
To initialise the socket uid, sock_init_data() assumes a the struct
socket* sock is always embedded in a struct socket_alloc, used to
access the corresponding inode uid. This may not be true.
Examples are sockets created in tun_chr_open() and tap_open().

Fixes: 86741ec2 ("net: core: Add a UID field to struct sock.")
Signed-off-by: default avatarPietro Borrello <borrello@diag.uniroma1.it>
Reviewed-by: default avatarEric Dumazet <edumazet@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>

Conflicts:
	net/core/sock.c

Signed-off-by: default avatarBaisong Zhong <zhongbaisong@huawei.com>
Reviewed-by: default avatarLiu Jian <liujian56@huawei.com>
Reviewed-by: default avatarXiu Jianfeng <xiujianfeng@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parent 840ae83f

include/net/sock.h

+6 −1
Original line number Diff line number Diff line
@@ -1808,7 +1808,12 @@ void sk_common_release(struct sock *sk); 
 *	Default socket callbacks and setup code

 */



/* Initialise core socket variables */

/* Initialise core socket variables using an explicit uid. */

void sock_init_data_uid(struct socket *sock, struct sock *sk, kuid_t uid);



/* Initialise core socket variables.

 * Assumes struct socket *sock is embedded in a struct socket_alloc.

 */

void sock_init_data(struct socket *sock, struct sock *sk);



/*

net/core/sock.c

+12 −3
Original line number Diff line number Diff line
@@ -2967,7 +2967,7 @@ void sk_stop_timer_sync(struct sock *sk, struct timer_list *timer) 
}

EXPORT_SYMBOL(sk_stop_timer_sync);



void sock_init_data(struct socket *sock, struct sock *sk)

void sock_init_data_uid(struct socket *sock, struct sock *sk, kuid_t uid)

{

	sk_init_common(sk);

	sk->sk_send_head	=	NULL;
@@ -2986,13 +2986,12 @@ void sock_init_data(struct socket *sock, struct sock *sk) 
		sk->sk_type	=	sock->type;

		RCU_INIT_POINTER(sk->sk_wq, &sock->wq);

		sock->sk	=	sk;

		sk->sk_uid	=	SOCK_INODE(sock)->i_uid;

		sk->sk_gid	=	SOCK_INODE(sock)->i_gid;

	} else {

		RCU_INIT_POINTER(sk->sk_wq, NULL);

		sk->sk_uid	=	make_kuid(sock_net(sk)->user_ns, 0);

		sk->sk_gid	=	make_kgid(sock_net(sk)->user_ns, 0);

	}

	sk->sk_uid	=	uid;



	rwlock_init(&sk->sk_callback_lock);

	if (sk->sk_kern_sock)
@@ -3050,6 +3049,16 @@ void sock_init_data(struct socket *sock, struct sock *sk) 
	refcount_set(&sk->sk_refcnt, 1);

	atomic_set(&sk->sk_drops, 0);

}

EXPORT_SYMBOL(sock_init_data_uid);



void sock_init_data(struct socket *sock, struct sock *sk)

{

	kuid_t uid = sock ?

		SOCK_INODE(sock)->i_uid :

		make_kuid(sock_net(sk)->user_ns, 0);



	sock_init_data_uid(sock, sk, uid);

}

EXPORT_SYMBOL(sock_init_data);



void lock_sock_nested(struct sock *sk, int subclass)