Commit 9aff0ec5 authored by Paolo Abeni's avatar Paolo Abeni
Browse files

Merge branch 'af_unix-fix-a-null-deref-in-sk_diag_dump_uid' 

Kuniyuki Iwashima says:

====================
af_unix: Fix a NULL deref in sk_diag_dump_uid().

The first patch fixes a NULL deref when we dump a AF_UNIX socket's UID,
and the second patch adds a repro/test for such a case.
====================

Link: https://lore.kernel.org/r/20221127012412.37969-1-kuniyu@amazon.com


Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
parents d68d7d20 ac011361

net/unix/diag.c

+12 −8
Original line number Diff line number Diff line
@@ -114,13 +114,15 @@ static int sk_diag_show_rqlen(struct sock *sk, struct sk_buff *nlskb) 
	return nla_put(nlskb, UNIX_DIAG_RQLEN, sizeof(rql), &rql);

}



static int sk_diag_dump_uid(struct sock *sk, struct sk_buff *nlskb)

static int sk_diag_dump_uid(struct sock *sk, struct sk_buff *nlskb,

			    struct user_namespace *user_ns)

{

	uid_t uid = from_kuid_munged(sk_user_ns(nlskb->sk), sock_i_uid(sk));

	uid_t uid = from_kuid_munged(user_ns, sock_i_uid(sk));

	return nla_put(nlskb, UNIX_DIAG_UID, sizeof(uid_t), &uid);

}



static int sk_diag_fill(struct sock *sk, struct sk_buff *skb, struct unix_diag_req *req,

			struct user_namespace *user_ns,

			u32 portid, u32 seq, u32 flags, int sk_ino)

{

	struct nlmsghdr *nlh;
@@ -167,7 +169,7 @@ static int sk_diag_fill(struct sock *sk, struct sk_buff *skb, struct unix_diag_r 
		goto out_nlmsg_trim;



	if ((req->udiag_show & UDIAG_SHOW_UID) &&

	    sk_diag_dump_uid(sk, skb))

	    sk_diag_dump_uid(sk, skb, user_ns))

		goto out_nlmsg_trim;



	nlmsg_end(skb, nlh);
@@ -179,6 +181,7 @@ static int sk_diag_fill(struct sock *sk, struct sk_buff *skb, struct unix_diag_r 
}



static int sk_diag_dump(struct sock *sk, struct sk_buff *skb, struct unix_diag_req *req,

			struct user_namespace *user_ns,

			u32 portid, u32 seq, u32 flags)

{

	int sk_ino;
@@ -190,7 +193,7 @@ static int sk_diag_dump(struct sock *sk, struct sk_buff *skb, struct unix_diag_r 
	if (!sk_ino)

		return 0;



	return sk_diag_fill(sk, skb, req, portid, seq, flags, sk_ino);

	return sk_diag_fill(sk, skb, req, user_ns, portid, seq, flags, sk_ino);

}



static int unix_diag_dump(struct sk_buff *skb, struct netlink_callback *cb)
@@ -214,7 +217,7 @@ static int unix_diag_dump(struct sk_buff *skb, struct netlink_callback *cb) 
				goto next;

			if (!(req->udiag_states & (1 << sk->sk_state)))

				goto next;

			if (sk_diag_dump(sk, skb, req,

			if (sk_diag_dump(sk, skb, req, sk_user_ns(skb->sk),

					 NETLINK_CB(cb->skb).portid,

					 cb->nlh->nlmsg_seq,

					 NLM_F_MULTI) < 0) {
@@ -282,7 +285,8 @@ static int unix_diag_get_exact(struct sk_buff *in_skb, 
	if (!rep)

		goto out;



	err = sk_diag_fill(sk, rep, req, NETLINK_CB(in_skb).portid,

	err = sk_diag_fill(sk, rep, req, sk_user_ns(NETLINK_CB(in_skb).sk),

			   NETLINK_CB(in_skb).portid,

			   nlh->nlmsg_seq, 0, req->udiag_ino);

	if (err < 0) {

		nlmsg_free(rep);

tools/testing/selftests/net/.gitignore

+1 −0
Original line number Diff line number Diff line 
# SPDX-License-Identifier: GPL-2.0-only

bind_bhash

cmsg_sender

diag_uid

fin_ack_lat

gro

hwtstamp_config

tools/testing/selftests/net/af_unix/Makefile

+1 −1
Original line number Diff line number Diff line 
TEST_GEN_PROGS := test_unix_oob unix_connect

TEST_GEN_PROGS := diag_uid test_unix_oob unix_connect



include ../../lib.mk

tools/testing/selftests/net/af_unix/diag_uid.c

0 → 100644
+178 −0
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0

/* Copyright Amazon.com Inc. or its affiliates. */



#define _GNU_SOURCE

#include <sched.h>



#include <unistd.h>

#include <linux/netlink.h>

#include <linux/rtnetlink.h>

#include <linux/sock_diag.h>

#include <linux/unix_diag.h>

#include <sys/socket.h>

#include <sys/stat.h>

#include <sys/types.h>

#include <sys/un.h>



#include "../../kselftest_harness.h"



FIXTURE(diag_uid)

{

	int netlink_fd;

	int unix_fd;

	__u32 inode;

	__u64 cookie;

};



FIXTURE_VARIANT(diag_uid)

{

	int unshare;

	int udiag_show;

};



FIXTURE_VARIANT_ADD(diag_uid, uid)

{

	.unshare = 0,

	.udiag_show = UDIAG_SHOW_UID

};



FIXTURE_VARIANT_ADD(diag_uid, uid_unshare)

{

	.unshare = CLONE_NEWUSER,

	.udiag_show = UDIAG_SHOW_UID

};



FIXTURE_SETUP(diag_uid)

{

	struct stat file_stat;

	socklen_t optlen;

	int ret;



	if (variant->unshare)

		ASSERT_EQ(unshare(variant->unshare), 0);



	self->netlink_fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_SOCK_DIAG);

	ASSERT_NE(self->netlink_fd, -1);



	self->unix_fd = socket(AF_UNIX, SOCK_STREAM, 0);

	ASSERT_NE(self->unix_fd, -1);



	ret = fstat(self->unix_fd, &file_stat);

	ASSERT_EQ(ret, 0);



	self->inode = file_stat.st_ino;



	optlen = sizeof(self->cookie);

	ret = getsockopt(self->unix_fd, SOL_SOCKET, SO_COOKIE, &self->cookie, &optlen);

	ASSERT_EQ(ret, 0);

}



FIXTURE_TEARDOWN(diag_uid)

{

	close(self->netlink_fd);

	close(self->unix_fd);

}



int send_request(struct __test_metadata *_metadata,

		 FIXTURE_DATA(diag_uid) *self,

		 const FIXTURE_VARIANT(diag_uid) *variant)

{

	struct {

		struct nlmsghdr nlh;

		struct unix_diag_req udr;

	} req = {

		.nlh = {

			.nlmsg_len = sizeof(req),

			.nlmsg_type = SOCK_DIAG_BY_FAMILY,

			.nlmsg_flags = NLM_F_REQUEST

		},

		.udr = {

			.sdiag_family = AF_UNIX,

			.udiag_ino = self->inode,

			.udiag_cookie = {

				(__u32)self->cookie,

				(__u32)(self->cookie >> 32)

			},

			.udiag_show = variant->udiag_show

		}

	};

	struct sockaddr_nl nladdr = {

		.nl_family = AF_NETLINK

	};

	struct iovec iov = {

		.iov_base = &req,

		.iov_len = sizeof(req)

	};

	struct msghdr msg = {

		.msg_name = &nladdr,

		.msg_namelen = sizeof(nladdr),

		.msg_iov = &iov,

		.msg_iovlen = 1

	};



	return sendmsg(self->netlink_fd, &msg, 0);

}



void render_response(struct __test_metadata *_metadata,

		     struct unix_diag_req *udr, __u32 len)

{

	unsigned int rta_len = len - NLMSG_LENGTH(sizeof(*udr));

	struct rtattr *attr;

	uid_t uid;



	ASSERT_GT(len, sizeof(*udr));

	ASSERT_EQ(udr->sdiag_family, AF_UNIX);



	attr = (struct rtattr *)(udr + 1);

	ASSERT_NE(RTA_OK(attr, rta_len), 0);

	ASSERT_EQ(attr->rta_type, UNIX_DIAG_UID);



	uid = *(uid_t *)RTA_DATA(attr);

	ASSERT_EQ(uid, getuid());

}



void receive_response(struct __test_metadata *_metadata,

		      FIXTURE_DATA(diag_uid) *self)

{

	long buf[8192 / sizeof(long)];

	struct sockaddr_nl nladdr = {

		.nl_family = AF_NETLINK

	};

	struct iovec iov = {

		.iov_base = buf,

		.iov_len = sizeof(buf)

	};

	struct msghdr msg = {

		.msg_name = &nladdr,

		.msg_namelen = sizeof(nladdr),

		.msg_iov = &iov,

		.msg_iovlen = 1

	};

	struct unix_diag_req *udr;

	struct nlmsghdr *nlh;

	int ret;



	ret = recvmsg(self->netlink_fd, &msg, 0);

	ASSERT_GT(ret, 0);



	nlh = (struct nlmsghdr *)buf;

	ASSERT_NE(NLMSG_OK(nlh, ret), 0);

	ASSERT_EQ(nlh->nlmsg_type, SOCK_DIAG_BY_FAMILY);



	render_response(_metadata, NLMSG_DATA(nlh), nlh->nlmsg_len);



	nlh = NLMSG_NEXT(nlh, ret);

	ASSERT_EQ(NLMSG_OK(nlh, ret), 0);

}



TEST_F(diag_uid, 1)

{

	int ret;



	ret = send_request(_metadata, self, variant);

	ASSERT_GT(ret, 0);



	receive_response(_metadata, self);

}



TEST_HARNESS_MAIN