evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

xt_qtaguid: Fix panic caused by synack processing

Browse source 
In upstream commit ca6fb06518
(tcp: attach SYNACK messages to request sockets instead of
listener)
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ca6fb0651883

The building of synack messages was changed, which made it so
the skb->sk points to a casted request_sock. This is problematic,
as there is no sk_socket in a request_sock. So when the qtaguid_mt
function tries to access the sk->sk_socket, it accesses uninitialized
memory.

After looking at how other netfilter implementations handle this,
I realized there was a skb_to_full_sk() helper added, which the
xt_qtaguid code isn't yet using.

This patch adds its use, and resovles panics seen when accessing
uninitialzed memory when processing synack packets.

Change-Id: Id0dbb7853aba221c1926e44616524fed90677602
CRs-Fixed: 1035969
Reported-by: YongQin Liu <yongquin.liu@linaro.org>
Signed-off-by: John Stultz <john.stultz@linaro.org>
Git-commit: 4e461c777e
Git-repo: https://android.googlesource.com/kernel/common/
Signed-off-by: Bryse Flowers <bflowers@codeaurora.org>
This commit is contained in:
John Stultz 2016-04-22 17:12:57 -07:00 • committed by Gerrit - the friendly Code Review server
parent 843033e005
commit 52d2c42bc4
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
net/netfilter/xt_qtaguid.c
View file

@ -1689,7 +1689,7 @@ static bool qtaguid_mt(const struct sk_buff *skb, struct xt_action_param *par)
/* default: Fall through and do UID releated work */ /* default: Fall through and do UID releated work */
} }
sk = skb->sk; sk = skb_to_full_sk(skb);
/* /*
* When in TCP_TIME_WAIT the sk is not a "struct sock" but * When in TCP_TIME_WAIT the sk is not a "struct sock" but
* "struct inet_timewait_sock" which is missing fields. * "struct inet_timewait_sock" which is missing fields.