tipc: fix null deref crash in compat config path

Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

kernel os linux

msg.dst_sk needs to be set up with a valid socket because some callbacks
later derive the netns from it.

Fixes: 263ea09084d172d ("Revert "genl: Add genlmsg_new_unicast() for unicast message allocation")
Reported-by: Jon Maloy <maloy@donjonn.com>
Bisected-by: Jon Maloy <maloy@donjonn.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

authored by

Florian Westphal and committed by

David S. Miller 10 years ago 619b1745 d25a0125

1 changed file

expand all

net

tipc

netlink_compat.c

net/tipc/netlink_compat.c

··· 1105 1105 msg.req = nlmsg_data(req_nlh) + GENL_HDRLEN + TIPC_GENL_HDRLEN; 1106 1106 msg.cmd = req_userhdr->cmd; 1107 1107 msg.net = genl_info_net(info); 1108 + msg.dst_sk = skb->sk; 1108 1109 1109 1110 if ((msg.cmd & 0xC000) && (!netlink_net_capable(skb, CAP_NET_ADMIN))) { 1110 1111 msg.rep = tipc_get_err_tlv(TIPC_CFG_NOT_NET_ADMIN);