From nobody Sat Sep 13 09:18:04 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3744EC636D4 for ; Fri, 3 Feb 2023 14:31:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231240AbjBCObP (ORCPT ); Fri, 3 Feb 2023 09:31:15 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47368 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232554AbjBCObI (ORCPT ); Fri, 3 Feb 2023 09:31:08 -0500 Received: from mail-ej1-x631.google.com (mail-ej1-x631.google.com [IPv6:2a00:1450:4864:20::631]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0FD0E918AE for ; Fri, 3 Feb 2023 06:30:40 -0800 (PST) Received: by mail-ej1-x631.google.com with SMTP id dr8so15743428ejc.12 for ; Fri, 03 Feb 2023 06:30:39 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=diag.uniroma1.it; s=google; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=c9/yht3OikKL+fz1dMURrWxLRY+qgX5Gigwcf5rk3MM=; b=RSzcTFAAUWSKVCbhm8aZ0/uk1Jne0xWrH+JQ8jOmB+TP/DIprOMhhF/Zo03aEbVcpP I6T4csW/JMHpJDsUwKojS3xnVWMKSCW6fU7oFnubirnZZsH8SqtqVE0TDi3+vja4l+Ck NV4MrMla7pc2KhVdWqLhOmgZTFjCKhrlc0w1A= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=c9/yht3OikKL+fz1dMURrWxLRY+qgX5Gigwcf5rk3MM=; b=FtLtl/UH+s4r+Uoccl1kvzL62gCMEHXRieBcfLX9p9FFCkgFE3dfuycXgnKsJy+TV2 EgTFbA+9EEnx6MaaFb6VGQHbzeap6hNUI3jSmpjX6cCxH9wJBCER+JXtgfMYA4hMHvCP OWrOPyzd/5l6AUcG9HYkvlAVDSQoVy2o5LzdM/NzZCQVW7aFdUb15RhTDo6VNU94jlK/ DsQr3gLQ4+6Pi/yBiPS1pZB/jFy/iSFXYU4PoQ7EUSxP49zCb5nd0cIWzPA3jxLuJHnS kKWu0QmHcenleBn4gi8F35LNSx2eWGJHglUYRFbuYALjAn7ltZv671t0zsPrLut+eAEt 3Szw== X-Gm-Message-State: AO0yUKUQezHtPPpz1R3Zjav5Z20HRPsyjPGkuO1Z5C4unX21uJoxA8eW 2NMWdEj9W0DK1VHcQRv6xYplEA== X-Google-Smtp-Source: AK7set8ba+Vi2s4AY/qUznnRC8VJHFm0w/qrf0RebmRyMi2DqzCuyvrTWS740lc/oYEorvTKZ6bV9A== X-Received: by 2002:a17:907:7ba9:b0:87b:d3dd:e0ca with SMTP id ne41-20020a1709077ba900b0087bd3dde0camr2412927ejc.26.1675434638615; Fri, 03 Feb 2023 06:30:38 -0800 (PST) Received: from [192.168.17.2] (wolkje-127.labs.vu.nl. [130.37.198.127]) by smtp.gmail.com with ESMTPSA id v17-20020a17090690d100b007b935641971sm1453388ejw.5.2023.02.03.06.30.37 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 03 Feb 2023 06:30:38 -0800 (PST) From: Pietro Borrello Date: Fri, 03 Feb 2023 14:30:27 +0000 Subject: [PATCH net-next v2 1/2] tun: tun_chr_open(): correctly initialize socket uid MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20230131-tuntap-sk-uid-v2-1-29ec15592813@diag.uniroma1.it> References: <20230131-tuntap-sk-uid-v2-0-29ec15592813@diag.uniroma1.it> In-Reply-To: <20230131-tuntap-sk-uid-v2-0-29ec15592813@diag.uniroma1.it> To: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Lorenzo Colitti Cc: Stephen Hemminger , Cristiano Giuffrida , "Bos, H.J." , Jakob Koschel , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Pietro Borrello X-Mailer: b4 0.12.1 X-Developer-Signature: v=1; a=ed25519-sha256; t=1675434637; l=1470; i=borrello@diag.uniroma1.it; s=20221223; h=from:subject:message-id; bh=mzUofY832mKWZjsqrcRqLrj8musIg93nc9mNqQ6CM78=; b=oO8acvtlD+JwPhpXLLgyitydHBUuzKiSzYVlovE15LZ4Xi/Agl+38mQ3hPqse1tQW1DWHT0ENbtn EqmTSgafARmbBpjOAZgbumnEaq4vdOspvJyOXE6z5dCv1olk9zJF X-Developer-Key: i=borrello@diag.uniroma1.it; a=ed25519; pk=4xRQbiJKehl7dFvrG33o2HpveMrwQiUPKtIlObzKmdY= Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org sock_init_data() assumes that the `struct socket` passed in input is contained in a `struct socket_alloc` allocated with sock_alloc(). However, tun_chr_open() passes a `struct socket` embedded in a `struct tun_file` allocated with sk_alloc(). This causes a type confusion when issuing a container_of() with SOCK_INODE() in sock_init_data() which results in assigning a wrong sk_uid to the `struct sock` in input. On default configuration, the type confused field overlaps with the high 4 bytes of `struct tun_struct __rcu *tun` of `struct tun_file`, NULL at the time of call, which makes the uid of all tun sockets 0, i.e., the root one. Fix the assignment by overriding it with the correct uid. Fixes: 86741ec25462 ("net: core: Add a UID field to struct sock.") Signed-off-by: Pietro Borrello --- drivers/net/tun.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/net/tun.c b/drivers/net/tun.c index a7d17c680f4a..ccffbc439c95 100644 --- a/drivers/net/tun.c +++ b/drivers/net/tun.c @@ -3450,6 +3450,11 @@ static int tun_chr_open(struct inode *inode, struct = file * file) =20 sock_init_data(&tfile->socket, &tfile->sk); =20 + /* Assign sk_uid from the inode argument, since tfile->socket + * passed to sock_init_data() has no corresponding inode + */ + tfile->sk.sk_uid =3D inode->i_uid; + tfile->sk.sk_write_space =3D tun_sock_write_space; tfile->sk.sk_sndbuf =3D INT_MAX; =20 --=20 2.25.1 From nobody Sat Sep 13 09:18:04 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1F11AC636D6 for ; Fri, 3 Feb 2023 14:31:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233213AbjBCObW (ORCPT ); Fri, 3 Feb 2023 09:31:22 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47370 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233013AbjBCObI (ORCPT ); Fri, 3 Feb 2023 09:31:08 -0500 Received: from mail-ej1-x62b.google.com (mail-ej1-x62b.google.com [IPv6:2a00:1450:4864:20::62b]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8656592C03 for ; Fri, 3 Feb 2023 06:30:40 -0800 (PST) Received: by mail-ej1-x62b.google.com with SMTP id mc11so15765171ejb.10 for ; Fri, 03 Feb 2023 06:30:40 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=diag.uniroma1.it; s=google; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=r0m2g8+GVf0ZZ1nhk/AEBKCt2TzchdbQ0OMGRYPpZQk=; b=lCNTPvRnftJlnMW1PsKFs1qObEJoHevEIpzC1N4wE3eG5QKK1Y/MrBZECgNNqllhie 8j/x3rKmkp6VZtX9Fq/LI+D7kcS/FEgNqNnEVX2IBdI/SXzqX5wQrPoYBBpZ/CqrD7Hz DDp8sYlcOu2dw9MtKvccwr2bHn7f28zkA5knI= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=r0m2g8+GVf0ZZ1nhk/AEBKCt2TzchdbQ0OMGRYPpZQk=; b=wa+FlE0pb4RVn8iI8+lWAXttb2iKDZ2ns1HZVIMf+owQTpTMVDqw5Zt8/hLl0Qkx+i 9/PrcnSQX98+gtfNkkJ6kA26g7kKsz3Lkcni9RYm8DKbqJqpjHWi6xor7rGQ1HOE8IeC Yp4PIfWigsrgx01GXDibAwAGsV7HBqK1A7yT95twgL0R17bLoB3szMAaawNfRKyXma+t hNWBe2OEtZqX2lqIceP8UEuOG+5pFZbsFki1K5jsmaAYisU3wpCcVviGrH15nf7gdQ+R lWc/UbQzDTzWfdAOYdDYL4a4KiMGOT0hCDgbhaPhD9s8R9/N8vxNL5q+VGbf9H+6oQvy VLIQ== X-Gm-Message-State: AO0yUKWHkgu005Jk6fRNFK7exk8EhngfCSr2FCyFluqIaT5blRfcw0Ug P6GjqKVRxiXQKjHMap0JSDddW6jnWEBaI48LsLUVfQ== X-Google-Smtp-Source: AK7set9b/U3Bez6JHqWNmBQmWFMha+36vVqTjXrRrnN6Fvttj+ni2rvrsKpk5Jr0O9GHE7WqEdPguw== X-Received: by 2002:a17:907:2c49:b0:887:2248:efd5 with SMTP id hf9-20020a1709072c4900b008872248efd5mr11117214ejc.77.1675434639078; Fri, 03 Feb 2023 06:30:39 -0800 (PST) Received: from [192.168.17.2] (wolkje-127.labs.vu.nl. [130.37.198.127]) by smtp.gmail.com with ESMTPSA id v17-20020a17090690d100b007b935641971sm1453388ejw.5.2023.02.03.06.30.38 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 03 Feb 2023 06:30:38 -0800 (PST) From: Pietro Borrello Date: Fri, 03 Feb 2023 14:30:28 +0000 Subject: [PATCH net-next v2 2/2] tap: tap_open(): correctly initialize socket uid MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20230131-tuntap-sk-uid-v2-2-29ec15592813@diag.uniroma1.it> References: <20230131-tuntap-sk-uid-v2-0-29ec15592813@diag.uniroma1.it> In-Reply-To: <20230131-tuntap-sk-uid-v2-0-29ec15592813@diag.uniroma1.it> To: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Lorenzo Colitti Cc: Stephen Hemminger , Cristiano Giuffrida , "Bos, H.J." , Jakob Koschel , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Pietro Borrello X-Mailer: b4 0.12.1 X-Developer-Signature: v=1; a=ed25519-sha256; t=1675434637; l=1520; i=borrello@diag.uniroma1.it; s=20221223; h=from:subject:message-id; bh=gy2uiWU+PZfZz9OqZCMOyGDsAY8Cohp72Vz0gjwoRSU=; b=I5uI/ctAlIL+vpLvAGhqXmr6UYyQq5x15ou5M9lz55gdMajDJ0SPh1qD0snm9fz5Qz0uW+1Qfo9m vxkBOjG5CjUnZdckJw8zrbHWm3rSNNP0iTKvR0RsYYrHWUS9+bh/ X-Developer-Key: i=borrello@diag.uniroma1.it; a=ed25519; pk=4xRQbiJKehl7dFvrG33o2HpveMrwQiUPKtIlObzKmdY= Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org sock_init_data() assumes that the `struct socket` passed in input is contained in a `struct socket_alloc` allocated with sock_alloc(). However, tap_open() passes a `struct socket` embedded in a `struct tap_queue` allocated with sk_alloc(). This causes a type confusion when issuing a container_of() with SOCK_INODE() in sock_init_data() which results in assigning a wrong sk_uid to the `struct sock` in input. On default configuration, the type confused field overlaps with padding bytes between `int vnet_hdr_sz` and `struct tap_dev __rcu *tap` in `struct tap_queue`, which makes the uid of all tap sockets 0, i.e., the root one. Fix the assignment by overriding it with the correct uid. Fixes: 86741ec25462 ("net: core: Add a UID field to struct sock.") Signed-off-by: Pietro Borrello --- drivers/net/tap.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/tap.c b/drivers/net/tap.c index a2be1994b389..145c3f84fac4 100644 --- a/drivers/net/tap.c +++ b/drivers/net/tap.c @@ -538,6 +538,10 @@ static int tap_open(struct inode *inode, struct file *= file) q->sk.sk_destruct =3D tap_sock_destruct; q->flags =3D IFF_VNET_HDR | IFF_NO_PI | IFF_TAP; q->vnet_hdr_sz =3D sizeof(struct virtio_net_hdr); + /* Assign sk_uid from the inode argument, since q->sock + * passed to sock_init_data() has no corresponding inode + */ + q->sk.sk_uid =3D inode->i_uid; =20 /* * so far only KVM virtio_net uses tap, enable zero copy between --=20 2.25.1