Commit 95c16925 authored Apr 25, 2019 by Willem de Bruijn Committed by David S. Miller Apr 29, 2019

ipv6: invert flowlabel sharing check in process and user mode



A request for a flowlabel fails in process or user exclusive mode must
fail if the caller pid or uid does not match. Invert the test.

Previously, the test was unsafe wrt PID recycling, but indeed tested
for inequality: fl1->owner != fl->owner

Fixes: 4f82f457 ("net ip6 flowlabel: Make owner a union of struct pid* and kuid_t")
Signed-off-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 6ee12b7b

net/ipv6/ip6_flowlabel.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -633,9 +633,9 @@ int ipv6_flowlabel_opt(struct sock sk, char __user optval, int optlen)
		if (fl1->share == IPV6_FL_S_EXCL \|\|
		fl1->share != fl->share \|\|
		((fl1->share == IPV6_FL_S_PROCESS) &&
		(fl1->owner.pid == fl->owner.pid)) \|\|
		(fl1->owner.pid != fl->owner.pid)) \|\|
		((fl1->share == IPV6_FL_S_USER) &&
		uid_eq(fl1->owner.uid, fl->owner.uid)))
		!uid_eq(fl1->owner.uid, fl->owner.uid)))
		goto release;

		err = -ENOMEM;