Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 619b1745 authored by Florian Westphal's avatar Florian Westphal Committed by David S. Miller
Browse files

tipc: fix null deref crash in compat config path 



msg.dst_sk needs to be set up with a valid socket because some callbacks
later derive the netns from it.

Fixes: 263ea09084d172d ("Revert "genl: Add genlmsg_new_unicast() for unicast message allocation")
Reported-by: default avatarJon Maloy <maloy@donjonn.com>
Bisected-by: default avatarJon Maloy <maloy@donjonn.com>
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Acked-by Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent d25a0125

net/tipc/netlink_compat.c

+1 −0
Original line number Diff line number Diff line
@@ -1105,6 +1105,7 @@ static int tipc_nl_compat_recv(struct sk_buff *skb, struct genl_info *info) 
	msg.req = nlmsg_data(req_nlh) + GENL_HDRLEN + TIPC_GENL_HDRLEN;

	msg.cmd = req_userhdr->cmd;

	msg.net = genl_info_net(info);

	msg.dst_sk = skb->sk;



	if ((msg.cmd & 0xC000) && (!netlink_net_capable(skb, CAP_NET_ADMIN))) {

		msg.rep = tipc_get_err_tlv(TIPC_CFG_NOT_NET_ADMIN);