selinux: fix random read in selinux_ip_postroute_compat()
In commite446f9dfe1
("net: synack packets can be attached to request sockets"), I missed one remaining case of invalid skb->sk->sk_security access. Dmitry Vyukov got a KASan report pointing to it. Add selinux_skb_sk() helper that is responsible to get back to the listener if skb is attached to a request socket, instead of duplicating the logic. Fixes:ca6fb06518
("tcp: attach SYNACK messages to request sockets instead of listener") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: Dmitry Vyukov <dvyukov@google.com> Cc: Paul Moore <paul@paul-moore.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
432599d7a7
commit
212cd08953
|
@ -4931,11 +4931,23 @@ static unsigned int selinux_ipv4_output(void *priv,
|
|||
return selinux_ip_output(skb, PF_INET);
|
||||
}
|
||||
|
||||
/* SYNACK messages might be attached to request sockets.
|
||||
* To get back to sk_security, we need to look at the listener.
|
||||
*/
|
||||
static struct sock *selinux_skb_sk(const struct sk_buff *skb)
|
||||
{
|
||||
struct sock *sk = skb->sk;
|
||||
|
||||
if (sk && sk->sk_state == TCP_NEW_SYN_RECV)
|
||||
sk = inet_reqsk(sk)->rsk_listener;
|
||||
return sk;
|
||||
}
|
||||
|
||||
static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
|
||||
int ifindex,
|
||||
u16 family)
|
||||
{
|
||||
struct sock *sk = skb->sk;
|
||||
struct sock *sk = selinux_skb_sk(skb);
|
||||
struct sk_security_struct *sksec;
|
||||
struct common_audit_data ad;
|
||||
struct lsm_network_audit net = {0,};
|
||||
|
@ -4990,7 +5002,7 @@ static unsigned int selinux_ip_postroute(struct sk_buff *skb,
|
|||
if (!secmark_active && !peerlbl_active)
|
||||
return NF_ACCEPT;
|
||||
|
||||
sk = skb->sk;
|
||||
sk = selinux_skb_sk(skb);
|
||||
|
||||
#ifdef CONFIG_XFRM
|
||||
/* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
|
||||
|
@ -5035,8 +5047,6 @@ static unsigned int selinux_ip_postroute(struct sk_buff *skb,
|
|||
u32 skb_sid;
|
||||
struct sk_security_struct *sksec;
|
||||
|
||||
if (sk->sk_state == TCP_NEW_SYN_RECV)
|
||||
sk = inet_reqsk(sk)->rsk_listener;
|
||||
sksec = sk->sk_security;
|
||||
if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
|
||||
return NF_DROP;
|
||||
|
|
Loading…
Reference in a new issue