diff options
| author | Cong Wang <xiyou.wangcong@gmail.com> | 2018-04-06 18:54:52 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2018-04-08 12:34:29 -0400 |
| commit | e41f0548473eb7b6499bd8482474e30ae6d31220 (patch) | |
| tree | 4704a448a00e5ab58d5b5972a6a47629ea8df610 /net/tipc/socket.h | |
| parent | 81e98370293afcb58340ce8bd71af7b97f925c26 (diff) | |
tipc: use the right skb in tipc_sk_fill_sock_diag()
Commit 4b2e6877b879 ("tipc: Fix namespace violation in tipc_sk_fill_sock_diag")
tried to fix the crash but failed, the crash is still 100% reproducible
with it.
In tipc_sk_fill_sock_diag(), skb is the diag dump we are filling, it is not
correct to retrieve its NETLINK_CB(), instead, like other protocol diag,
we should use NETLINK_CB(cb->skb).sk here.
Reported-by: <syzbot+326e587eff1074657718@syzkaller.appspotmail.com>
Fixes: 4b2e6877b879 ("tipc: Fix namespace violation in tipc_sk_fill_sock_diag")
Fixes: c30b70deb5f4 (tipc: implement socket diagnostics for AF_TIPC)
Cc: GhantaKrishnamurthy MohanKrishna <mohan.krishna.ghanta.krishnamurthy@ericsson.com>
Cc: Jon Maloy <jon.maloy@ericsson.com>
Cc: Ying Xue <ying.xue@windriver.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/tipc/socket.h')
| -rw-r--r-- | net/tipc/socket.h | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/net/tipc/socket.h b/net/tipc/socket.h index aae3fd4cd06c..aff9b2ae5a1f 100644 --- a/net/tipc/socket.h +++ b/net/tipc/socket.h @@ -61,8 +61,8 @@ int tipc_sk_rht_init(struct net *net); void tipc_sk_rht_destroy(struct net *net); int tipc_nl_sk_dump(struct sk_buff *skb, struct netlink_callback *cb); int tipc_nl_publ_dump(struct sk_buff *skb, struct netlink_callback *cb); -int tipc_sk_fill_sock_diag(struct sk_buff *skb, struct tipc_sock *tsk, - u32 sk_filter_state, +int tipc_sk_fill_sock_diag(struct sk_buff *skb, struct netlink_callback *cb, + struct tipc_sock *tsk, u32 sk_filter_state, u64 (*tipc_diag_gen_cookie)(struct sock *sk)); int tipc_nl_sk_walk(struct sk_buff *skb, struct netlink_callback *cb, int (*skb_handler)(struct sk_buff *skb, |