From: Herbert Xu <herbert@gondor.apana.org.au>
To: Richard Weinberger <richard.weinberger@gmail.com>
Cc: "David S. Miller" <davem@davemloft.net>,
Thomas Graf <tgraf@suug.ch>,
Daniel Borkmann <daniel@iogearbox.net>,
Ken-ichirou MATSUZAWA <chamaken@gmail.com>,
Nicolas Dichtel <nicolas.dichtel@6wind.com>,
Florian Westphal <fw@strlen.de>, netdev <netdev@vger.kernel.org>,
LKML <linux-kernel@vger.kernel.org>,
syzkaller <syzkaller@googlegroups.com>,
Kostya Serebryany <kcc@google.com>,
Alexander Potapenko <glider@google.com>,
Sasha Levin <sasha.levin@oracle.com>,
Eric Dumazet <edumazet@google.com>,
Dmitry Vyukov <dvyukov@google.com>,
"Eric W. Biederman" <ebiederm@xmission.com>
Subject: Re: net: GPF in __netlink_ns_capable
Date: Mon, 18 Jan 2016 17:20:47 +0800 [thread overview]
Message-ID: <20160118092047.GA30682@gondor.apana.org.au> (raw)
In-Reply-To: <CAFLxGvzo6NRNsHsJwys6c+oSMUpQxdfDEkWG-qaSqqP=V3Sjdw@mail.gmail.com>
On Sat, Jan 16, 2016 at 01:08:33AM +0100, Richard Weinberger wrote:
> On Fri, Jan 15, 2016 at 11:31 PM, Dmitry Vyukov <dvyukov@google.com> wrote:
> > Call Trace:
> > [< inline >] netlink_ns_capable net/netlink/af_netlink.c:1417
> > [<ffffffff8529c0a5>] netlink_capable+0x25/0x30 net/netlink/af_netlink.c:1432
>
> Hmm, we're crashing because NETLINK_CB(skb).sk is NULL.
> netlink_dump() creates a new skb without a netlink control block,
> but infiniband's dump functions use netlink_capable() which needs a valid
> NETLINK_CB(skb).sk.
>
> What about something like that?
No you can't do it here as netlink_unicast also calls this and for
that case you'd be overwriting the original sending user-space
socket with the kernel socket.
I'm adding Eric Bierderman as he wrote some of the code in question.
Cheers,
--
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
next prev parent reply other threads:[~2016-01-18 9:21 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-01-15 22:31 Dmitry Vyukov
2016-01-16 0:08 ` Richard Weinberger
2016-01-18 9:20 ` Herbert Xu [this message]
2016-01-18 20:21 ` Eric W. Biederman
2016-01-18 20:26 ` Eric W. Biederman
2016-01-19 20:47 ` Wan, Kaike
2016-01-20 14:35 ` Wan, Kaike
2016-01-20 15:00 ` Herbert Xu
2016-01-20 18:14 ` Wan, Kaike
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160118092047.GA30682@gondor.apana.org.au \
--to=herbert@gondor.apana.org.au \
--cc=chamaken@gmail.com \
--cc=daniel@iogearbox.net \
--cc=davem@davemloft.net \
--cc=dvyukov@google.com \
--cc=ebiederm@xmission.com \
--cc=edumazet@google.com \
--cc=fw@strlen.de \
--cc=glider@google.com \
--cc=kcc@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=nicolas.dichtel@6wind.com \
--cc=richard.weinberger@gmail.com \
--cc=sasha.levin@oracle.com \
--cc=syzkaller@googlegroups.com \
--cc=tgraf@suug.ch \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®