xt_qtaguid: Fix panic caused by synack processing
authorJohn Stultz <john.stultz@linaro.org>
Sat, 23 Apr 2016 00:12:57 +0000 (17:12 -0700)
committerAmit Pundir <amit.pundir@linaro.org>
Thu, 19 May 2016 07:05:13 +0000 (12:35 +0530)
commit202d12a1f733a252ee76f4cc497c9ce86270ebb2
tree8fb559aef5d3efb761e890ff873e7baee352d184
parent52a20402ae1d5d81ddccd2be2a9f62283cc256e7
xt_qtaguid: Fix panic caused by synack processing

In upstream commit ca6fb06518836ef9b65dc0aac02ff97704d52a05
(tcp: attach SYNACK messages to request sockets instead of
listener)
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ca6fb0651883

The building of synack messages was changed, which made it so
the skb->sk points to a casted request_sock. This is problematic,
as there is no sk_socket in a request_sock. So when the qtaguid_mt
function tries to access the sk->sk_socket, it accesses uninitialized
memory.

After looking at how other netfilter implementations handle this,
I realized there was a skb_to_full_sk() helper added, which the
xt_qtaguid code isn't yet using.

This patch adds its use, and resovles panics seen when accessing
uninitialzed memory when processing synack packets.

Reported-by: YongQin Liu <yongquin.liu@linaro.org>
Signed-off-by: John Stultz <john.stultz@linaro.org>
net/netfilter/xt_qtaguid.c