Re: [PATCH urgent] netlink: Only check file credentials for implicit destinations

[Jiri Benc <jbenc@redhat.com>]

On Fri, 30 May 2014 11:04:00 -0700, Andy Lutomirski wrote:
> --- a/net/netlink/af_netlink.c
> +++ b/net/netlink/af_netlink.c
> @@ -1373,7 +1373,9 @@ retry:
>  bool __netlink_ns_capable(const struct netlink_skb_parms *nsp,
>  			struct user_namespace *user_ns, int cap)
>  {
> -	return sk_ns_capable(nsp->sk, user_ns, cap);
> +	return ((nsp->flags & NETLINK_SKB_DST) ||
> +		file_ns_capable(nsp->sk->sk_socket->file, user_ns, cap)) &&
> +		ns_capable(user_ns, cap);

Sorry if I'm missing something. Is socket->file valid (non-NULL) in
kernel->kernel netlink communication? I don't think it's assigned for
sockets created by netlink_kernel_create, is it? Seems this would cause
NULL ptr dereference.

But then, I don't even know whether kernel->kernel netlink
communication is allowed.

(I'm aware that if this is really the case the NULL ptr deref is not
caused by this patch but by the one this is fixing.)

Thanks,

 Jiri

-- 
Jiri Benc