Cong Wang e41f054847 tipc: use the right skb in tipc_sk_fill_sock_diag() ...

Commit 4b2e6877b8 ("tipc: Fix namespace violation in tipc_sk_fill_sock_diag")
tried to fix the crash but failed, the crash is still 100% reproducible
with it.

In tipc_sk_fill_sock_diag(), skb is the diag dump we are filling, it is not
correct to retrieve its NETLINK_CB(), instead, like other protocol diag,
we should use NETLINK_CB(cb->skb).sk here.

Reported-by: <syzbot+326e587eff1074657718@syzkaller.appspotmail.com>
Fixes: 4b2e6877b8 ("tipc: Fix namespace violation in tipc_sk_fill_sock_diag")
Fixes: c30b70deb5 (tipc: implement socket diagnostics for AF_TIPC)
Cc: GhantaKrishnamurthy MohanKrishna <mohan.krishna.ghanta.krishnamurthy@ericsson.com>
Cc: Jon Maloy <jon.maloy@ericsson.com>
Cc: Ying Xue <ying.xue@windriver.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

2018-04-08 12:34:29 -04:00

..

addr.c

tipc: handle collisions of 32-bit node address hash values

2018-03-23 13:12:18 -04:00

addr.h

tipc: add 128-bit node identifier

2018-03-23 13:12:18 -04:00

bcast.c

tipc: bcast: use true and false for boolean values

2018-03-07 12:18:00 -05:00

bcast.h

…

bearer.c

tipc: obtain node identity from interface by default

2018-03-23 13:12:18 -04:00

bearer.h

tipc: some cleanups in the file discover.c

2018-03-23 13:12:17 -04:00

core.c

net: Drop pernet_operations::async

2018-03-27 13:18:09 -04:00

core.h

tipc: replace name table service range array with rb tree

2018-03-31 22:19:52 -04:00

diag.c

tipc: use the right skb in tipc_sk_fill_sock_diag()

2018-04-08 12:34:29 -04:00

discover.c

tipc: tipc_disc_addr_trial_msg() can be static

2018-03-25 21:21:43 -04:00

discover.h

tipc: some cleanups in the file discover.c

2018-03-23 13:12:17 -04:00

eth_media.c

…

group.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2018-03-06 01:20:46 -05:00

group.h

tipc: fix race between poll() and setsockopt()

2018-01-19 15:12:21 -05:00

ib_media.c

…

Kconfig

tipc: implement socket diagnostics for AF_TIPC

2018-03-22 14:43:35 -04:00

link.c

tipc: avoid possible string overflow

2018-03-31 22:19:52 -04:00

link.h

tipc: handle collisions of 32-bit node address hash values

2018-03-23 13:12:18 -04:00

Makefile

tipc: implement socket diagnostics for AF_TIPC

2018-03-22 14:43:35 -04:00

monitor.c

tipc: fix tipc_mon_delete() oops in tipc_enable_bearer() error path

2017-12-27 10:55:00 -05:00

monitor.h

…

msg.c

tipc: obsolete TIPC_ZONE_SCOPE

2018-03-17 17:11:46 -04:00

msg.h

tipc: handle collisions of 32-bit node address hash values

2018-03-23 13:12:18 -04:00

name_distr.c

tipc: permit overlapping service ranges in name table

2018-03-31 22:19:52 -04:00

name_distr.h

tipc: permit overlapping service ranges in name table

2018-03-31 22:19:52 -04:00

name_table.c

tipc: permit overlapping service ranges in name table

2018-03-31 22:19:52 -04:00

name_table.h

tipc: permit overlapping service ranges in name table

2018-03-31 22:19:52 -04:00

net.c

tipc: permit overlapping service ranges in name table

2018-03-31 22:19:52 -04:00

net.h

tipc: obtain node identity from interface by default

2018-03-23 13:12:18 -04:00

netlink_compat.c

tipc: Fix missing RTNL lock protection during setting link properties

2018-02-14 14:46:33 -05:00

netlink.c

…

netlink.h

…

node.c

tipc: permit overlapping service ranges in name table

2018-03-31 22:19:52 -04:00

node.h

tipc: handle collisions of 32-bit node address hash values

2018-03-23 13:12:18 -04:00

socket.c

tipc: use the right skb in tipc_sk_fill_sock_diag()

2018-04-08 12:34:29 -04:00

socket.h

tipc: use the right skb in tipc_sk_fill_sock_diag()

2018-04-08 12:34:29 -04:00

subscr.c

tipc: Fix missing list initializations in struct tipc_subscription

2018-04-04 11:33:52 -04:00

subscr.h

tipc: replace name table service range array with rb tree

2018-03-31 22:19:52 -04:00

sysctl.c

…

topsrv.c

tipc: don't call sock_release() in atomic context

2018-02-19 14:38:50 -05:00

topsrv.h

tipc: rename tipc_server to tipc_topsrv

2018-02-16 15:26:34 -05:00

udp_media.c

tipc: fix error handling in tipc_udp_enable()

2018-03-27 10:50:02 -04:00

udp_media.h

…