Cong Wang e41f054847 tipc: use the right skb in tipc_sk_fill_sock_diag() ...

Commit 4b2e6877b8 ("tipc: Fix namespace violation in tipc_sk_fill_sock_diag")
tried to fix the crash but failed, the crash is still 100% reproducible
with it.

In tipc_sk_fill_sock_diag(), skb is the diag dump we are filling, it is not
correct to retrieve its NETLINK_CB(), instead, like other protocol diag,
we should use NETLINK_CB(cb->skb).sk here.

Reported-by: <syzbot+326e587eff1074657718@syzkaller.appspotmail.com>
Fixes: 4b2e6877b8 ("tipc: Fix namespace violation in tipc_sk_fill_sock_diag")
Fixes: c30b70deb5 (tipc: implement socket diagnostics for AF_TIPC)
Cc: GhantaKrishnamurthy MohanKrishna <mohan.krishna.ghanta.krishnamurthy@ericsson.com>
Cc: Jon Maloy <jon.maloy@ericsson.com>
Cc: Ying Xue <ying.xue@windriver.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

2018-04-08 12:34:29 -04:00

..

addr.c

tipc: handle collisions of 32-bit node address hash values

2018-03-23 13:12:18 -04:00

addr.h

tipc: add 128-bit node identifier

2018-03-23 13:12:18 -04:00

bcast.c

…

bcast.h

…

bearer.c

tipc: obtain node identity from interface by default

2018-03-23 13:12:18 -04:00

bearer.h

tipc: some cleanups in the file discover.c

2018-03-23 13:12:17 -04:00

core.c

net: Drop pernet_operations::async

2018-03-27 13:18:09 -04:00

core.h

tipc: replace name table service range array with rb tree

2018-03-31 22:19:52 -04:00

diag.c

tipc: use the right skb in tipc_sk_fill_sock_diag()

2018-04-08 12:34:29 -04:00

discover.c

tipc: tipc_disc_addr_trial_msg() can be static

2018-03-25 21:21:43 -04:00

discover.h

tipc: some cleanups in the file discover.c

2018-03-23 13:12:17 -04:00

eth_media.c

…

group.c

…

group.h

…

ib_media.c

…

Kconfig

tipc: implement socket diagnostics for AF_TIPC

2018-03-22 14:43:35 -04:00

link.c

tipc: avoid possible string overflow

2018-03-31 22:19:52 -04:00

link.h

tipc: handle collisions of 32-bit node address hash values

2018-03-23 13:12:18 -04:00

Makefile

tipc: implement socket diagnostics for AF_TIPC

2018-03-22 14:43:35 -04:00

monitor.c

…

monitor.h

…

msg.c

…

msg.h

tipc: handle collisions of 32-bit node address hash values

2018-03-23 13:12:18 -04:00

name_distr.c

tipc: permit overlapping service ranges in name table

2018-03-31 22:19:52 -04:00

name_distr.h

tipc: permit overlapping service ranges in name table

2018-03-31 22:19:52 -04:00

name_table.c

tipc: permit overlapping service ranges in name table

2018-03-31 22:19:52 -04:00

name_table.h

tipc: permit overlapping service ranges in name table

2018-03-31 22:19:52 -04:00

net.c

tipc: permit overlapping service ranges in name table

2018-03-31 22:19:52 -04:00

net.h

tipc: obtain node identity from interface by default

2018-03-23 13:12:18 -04:00

netlink_compat.c

…

netlink.c

…

netlink.h

…

node.c

tipc: permit overlapping service ranges in name table

2018-03-31 22:19:52 -04:00

node.h

tipc: handle collisions of 32-bit node address hash values

2018-03-23 13:12:18 -04:00

socket.c

tipc: use the right skb in tipc_sk_fill_sock_diag()

2018-04-08 12:34:29 -04:00

socket.h

tipc: use the right skb in tipc_sk_fill_sock_diag()

2018-04-08 12:34:29 -04:00

subscr.c

tipc: Fix missing list initializations in struct tipc_subscription

2018-04-04 11:33:52 -04:00

subscr.h

tipc: replace name table service range array with rb tree

2018-03-31 22:19:52 -04:00

sysctl.c

…

topsrv.c

…

topsrv.h

…

udp_media.c

tipc: fix error handling in tipc_udp_enable()

2018-03-27 10:50:02 -04:00

udp_media.h

…