All of lore.kernel.org
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Jeimon <jjjinmeng.zhou@gmail.com>,
	"David S . Miller" <davem@davemloft.net>,
	Sasha Levin <sashal@kernel.org>,
	linux-nfc@lists.01.org, netdev@vger.kernel.org
Subject: [PATCH AUTOSEL 4.19 02/23] net/nfc/rawsock.c: fix a permission check bug
Date: Thu,  3 Jun 2021 13:09:38 -0400	[thread overview]
Message-ID: <20210603170959.3169420-2-sashal@kernel.org> (raw)
In-Reply-To: <20210603170959.3169420-1-sashal@kernel.org>

From: Jeimon <jjjinmeng.zhou@gmail.com>

[ Upstream commit 8ab78863e9eff11910e1ac8bcf478060c29b379e ]

The function rawsock_create() calls a privileged function sk_alloc(), which requires a ns-aware check to check net->user_ns, i.e., ns_capable(). However, the original code checks the init_user_ns using capable(). So we replace the capable() with ns_capable().

Signed-off-by: Jeimon <jjjinmeng.zhou@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/nfc/rawsock.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/nfc/rawsock.c b/net/nfc/rawsock.c
index 57a07ab80d92..bdc72737fe24 100644
--- a/net/nfc/rawsock.c
+++ b/net/nfc/rawsock.c
@@ -345,7 +345,7 @@ static int rawsock_create(struct net *net, struct socket *sock,
 		return -ESOCKTNOSUPPORT;
 
 	if (sock->type == SOCK_RAW) {
-		if (!capable(CAP_NET_RAW))
+		if (!ns_capable(net->user_ns, CAP_NET_RAW))
 			return -EPERM;
 		sock->ops = &rawsock_raw_ops;
 	} else {
-- 
2.30.2


  reply	other threads:[~2021-06-03 17:14 UTC|newest]

Thread overview: 30+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-06-03 17:09 [PATCH AUTOSEL 4.19 01/23] spi: Fix spi device unregister flow Sasha Levin
2021-06-03 17:09 ` Sasha Levin [this message]
2021-06-03 17:09 ` [PATCH AUTOSEL 4.19 03/23] ASoC: Intel: bytcr_rt5640: Add quirk for the Glavey TM800A550L tablet Sasha Levin
2021-06-03 17:09   ` Sasha Levin
2021-06-03 17:09 ` [PATCH AUTOSEL 4.19 04/23] ASoC: Intel: bytcr_rt5640: Add quirk for the Lenovo Miix 3-830 tablet Sasha Levin
2021-06-03 17:09   ` Sasha Levin
2021-06-03 17:09 ` [PATCH AUTOSEL 4.19 05/23] ASoC: sti-sas: add missing MODULE_DEVICE_TABLE Sasha Levin
2021-06-03 17:09   ` Sasha Levin
2021-06-03 17:09 ` [PATCH AUTOSEL 4.19 06/23] isdn: mISDN: netjet: Fix crash in nj_probe: Sasha Levin
2021-06-03 17:09 ` [PATCH AUTOSEL 4.19 07/23] bonding: init notify_work earlier to avoid uninitialized use Sasha Levin
2021-06-03 17:09 ` [PATCH AUTOSEL 4.19 08/23] netlink: disable IRQs for netlink_lock_table() Sasha Levin
2021-06-03 17:09 ` [PATCH AUTOSEL 4.19 09/23] net: mdiobus: get rid of a BUG_ON() Sasha Levin
2021-06-03 17:09 ` [PATCH AUTOSEL 4.19 10/23] cgroup: disable controllers at parse time Sasha Levin
2021-06-03 17:09   ` Sasha Levin
2021-06-03 17:09 ` [PATCH AUTOSEL 4.19 11/23] wq: handle VM suspension in stall detection Sasha Levin
2021-06-03 17:09 ` [PATCH AUTOSEL 4.19 12/23] net/qla3xxx: fix schedule while atomic in ql_sem_spinlock Sasha Levin
2021-06-03 17:09 ` [PATCH AUTOSEL 4.19 13/23] RDS tcp loopback connection can hang Sasha Levin
2021-06-03 17:09 ` [PATCH AUTOSEL 4.19 14/23] scsi: bnx2fc: Return failure if io_req is already in ABTS processing Sasha Levin
2021-06-03 17:09 ` [PATCH AUTOSEL 4.19 15/23] scsi: vmw_pvscsi: Set correct residual data length Sasha Levin
2021-06-03 17:09 ` [PATCH AUTOSEL 4.19 16/23] scsi: target: qla2xxx: Wait for stop_phase1 at WWN removal Sasha Levin
2021-06-03 17:09 ` [PATCH AUTOSEL 4.19 17/23] net: macb: ensure the device is available before accessing GEMGXL control registers Sasha Levin
2021-06-03 17:09 ` [PATCH AUTOSEL 4.19 18/23] net: appletalk: cops: Fix data race in cops_probe1 Sasha Levin
2021-06-03 17:09 ` [PATCH AUTOSEL 4.19 19/23] nvme-fabrics: decode host pathing error for connect Sasha Levin
2021-06-03 17:09   ` Sasha Levin
2021-06-03 17:09 ` [PATCH AUTOSEL 4.19 20/23] MIPS: Fix kernel hang under FUNCTION_GRAPH_TRACER and PREEMPT_TRACER Sasha Levin
2021-06-03 17:09 ` [PATCH AUTOSEL 4.19 21/23] bnx2x: Fix missing error code in bnx2x_iov_init_one() Sasha Levin
2021-06-03 17:09 ` [PATCH AUTOSEL 4.19 22/23] powerpc/fsl: set fsl,i2c-erratum-a004447 flag for P2041 i2c controllers Sasha Levin
2021-06-03 17:09   ` [PATCH AUTOSEL 4.19 22/23] powerpc/fsl: set fsl, i2c-erratum-a004447 " Sasha Levin
2021-06-03 17:09 ` [PATCH AUTOSEL 4.19 23/23] powerpc/fsl: set fsl,i2c-erratum-a004447 flag for P1010 " Sasha Levin
2021-06-03 17:09   ` [PATCH AUTOSEL 4.19 23/23] powerpc/fsl: set fsl, i2c-erratum-a004447 " Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210603170959.3169420-2-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=davem@davemloft.net \
    --cc=jjjinmeng.zhou@gmail.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-nfc@lists.01.org \
    --cc=netdev@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.