Commit 3aed8225 authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller

netfilter: nft_meta: use skb_to_full_sk() helper

SYNACK packets might be attached to request sockets.

Fixes: ca6fb065 ("tcp: attach SYNACK messages to request sockets instead of listener")
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 02a56c81
...@@ -31,6 +31,7 @@ void nft_meta_get_eval(const struct nft_expr *expr, ...@@ -31,6 +31,7 @@ void nft_meta_get_eval(const struct nft_expr *expr,
const struct nft_meta *priv = nft_expr_priv(expr); const struct nft_meta *priv = nft_expr_priv(expr);
const struct sk_buff *skb = pkt->skb; const struct sk_buff *skb = pkt->skb;
const struct net_device *in = pkt->in, *out = pkt->out; const struct net_device *in = pkt->in, *out = pkt->out;
struct sock *sk;
u32 *dest = &regs->data[priv->dreg]; u32 *dest = &regs->data[priv->dreg];
switch (priv->key) { switch (priv->key) {
...@@ -86,33 +87,35 @@ void nft_meta_get_eval(const struct nft_expr *expr, ...@@ -86,33 +87,35 @@ void nft_meta_get_eval(const struct nft_expr *expr,
*(u16 *)dest = out->type; *(u16 *)dest = out->type;
break; break;
case NFT_META_SKUID: case NFT_META_SKUID:
if (skb->sk == NULL || !sk_fullsock(skb->sk)) sk = skb_to_full_sk(skb);
if (!sk || !sk_fullsock(sk))
goto err; goto err;
read_lock_bh(&skb->sk->sk_callback_lock); read_lock_bh(&sk->sk_callback_lock);
if (skb->sk->sk_socket == NULL || if (sk->sk_socket == NULL ||
skb->sk->sk_socket->file == NULL) { sk->sk_socket->file == NULL) {
read_unlock_bh(&skb->sk->sk_callback_lock); read_unlock_bh(&sk->sk_callback_lock);
goto err; goto err;
} }
*dest = from_kuid_munged(&init_user_ns, *dest = from_kuid_munged(&init_user_ns,
skb->sk->sk_socket->file->f_cred->fsuid); sk->sk_socket->file->f_cred->fsuid);
read_unlock_bh(&skb->sk->sk_callback_lock); read_unlock_bh(&sk->sk_callback_lock);
break; break;
case NFT_META_SKGID: case NFT_META_SKGID:
if (skb->sk == NULL || !sk_fullsock(skb->sk)) sk = skb_to_full_sk(skb);
if (!sk || !sk_fullsock(sk))
goto err; goto err;
read_lock_bh(&skb->sk->sk_callback_lock); read_lock_bh(&sk->sk_callback_lock);
if (skb->sk->sk_socket == NULL || if (sk->sk_socket == NULL ||
skb->sk->sk_socket->file == NULL) { sk->sk_socket->file == NULL) {
read_unlock_bh(&skb->sk->sk_callback_lock); read_unlock_bh(&sk->sk_callback_lock);
goto err; goto err;
} }
*dest = from_kgid_munged(&init_user_ns, *dest = from_kgid_munged(&init_user_ns,
skb->sk->sk_socket->file->f_cred->fsgid); sk->sk_socket->file->f_cred->fsgid);
read_unlock_bh(&skb->sk->sk_callback_lock); read_unlock_bh(&sk->sk_callback_lock);
break; break;
#ifdef CONFIG_IP_ROUTE_CLASSID #ifdef CONFIG_IP_ROUTE_CLASSID
case NFT_META_RTCLASSID: { case NFT_META_RTCLASSID: {
...@@ -168,9 +171,10 @@ void nft_meta_get_eval(const struct nft_expr *expr, ...@@ -168,9 +171,10 @@ void nft_meta_get_eval(const struct nft_expr *expr,
break; break;
#ifdef CONFIG_CGROUP_NET_CLASSID #ifdef CONFIG_CGROUP_NET_CLASSID
case NFT_META_CGROUP: case NFT_META_CGROUP:
if (skb->sk == NULL || !sk_fullsock(skb->sk)) sk = skb_to_full_sk(skb);
if (!sk || !sk_fullsock(sk))
goto err; goto err;
*dest = skb->sk->sk_classid; *dest = sk->sk_classid;
break; break;
#endif #endif
default: default:
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment