Re: general protection fault in __netlink_ns_capable

On Tue, Jan 02, 2018 at 10:58:01AM -0800, syzbot wrote:

quoted

Hello,

syzkaller hit the following crash on
75aa5540627fdb3d8f86229776ea87f995275351
git://git.cmpxchg.org/linux-mmots.git/master
compiler: gcc (GCC) 7.1.1 20170620
.config is attached
Raw console output is attached.
C reproducer is attached
syzkaller reproducer is attached. See https://goo.gl/kgGztJ
for information about syzkaller reproducers


IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+e432865c29eb4c48c142@syzkaller.appspotmail.com
It will help syzbot understand when the bug is fixed. See footer for
details.
If you forward the report, please keep this part and the footer.

netlink: 3 bytes leftover after parsing attributes in process
`syzkaller140561'.
netlink: 3 bytes leftover after parsing attributes in process
`syzkaller140561'.
netlink: 3 bytes leftover after parsing attributes in process
`syzkaller140561'.
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 3149 Comm: syzkaller140561 Not tainted 4.15.0-rc4-mm1+ #47
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:__netlink_ns_capable+0x8b/0x120 net/netlink/af_netlink.c:868

NETLINK_CB(skb).sk is NULL here. It looks like we have to use
sk_ns_capable instead of netlink_ns_capable:

diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index c688dc564b11..408c75de52ea 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c

@@ -1762,7 +1762,7 @@ static struct net *get_target_net(struct sk_buff

*skb, int netnsid)
        /* For now, the caller is required to have CAP_NET_ADMIN in
         * the user namespace owning the target net ns.
         */
-       if (!netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN)) {
+       if (!sk_ns_capable(skb->sk, net->user_ns, CAP_NET_ADMIN)) {
                put_net(net);
                return ERR_PTR(-EACCES);
        }