tipc: fix null deref crash in compat config path

msg.dst_sk needs to be set up with a valid socket because some callbacks later derive the netns from it. Fixes: 263ea09084d172d ("Revert "genl: Add genlmsg_new_unicast() for unicast message allocation") Reported-by: Jon Maloy <[email protected]> Bisected-by: Jon Maloy <[email protected]> Signed-off-by: Florian Westphal <[email protected]> Acked-by Jon Maloy <[email protected]> Signed-off-by: David S. Miller <[email protected]>
beagleboard · Feb 25, 2016 · 619b174 · 619b174
1 parent d25a012
commit 619b174
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
@@ -1105,6 +1105,7 @@ static int tipc_nl_compat_recv(struct sk_buff *skb, struct genl_info *info)
 	msg.req = nlmsg_data(req_nlh) + GENL_HDRLEN + TIPC_GENL_HDRLEN;
 	msg.cmd = req_userhdr->cmd;
 	msg.net = genl_info_net(info);
+	msg.dst_sk = skb->sk;
 
 	if ((msg.cmd & 0xC000) && (!netlink_net_capable(skb, CAP_NET_ADMIN))) {
 		msg.rep = tipc_get_err_tlv(TIPC_CFG_NOT_NET_ADMIN);