Patch "tun: tun_chr_open(): correctly initialize socket uid" has been added to the 5.10-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    tun: tun_chr_open(): correctly initialize socket uid

to the 5.10-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     tun-tun_chr_open-correctly-initialize-socket-uid.patch
and it can be found in the queue-5.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit e343a83c2270932f686c35a32a230d4cd6795165
Author: Pietro Borrello <borrello@xxxxxxxxxxxxxxxx>
Date:   Sat Feb 4 17:39:21 2023 +0000

    tun: tun_chr_open(): correctly initialize socket uid
    
    [ Upstream commit a096ccca6e503a5c575717ff8a36ace27510ab0a ]
    
    sock_init_data() assumes that the `struct socket` passed in input is
    contained in a `struct socket_alloc` allocated with sock_alloc().
    However, tun_chr_open() passes a `struct socket` embedded in a `struct
    tun_file` allocated with sk_alloc().
    This causes a type confusion when issuing a container_of() with
    SOCK_INODE() in sock_init_data() which results in assigning a wrong
    sk_uid to the `struct sock` in input.
    On default configuration, the type confused field overlaps with the
    high 4 bytes of `struct tun_struct __rcu *tun` of `struct tun_file`,
    NULL at the time of call, which makes the uid of all tun sockets 0,
    i.e., the root one.
    Fix the assignment by using sock_init_data_uid().
    
    Fixes: 86741ec25462 ("net: core: Add a UID field to struct sock.")
    Signed-off-by: Pietro Borrello <borrello@xxxxxxxxxxxxxxxx>
    Reviewed-by: Eric Dumazet <edumazet@xxxxxxxxxx>
    Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 67ce7b779af61..f1d46aea8a2ba 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -3457,7 +3457,7 @@ static int tun_chr_open(struct inode *inode, struct file * file)
 	tfile->socket.file = file;
 	tfile->socket.ops = &tun_socket_ops;
 
-	sock_init_data(&tfile->socket, &tfile->sk);
+	sock_init_data_uid(&tfile->socket, &tfile->sk, inode->i_uid);
 
 	tfile->sk.sk_write_space = tun_sock_write_space;
 	tfile->sk.sk_sndbuf = INT_MAX;