Patch "tap: tap_open(): correctly initialize socket uid" has been added to the 5.10-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    tap: tap_open(): correctly initialize socket uid

to the 5.10-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     tap-tap_open-correctly-initialize-socket-uid.patch
and it can be found in the queue-5.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit beca4633be20dce6d31e5fad5014f3833a866b1e
Author: Pietro Borrello <borrello@xxxxxxxxxxxxxxxx>
Date:   Sat Feb 4 17:39:22 2023 +0000

    tap: tap_open(): correctly initialize socket uid
    
    [ Upstream commit 66b2c338adce580dfce2199591e65e2bab889cff ]
    
    sock_init_data() assumes that the `struct socket` passed in input is
    contained in a `struct socket_alloc` allocated with sock_alloc().
    However, tap_open() passes a `struct socket` embedded in a `struct
    tap_queue` allocated with sk_alloc().
    This causes a type confusion when issuing a container_of() with
    SOCK_INODE() in sock_init_data() which results in assigning a wrong
    sk_uid to the `struct sock` in input.
    On default configuration, the type confused field overlaps with
    padding bytes between `int vnet_hdr_sz` and `struct tap_dev __rcu
    *tap` in `struct tap_queue`, which makes the uid of all tap sockets 0,
    i.e., the root one.
    Fix the assignment by using sock_init_data_uid().
    
    Fixes: 86741ec25462 ("net: core: Add a UID field to struct sock.")
    Signed-off-by: Pietro Borrello <borrello@xxxxxxxxxxxxxxxx>
    Reviewed-by: Eric Dumazet <edumazet@xxxxxxxxxx>
    Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/net/tap.c b/drivers/net/tap.c
index 8f7bb15206e9f..d9018d9fe3106 100644
--- a/drivers/net/tap.c
+++ b/drivers/net/tap.c
@@ -523,7 +523,7 @@ static int tap_open(struct inode *inode, struct file *file)
 	q->sock.state = SS_CONNECTED;
 	q->sock.file = file;
 	q->sock.ops = &tap_socket_ops;
-	sock_init_data(&q->sock, &q->sk);
+	sock_init_data_uid(&q->sock, &q->sk, inode->i_uid);
 	q->sk.sk_write_space = tap_sock_write_space;
 	q->sk.sk_destruct = tap_sock_destruct;
 	q->flags = IFF_VNET_HDR | IFF_NO_PI | IFF_TAP;