diff options
| author | Paul Moore <paul@paul-moore.com> | 2021-10-19 12:19:44 -0400 |
|---|---|---|
| committer | Paul Moore <paul@paul-moore.com> | 2021-10-19 12:35:18 -0400 |
| commit | 1c73213ba991d26a91282e775d1f5a60e41e5184 (patch) | |
| tree | e555b8e1ba2231f6419aca576fc46d6af3ea25cd /security | |
| parent | 4d5b5539742d2554591751b4248b0204d20dcc9d (diff) | |
selinux: fix a sock regression in selinux_ip_postroute_compat()
Unfortunately we can't rely on nf_hook_state->sk being the proper
originating socket so revert to using skb_to_full_sk(skb).
Fixes: 1d1e1ded1356 ("selinux: make better use of the nf_hook_state passed to the NF hooks")
Reported-by: Linux Kernel Functional Testing <lkft@linaro.org>
Suggested-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Diffstat (limited to 'security')
| -rw-r--r-- | security/selinux/hooks.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index b4a1bde20261..6f08cd2fc6a8 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -5778,9 +5778,9 @@ static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb, struct lsm_network_audit net = {0,}; u8 proto; - if (state->sk == NULL) - return NF_ACCEPT; sk = skb_to_full_sk(skb); + if (sk == NULL) + return NF_ACCEPT; sksec = sk->sk_security; ad.type = LSM_AUDIT_DATA_NET; |