ipv6: invert flowlabel sharing check in process and user mode

A request for a flowlabel fails in process or user exclusive mode must
fail if the caller pid or uid does not match. Invert the test.

Previously, the test was unsafe wrt PID recycling, but indeed tested
for inequality: fl1->owner != fl->owner

Fixes: 4f82f45730c68 ("net ip6 flowlabel: Make owner a union of struct pid* and kuid_t")
Signed-off-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index cb54a8a3c2735221ec0ee1feaa63c28d3383b5cf..a05036bc808d531a249027a9bd31ef796a08f6e2 100644 (file)
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -633,9 +633,9 @@ int ipv6_flowlabel_opt(struct sock *sk, char __user *optval, int optlen)
                                if (fl1->share == IPV6_FL_S_EXCL ||
                                    fl1->share != fl->share ||
                                    ((fl1->share == IPV6_FL_S_PROCESS) &&
-                                    (fl1->owner.pid == fl->owner.pid)) ||
+                                    (fl1->owner.pid != fl->owner.pid)) ||
                                    ((fl1->share == IPV6_FL_S_USER) &&
-                                    uid_eq(fl1->owner.uid, fl->owner.uid)))
+                                    !uid_eq(fl1->owner.uid, fl->owner.uid)))
                                        goto release;
 
                                err = -ENOMEM;