AcoSail/kernel_optimize_test
8
0
Fork 0
forked from luck/tmp_suning_uos_patched
Code Pull Requests Activity

socket: fix struct ifreq size in compat ioctl

Browse Source 
As reported by Reobert O'Callahan, since Viro's commit to kill
dev_ifsioc() we attempt to copy too much data in compat mode,
which may lead to EFAULT when the 32-bit version of struct ifreq
sits at/near the end of a page boundary, and the next page isn't
mapped.

Fix this by passing the approprate compat/non-compat size to copy
and using that, as before the dev_ifsioc() removal. This works
because only the embedded "struct ifmap" has different size, and
this is only used in SIOCGIFMAP/SIOCSIFMAP which has a different
handler. All other parts of the union are naturally compatible.

This fixes https://bugzilla.kernel.org/show_bug.cgi?id=199469.

Fixes: bf4405737f ("kill dev_ifsioc()")
Reported-by: Robert O'Callahan <robert@ocallahan.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Johannes Berg 2018-09-13 14:40:55 +02:00 committed by David S. Miller
parent c56cae23c6
commit 1cebf8f143
1 changed files with 14 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
net/socket.c
View File

@ -941,7 +941,8 @@ void dlci_ioctl_set(int (*hook) (unsigned int, void __user *))
EXPORT_SYMBOL(dlci_ioctl_set); EXPORT_SYMBOL(dlci_ioctl_set);
static long sock_do_ioctl(struct net *net, struct socket *sock, static long sock_do_ioctl(struct net *net, struct socket *sock,
unsigned int cmd, unsigned long arg) unsigned int cmd, unsigned long arg,
unsigned int ifreq_size)
{ {
int err; int err;
void __user *argp = (void __user *)arg; void __user *argp = (void __user *)arg;
@ -967,11 +968,11 @@ static long sock_do_ioctl(struct net *net, struct socket *sock,
} else { } else {
struct ifreq ifr; struct ifreq ifr;
bool need_copyout; bool need_copyout;
if (copy_from_user(&ifr, argp, sizeof(struct ifreq))) if (copy_from_user(&ifr, argp, ifreq_size))
return -EFAULT; return -EFAULT;
err = dev_ioctl(net, cmd, &ifr, &need_copyout); err = dev_ioctl(net, cmd, &ifr, &need_copyout);
if (!err && need_copyout) if (!err && need_copyout)
if (copy_to_user(argp, &ifr, sizeof(struct ifreq))) if (copy_to_user(argp, &ifr, ifreq_size))
return -EFAULT; return -EFAULT;
} }
return err; return err;
@ -1070,7 +1071,8 @@ static long sock_ioctl(struct file *file, unsigned cmd, unsigned long arg)
err = open_related_ns(&net->ns, get_net_ns); err = open_related_ns(&net->ns, get_net_ns);
break; break;
default: default:
err = sock_do_ioctl(net, sock, cmd, arg); err = sock_do_ioctl(net, sock, cmd, arg,
sizeof(struct ifreq));
break; break;
} }
return err; return err;
@ -2750,7 +2752,8 @@ static int do_siocgstamp(struct net *net, struct socket *sock,
int err; int err;
set_fs(KERNEL_DS); set_fs(KERNEL_DS);
err = sock_do_ioctl(net, sock, cmd, (unsigned long)&ktv); err = sock_do_ioctl(net, sock, cmd, (unsigned long)&ktv,
sizeof(struct compat_ifreq));
set_fs(old_fs); set_fs(old_fs);
if (!err) if (!err)
err = compat_put_timeval(&ktv, up); err = compat_put_timeval(&ktv, up);
@ -2766,7 +2769,8 @@ static int do_siocgstampns(struct net *net, struct socket *sock,
int err; int err;
set_fs(KERNEL_DS); set_fs(KERNEL_DS);
err = sock_do_ioctl(net, sock, cmd, (unsigned long)&kts); err = sock_do_ioctl(net, sock, cmd, (unsigned long)&kts,
sizeof(struct compat_ifreq));
set_fs(old_fs); set_fs(old_fs);
if (!err) if (!err)
err = compat_put_timespec(&kts, up); err = compat_put_timespec(&kts, up);
@ -3072,7 +3076,8 @@ static int routing_ioctl(struct net *net, struct socket *sock,
} }
set_fs(KERNEL_DS); set_fs(KERNEL_DS);
ret = sock_do_ioctl(net, sock, cmd, (unsigned long) r); ret = sock_do_ioctl(net, sock, cmd, (unsigned long) r,
sizeof(struct compat_ifreq));
set_fs(old_fs); set_fs(old_fs);
out: out:
@ -3185,7 +3190,8 @@ static int compat_sock_ioctl_trans(struct file *file, struct socket *sock,
case SIOCBONDSETHWADDR: case SIOCBONDSETHWADDR:
case SIOCBONDCHANGEACTIVE: case SIOCBONDCHANGEACTIVE:
case SIOCGIFNAME: case SIOCGIFNAME:
return sock_do_ioctl(net, sock, cmd, arg); return sock_do_ioctl(net, sock, cmd, arg,
sizeof(struct compat_ifreq));
} }
return -ENOIOCTLCMD; return -ENOIOCTLCMD;