Commit 1cebf8f1 authored by Johannes Berg's avatar Johannes Berg Committed by David S. Miller
Browse files

socket: fix struct ifreq size in compat ioctl 

As reported by Reobert O'Callahan, since Viro's commit to kill
dev_ifsioc() we attempt to copy too much data in compat mode,
which may lead to EFAULT when the 32-bit version of struct ifreq
sits at/near the end of a page boundary, and the next page isn't
mapped.

Fix this by passing the approprate compat/non-compat size to copy
and using that, as before the dev_ifsioc() removal. This works
because only the embedded "struct ifmap" has different size, and
this is only used in SIOCGIFMAP/SIOCSIFMAP which has a different
handler. All other parts of the union are naturally compatible.

This fixes https://bugzilla.kernel.org/show_bug.cgi?id=199469

.

Fixes: bf440573 ("kill dev_ifsioc()")
Reported-by: default avatarRobert O'Callahan <robert@ocallahan.org>
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent c56cae23

net/socket.c

+14 −8
Original line number Diff line number Diff line
@@ -941,7 +941,8 @@ void dlci_ioctl_set(int (*hook) (unsigned int, void __user *)) 
EXPORT_SYMBOL(dlci_ioctl_set);



static long sock_do_ioctl(struct net *net, struct socket *sock,

				 unsigned int cmd, unsigned long arg)

			  unsigned int cmd, unsigned long arg,

			  unsigned int ifreq_size)

{

	int err;

	void __user *argp = (void __user *)arg;
@@ -967,11 +968,11 @@ static long sock_do_ioctl(struct net *net, struct socket *sock, 
	} else {

		struct ifreq ifr;

		bool need_copyout;

		if (copy_from_user(&ifr, argp, sizeof(struct ifreq)))

		if (copy_from_user(&ifr, argp, ifreq_size))

			return -EFAULT;

		err = dev_ioctl(net, cmd, &ifr, &need_copyout);

		if (!err && need_copyout)

			if (copy_to_user(argp, &ifr, sizeof(struct ifreq)))

			if (copy_to_user(argp, &ifr, ifreq_size))

				return -EFAULT;

	}

	return err;
@@ -1070,7 +1071,8 @@ static long sock_ioctl(struct file *file, unsigned cmd, unsigned long arg) 
			err = open_related_ns(&net->ns, get_net_ns);

			break;

		default:

			err = sock_do_ioctl(net, sock, cmd, arg);

			err = sock_do_ioctl(net, sock, cmd, arg,

					    sizeof(struct ifreq));

			break;

		}

	return err;
@@ -2750,7 +2752,8 @@ static int do_siocgstamp(struct net *net, struct socket *sock, 
	int err;



	set_fs(KERNEL_DS);

	err = sock_do_ioctl(net, sock, cmd, (unsigned long)&ktv);

	err = sock_do_ioctl(net, sock, cmd, (unsigned long)&ktv,

			    sizeof(struct compat_ifreq));

	set_fs(old_fs);

	if (!err)

		err = compat_put_timeval(&ktv, up);
@@ -2766,7 +2769,8 @@ static int do_siocgstampns(struct net *net, struct socket *sock, 
	int err;



	set_fs(KERNEL_DS);

	err = sock_do_ioctl(net, sock, cmd, (unsigned long)&kts);

	err = sock_do_ioctl(net, sock, cmd, (unsigned long)&kts,

			    sizeof(struct compat_ifreq));

	set_fs(old_fs);

	if (!err)

		err = compat_put_timespec(&kts, up);
@@ -3072,7 +3076,8 @@ static int routing_ioctl(struct net *net, struct socket *sock, 
	}



	set_fs(KERNEL_DS);

	ret = sock_do_ioctl(net, sock, cmd, (unsigned long) r);

	ret = sock_do_ioctl(net, sock, cmd, (unsigned long) r,

			    sizeof(struct compat_ifreq));

	set_fs(old_fs);



out:
@@ -3185,7 +3190,8 @@ static int compat_sock_ioctl_trans(struct file *file, struct socket *sock, 
	case SIOCBONDSETHWADDR:

	case SIOCBONDCHANGEACTIVE:

	case SIOCGIFNAME:

		return sock_do_ioctl(net, sock, cmd, arg);

		return sock_do_ioctl(net, sock, cmd, arg,

				     sizeof(struct compat_ifreq));

	}



	return -ENOIOCTLCMD;

CRA Git | Maintained and supported by SUSTech CRA and CCSE