Commit 68dd02d1 authored by Johannes Berg's avatar Johannes Berg
Browse files

dev_ioctl: copy only the smaller struct iwreq for wext 

Unfortunately, struct iwreq isn't a proper subset of struct ifreq,
but is still handled by the same code path. Robert reported that
then applications may (randomly) fault if the struct iwreq they
pass happens to land within 8 bytes of the end of a mapping (the
struct is only 32 bytes, vs. struct ifreq's 40 bytes).

To fix this, pull out the code handling wireless extension ioctls
and copy only the smaller structure in this case.

This bug goes back a long time, I tracked that it was introduced
into mainline in 2.1.15, over 20 years ago!

This fixes https://bugzilla.kernel.org/show_bug.cgi?id=195869



Reported-by: default avatarRobert O'Callahan <robert@ocallahan.org>
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent 4f39a1f5

include/net/wext.h

+2 −2
Original line number Diff line number Diff line
@@ -6,7 +6,7 @@ 
struct net;



#ifdef CONFIG_WEXT_CORE

int wext_handle_ioctl(struct net *net, struct ifreq *ifr, unsigned int cmd,

int wext_handle_ioctl(struct net *net, struct iwreq *iwr, unsigned int cmd,

		      void __user *arg);

int compat_wext_handle_ioctl(struct net *net, unsigned int cmd,

			     unsigned long arg);
@@ -14,7 +14,7 @@ int compat_wext_handle_ioctl(struct net *net, unsigned int cmd, 
struct iw_statistics *get_wireless_stats(struct net_device *dev);

int call_commit_handler(struct net_device *dev);

#else

static inline int wext_handle_ioctl(struct net *net, struct ifreq *ifr, unsigned int cmd,

static inline int wext_handle_ioctl(struct net *net, struct iwreq *iwr, unsigned int cmd,

				    void __user *arg)

{

	return -EINVAL;

net/core/dev_ioctl.c

+16 −3
Original line number Diff line number Diff line
@@ -410,6 +410,22 @@ int dev_ioctl(struct net *net, unsigned int cmd, void __user *arg) 
	if (cmd == SIOCGIFNAME)

		return dev_ifname(net, (struct ifreq __user *)arg);



	/*

	 * Take care of Wireless Extensions. Unfortunately struct iwreq

	 * isn't a proper subset of struct ifreq (it's 8 byte shorter)

	 * so we need to treat it specially, otherwise applications may

	 * fault if the struct they're passing happens to land at the

	 * end of a mapped page.

	 */

	if (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST) {

		struct iwreq iwr;



		if (copy_from_user(&iwr, arg, sizeof(iwr)))

			return -EFAULT;



		return wext_handle_ioctl(net, &iwr, cmd, arg);

	}



	if (copy_from_user(&ifr, arg, sizeof(struct ifreq)))

		return -EFAULT;
@@ -559,9 +575,6 @@ int dev_ioctl(struct net *net, unsigned int cmd, void __user *arg) 
				ret = -EFAULT;

			return ret;

		}

		/* Take care of Wireless Extensions */

		if (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST)

			return wext_handle_ioctl(net, &ifr, cmd, arg);

		return -ENOTTY;

	}

}

net/wireless/wext-core.c

+3 −3
Original line number Diff line number Diff line
@@ -1035,18 +1035,18 @@ static int ioctl_standard_call(struct net_device * dev, 
}





int wext_handle_ioctl(struct net *net, struct ifreq *ifr, unsigned int cmd,

int wext_handle_ioctl(struct net *net, struct iwreq *iwr, unsigned int cmd,

		      void __user *arg)

{

	struct iw_request_info info = { .cmd = cmd, .flags = 0 };

	int ret;



	ret = wext_ioctl_dispatch(net, (void *)ifr, cmd, &info,

	ret = wext_ioctl_dispatch(net, iwr, cmd, &info,

				  ioctl_standard_call,

				  ioctl_private_call);

	if (ret >= 0 &&

	    IW_IS_GET(cmd) &&

	    copy_to_user(arg, ifr, sizeof(struct iwreq)))

	    copy_to_user(arg, iwr, sizeof(struct iwreq)))

		return -EFAULT;



	return ret;

CRA Git | Maintained and supported by SUSTech CRA and CCSE