Peter Collingbourne d0efb16294 net: don't unconditionally copy_from_user a struct ifreq for socket ioctls ... A common implementation of isatty(3) involves calling a ioctl passing a dummy struct argument and checking whether the syscall failed -- bionic and glibc use TCGETS (passing a struct termios), and musl uses TIOCGWINSZ (passing a struct winsize). If the FD is a socket, we will copy sizeof(struct ifreq) bytes of data from the argument and return -EFAULT if that fails. The result is that the isatty implementations may return a non-POSIX-compliant value in errno in the case where part of the dummy struct argument is inaccessible, as both struct termios and struct winsize are smaller than struct ifreq (at least on arm64). Although there is usually enough stack space following the argument on the stack that this did not present a practical problem up to now, with MTE stack instrumentation it's more likely for the copy to fail, as the memory following the struct may have a different tag. Fix the problem by adding an early check for whether the ioctl is a valid socket ioctl, and return -ENOTTY if it isn't. Fixes: 44c02a2c3d ("dev_ioctl(): move copyin/copyout to callers") Link: https://linux-review.googlesource.com/id/I869da6cf6daabc3e4b7b82ac979683ba05e27d4d Signed-off-by: Peter Collingbourne <pcc@google.com> Cc: <stable@vger.kernel.org> # 4.19 Signed-off-by: David S. Miller <davem@davemloft.net>		2021-08-27 09:40:25 +01:00
..
6lowpan
9p	9p/trans_virtio: Fix spelling mistakes	2021-06-02 14:01:55 -07:00
802	net/802/garp: fix memleak in garp_request_join()	2021-07-01 11:21:57 -07:00
8021q	net: vlan: pass thru all GSO_SOFTWARE in hw_enc_features	2021-06-18 11:58:03 -07:00
appletalk	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2021-06-18 19:47:02 -07:00
atm	atm: Use list_for_each_entry() to simplify code in resources.c	2021-06-10 14:08:09 -07:00
ax25
batman-adv	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2021-06-18 19:47:02 -07:00
bluetooth	Bluetooth: defer cleanup of resources in hci_unregister_dev()	2021-08-05 12:15:24 -07:00
bpf	bpf: Add missing bpf_read_[un]lock_trace() for syscall program	2021-08-10 10:10:49 +02:00
bpfilter	bpfilter: Specify the log level for the kmsg message	2021-06-25 13:13:50 +02:00
bridge	net: bridge: fix memleak in br_add_if()	2021-08-10 13:25:14 -07:00
caif	net: fix uninit-value in caif_seqpkt_sendmsg	2021-07-15 11:08:33 -07:00
can	can: j1939: j1939_xtp_rx_dat_one(): fix rxtimer value between consecutive TP.DT to 750ms	2021-07-24 19:02:24 +02:00
ceph	Networking changes for 5.14.	2021-06-30 15:51:09 -07:00
core	rtnetlink: Return correct error on changing device netns	2021-08-26 12:08:08 +01:00
dcb	net: dcb: Return the correct errno code	2021-06-01 17:01:33 -07:00
dccp	dccp: add do-while-0 stubs for dccp_pr_debug macros	2021-08-09 10:00:02 +01:00
decnet	net: decnet: Fix sleeping inside in af_decnet	2021-07-16 14:06:16 -07:00
dns_resolver
dsa	net: switchdev: zero-initialize struct switchdev_notifier_fdb_info emitted by drivers towards the bridge	2021-08-10 13:22:57 -07:00
ethernet
ethtool	net: sock: extend SO_TIMESTAMPING for PHC binding	2021-07-01 13:08:18 -07:00
hsr	net: hsr: don't check sequence number if tag removal is offloaded	2021-06-16 12:13:01 -07:00
ieee802154	net: Fix memory leak in ieee802154_raw_deliver	2021-08-10 12:18:10 +02:00
ife
ipv4	net: fix NULL pointer reference in cipso_v4_doi_free	2021-08-26 12:20:47 +01:00
ipv6	ipv6: use siphash in rt6_exception_hash()	2021-08-26 10:20:34 +01:00
iucv	s390: iucv: Avoid field over-reading memcpy()	2021-07-01 15:54:01 -07:00
kcm	net: sock: introduce sk_error_report	2021-06-29 11:28:21 -07:00
key	net: Remove unnecessary variables	2021-05-26 07:03:39 +02:00
l2tp	l2tp: Fix spelling mistakes	2021-06-07 14:08:30 -07:00
l3mdev
lapb	net: lapb: Use list_for_each_entry() to simplify code in lapb_iface.c	2021-06-08 16:31:25 -07:00
llc	net: llc: fix skb_over_panic	2021-07-27 13:05:56 +01:00
mac80211	mac80211: fix locking in ieee80211_restart_work()	2021-08-17 06:51:43 -07:00
mac802154
mpls
mptcp	mptcp: full fully established support after ADD_ADDR	2021-08-19 12:16:54 +01:00
ncsi	net/ncsi: add dummy response handler for Intel boards	2021-07-08 14:16:39 -07:00
netfilter	netfilter: nfnetlink_hook: translate inet ingress to netdev	2021-08-06 17:07:41 +02:00
netlabel	netlabel: Fix memory leak in netlbl_mgmt_add_common	2021-06-15 11:19:04 -07:00
netlink	net: Use nlmsg_unicast() instead of netlink_unicast()	2021-07-13 09:28:29 -07:00
netrom	netrom: Decrease sock refcount when sock timers expire	2021-07-18 09:48:59 -07:00
nfc	TTY / Serial patches for 5.14-rc1	2021-07-05 14:08:24 -07:00
nsh
openvswitch	ovs: clear skb->tstamp in forwarding path	2021-08-18 11:31:13 +01:00
packet	Networking changes for 5.14.	2021-06-30 15:51:09 -07:00
phonet
psample
qrtr	Revert "net: really fix the build..."	2021-08-26 11:08:32 -07:00
rds	net/rds: dma_map_sg is entitled to merge entries	2021-08-18 15:35:50 -07:00
rfkill
rose
rxrpc	Networking changes for 5.14.	2021-06-30 15:51:09 -07:00
sched	net/sched: ets: fix crash when flipping from 'strict' to 'quantum'	2021-08-25 11:15:30 +01:00
sctp	sctp: move the active_key update after sh_keys is added	2021-08-03 11:43:43 +01:00
smc	net/smc: Correct smc link connection counter in case of smc client	2021-08-09 10:46:59 +01:00
strparser	net: sock: introduce sk_error_report	2021-06-29 11:28:21 -07:00
sunrpc	SUNRPC: Fix XPT_BUSY flag leakage in svc_handle_xprt()...	2021-08-25 16:58:09 -04:00
switchdev	net: switchdev: add a context void pointer to struct switchdev_notifier_info	2021-06-28 14:09:03 -07:00
tipc	tipc: call tipc_wait_for_connect only when dlen is not 0	2021-08-16 11:20:56 +01:00
tls	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2021-06-29 15:45:27 -07:00
unix	af_unix: fix garbage collect vs MSG_PEEK	2021-07-28 10:18:00 -07:00
vmw_vsock	vsock/virtio: avoid potential deadlock when vsock device remove	2021-08-12 10:57:27 -07:00
wireless	cfg80211: Fix possible memory leak in function cfg80211_bss_update	2021-07-23 10:38:18 +02:00
x25	net: x25: Use list_for_each_entry() to simplify code in x25_route.c	2021-06-10 14:08:09 -07:00
xdp	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2021-06-29 15:45:27 -07:00
xfrm	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec	2021-08-04 10:45:41 +01:00
compat.c	net: Return the correct errno code	2021-06-03 15:13:56 -07:00
devres.c	net: devres: Correct a grammatical error	2021-06-11 12:55:28 -07:00
Kconfig	bpf, kconfig: Add consolidated menu entry for bpf with core options	2021-05-11 13:56:16 -07:00
Makefile
socket.c	net: don't unconditionally copy_from_user a struct ifreq for socket ioctls	2021-08-27 09:40:25 +01:00
sysctl_net.c