leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

net: sctp: fix sctp_connectx abi for ia32 emulation/compat mode

Browse Source 
SCTP's sctp_connectx() abi breaks for 64bit kernels compiled with 32bit
emulation (e.g. ia32 emulation or x86_x32). Due to internal usage of
'struct sctp_getaddrs_old' which includes a struct sockaddr pointer,
sizeof(param) check will always fail in kernel as the structure in
64bit kernel space is 4bytes larger than for user binaries compiled
in 32bit mode. Thus, applications making use of sctp_connectx() won't
be able to run under such circumstances.

Introduce a compat interface in the kernel to deal with such
situations by using a 'struct compat_sctp_getaddrs_old' structure
where user data is copied into it, and then sucessively transformed
into a 'struct sctp_getaddrs_old' structure with the help of
compat_ptr(). That fixes sctp_connectx() abi without any changes
needed in user space, and lets the SCTP test suite pass when compiled
in 32bit and run on 64bit kernels.

Fixes: f9c67811eb ("sctp: Fix regression introduced by new sctp_connectx api")
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Acked-by: Vlad Yasevich <vyasevich@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Daniel Borkmann 2014-02-17 12:11:11 +01:00 committed by David S. Miller
parent 7ffb0d317d
commit ffd5939381
1 changed files with 32 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

41
net/sctp/socket.c
View File

@ -64,6 +64,7 @@
#include <linux/crypto.h>
#include <linux/slab.h>
#include <linux/file.h>
#include <linux/compat.h>
#include <net/ip.h>
#include <net/icmp.h>
@ -1368,11 +1369,19 @@ static int sctp_setsockopt_connectx(struct sock *sk,
/*
* New (hopefully final) interface for the API.
* We use the sctp_getaddrs_old structure so that use-space library
* can avoid any unnecessary allocations. The only defferent part
* can avoid any unnecessary allocations. The only different part
* is that we store the actual length of the address buffer into the
* addrs_num structure member. That way we can re-use the existing
* addrs_num structure member. That way we can re-use the existing
* code.
*/
#ifdef CONFIG_COMPAT
struct compat_sctp_getaddrs_old {
sctp_assoc_t assoc_id;
s32 addr_num;
compat_uptr_t addrs; /* struct sockaddr * */
};
#endif
static int sctp_getsockopt_connectx3(struct sock *sk, int len,
char __user *optval,
int __user *optlen)
@ -1381,16 +1390,30 @@ static int sctp_getsockopt_connectx3(struct sock *sk, int len,
sctp_assoc_t assoc_id = 0;
int err = 0;
if (len < sizeof(param))
return -EINVAL;
#ifdef CONFIG_COMPAT
if (is_compat_task()) {
struct compat_sctp_getaddrs_old param32;
if (copy_from_user(&param, optval, sizeof(param)))
return -EFAULT;
if (len < sizeof(param32))
return -EINVAL;
if (copy_from_user(&param32, optval, sizeof(param32)))
return -EFAULT;
err = __sctp_setsockopt_connectx(sk,
(struct sockaddr __user *)param.addrs,
param.addr_num, &assoc_id);
param.assoc_id = param32.assoc_id;
param.addr_num = param32.addr_num;
param.addrs = compat_ptr(param32.addrs);
} else
#endif
{
if (len < sizeof(param))
return -EINVAL;
if (copy_from_user(&param, optval, sizeof(param)))
return -EFAULT;
}
err = __sctp_setsockopt_connectx(sk, (struct sockaddr __user *)
param.addrs, param.addr_num,
&assoc_id);
if (err == 0 || err == -EINPROGRESS) {
if (copy_to_user(optval, &assoc_id, sizeof(assoc_id)))
return -EFAULT;