Bug 199469 - Regression in 32-bit-compat dev_ioctl due to bf4405737f9f85a06db2b0ce5d76a818b61992e2
Summary: Regression in 32-bit-compat dev_ioctl due to bf4405737f9f85a06db2b0ce5d76a818...
Status: RESOLVED CODE_FIX
Alias: None
Product: Networking
Classification: Unclassified
Component: Other (show other bugs)
Hardware: All Linux
: P1 normal
Assignee: viro
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2018-04-23 01:26 UTC by Robert O'Callahan
Modified: 2019-01-15 05:17 UTC (History)
1 user (show)

See Also:
Kernel Version: 4.16.0-0.rc4.git0.1.fc28.x86_64
Tree: Mainline
Regression: No


Attachments
Test program (680 bytes, text/x-csrc)
2018-04-23 01:26 UTC, Robert O'Callahan
Details

Description Robert O'Callahan 2018-04-23 01:26:46 UTC
Created attachment 275501 [details]
Test program

The commit says

    Once upon a time net/socket.c:dev_ifsioc() used to handle SIOCSHWTSTAMP and
    SIOCSIFMAP.  These have different native and compat layout, so the format
    conversion had been needed.  In 2009 these two cases had been taken out,
    turning the rest into a convoluted way to calling sock_do_ioctl().  We copy
    compat structure into native one, call sock_do_ioctl() on that and copy
    the result back for the in/out ioctls.  No layout transformation anywhere,
    so we might as well just call sock_do_ioctl() and skip all the headache with
    copying.
    
However there is one problem: 32-bit 'struct ifreq' and 64-bit 'struct ifreq' are not the same size. The former is 32 bytes and the latter is 40 bytes. Thus, if you place a 32-bit 'struct ifreq' immediately before an unmapped page and try to pass it to one of these ioctls, the syscall fails with EFAULT due to this commit.

Steps to reproduce:
Copy attached file to /tmp/test.c, then:
[roc@localhost-live ~]$ gcc -o /tmp/test /tmp/test.c && /tmp/test
Index: 1
[roc@localhost-live ~]$ gcc -m32 -o /tmp/test /tmp/test.c && /tmp/test
Failed SIOCGIFINDEX: Bad address
Comment 1 Robert O'Callahan 2018-04-23 01:36:27 UTC
This is very similar to bug 195869.
Comment 2 Johannes Berg 2018-09-13 11:37:49 UTC
I apologize - this dropped off my radar.
Comment 3 Johannes Berg 2018-09-13 11:49:51 UTC
Ok, that wasn't so hard to fix:

https://patchwork.ozlabs.org/patch/969317/
Comment 4 Robert O'Callahan 2018-09-13 11:50:22 UTC
Thanks!

Note You need to log in before you can comment on or make changes to this bug.