From: Luis Henriques <luis.henriques@canonical.com>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org,
kernel-team@lists.ubuntu.com
Cc: Andy Lutomirski <luto@amacapital.net>,
"David S. Miller" <davem@davemloft.net>,
Luis Henriques <luis.henriques@canonical.com>
Subject: [PATCH 14/50] net: Unbreak compat_sys_{send,recv}msg
Date: Tue, 2 Jul 2013 12:07:02 +0100 [thread overview]
Message-ID: <1372763258-20664-15-git-send-email-luis.henriques@canonical.com> (raw)
In-Reply-To: <1372763258-20664-1-git-send-email-luis.henriques@canonical.com>
3.5.7.16 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Lutomirski <luto@amacapital.net>
commit a7526eb5d06b0084ef12d7b168d008fcf516caab upstream.
I broke them in this commit:
commit 1be374a0518a288147c6a7398792583200a67261
Author: Andy Lutomirski <luto@amacapital.net>
Date: Wed May 22 14:07:44 2013 -0700
net: Block MSG_CMSG_COMPAT in send(m)msg and recv(m)msg
This patch adds __sys_sendmsg and __sys_sendmsg as common helpers that accept
MSG_CMSG_COMPAT and blocks MSG_CMSG_COMPAT at the syscall entrypoints. It
also reverts some unnecessary checks in sys_socketcall.
Apparently I was suffering from underscore blindness the first time around.
Signed-off-by: Andy Lutomirski <luto@amacapital.net>
Tested-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
include/linux/socket.h | 3 +++
net/compat.c | 13 +++++++--
net/socket.c | 72 +++++++++++++++++++++++---------------------------
3 files changed, 47 insertions(+), 41 deletions(-)
diff --git a/include/linux/socket.h b/include/linux/socket.h
index 2a32b9d..3d3ca9d 100644
--- a/include/linux/socket.h
+++ b/include/linux/socket.h
@@ -336,6 +336,9 @@ extern int put_cmsg(struct msghdr*, int level, int type, int len, void *data);
struct timespec;
+/* The __sys_...msg variants allow MSG_CMSG_COMPAT */
+extern long __sys_recvmsg(int fd, struct msghdr __user *msg, unsigned flags);
+extern long __sys_sendmsg(int fd, struct msghdr __user *msg, unsigned flags);
extern int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
unsigned int flags, struct timespec *timeout);
extern int __sys_sendmmsg(int fd, struct mmsghdr __user *mmsg,
diff --git a/net/compat.c b/net/compat.c
index 74ed1d7..9c816e8 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -735,19 +735,25 @@ static unsigned char nas[21] = {
asmlinkage long compat_sys_sendmsg(int fd, struct compat_msghdr __user *msg, unsigned int flags)
{
- return sys_sendmsg(fd, (struct msghdr __user *)msg, flags | MSG_CMSG_COMPAT);
+ if (flags & MSG_CMSG_COMPAT)
+ return -EINVAL;
+ return __sys_sendmsg(fd, (struct msghdr __user *)msg, flags | MSG_CMSG_COMPAT);
}
asmlinkage long compat_sys_sendmmsg(int fd, struct compat_mmsghdr __user *mmsg,
unsigned int vlen, unsigned int flags)
{
+ if (flags & MSG_CMSG_COMPAT)
+ return -EINVAL;
return __sys_sendmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
flags | MSG_CMSG_COMPAT);
}
asmlinkage long compat_sys_recvmsg(int fd, struct compat_msghdr __user *msg, unsigned int flags)
{
- return sys_recvmsg(fd, (struct msghdr __user *)msg, flags | MSG_CMSG_COMPAT);
+ if (flags & MSG_CMSG_COMPAT)
+ return -EINVAL;
+ return __sys_recvmsg(fd, (struct msghdr __user *)msg, flags | MSG_CMSG_COMPAT);
}
asmlinkage long compat_sys_recv(int fd, void __user *buf, size_t len, unsigned int flags)
@@ -769,6 +775,9 @@ asmlinkage long compat_sys_recvmmsg(int fd, struct compat_mmsghdr __user *mmsg,
int datagrams;
struct timespec ktspec;
+ if (flags & MSG_CMSG_COMPAT)
+ return -EINVAL;
+
if (COMPAT_USE_64BIT_TIME)
return __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
flags | MSG_CMSG_COMPAT,
diff --git a/net/socket.c b/net/socket.c
index a8e03b9..cd51a03 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -1898,7 +1898,7 @@ struct used_address {
unsigned int name_len;
};
-static int __sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
+static int ___sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
struct msghdr *msg_sys, unsigned int flags,
struct used_address *used_address)
{
@@ -2013,26 +2013,30 @@ out:
* BSD sendmsg interface
*/
-SYSCALL_DEFINE3(sendmsg, int, fd, struct msghdr __user *, msg, unsigned int, flags)
+long __sys_sendmsg(int fd, struct msghdr __user *msg, unsigned flags)
{
int fput_needed, err;
struct msghdr msg_sys;
struct socket *sock;
- if (flags & MSG_CMSG_COMPAT)
- return -EINVAL;
-
sock = sockfd_lookup_light(fd, &err, &fput_needed);
if (!sock)
goto out;
- err = __sys_sendmsg(sock, msg, &msg_sys, flags, NULL);
+ err = ___sys_sendmsg(sock, msg, &msg_sys, flags, NULL);
fput_light(sock->file, fput_needed);
out:
return err;
}
+SYSCALL_DEFINE3(sendmsg, int, fd, struct msghdr __user *, msg, unsigned int, flags)
+{
+ if (flags & MSG_CMSG_COMPAT)
+ return -EINVAL;
+ return __sys_sendmsg(fd, msg, flags);
+}
+
/*
* Linux sendmmsg interface
*/
@@ -2063,15 +2067,16 @@ int __sys_sendmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
while (datagrams < vlen) {
if (MSG_CMSG_COMPAT & flags) {
- err = __sys_sendmsg(sock, (struct msghdr __user *)compat_entry,
- &msg_sys, flags, &used_address);
+ err = ___sys_sendmsg(sock, (struct msghdr __user *)compat_entry,
+ &msg_sys, flags, &used_address);
if (err < 0)
break;
err = __put_user(err, &compat_entry->msg_len);
++compat_entry;
} else {
- err = __sys_sendmsg(sock, (struct msghdr __user *)entry,
- &msg_sys, flags, &used_address);
+ err = ___sys_sendmsg(sock,
+ (struct msghdr __user *)entry,
+ &msg_sys, flags, &used_address);
if (err < 0)
break;
err = put_user(err, &entry->msg_len);
@@ -2100,7 +2105,7 @@ SYSCALL_DEFINE4(sendmmsg, int, fd, struct mmsghdr __user *, mmsg,
return __sys_sendmmsg(fd, mmsg, vlen, flags);
}
-static int __sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
+static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
struct msghdr *msg_sys, unsigned int flags, int nosec)
{
struct compat_msghdr __user *msg_compat =
@@ -2192,27 +2197,31 @@ out:
* BSD recvmsg interface
*/
-SYSCALL_DEFINE3(recvmsg, int, fd, struct msghdr __user *, msg,
- unsigned int, flags)
+long __sys_recvmsg(int fd, struct msghdr __user *msg, unsigned flags)
{
int fput_needed, err;
struct msghdr msg_sys;
struct socket *sock;
- if (flags & MSG_CMSG_COMPAT)
- return -EINVAL;
-
sock = sockfd_lookup_light(fd, &err, &fput_needed);
if (!sock)
goto out;
- err = __sys_recvmsg(sock, msg, &msg_sys, flags, 0);
+ err = ___sys_recvmsg(sock, msg, &msg_sys, flags, 0);
fput_light(sock->file, fput_needed);
out:
return err;
}
+SYSCALL_DEFINE3(recvmsg, int, fd, struct msghdr __user *, msg,
+ unsigned int, flags)
+{
+ if (flags & MSG_CMSG_COMPAT)
+ return -EINVAL;
+ return __sys_recvmsg(fd, msg, flags);
+}
+
/*
* Linux recvmmsg interface
*/
@@ -2250,17 +2259,18 @@ int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
* No need to ask LSM for more than the first datagram.
*/
if (MSG_CMSG_COMPAT & flags) {
- err = __sys_recvmsg(sock, (struct msghdr __user *)compat_entry,
- &msg_sys, flags & ~MSG_WAITFORONE,
- datagrams);
+ err = ___sys_recvmsg(sock, (struct msghdr __user *)compat_entry,
+ &msg_sys, flags & ~MSG_WAITFORONE,
+ datagrams);
if (err < 0)
break;
err = __put_user(err, &compat_entry->msg_len);
++compat_entry;
} else {
- err = __sys_recvmsg(sock, (struct msghdr __user *)entry,
- &msg_sys, flags & ~MSG_WAITFORONE,
- datagrams);
+ err = ___sys_recvmsg(sock,
+ (struct msghdr __user *)entry,
+ &msg_sys, flags & ~MSG_WAITFORONE,
+ datagrams);
if (err < 0)
break;
err = put_user(err, &entry->msg_len);
@@ -2445,31 +2455,15 @@ SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args)
(int __user *)a[4]);
break;
case SYS_SENDMSG:
- if (a[2] & MSG_CMSG_COMPAT) {
- err = -EINVAL;
- break;
- }
err = sys_sendmsg(a0, (struct msghdr __user *)a1, a[2]);
break;
case SYS_SENDMMSG:
- if (a[3] & MSG_CMSG_COMPAT) {
- err = -EINVAL;
- break;
- }
err = sys_sendmmsg(a0, (struct mmsghdr __user *)a1, a[2], a[3]);
break;
case SYS_RECVMSG:
- if (a[2] & MSG_CMSG_COMPAT) {
- err = -EINVAL;
- break;
- }
err = sys_recvmsg(a0, (struct msghdr __user *)a1, a[2]);
break;
case SYS_RECVMMSG:
- if (a[3] & MSG_CMSG_COMPAT) {
- err = -EINVAL;
- break;
- }
err = sys_recvmmsg(a0, (struct mmsghdr __user *)a1, a[2], a[3],
(struct timespec __user *)a[4]);
break;
--
1.8.1.2
next prev parent reply other threads:[~2013-07-02 11:18 UTC|newest]
Thread overview: 51+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-07-02 11:06 [ 3.5.y.z extended stable ] Linux 3.5.7.16 stable review Luis Henriques
2013-07-02 11:06 ` [PATCH 01/50] clk: remove notifier from list before freeing it Luis Henriques
2013-07-02 11:06 ` [PATCH 02/50] ALSA: usb-audio: work around Android accessory firmware bug Luis Henriques
2013-07-02 11:06 ` [PATCH 03/50] ALSA: usb-audio: Fix invalid volume resolution for Logitech HD Webcam c310 Luis Henriques
2013-07-02 11:06 ` [PATCH 04/50] ncpfs: fix rmdir returns Device or resource busy Luis Henriques
2013-07-02 11:06 ` [PATCH 05/50] tcp: fix tcp_md5_hash_skb_data() Luis Henriques
2013-07-02 11:06 ` [PATCH 06/50] gianfar: add missing iounmap() on error in gianfar_ptp_probe() Luis Henriques
2013-07-02 11:06 ` [PATCH 07/50] ipv6: fix possible crashes in ip6_cork_release() Luis Henriques
2013-07-02 11:06 ` [PATCH 08/50] netlabel: improve domain mapping validation Luis Henriques
2013-07-02 11:06 ` [PATCH 09/50] r8169: fix 8168evl frame padding Luis Henriques
2013-07-02 11:06 ` [PATCH 10/50] r8169: fix offloaded tx checksum for small packets Luis Henriques
2013-07-02 11:06 ` [PATCH 11/50] 8139cp: reset BQL when ring tx ring cleared Luis Henriques
2013-07-02 11:07 ` [PATCH 12/50] tcp: bug fix in proportional rate reduction Luis Henriques
2013-07-02 11:07 ` [PATCH 13/50] net: Block MSG_CMSG_COMPAT in send(m)msg and recv(m)msg Luis Henriques
2013-07-02 11:07 ` Luis Henriques [this message]
2013-07-02 11:07 ` [PATCH 15/50] tcp: xps: fix reordering issues Luis Henriques
2013-07-02 11:07 ` [PATCH 16/50] ip_tunnel: fix kernel panic with icmp_dest_unreach Luis Henriques
2013-07-02 11:07 ` [PATCH 17/50] net: force a reload of first item in hlist_nulls_for_each_entry_rcu Luis Henriques
2013-07-02 11:07 ` [PATCH 18/50] ipv6: assign rt6_info to inet6_ifaddr in init_loopback Luis Henriques
2013-07-02 11:07 ` [PATCH 19/50] net: sctp: fix NULL pointer dereference in socket destruction Luis Henriques
2013-07-02 11:07 ` [PATCH 20/50] team: check return value of team_get_port_by_index_rcu() for NULL Luis Henriques
2013-07-02 11:07 ` [PATCH 21/50] packet: packet_getname_spkt: make sure string is always 0-terminated Luis Henriques
2013-07-02 11:07 ` [PATCH 22/50] l2tp: Fix PPP header erasure and memory leak Luis Henriques
2013-07-02 11:07 ` [PATCH 23/50] l2tp: Fix sendmsg() return value Luis Henriques
2013-07-02 11:07 ` [PATCH 24/50] bonding: rlb mode of bond should not alter ARP originating via bridge Luis Henriques
2013-07-02 11:07 ` [PATCH 25/50] tilepro: work around module link error with gcc 4.7 Luis Henriques
2013-07-02 11:07 ` [PATCH 26/50] Input: cyttsp - fix memcpy size param Luis Henriques
2013-07-02 11:07 ` [PATCH 27/50] target/iscsi: don't corrupt bh_count in iscsit_stop_time2retain_timer() Luis Henriques
2013-07-02 11:07 ` [PATCH 28/50] tcm_qla2xxx: Fix residual for underrun commands that fail Luis Henriques
2013-07-02 11:07 ` [PATCH 29/50] KVM: x86: remove vcpu's CPL check in host-invoked XCR set Luis Henriques
2013-07-02 11:07 ` [PATCH 30/50] x86: fix build error and kconfig for ia32_emulation and binfmt Luis Henriques
2013-07-02 11:07 ` [PATCH 31/50] USB: serial: ti_usb_3410_5052: new device id for Abbot strip port cable Luis Henriques
2013-07-02 11:07 ` [PATCH 32/50] drm/radeon: update lockup tracking when scheduling in empty ring Luis Henriques
2013-07-02 11:07 ` [PATCH 33/50] team: move add to port list before port enablement Luis Henriques
2013-07-02 11:07 ` [PATCH 34/50] net: sh_eth: fix incorrect RX length error if R8A7740 Luis Henriques
2013-07-02 11:07 ` [PATCH 35/50] sctp: fully initialize sctp_outq in sctp_outq_init Luis Henriques
2013-07-02 11:07 ` [PATCH 36/50] ARM: 7755/1: handle user space mapped pages in flush_kernel_dcache_page Luis Henriques
2013-07-02 11:07 ` [PATCH 37/50] iwlwifi: dvm: fix chain noise calibration Luis Henriques
2013-07-02 11:07 ` [PATCH 38/50] Bluetooth: Fix crash in l2cap_build_cmd() with small MTU Luis Henriques
2013-07-02 11:07 ` [PATCH 39/50] hw_breakpoint: Use cpu_possible_mask in {reserve,release}_bp_slot() Luis Henriques
2013-07-02 11:07 ` [PATCH 40/50] ARM: 7772/1: Fix missing flush_kernel_dcache_page() for noMMU Luis Henriques
2013-07-02 11:07 ` [PATCH 41/50] net/tg3: Avoid delay during MMIO access Luis Henriques
2013-07-02 11:07 ` [PATCH 42/50] dlci: acquire rtnl_lock before calling __dev_get_by_name() Luis Henriques
2013-07-02 11:07 ` [PATCH 43/50] dlci: validate the net device in dlci_del() Luis Henriques
2013-07-02 11:07 ` [PATCH 44/50] Bluetooth: btmrvl: fix thread stopping race Luis Henriques
2013-07-02 11:07 ` [PATCH 45/50] pch_uart: fix a deadlock when pch_uart as console Luis Henriques
2013-07-02 11:07 ` [PATCH 46/50] perf: Disable monitoring on setuid processes for regular users Luis Henriques
2013-07-02 11:07 ` [PATCH 47/50] UBIFS: prepare to fix a horrid bug Luis Henriques
2013-07-02 11:07 ` [PATCH 48/50] UBIFS: " Luis Henriques
2013-07-02 11:07 ` [PATCH 49/50] perf: Fix perf mmap bugs Luis Henriques
2013-07-02 11:07 ` [PATCH 50/50] perf: Fix mmap() accounting hole Luis Henriques
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1372763258-20664-15-git-send-email-luis.henriques@canonical.com \
--to=luis.henriques@canonical.com \
--cc=davem@davemloft.net \
--cc=kernel-team@lists.ubuntu.com \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@amacapital.net \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®