[PATCH] ioctl_list.2: BLKRASET/BLKRAGET take unsigned long

[PATCH] ioctl_list.2: BLKRASET/BLKRAGET take unsigned long

[Cyril Hrubis]

The BLKRASET/BLKRAGET ioctls() take unsigned long, if I pass int * to
the BLKRAGET ioctl on x86_64 (or on any other arch where sizeof(int) !=
sizeof(long)) the BLKRAGET ioctl will rewrite four bytes on the stack.

If you look at block/ioctl.c in kernel sources you can clearly see that
BLKRAGET ioctl calls put_long().

Compile following reproducer and run it as ./a.out /dev/sda, you can see
that the second member of the array will be zeroed. If you change the
array to have only one member you will see stack smashing trace.

I also wonder if it's OK to pass int value to ioctl() at all, the arg
value seems to be unsigned long in the syscall definition in fs/ioctl.c
and there does not seem to be any glibc magic around the syscall.

-------------------------8<----------------------------
#include <sys/mount.h>
#include <sys/ioctl.h>
#include <fcntl.h>
#include <stdio.h>

static int fd;

int main(int argc, char *argv[])
{
	int ra[] = {100, 100};

	fd = open(argv[1], O_RDONLY);
	if (fd < 0) {
		perror("open");
		return 1;
	}

	ioctl(fd, BLKRAGET, ra);

	fprintf(stderr, "%i %i\n", ra[0], ra[1]);

	return 0;
}

-------------------------8<----------------------------

Signed-off-by: Cyril Hrubis <chrubis-AlSwsSmVLrQ@public.gmane.org>
---
 man2/ioctl_list.2 | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/man2/ioctl_list.2 b/man2/ioctl_list.2
index 0165c77..c8efd66 100644
--- a/man2/ioctl_list.2
+++ b/man2/ioctl_list.2
@@ -311,8 +311,8 @@ l l l l.
 0x0000125F	BLKRRPART	void
 0x00001260	BLKGETSIZE	unsigned long *
 0x00001261	BLKFLSBUF	void
-0x00001262	BLKRASET	int
-0x00001263	BLKRAGET	int *
+0x00001262	BLKRASET	unsigned long
+0x00001263	BLKRAGET	unsigned long *
 0x00000001	FIBMAP	int *	// I-O
 0x00000002	FIGETBSZ	int *
 0x80086601	FS_IOC_GETFLAGS	int *
-- 
2.10.2


-- 
Cyril Hrubis
chrubis-AlSwsSmVLrQ@public.gmane.org
--
To unsubscribe from this list: send the line "unsubscribe linux-man" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH] ioctl_list.2: BLKRASET/BLKRAGET take unsigned long

[Cyril Hrubis]

[CCing linux api as well]
> The BLKRASET/BLKRAGET ioctls() take unsigned long, if I pass int * to
> the BLKRAGET ioctl on x86_64 (or on any other arch where sizeof(int) !=
> sizeof(long)) the BLKRAGET ioctl will rewrite four bytes on the stack.
> 
> If you look at block/ioctl.c in kernel sources you can clearly see that
> BLKRAGET ioctl calls put_long().
> 
> Compile following reproducer and run it as ./a.out /dev/sda, you can see
> that the second member of the array will be zeroed. If you change the
> array to have only one member you will see stack smashing trace.
> 
> I also wonder if it's OK to pass int value to ioctl() at all, the arg
> value seems to be unsigned long in the syscall definition in fs/ioctl.c
> and there does not seem to be any glibc magic around the syscall.
> 
> -------------------------8<----------------------------
> #include <sys/mount.h>
> #include <sys/ioctl.h>
> #include <fcntl.h>
> #include <stdio.h>
> 
> static int fd;
> 
> int main(int argc, char *argv[])
> {
> 	int ra[] = {100, 100};
> 
> 	fd = open(argv[1], O_RDONLY);
> 	if (fd < 0) {
> 		perror("open");
> 		return 1;
> 	}
> 
> 	ioctl(fd, BLKRAGET, ra);
> 
> 	fprintf(stderr, "%i %i\n", ra[0], ra[1]);
> 
> 	return 0;
> }
> 
> -------------------------8<----------------------------
> 
> Signed-off-by: Cyril Hrubis <chrubis-AlSwsSmVLrQ@public.gmane.org>
> ---
>  man2/ioctl_list.2 | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/man2/ioctl_list.2 b/man2/ioctl_list.2
> index 0165c77..c8efd66 100644
> --- a/man2/ioctl_list.2
> +++ b/man2/ioctl_list.2
> @@ -311,8 +311,8 @@ l l l l.
>  0x0000125F	BLKRRPART	void
>  0x00001260	BLKGETSIZE	unsigned long *
>  0x00001261	BLKFLSBUF	void
> -0x00001262	BLKRASET	int
> -0x00001263	BLKRAGET	int *
> +0x00001262	BLKRASET	unsigned long
> +0x00001263	BLKRAGET	unsigned long *
>  0x00000001	FIBMAP	int *	// I-O
>  0x00000002	FIGETBSZ	int *
>  0x80086601	FS_IOC_GETFLAGS	int *
> -- 
> 2.10.2
> 
> 
> -- 
> Cyril Hrubis
> chrubis-AlSwsSmVLrQ@public.gmane.org

-- 
Cyril Hrubis
chrubis-AlSwsSmVLrQ@public.gmane.org

Re: [PATCH] ioctl_list.2: BLKRASET/BLKRAGET take unsigned long

[Arnd Bergmann]

On Wed, Feb 15, 2017 at 12:22 PM, Cyril Hrubis <chrubis-AlSwsSmVLrQ@public.gmane.org> wrote:
> [CCing linux api as well]
>> The BLKRASET/BLKRAGET ioctls() take unsigned long, if I pass int * to
>> the BLKRAGET ioctl on x86_64 (or on any other arch where sizeof(int) !=
>> sizeof(long)) the BLKRAGET ioctl will rewrite four bytes on the stack.
>>
>> If you look at block/ioctl.c in kernel sources you can clearly see that
>> BLKRAGET ioctl calls put_long().

BLKFRAGET as well, fwiw, see compat_blkdev_ioctl().
We might as well include them in the list.

>> I also wonder if it's OK to pass int value to ioctl() at all, the arg
>> value seems to be unsigned long in the syscall definition in fs/ioctl.c
>> and there does not seem to be any glibc magic around the syscall.

This shouldn't matter, if you pass an 'int' into a function that takes
a 'long', it will be extended if necessary. The question is more about
how it gets interpreted, and in this case it's done by assigning to

struct backing_dev_info {
...
        unsigned long ra_pages; /* max readahead in PAGE_SIZE units */
...
};

Large values will not be used in practice (these are capped by the
I/O sizes), but I guess you can set a value larger than UINT_MAX
and read it back later.

>>  man2/ioctl_list.2 | 4 ++--
>>  1 file changed, 2 insertions(+), 2 deletions(-)
>>
>> diff --git a/man2/ioctl_list.2 b/man2/ioctl_list.2
>> index 0165c77..c8efd66 100644
>> --- a/man2/ioctl_list.2
>> +++ b/man2/ioctl_list.2
>> @@ -311,8 +311,8 @@ l l l l.
>>  0x0000125F   BLKRRPART       void
>>  0x00001260   BLKGETSIZE      unsigned long *
>>  0x00001261   BLKFLSBUF       void
>> -0x00001262   BLKRASET        int
>> -0x00001263   BLKRAGET        int *
>> +0x00001262   BLKRASET        unsigned long
>> +0x00001263   BLKRAGET        unsigned long *
>>  0x00000001   FIBMAP  int *   // I-O
>>  0x00000002   FIGETBSZ        int *
>>  0x80086601   FS_IOC_GETFLAGS int *

Looks correct to me.

   Arnd
--
To unsubscribe from this list: send the line "unsubscribe linux-man" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH] ioctl_list.2: BLKRASET/BLKRAGET take unsigned long

[Cyril Hrubis]

Hi!
> >> I also wonder if it's OK to pass int value to ioctl() at all, the arg
> >> value seems to be unsigned long in the syscall definition in fs/ioctl.c
> >> and there does not seem to be any glibc magic around the syscall.
> 
> This shouldn't matter, if you pass an 'int' into a function that takes
> a 'long', it will be extended if necessary. The question is more about
> how it gets interpreted, and in this case it's done by assigning to

I guess that it may, since the ioctl() prototype is defined with ...

>From /usr/include/sys/ioctl.h:

...
extern int ioctl (int __fd, unsigned long int __request, ...) __THROW;
...

Looking at dissasembly we do:

4005bb:       89 c7                   mov    %eax,%edi
(%eax holds fd from open())

...

4005bb:       89 c7                   mov    %eax,%edi
4005bd:       ba 00 02 00 00          mov    $0x200,%edx
                                                    ^
						We do 32bit load here

4005c2:       be 62 12 00 00          mov    $0x1262,%esi
4005c7:       31 c0                   xor    %eax,%eax
4005c9:       e8 72 ff ff ff          callq  400540 <ioctl@plt>

The ioctl assembly just sets %eax and then syscall.

So as far as I can tell we depend here on a fact that upper part of $rdx
is zeroed. Not sure if that is guaranteed or not.

-- 
Cyril Hrubis
chrubis-AlSwsSmVLrQ@public.gmane.org
--
To unsubscribe from this list: send the line "unsubscribe linux-man" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH] ioctl_list.2: BLKRASET/BLKRAGET take unsigned long

[Cyril Hrubis]

Hi!
> So as far as I can tell we depend here on a fact that upper part of $rdx
> is zeroed. Not sure if that is guaranteed or not.

Which seems to be the case for x86_64 processors, so passing int value
to ioctl() will work fine there. Not sure about the rest of 64bit archs.

-- 
Cyril Hrubis
chrubis-AlSwsSmVLrQ@public.gmane.org
--
To unsubscribe from this list: send the line "unsubscribe linux-man" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH] ioctl_list.2: BLKRASET/BLKRAGET take unsigned long

[Michael Kerrisk (man-pages)]

On 02/15/2017 01:04 PM, Arnd Bergmann wrote:
> On Wed, Feb 15, 2017 at 12:22 PM, Cyril Hrubis <chrubis-AlSwsSmVLrQ@public.gmane.org> wrote:
>> [CCing linux api as well]
>>> The BLKRASET/BLKRAGET ioctls() take unsigned long, if I pass int * to
>>> the BLKRAGET ioctl on x86_64 (or on any other arch where sizeof(int) !=
>>> sizeof(long)) the BLKRAGET ioctl will rewrite four bytes on the stack.
>>>
>>> If you look at block/ioctl.c in kernel sources you can clearly see that
>>> BLKRAGET ioctl calls put_long().
> 
> BLKFRAGET as well, fwiw, see compat_blkdev_ioctl().
> We might as well include them in the list.
> 
>>> I also wonder if it's OK to pass int value to ioctl() at all, the arg
>>> value seems to be unsigned long in the syscall definition in fs/ioctl.c
>>> and there does not seem to be any glibc magic around the syscall.
> 
> This shouldn't matter, if you pass an 'int' into a function that takes
> a 'long', it will be extended if necessary. The question is more about
> how it gets interpreted, and in this case it's done by assigning to
> 
> struct backing_dev_info {
> ...
>         unsigned long ra_pages; /* max readahead in PAGE_SIZE units */
> ...
> };
> 
> Large values will not be used in practice (these are capped by the
> I/O sizes), but I guess you can set a value larger than UINT_MAX
> and read it back later.
> 
>>>  man2/ioctl_list.2 | 4 ++--
>>>  1 file changed, 2 insertions(+), 2 deletions(-)
>>>
>>> diff --git a/man2/ioctl_list.2 b/man2/ioctl_list.2
>>> index 0165c77..c8efd66 100644
>>> --- a/man2/ioctl_list.2
>>> +++ b/man2/ioctl_list.2
>>> @@ -311,8 +311,8 @@ l l l l.
>>>  0x0000125F   BLKRRPART       void
>>>  0x00001260   BLKGETSIZE      unsigned long *
>>>  0x00001261   BLKFLSBUF       void
>>> -0x00001262   BLKRASET        int
>>> -0x00001263   BLKRAGET        int *
>>> +0x00001262   BLKRASET        unsigned long
>>> +0x00001263   BLKRAGET        unsigned long *
>>>  0x00000001   FIBMAP  int *   // I-O
>>>  0x00000002   FIGETBSZ        int *
>>>  0x80086601   FS_IOC_GETFLAGS int *
> 
> Looks correct to me.

Thanks for reviewing this, Arnd.

Cheers,

Michael

-- 
Michael Kerrisk
Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
Linux/UNIX System Programming Training: http://man7.org/training/

Re: [PATCH] ioctl_list.2: BLKRASET/BLKRAGET take unsigned long

[Cyril Hrubis]

Hi!
Ping.

-- 
Cyril Hrubis
chrubis-AlSwsSmVLrQ@public.gmane.org

Re: [PATCH] ioctl_list.2: BLKRASET/BLKRAGET take unsigned long

[Cyril Hrubis]

Hi!
Ping.

-- 
Cyril Hrubis
chrubis-AlSwsSmVLrQ@public.gmane.org

Re: [PATCH] ioctl_list.2: BLKRASET/BLKRAGET take unsigned long

[Michael Kerrisk (man-pages)]

On 02/15/2017 12:20 PM, Cyril Hrubis wrote:
> The BLKRASET/BLKRAGET ioctls() take unsigned long, if I pass int * to
> the BLKRAGET ioctl on x86_64 (or on any other arch where sizeof(int) !=
> sizeof(long)) the BLKRAGET ioctl will rewrite four bytes on the stack.
> 
> If you look at block/ioctl.c in kernel sources you can clearly see that
> BLKRAGET ioctl calls put_long().
> 
> Compile following reproducer and run it as ./a.out /dev/sda, you can see
> that the second member of the array will be zeroed. If you change the
> array to have only one member you will see stack smashing trace.
> 
> I also wonder if it's OK to pass int value to ioctl() at all, the arg
> value seems to be unsigned long in the syscall definition in fs/ioctl.c
> and there does not seem to be any glibc magic around the syscall.

Thanks Cyril. Applied now. Sorry for the delayed response...

Cheers,

Michael


> -------------------------8<----------------------------
> #include <sys/mount.h>
> #include <sys/ioctl.h>
> #include <fcntl.h>
> #include <stdio.h>
> 
> static int fd;
> 
> int main(int argc, char *argv[])
> {
> 	int ra[] = {100, 100};
> 
> 	fd = open(argv[1], O_RDONLY);
> 	if (fd < 0) {
> 		perror("open");
> 		return 1;
> 	}
> 
> 	ioctl(fd, BLKRAGET, ra);
> 
> 	fprintf(stderr, "%i %i\n", ra[0], ra[1]);
> 
> 	return 0;
> }
> 
> -------------------------8<----------------------------
> 
> Signed-off-by: Cyril Hrubis <chrubis-AlSwsSmVLrQ@public.gmane.org>
> ---
>  man2/ioctl_list.2 | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/man2/ioctl_list.2 b/man2/ioctl_list.2
> index 0165c77..c8efd66 100644
> --- a/man2/ioctl_list.2
> +++ b/man2/ioctl_list.2
> @@ -311,8 +311,8 @@ l l l l.
>  0x0000125F	BLKRRPART	void
>  0x00001260	BLKGETSIZE	unsigned long *
>  0x00001261	BLKFLSBUF	void
> -0x00001262	BLKRASET	int
> -0x00001263	BLKRAGET	int *
> +0x00001262	BLKRASET	unsigned long
> +0x00001263	BLKRAGET	unsigned long *
>  0x00000001	FIBMAP	int *	// I-O
>  0x00000002	FIGETBSZ	int *
>  0x80086601	FS_IOC_GETFLAGS	int *
> 


-- 
Michael Kerrisk
Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
Linux/UNIX System Programming Training: http://man7.org/training/