* [RFC][PATCHES] uaccess-related stuff in net/*
@ 2020-05-11 4:43 Al Viro
2020-05-11 4:45 ` [PATCH 01/19] lift compat definitions of mcast [sg]etsockopt requests into net/compat.h Al Viro
2020-05-12 0:02 ` [RFC][PATCHES] uaccess-related stuff in net/* David Miller
0 siblings, 2 replies; 42+ messages in thread
From: Al Viro @ 2020-05-11 4:43 UTC (permalink / raw)
To: netdev; +Cc: davem, viro, linux-kernel
Assorted uaccess-related work in net/*. First, there's
getting rid of compat_alloc_user_space() mess in MCAST_...
[gs]etsockopt() - no need to play with copying to/from temporary
object on userland stack, etc., when ->compat_[sg]etsockopt()
instances in question can easly do everything without that.
That's the first 13 patches. Then there's a trivial bit in
net/batman-adv (completely unrelated to everything else) and
finally getting the atm compat ioctls into simpler shape.
Please, review and comment. Individual patches in followups,
the entire branch (on top of current net/master) is in
git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git #uaccess.net
Shortlog:
Al Viro (19):
lift compat definitions of mcast [sg]etsockopt requests into net/compat.h
compat_ip{,v6}_setsockopt(): enumerate MCAST_... options explicitly
ip*_mc_gsfget(): lift copyout of struct group_filter into callers
get rid of compat_mc_getsockopt()
set_mcast_msfilter(): take the guts of setsockopt(MCAST_MSFILTER) into a helper
ipv4: do compat setsockopt for MCAST_MSFILTER directly
ip6_mc_msfilter(): pass the address list separately
ipv6: do compat setsockopt for MCAST_MSFILTER directly
ipv[46]: do compat setsockopt for MCAST_{JOIN,LEAVE}_GROUP directly
ipv4: take handling of group_source_req options into a helper
ipv6: take handling of group_source_req options into a helper
handle the group_source_req options directly
get rid of compat_mc_setsockopt()
batadv_socket_read(): get rid of pointless access_ok()
atm: separate ATM_GETNAMES handling from the rest of atm_dev_ioctl()
atm: move copyin from atm_getnames() into the caller
atm: switch do_atm_iobuf() to direct use of atm_getnames()
atm: lift copyin from atm_dev_ioctl()
atm: switch do_atmif_sioc() to direct use of atm_dev_ioctl()
Diffstat:
include/linux/igmp.h | 2 +-
include/net/compat.h | 29 +++-
include/net/ipv6.h | 5 +-
net/atm/ioctl.c | 96 +++++++------
net/atm/resources.c | 108 +++++---------
net/atm/resources.h | 5 +-
net/batman-adv/icmp_socket.c | 3 -
net/compat.c | 194 -------------------------
net/ipv4/igmp.c | 18 +--
net/ipv4/ip_sockglue.c | 329 ++++++++++++++++++++++++++++++++-----------
net/ipv6/ipv6_sockglue.c | 233 ++++++++++++++++++++++++------
net/ipv6/mcast.c | 17 +--
12 files changed, 567 insertions(+), 472 deletions(-)
^ permalink raw reply [flat|nested] 42+ messages in thread* [PATCH 01/19] lift compat definitions of mcast [sg]etsockopt requests into net/compat.h 2020-05-11 4:43 [RFC][PATCHES] uaccess-related stuff in net/* Al Viro @ 2020-05-11 4:45 ` Al Viro 2020-05-11 4:45 ` [PATCH 02/19] compat_ip{,v6}_setsockopt(): enumerate MCAST_... options explicitly Al Viro ` (17 more replies) 2020-05-12 0:02 ` [RFC][PATCHES] uaccess-related stuff in net/* David Miller 1 sibling, 18 replies; 42+ messages in thread From: Al Viro @ 2020-05-11 4:45 UTC (permalink / raw) To: netdev; +Cc: davem, viro, linux-kernel From: Al Viro <viro@zeniv.linux.org.uk> We want to get rid of compat_mc_[sg]etsockopt() and to have that stuff handled without compat_alloc_user_space(), extra copying through userland, etc. To do that we'll need ipv4 and ipv6 instances of ->compat_[sg]etsockopt() to manipulate the 32bit variants of mcast requests, so we need to move the definitions of those out of net/compat.c and into a public header. This patch just does a mechanical move to include/net/compat.h Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> --- include/net/compat.h | 24 ++++++++++++++++++++++++ net/compat.c | 25 ------------------------- 2 files changed, 24 insertions(+), 25 deletions(-) diff --git a/include/net/compat.h b/include/net/compat.h index e341260642fe..9f4a56c5671e 100644 --- a/include/net/compat.h +++ b/include/net/compat.h @@ -56,4 +56,28 @@ int compat_mc_getsockopt(struct sock *, int, int, char __user *, int __user *, int (*)(struct sock *, int, int, char __user *, int __user *)); +struct compat_group_req { + __u32 gr_interface; + struct __kernel_sockaddr_storage gr_group + __aligned(4); +} __packed; + +struct compat_group_source_req { + __u32 gsr_interface; + struct __kernel_sockaddr_storage gsr_group + __aligned(4); + struct __kernel_sockaddr_storage gsr_source + __aligned(4); +} __packed; + +struct compat_group_filter { + __u32 gf_interface; + struct __kernel_sockaddr_storage gf_group + __aligned(4); + __u32 gf_fmode; + __u32 gf_numsrc; + struct __kernel_sockaddr_storage gf_slist[1] + __aligned(4); +} __packed; + #endif /* NET_COMPAT_H */ diff --git a/net/compat.c b/net/compat.c index 4bed96e84d9a..06af69e7b408 100644 --- a/net/compat.c +++ b/net/compat.c @@ -447,34 +447,9 @@ COMPAT_SYSCALL_DEFINE5(getsockopt, int, fd, int, level, int, optname, return __compat_sys_getsockopt(fd, level, optname, optval, optlen); } -struct compat_group_req { - __u32 gr_interface; - struct __kernel_sockaddr_storage gr_group - __aligned(4); -} __packed; - -struct compat_group_source_req { - __u32 gsr_interface; - struct __kernel_sockaddr_storage gsr_group - __aligned(4); - struct __kernel_sockaddr_storage gsr_source - __aligned(4); -} __packed; - -struct compat_group_filter { - __u32 gf_interface; - struct __kernel_sockaddr_storage gf_group - __aligned(4); - __u32 gf_fmode; - __u32 gf_numsrc; - struct __kernel_sockaddr_storage gf_slist[1] - __aligned(4); -} __packed; - #define __COMPAT_GF0_SIZE (sizeof(struct compat_group_filter) - \ sizeof(struct __kernel_sockaddr_storage)) - int compat_mc_setsockopt(struct sock *sock, int level, int optname, char __user *optval, unsigned int optlen, int (*setsockopt)(struct sock *, int, int, char __user *, unsigned int)) -- 2.11.0 ^ permalink raw reply related [flat|nested] 42+ messages in thread
* [PATCH 02/19] compat_ip{,v6}_setsockopt(): enumerate MCAST_... options explicitly 2020-05-11 4:45 ` [PATCH 01/19] lift compat definitions of mcast [sg]etsockopt requests into net/compat.h Al Viro @ 2020-05-11 4:45 ` Al Viro 2020-05-11 4:45 ` [PATCH 03/19] ip*_mc_gsfget(): lift copyout of struct group_filter into callers Al Viro ` (16 subsequent siblings) 17 siblings, 0 replies; 42+ messages in thread From: Al Viro @ 2020-05-11 4:45 UTC (permalink / raw) To: netdev; +Cc: davem, viro, linux-kernel From: Al Viro <viro@zeniv.linux.org.uk> We want to check if optname is among the MCAST_... ones; do that as an explicit switch. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> --- net/ipv4/ip_sockglue.c | 10 +++++++++- net/ipv6/ipv6_sockglue.c | 10 +++++++++- 2 files changed, 18 insertions(+), 2 deletions(-) diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c index aa3fd61818c4..8f550cf4c1c0 100644 --- a/net/ipv4/ip_sockglue.c +++ b/net/ipv4/ip_sockglue.c @@ -1272,9 +1272,17 @@ int compat_ip_setsockopt(struct sock *sk, int level, int optname, if (level != SOL_IP) return -ENOPROTOOPT; - if (optname >= MCAST_JOIN_GROUP && optname <= MCAST_MSFILTER) + switch (optname) { + case MCAST_JOIN_GROUP: + case MCAST_LEAVE_GROUP: + case MCAST_JOIN_SOURCE_GROUP: + case MCAST_LEAVE_SOURCE_GROUP: + case MCAST_BLOCK_SOURCE: + case MCAST_UNBLOCK_SOURCE: + case MCAST_MSFILTER: return compat_mc_setsockopt(sk, level, optname, optval, optlen, ip_setsockopt); + } err = do_ip_setsockopt(sk, level, optname, optval, optlen); #ifdef CONFIG_NETFILTER diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c index 18d05403d3b5..1b4ad4f8dc42 100644 --- a/net/ipv6/ipv6_sockglue.c +++ b/net/ipv6/ipv6_sockglue.c @@ -973,9 +973,17 @@ int compat_ipv6_setsockopt(struct sock *sk, int level, int optname, if (level != SOL_IPV6) return -ENOPROTOOPT; - if (optname >= MCAST_JOIN_GROUP && optname <= MCAST_MSFILTER) + switch (optname) { + case MCAST_JOIN_GROUP: + case MCAST_LEAVE_GROUP: + case MCAST_JOIN_SOURCE_GROUP: + case MCAST_LEAVE_SOURCE_GROUP: + case MCAST_BLOCK_SOURCE: + case MCAST_UNBLOCK_SOURCE: + case MCAST_MSFILTER: return compat_mc_setsockopt(sk, level, optname, optval, optlen, ipv6_setsockopt); + } err = do_ipv6_setsockopt(sk, level, optname, optval, optlen); #ifdef CONFIG_NETFILTER -- 2.11.0 ^ permalink raw reply related [flat|nested] 42+ messages in thread
* [PATCH 03/19] ip*_mc_gsfget(): lift copyout of struct group_filter into callers 2020-05-11 4:45 ` [PATCH 01/19] lift compat definitions of mcast [sg]etsockopt requests into net/compat.h Al Viro 2020-05-11 4:45 ` [PATCH 02/19] compat_ip{,v6}_setsockopt(): enumerate MCAST_... options explicitly Al Viro @ 2020-05-11 4:45 ` Al Viro 2020-05-11 4:45 ` [PATCH 04/19] get rid of compat_mc_getsockopt() Al Viro ` (15 subsequent siblings) 17 siblings, 0 replies; 42+ messages in thread From: Al Viro @ 2020-05-11 4:45 UTC (permalink / raw) To: netdev; +Cc: davem, viro, linux-kernel From: Al Viro <viro@zeniv.linux.org.uk> pass the userland pointer to the array in its tail, so that part gets copied out by our functions; copyout of everything else is done in the callers. Rationale: reuse for compat; the array is the same in native and compat, the layout of parts before it is different for compat. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> --- include/linux/igmp.h | 2 +- include/net/ipv6.h | 2 +- net/ipv4/igmp.c | 18 +++++------------- net/ipv4/ip_sockglue.c | 19 ++++++++++++++----- net/ipv6/ipv6_sockglue.c | 18 ++++++++++++++---- net/ipv6/mcast.c | 10 +++------- 6 files changed, 38 insertions(+), 31 deletions(-) diff --git a/include/linux/igmp.h b/include/linux/igmp.h index faa6586a5783..64ce8cd1cfaf 100644 --- a/include/linux/igmp.h +++ b/include/linux/igmp.h @@ -123,7 +123,7 @@ extern int ip_mc_msfilter(struct sock *sk, struct ip_msfilter *msf,int ifindex); extern int ip_mc_msfget(struct sock *sk, struct ip_msfilter *msf, struct ip_msfilter __user *optval, int __user *optlen); extern int ip_mc_gsfget(struct sock *sk, struct group_filter *gsf, - struct group_filter __user *optval, int __user *optlen); + struct sockaddr_storage __user *p); extern int ip_mc_sf_allow(struct sock *sk, __be32 local, __be32 rmt, int dif, int sdif); extern void ip_mc_init_dev(struct in_device *); diff --git a/include/net/ipv6.h b/include/net/ipv6.h index 955badd1e8ff..900cc66311c4 100644 --- a/include/net/ipv6.h +++ b/include/net/ipv6.h @@ -1136,7 +1136,7 @@ int ip6_mc_source(int add, int omode, struct sock *sk, struct group_source_req *pgsr); int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf); int ip6_mc_msfget(struct sock *sk, struct group_filter *gsf, - struct group_filter __user *optval, int __user *optlen); + struct sockaddr_storage __user *p); #ifdef CONFIG_PROC_FS int ac6_proc_init(struct net *net); diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c index 47f0502b2101..7b272bbed2b4 100644 --- a/net/ipv4/igmp.c +++ b/net/ipv4/igmp.c @@ -2565,9 +2565,9 @@ int ip_mc_msfget(struct sock *sk, struct ip_msfilter *msf, } int ip_mc_gsfget(struct sock *sk, struct group_filter *gsf, - struct group_filter __user *optval, int __user *optlen) + struct sockaddr_storage __user *p) { - int err, i, count, copycount; + int i, count, copycount; struct sockaddr_in *psin; __be32 addr; struct ip_mc_socklist *pmc; @@ -2583,37 +2583,29 @@ int ip_mc_gsfget(struct sock *sk, struct group_filter *gsf, if (!ipv4_is_multicast(addr)) return -EINVAL; - err = -EADDRNOTAVAIL; - for_each_pmc_rtnl(inet, pmc) { if (pmc->multi.imr_multiaddr.s_addr == addr && pmc->multi.imr_ifindex == gsf->gf_interface) break; } if (!pmc) /* must have a prior join */ - goto done; + return -EADDRNOTAVAIL; gsf->gf_fmode = pmc->sfmode; psl = rtnl_dereference(pmc->sflist); count = psl ? psl->sl_count : 0; copycount = count < gsf->gf_numsrc ? count : gsf->gf_numsrc; gsf->gf_numsrc = count; - if (put_user(GROUP_FILTER_SIZE(copycount), optlen) || - copy_to_user(optval, gsf, GROUP_FILTER_SIZE(0))) { - return -EFAULT; - } - for (i = 0; i < copycount; i++) { + for (i = 0; i < copycount; i++, p++) { struct sockaddr_storage ss; psin = (struct sockaddr_in *)&ss; memset(&ss, 0, sizeof(ss)); psin->sin_family = AF_INET; psin->sin_addr.s_addr = psl->sl_addr[i]; - if (copy_to_user(&optval->gf_slist[i], &ss, sizeof(ss))) + if (copy_to_user(p, &ss, sizeof(ss))) return -EFAULT; } return 0; -done: - return err; } /* diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c index 8f550cf4c1c0..8616c38bd420 100644 --- a/net/ipv4/ip_sockglue.c +++ b/net/ipv4/ip_sockglue.c @@ -1473,19 +1473,28 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname, } case MCAST_MSFILTER: { + struct group_filter __user *p = (void __user *)optval; struct group_filter gsf; + const int size0 = offsetof(struct group_filter, gf_slist); + int num; - if (len < GROUP_FILTER_SIZE(0)) { + if (len < size0) { err = -EINVAL; goto out; } - if (copy_from_user(&gsf, optval, GROUP_FILTER_SIZE(0))) { + if (copy_from_user(&gsf, p, size0)) { err = -EFAULT; goto out; } - err = ip_mc_gsfget(sk, &gsf, - (struct group_filter __user *)optval, - optlen); + num = gsf.gf_numsrc; + err = ip_mc_gsfget(sk, &gsf, p->gf_slist); + if (err) + goto out; + if (gsf.gf_numsrc < num) + num = gsf.gf_numsrc; + if (put_user(GROUP_FILTER_SIZE(num), optlen) || + copy_to_user(p, &gsf, size0)) + err = -EFAULT; goto out; } case IP_MULTICAST_ALL: diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c index 1b4ad4f8dc42..6441e824b63b 100644 --- a/net/ipv6/ipv6_sockglue.c +++ b/net/ipv6/ipv6_sockglue.c @@ -1056,18 +1056,28 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname, break; case MCAST_MSFILTER: { + struct group_filter __user *p = (void __user *)optval; struct group_filter gsf; + const int size0 = offsetof(struct group_filter, gf_slist); + int num; int err; - if (len < GROUP_FILTER_SIZE(0)) + if (len < size0) return -EINVAL; - if (copy_from_user(&gsf, optval, GROUP_FILTER_SIZE(0))) + if (copy_from_user(&gsf, p, size0)) return -EFAULT; if (gsf.gf_group.ss_family != AF_INET6) return -EADDRNOTAVAIL; + num = gsf.gf_numsrc; lock_sock(sk); - err = ip6_mc_msfget(sk, &gsf, - (struct group_filter __user *)optval, optlen); + err = ip6_mc_msfget(sk, &gsf, p->gf_slist); + if (!err) { + if (num > gsf.gf_numsrc) + num = gsf.gf_numsrc; + if (put_user(GROUP_FILTER_SIZE(num), optlen) || + copy_to_user(p, &gsf, size0)) + err = -EFAULT; + } release_sock(sk); return err; } diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c index eaa4c2cc2fbb..97d796c7d6c0 100644 --- a/net/ipv6/mcast.c +++ b/net/ipv6/mcast.c @@ -547,7 +547,7 @@ int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf) } int ip6_mc_msfget(struct sock *sk, struct group_filter *gsf, - struct group_filter __user *optval, int __user *optlen) + struct sockaddr_storage *p) { int err, i, count, copycount; const struct in6_addr *group; @@ -592,14 +592,10 @@ int ip6_mc_msfget(struct sock *sk, struct group_filter *gsf, copycount = count < gsf->gf_numsrc ? count : gsf->gf_numsrc; gsf->gf_numsrc = count; - if (put_user(GROUP_FILTER_SIZE(copycount), optlen) || - copy_to_user(optval, gsf, GROUP_FILTER_SIZE(0))) { - return -EFAULT; - } /* changes to psl require the socket lock, and a write lock * on pmc->sflock. We have the socket lock so reading here is safe. */ - for (i = 0; i < copycount; i++) { + for (i = 0; i < copycount; i++, p++) { struct sockaddr_in6 *psin6; struct sockaddr_storage ss; @@ -607,7 +603,7 @@ int ip6_mc_msfget(struct sock *sk, struct group_filter *gsf, memset(&ss, 0, sizeof(ss)); psin6->sin6_family = AF_INET6; psin6->sin6_addr = psl->sl_addr[i]; - if (copy_to_user(&optval->gf_slist[i], &ss, sizeof(ss))) + if (copy_to_user(p, &ss, sizeof(ss))) return -EFAULT; } return 0; -- 2.11.0 ^ permalink raw reply related [flat|nested] 42+ messages in thread
* [PATCH 04/19] get rid of compat_mc_getsockopt() 2020-05-11 4:45 ` [PATCH 01/19] lift compat definitions of mcast [sg]etsockopt requests into net/compat.h Al Viro 2020-05-11 4:45 ` [PATCH 02/19] compat_ip{,v6}_setsockopt(): enumerate MCAST_... options explicitly Al Viro 2020-05-11 4:45 ` [PATCH 03/19] ip*_mc_gsfget(): lift copyout of struct group_filter into callers Al Viro @ 2020-05-11 4:45 ` Al Viro 2020-05-11 4:45 ` [PATCH 05/19] set_mcast_msfilter(): take the guts of setsockopt(MCAST_MSFILTER) into a helper Al Viro ` (14 subsequent siblings) 17 siblings, 0 replies; 42+ messages in thread From: Al Viro @ 2020-05-11 4:45 UTC (permalink / raw) To: netdev; +Cc: davem, viro, linux-kernel From: Al Viro <viro@zeniv.linux.org.uk> now we can do MCAST_MSFILTER in compat ->getsockopt() without playing silly buggers with copying things back and forth. We can form a native struct group_filter (sans the variable-length tail) on stack, pass that + pointer to the tail of original request to the helper doing the bulk of the work, then do the rest of copyout - same as the native getsockopt() does. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> --- include/net/compat.h | 3 -- net/compat.c | 79 ------------------------------------------------ net/ipv4/ip_sockglue.c | 44 +++++++++++++++++++++++++-- net/ipv6/ipv6_sockglue.c | 41 +++++++++++++++++++++++-- 4 files changed, 79 insertions(+), 88 deletions(-) diff --git a/include/net/compat.h b/include/net/compat.h index 9f4a56c5671e..b6043e759cde 100644 --- a/include/net/compat.h +++ b/include/net/compat.h @@ -52,9 +52,6 @@ int cmsghdr_from_user_compat_to_kern(struct msghdr *, struct sock *, int compat_mc_setsockopt(struct sock *, int, int, char __user *, unsigned int, int (*)(struct sock *, int, int, char __user *, unsigned int)); -int compat_mc_getsockopt(struct sock *, int, int, char __user *, int __user *, - int (*)(struct sock *, int, int, char __user *, - int __user *)); struct compat_group_req { __u32 gr_interface; diff --git a/net/compat.c b/net/compat.c index 06af69e7b408..6191481b5ef0 100644 --- a/net/compat.c +++ b/net/compat.c @@ -537,85 +537,6 @@ int compat_mc_setsockopt(struct sock *sock, int level, int optname, } EXPORT_SYMBOL(compat_mc_setsockopt); -int compat_mc_getsockopt(struct sock *sock, int level, int optname, - char __user *optval, int __user *optlen, - int (*getsockopt)(struct sock *, int, int, char __user *, int __user *)) -{ - struct compat_group_filter __user *gf32 = (void __user *)optval; - struct group_filter __user *kgf; - int __user *koptlen; - u32 interface, fmode, numsrc; - int klen, ulen, err; - - if (optname != MCAST_MSFILTER) - return getsockopt(sock, level, optname, optval, optlen); - - koptlen = compat_alloc_user_space(sizeof(*koptlen)); - if (!access_ok(optlen, sizeof(*optlen)) || - __get_user(ulen, optlen)) - return -EFAULT; - - /* adjust len for pad */ - klen = ulen + sizeof(*kgf) - sizeof(*gf32); - - if (klen < GROUP_FILTER_SIZE(0)) - return -EINVAL; - - if (!access_ok(koptlen, sizeof(*koptlen)) || - __put_user(klen, koptlen)) - return -EFAULT; - - /* have to allow space for previous compat_alloc_user_space, too */ - kgf = compat_alloc_user_space(klen+sizeof(*optlen)); - - if (!access_ok(gf32, __COMPAT_GF0_SIZE) || - __get_user(interface, &gf32->gf_interface) || - __get_user(fmode, &gf32->gf_fmode) || - __get_user(numsrc, &gf32->gf_numsrc) || - __put_user(interface, &kgf->gf_interface) || - __put_user(fmode, &kgf->gf_fmode) || - __put_user(numsrc, &kgf->gf_numsrc) || - copy_in_user(&kgf->gf_group, &gf32->gf_group, sizeof(kgf->gf_group))) - return -EFAULT; - - err = getsockopt(sock, level, optname, (char __user *)kgf, koptlen); - if (err) - return err; - - if (!access_ok(koptlen, sizeof(*koptlen)) || - __get_user(klen, koptlen)) - return -EFAULT; - - ulen = klen - (sizeof(*kgf)-sizeof(*gf32)); - - if (!access_ok(optlen, sizeof(*optlen)) || - __put_user(ulen, optlen)) - return -EFAULT; - - if (!access_ok(kgf, klen) || - !access_ok(gf32, ulen) || - __get_user(interface, &kgf->gf_interface) || - __get_user(fmode, &kgf->gf_fmode) || - __get_user(numsrc, &kgf->gf_numsrc) || - __put_user(interface, &gf32->gf_interface) || - __put_user(fmode, &gf32->gf_fmode) || - __put_user(numsrc, &gf32->gf_numsrc)) - return -EFAULT; - if (numsrc) { - int copylen; - - klen -= GROUP_FILTER_SIZE(0); - copylen = numsrc * sizeof(gf32->gf_slist[0]); - if (copylen > klen) - copylen = klen; - if (copy_in_user(gf32->gf_slist, kgf->gf_slist, copylen)) - return -EFAULT; - } - return err; -} -EXPORT_SYMBOL(compat_mc_getsockopt); - - /* Argument list sizes for compat_sys_socketcall */ #define AL(x) ((x) * sizeof(u32)) static unsigned char nas[21] = { diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c index 8616c38bd420..6bdaf43236ea 100644 --- a/net/ipv4/ip_sockglue.c +++ b/net/ipv4/ip_sockglue.c @@ -1606,9 +1606,47 @@ int compat_ip_getsockopt(struct sock *sk, int level, int optname, { int err; - if (optname == MCAST_MSFILTER) - return compat_mc_getsockopt(sk, level, optname, optval, optlen, - ip_getsockopt); + if (optname == MCAST_MSFILTER) { + const int size0 = offsetof(struct compat_group_filter, gf_slist); + struct compat_group_filter __user *p = (void __user *)optval; + struct compat_group_filter gf32; + struct group_filter gf; + int ulen, err; + int num; + + if (level != SOL_IP) + return -EOPNOTSUPP; + + if (get_user(ulen, optlen)) + return -EFAULT; + + if (ulen < size0) + return -EINVAL; + + if (copy_from_user(&gf32, p, size0)) + return -EFAULT; + + gf.gf_interface = gf32.gf_interface; + gf.gf_fmode = gf32.gf_fmode; + num = gf.gf_numsrc = gf32.gf_numsrc; + gf.gf_group = gf32.gf_group; + + rtnl_lock(); + lock_sock(sk); + err = ip_mc_gsfget(sk, &gf, p->gf_slist); + release_sock(sk); + rtnl_unlock(); + if (err) + return err; + if (gf.gf_numsrc < num) + num = gf.gf_numsrc; + ulen = GROUP_FILTER_SIZE(num) - (sizeof(gf) - sizeof(gf32)); + if (put_user(ulen, optlen) || + put_user(gf.gf_fmode, &p->gf_fmode) || + put_user(gf.gf_numsrc, &p->gf_numsrc)) + return -EFAULT; + return 0; + } err = do_ip_getsockopt(sk, level, optname, optval, optlen, MSG_CMSG_COMPAT); diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c index 6441e824b63b..3f127c6b3c22 100644 --- a/net/ipv6/ipv6_sockglue.c +++ b/net/ipv6/ipv6_sockglue.c @@ -1445,9 +1445,44 @@ int compat_ipv6_getsockopt(struct sock *sk, int level, int optname, if (level != SOL_IPV6) return -ENOPROTOOPT; - if (optname == MCAST_MSFILTER) - return compat_mc_getsockopt(sk, level, optname, optval, optlen, - ipv6_getsockopt); + if (optname == MCAST_MSFILTER) { + const int size0 = offsetof(struct compat_group_filter, gf_slist); + struct compat_group_filter __user *p = (void __user *)optval; + struct compat_group_filter gf32; + struct group_filter gf; + int ulen, err; + int num; + + if (get_user(ulen, optlen)) + return -EFAULT; + + if (ulen < size0) + return -EINVAL; + + if (copy_from_user(&gf32, p, size0)) + return -EFAULT; + + gf.gf_interface = gf32.gf_interface; + gf.gf_fmode = gf32.gf_fmode; + num = gf.gf_numsrc = gf32.gf_numsrc; + gf.gf_group = gf32.gf_group; + + if (gf.gf_group.ss_family != AF_INET6) + return -EADDRNOTAVAIL; + lock_sock(sk); + err = ip6_mc_msfget(sk, &gf, p->gf_slist); + release_sock(sk); + if (err) + return err; + if (num > gf.gf_numsrc) + num = gf.gf_numsrc; + ulen = GROUP_FILTER_SIZE(num) - (sizeof(gf)-sizeof(gf32)); + if (put_user(ulen, optlen) || + put_user(gf.gf_fmode, &p->gf_fmode) || + put_user(gf.gf_numsrc, &p->gf_numsrc)) + return -EFAULT; + return 0; + } err = do_ipv6_getsockopt(sk, level, optname, optval, optlen, MSG_CMSG_COMPAT); -- 2.11.0 ^ permalink raw reply related [flat|nested] 42+ messages in thread
* [PATCH 05/19] set_mcast_msfilter(): take the guts of setsockopt(MCAST_MSFILTER) into a helper 2020-05-11 4:45 ` [PATCH 01/19] lift compat definitions of mcast [sg]etsockopt requests into net/compat.h Al Viro ` (2 preceding siblings ...) 2020-05-11 4:45 ` [PATCH 04/19] get rid of compat_mc_getsockopt() Al Viro @ 2020-05-11 4:45 ` Al Viro 2020-05-11 4:45 ` [PATCH 06/19] ipv4: do compat setsockopt for MCAST_MSFILTER directly Al Viro ` (13 subsequent siblings) 17 siblings, 0 replies; 42+ messages in thread From: Al Viro @ 2020-05-11 4:45 UTC (permalink / raw) To: netdev; +Cc: davem, viro, linux-kernel From: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> --- net/ipv4/ip_sockglue.c | 73 +++++++++++++++++++++++++++----------------------- 1 file changed, 40 insertions(+), 33 deletions(-) diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c index 6bdaf43236ea..8c14a474870d 100644 --- a/net/ipv4/ip_sockglue.c +++ b/net/ipv4/ip_sockglue.c @@ -587,6 +587,43 @@ static bool setsockopt_needs_rtnl(int optname) return false; } +static int set_mcast_msfilter(struct sock *sk, int ifindex, + int numsrc, int fmode, + struct sockaddr_storage *group, + struct sockaddr_storage *list) +{ + int msize = IP_MSFILTER_SIZE(numsrc); + struct ip_msfilter *msf; + struct sockaddr_in *psin; + int err, i; + + msf = kmalloc(msize, GFP_KERNEL); + if (!msf) + return -ENOBUFS; + + psin = (struct sockaddr_in *)group; + if (psin->sin_family != AF_INET) + goto Eaddrnotavail; + msf->imsf_multiaddr = psin->sin_addr.s_addr; + msf->imsf_interface = 0; + msf->imsf_fmode = fmode; + msf->imsf_numsrc = numsrc; + for (i = 0; i < numsrc; ++i) { + psin = (struct sockaddr_in *)&list[i]; + + if (psin->sin_family != AF_INET) + goto Eaddrnotavail; + msf->imsf_slist[i] = psin->sin_addr.s_addr; + } + err = ip_mc_msfilter(sk, msf, ifindex); + kfree(msf); + return err; + +Eaddrnotavail: + kfree(msf); + return -EADDRNOTAVAIL; +} + static int do_ip_setsockopt(struct sock *sk, int level, int optname, char __user *optval, unsigned int optlen) { @@ -1079,10 +1116,7 @@ static int do_ip_setsockopt(struct sock *sk, int level, } case MCAST_MSFILTER: { - struct sockaddr_in *psin; - struct ip_msfilter *msf = NULL; struct group_filter *gsf = NULL; - int msize, i, ifindex; if (optlen < GROUP_FILTER_SIZE(0)) goto e_inval; @@ -1095,7 +1129,6 @@ static int do_ip_setsockopt(struct sock *sk, int level, err = PTR_ERR(gsf); break; } - /* numsrc >= (4G-140)/128 overflow in 32 bits */ if (gsf->gf_numsrc >= 0x1ffffff || gsf->gf_numsrc > net->ipv4.sysctl_igmp_max_msf) { @@ -1106,36 +1139,10 @@ static int do_ip_setsockopt(struct sock *sk, int level, err = -EINVAL; goto mc_msf_out; } - msize = IP_MSFILTER_SIZE(gsf->gf_numsrc); - msf = kmalloc(msize, GFP_KERNEL); - if (!msf) { - err = -ENOBUFS; - goto mc_msf_out; - } - ifindex = gsf->gf_interface; - psin = (struct sockaddr_in *)&gsf->gf_group; - if (psin->sin_family != AF_INET) { - err = -EADDRNOTAVAIL; - goto mc_msf_out; - } - msf->imsf_multiaddr = psin->sin_addr.s_addr; - msf->imsf_interface = 0; - msf->imsf_fmode = gsf->gf_fmode; - msf->imsf_numsrc = gsf->gf_numsrc; - err = -EADDRNOTAVAIL; - for (i = 0; i < gsf->gf_numsrc; ++i) { - psin = (struct sockaddr_in *)&gsf->gf_slist[i]; - - if (psin->sin_family != AF_INET) - goto mc_msf_out; - msf->imsf_slist[i] = psin->sin_addr.s_addr; - } - kfree(gsf); - gsf = NULL; - - err = ip_mc_msfilter(sk, msf, ifindex); + err = set_mcast_msfilter(sk, gsf->gf_interface, + gsf->gf_numsrc, gsf->gf_fmode, + &gsf->gf_group, gsf->gf_slist); mc_msf_out: - kfree(msf); kfree(gsf); break; } -- 2.11.0 ^ permalink raw reply related [flat|nested] 42+ messages in thread
* [PATCH 06/19] ipv4: do compat setsockopt for MCAST_MSFILTER directly 2020-05-11 4:45 ` [PATCH 01/19] lift compat definitions of mcast [sg]etsockopt requests into net/compat.h Al Viro ` (3 preceding siblings ...) 2020-05-11 4:45 ` [PATCH 05/19] set_mcast_msfilter(): take the guts of setsockopt(MCAST_MSFILTER) into a helper Al Viro @ 2020-05-11 4:45 ` Al Viro 2020-05-11 4:45 ` [PATCH 07/19] ip6_mc_msfilter(): pass the address list separately Al Viro ` (12 subsequent siblings) 17 siblings, 0 replies; 42+ messages in thread From: Al Viro @ 2020-05-11 4:45 UTC (permalink / raw) To: netdev; +Cc: davem, viro, linux-kernel From: Al Viro <viro@zeniv.linux.org.uk> Parallel to what the native setsockopt() does, except that unlike the native setsockopt() we do not use memdup_user() - we want the sockaddr_storage fields properly aligned, so we allocate 4 bytes more and copy compat_group_filter at the offset 4, which yields the proper alignments. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> --- net/ipv4/ip_sockglue.c | 48 +++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 47 insertions(+), 1 deletion(-) diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c index 8c14a474870d..dc1f5276be4e 100644 --- a/net/ipv4/ip_sockglue.c +++ b/net/ipv4/ip_sockglue.c @@ -1286,9 +1286,55 @@ int compat_ip_setsockopt(struct sock *sk, int level, int optname, case MCAST_LEAVE_SOURCE_GROUP: case MCAST_BLOCK_SOURCE: case MCAST_UNBLOCK_SOURCE: - case MCAST_MSFILTER: return compat_mc_setsockopt(sk, level, optname, optval, optlen, ip_setsockopt); + case MCAST_MSFILTER: + { + const int size0 = offsetof(struct compat_group_filter, gf_slist); + struct compat_group_filter *gf32; + void *p; + int n; + + if (optlen < size0) + return -EINVAL; + if (optlen > sysctl_optmem_max - 4) + return -ENOBUFS; + + p = kmalloc(optlen + 4, GFP_KERNEL); + if (!p) + return -ENOMEM; + gf32 = p + 4; /* we want ->gf_group and ->gf_slist aligned */ + if (copy_from_user(gf32, optval, optlen)) { + err = -EFAULT; + goto mc_msf_out; + } + + n = gf32->gf_numsrc; + /* numsrc >= (4G-140)/128 overflow in 32 bits */ + if (n >= 0x1ffffff) { + err = -ENOBUFS; + goto mc_msf_out; + } + if (offsetof(struct compat_group_filter, gf_slist[n]) > optlen) { + err = -EINVAL; + goto mc_msf_out; + } + + rtnl_lock(); + lock_sock(sk); + /* numsrc >= (4G-140)/128 overflow in 32 bits */ + if (n > sock_net(sk)->ipv4.sysctl_igmp_max_msf) + err = -ENOBUFS; + else + err = set_mcast_msfilter(sk, gf32->gf_interface, + n, gf32->gf_fmode, + &gf32->gf_group, gf32->gf_slist); + release_sock(sk); + rtnl_unlock(); +mc_msf_out: + kfree(p); + return err; + } } err = do_ip_setsockopt(sk, level, optname, optval, optlen); -- 2.11.0 ^ permalink raw reply related [flat|nested] 42+ messages in thread
* [PATCH 07/19] ip6_mc_msfilter(): pass the address list separately 2020-05-11 4:45 ` [PATCH 01/19] lift compat definitions of mcast [sg]etsockopt requests into net/compat.h Al Viro ` (4 preceding siblings ...) 2020-05-11 4:45 ` [PATCH 06/19] ipv4: do compat setsockopt for MCAST_MSFILTER directly Al Viro @ 2020-05-11 4:45 ` Al Viro 2020-05-11 4:45 ` [PATCH 08/19] ipv6: do compat setsockopt for MCAST_MSFILTER directly Al Viro ` (11 subsequent siblings) 17 siblings, 0 replies; 42+ messages in thread From: Al Viro @ 2020-05-11 4:45 UTC (permalink / raw) To: netdev; +Cc: davem, viro, linux-kernel From: Al Viro <viro@zeniv.linux.org.uk> that way we'll be able to reuse it for compat case Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> --- include/net/ipv6.h | 3 ++- net/ipv6/ipv6_sockglue.c | 2 +- net/ipv6/mcast.c | 7 ++++--- 3 files changed, 7 insertions(+), 5 deletions(-) diff --git a/include/net/ipv6.h b/include/net/ipv6.h index 900cc66311c4..901c78b117a1 100644 --- a/include/net/ipv6.h +++ b/include/net/ipv6.h @@ -1134,7 +1134,8 @@ struct group_filter; int ip6_mc_source(int add, int omode, struct sock *sk, struct group_source_req *pgsr); -int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf); +int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf, + struct sockaddr_storage *list); int ip6_mc_msfget(struct sock *sk, struct group_filter *gsf, struct sockaddr_storage __user *p); diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c index 3f127c6b3c22..33efc9112259 100644 --- a/net/ipv6/ipv6_sockglue.c +++ b/net/ipv6/ipv6_sockglue.c @@ -780,7 +780,7 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname, retv = -EINVAL; break; } - retv = ip6_mc_msfilter(sk, gsf); + retv = ip6_mc_msfilter(sk, gsf, gsf->gf_slist); kfree(gsf); break; diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c index 97d796c7d6c0..7e12d2114158 100644 --- a/net/ipv6/mcast.c +++ b/net/ipv6/mcast.c @@ -457,7 +457,8 @@ int ip6_mc_source(int add, int omode, struct sock *sk, return err; } -int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf) +int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf, + struct sockaddr_storage *list) { const struct in6_addr *group; struct ipv6_mc_socklist *pmc; @@ -509,10 +510,10 @@ int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf) goto done; } newpsl->sl_max = newpsl->sl_count = gsf->gf_numsrc; - for (i = 0; i < newpsl->sl_count; ++i) { + for (i = 0; i < newpsl->sl_count; ++i, ++list) { struct sockaddr_in6 *psin6; - psin6 = (struct sockaddr_in6 *)&gsf->gf_slist[i]; + psin6 = (struct sockaddr_in6 *)list; newpsl->sl_addr[i] = psin6->sin6_addr; } err = ip6_mc_add_src(idev, group, gsf->gf_fmode, -- 2.11.0 ^ permalink raw reply related [flat|nested] 42+ messages in thread
* [PATCH 08/19] ipv6: do compat setsockopt for MCAST_MSFILTER directly 2020-05-11 4:45 ` [PATCH 01/19] lift compat definitions of mcast [sg]etsockopt requests into net/compat.h Al Viro ` (5 preceding siblings ...) 2020-05-11 4:45 ` [PATCH 07/19] ip6_mc_msfilter(): pass the address list separately Al Viro @ 2020-05-11 4:45 ` Al Viro 2020-05-11 4:45 ` [PATCH 09/19] ipv[46]: do compat setsockopt for MCAST_{JOIN,LEAVE}_GROUP directly Al Viro ` (10 subsequent siblings) 17 siblings, 0 replies; 42+ messages in thread From: Al Viro @ 2020-05-11 4:45 UTC (permalink / raw) To: netdev; +Cc: davem, viro, linux-kernel From: Al Viro <viro@zeniv.linux.org.uk> similar to the ipv4 counterpart of that patch - the same trick used to align the tail array properly. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> --- net/ipv6/ipv6_sockglue.c | 48 +++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 47 insertions(+), 1 deletion(-) diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c index 33efc9112259..220087bfd17c 100644 --- a/net/ipv6/ipv6_sockglue.c +++ b/net/ipv6/ipv6_sockglue.c @@ -980,9 +980,55 @@ int compat_ipv6_setsockopt(struct sock *sk, int level, int optname, case MCAST_LEAVE_SOURCE_GROUP: case MCAST_BLOCK_SOURCE: case MCAST_UNBLOCK_SOURCE: - case MCAST_MSFILTER: return compat_mc_setsockopt(sk, level, optname, optval, optlen, ipv6_setsockopt); + case MCAST_MSFILTER: + { + const int size0 = offsetof(struct compat_group_filter, gf_slist); + struct compat_group_filter *gf32; + void *p; + int n; + + if (optlen < size0) + return -EINVAL; + if (optlen > sysctl_optmem_max - 4) + return -ENOBUFS; + + p = kmalloc(optlen + 4, GFP_KERNEL); + if (!p) + return -ENOMEM; + + gf32 = p + 4; /* we want ->gf_group and ->gf_slist aligned */ + if (copy_from_user(gf32, optval, optlen)) { + err = -EFAULT; + goto mc_msf_out; + } + + n = gf32->gf_numsrc; + /* numsrc >= (4G-140)/128 overflow in 32 bits */ + if (n >= 0x1ffffffU || + n > sysctl_mld_max_msf) { + err = -ENOBUFS; + goto mc_msf_out; + } + if (offsetof(struct compat_group_filter, gf_slist[n]) > optlen) { + err = -EINVAL; + goto mc_msf_out; + } + + rtnl_lock(); + lock_sock(sk); + err = ip6_mc_msfilter(sk, &(struct group_filter){ + .gf_interface = gf32->gf_interface, + .gf_group = gf32->gf_group, + .gf_fmode = gf32->gf_fmode, + .gf_numsrc = gf32->gf_numsrc}, gf32->gf_slist); + release_sock(sk); + rtnl_unlock(); +mc_msf_out: + kfree(p); + return err; + } } err = do_ipv6_setsockopt(sk, level, optname, optval, optlen); -- 2.11.0 ^ permalink raw reply related [flat|nested] 42+ messages in thread
* [PATCH 09/19] ipv[46]: do compat setsockopt for MCAST_{JOIN,LEAVE}_GROUP directly 2020-05-11 4:45 ` [PATCH 01/19] lift compat definitions of mcast [sg]etsockopt requests into net/compat.h Al Viro ` (6 preceding siblings ...) 2020-05-11 4:45 ` [PATCH 08/19] ipv6: do compat setsockopt for MCAST_MSFILTER directly Al Viro @ 2020-05-11 4:45 ` Al Viro 2020-05-11 4:45 ` [PATCH 10/19] ipv4: take handling of group_source_req options into a helper Al Viro ` (9 subsequent siblings) 17 siblings, 0 replies; 42+ messages in thread From: Al Viro @ 2020-05-11 4:45 UTC (permalink / raw) To: netdev; +Cc: davem, viro, linux-kernel From: Al Viro <viro@zeniv.linux.org.uk> direct parallel to the way these two are handled in the native ->setsockopt() instances - the helpers that do the real work are already separated and can be reused as-is in this case. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> --- net/ipv4/ip_sockglue.c | 31 +++++++++++++++++++++++++++++++ net/ipv6/ipv6_sockglue.c | 28 ++++++++++++++++++++++++++++ 2 files changed, 59 insertions(+) diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c index dc1f5276be4e..937f39906419 100644 --- a/net/ipv4/ip_sockglue.c +++ b/net/ipv4/ip_sockglue.c @@ -1282,6 +1282,37 @@ int compat_ip_setsockopt(struct sock *sk, int level, int optname, switch (optname) { case MCAST_JOIN_GROUP: case MCAST_LEAVE_GROUP: + { + struct compat_group_req __user *gr32 = (void __user *)optval; + struct group_req greq; + struct sockaddr_in *psin = (struct sockaddr_in *)&greq.gr_group; + struct ip_mreqn mreq; + + if (optlen < sizeof(struct compat_group_req)) + return -EINVAL; + + if (get_user(greq.gr_interface, &gr32->gr_interface) || + copy_from_user(&greq.gr_group, &gr32->gr_group, + sizeof(greq.gr_group))) + return -EFAULT; + + if (psin->sin_family != AF_INET) + return -EINVAL; + + memset(&mreq, 0, sizeof(mreq)); + mreq.imr_multiaddr = psin->sin_addr; + mreq.imr_ifindex = greq.gr_interface; + + rtnl_lock(); + lock_sock(sk); + if (optname == MCAST_JOIN_GROUP) + err = ip_mc_join_group(sk, &mreq); + else + err = ip_mc_leave_group(sk, &mreq); + release_sock(sk); + rtnl_unlock(); + return err; + } case MCAST_JOIN_SOURCE_GROUP: case MCAST_LEAVE_SOURCE_GROUP: case MCAST_BLOCK_SOURCE: diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c index 220087bfd17c..b386a2b3668c 100644 --- a/net/ipv6/ipv6_sockglue.c +++ b/net/ipv6/ipv6_sockglue.c @@ -976,6 +976,34 @@ int compat_ipv6_setsockopt(struct sock *sk, int level, int optname, switch (optname) { case MCAST_JOIN_GROUP: case MCAST_LEAVE_GROUP: + { + struct compat_group_req __user *gr32 = (void __user *)optval; + struct group_req greq; + struct sockaddr_in6 *psin6 = (struct sockaddr_in6 *)&greq.gr_group; + + if (optlen < sizeof(struct compat_group_req)) + return -EINVAL; + + if (get_user(greq.gr_interface, &gr32->gr_interface) || + copy_from_user(&greq.gr_group, &gr32->gr_group, + sizeof(greq.gr_group))) + return -EFAULT; + + if (greq.gr_group.ss_family != AF_INET6) + return -EADDRNOTAVAIL; + + rtnl_lock(); + lock_sock(sk); + if (optname == MCAST_JOIN_GROUP) + err = ipv6_sock_mc_join(sk, greq.gr_interface, + &psin6->sin6_addr); + else + err = ipv6_sock_mc_drop(sk, greq.gr_interface, + &psin6->sin6_addr); + release_sock(sk); + rtnl_unlock(); + return err; + } case MCAST_JOIN_SOURCE_GROUP: case MCAST_LEAVE_SOURCE_GROUP: case MCAST_BLOCK_SOURCE: -- 2.11.0 ^ permalink raw reply related [flat|nested] 42+ messages in thread
* [PATCH 10/19] ipv4: take handling of group_source_req options into a helper 2020-05-11 4:45 ` [PATCH 01/19] lift compat definitions of mcast [sg]etsockopt requests into net/compat.h Al Viro ` (7 preceding siblings ...) 2020-05-11 4:45 ` [PATCH 09/19] ipv[46]: do compat setsockopt for MCAST_{JOIN,LEAVE}_GROUP directly Al Viro @ 2020-05-11 4:45 ` Al Viro 2020-05-11 4:45 ` [PATCH 11/19] ipv6: " Al Viro ` (8 subsequent siblings) 17 siblings, 0 replies; 42+ messages in thread From: Al Viro @ 2020-05-11 4:45 UTC (permalink / raw) To: netdev; +Cc: davem, viro, linux-kernel From: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> --- net/ipv4/ip_sockglue.c | 83 ++++++++++++++++++++++++++------------------------ 1 file changed, 44 insertions(+), 39 deletions(-) diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c index 937f39906419..4f412b0bdda4 100644 --- a/net/ipv4/ip_sockglue.c +++ b/net/ipv4/ip_sockglue.c @@ -624,6 +624,49 @@ static int set_mcast_msfilter(struct sock *sk, int ifindex, return -EADDRNOTAVAIL; } +static int do_mcast_group_source(struct sock *sk, int optname, + struct group_source_req *greqs) +{ + struct ip_mreq_source mreqs; + struct sockaddr_in *psin; + int omode, add, err; + + if (greqs->gsr_group.ss_family != AF_INET || + greqs->gsr_source.ss_family != AF_INET) + return -EADDRNOTAVAIL; + + psin = (struct sockaddr_in *)&greqs->gsr_group; + mreqs.imr_multiaddr = psin->sin_addr.s_addr; + psin = (struct sockaddr_in *)&greqs->gsr_source; + mreqs.imr_sourceaddr = psin->sin_addr.s_addr; + mreqs.imr_interface = 0; /* use index for mc_source */ + + if (optname == MCAST_BLOCK_SOURCE) { + omode = MCAST_EXCLUDE; + add = 1; + } else if (optname == MCAST_UNBLOCK_SOURCE) { + omode = MCAST_EXCLUDE; + add = 0; + } else if (optname == MCAST_JOIN_SOURCE_GROUP) { + struct ip_mreqn mreq; + + psin = (struct sockaddr_in *)&greqs->gsr_group; + mreq.imr_multiaddr = psin->sin_addr; + mreq.imr_address.s_addr = 0; + mreq.imr_ifindex = greqs->gsr_interface; + err = ip_mc_join_group_ssm(sk, &mreq, MCAST_INCLUDE); + if (err && err != -EADDRINUSE) + return err; + greqs->gsr_interface = mreq.imr_ifindex; + omode = MCAST_INCLUDE; + add = 1; + } else /* MCAST_LEAVE_SOURCE_GROUP */ { + omode = MCAST_INCLUDE; + add = 0; + } + return ip_mc_source(add, omode, sk, &mreqs, greqs->gsr_interface); +} + static int do_ip_setsockopt(struct sock *sk, int level, int optname, char __user *optval, unsigned int optlen) { @@ -1066,9 +1109,6 @@ static int do_ip_setsockopt(struct sock *sk, int level, case MCAST_UNBLOCK_SOURCE: { struct group_source_req greqs; - struct ip_mreq_source mreqs; - struct sockaddr_in *psin; - int omode, add; if (optlen != sizeof(struct group_source_req)) goto e_inval; @@ -1076,42 +1116,7 @@ static int do_ip_setsockopt(struct sock *sk, int level, err = -EFAULT; break; } - if (greqs.gsr_group.ss_family != AF_INET || - greqs.gsr_source.ss_family != AF_INET) { - err = -EADDRNOTAVAIL; - break; - } - psin = (struct sockaddr_in *)&greqs.gsr_group; - mreqs.imr_multiaddr = psin->sin_addr.s_addr; - psin = (struct sockaddr_in *)&greqs.gsr_source; - mreqs.imr_sourceaddr = psin->sin_addr.s_addr; - mreqs.imr_interface = 0; /* use index for mc_source */ - - if (optname == MCAST_BLOCK_SOURCE) { - omode = MCAST_EXCLUDE; - add = 1; - } else if (optname == MCAST_UNBLOCK_SOURCE) { - omode = MCAST_EXCLUDE; - add = 0; - } else if (optname == MCAST_JOIN_SOURCE_GROUP) { - struct ip_mreqn mreq; - - psin = (struct sockaddr_in *)&greqs.gsr_group; - mreq.imr_multiaddr = psin->sin_addr; - mreq.imr_address.s_addr = 0; - mreq.imr_ifindex = greqs.gsr_interface; - err = ip_mc_join_group_ssm(sk, &mreq, MCAST_INCLUDE); - if (err && err != -EADDRINUSE) - break; - greqs.gsr_interface = mreq.imr_ifindex; - omode = MCAST_INCLUDE; - add = 1; - } else /* MCAST_LEAVE_SOURCE_GROUP */ { - omode = MCAST_INCLUDE; - add = 0; - } - err = ip_mc_source(add, omode, sk, &mreqs, - greqs.gsr_interface); + err = do_mcast_group_source(sk, optname, &greqs); break; } case MCAST_MSFILTER: -- 2.11.0 ^ permalink raw reply related [flat|nested] 42+ messages in thread
* [PATCH 11/19] ipv6: take handling of group_source_req options into a helper 2020-05-11 4:45 ` [PATCH 01/19] lift compat definitions of mcast [sg]etsockopt requests into net/compat.h Al Viro ` (8 preceding siblings ...) 2020-05-11 4:45 ` [PATCH 10/19] ipv4: take handling of group_source_req options into a helper Al Viro @ 2020-05-11 4:45 ` Al Viro 2020-05-11 4:45 ` [PATCH 12/19] handle the group_source_req options directly Al Viro ` (7 subsequent siblings) 17 siblings, 0 replies; 42+ messages in thread From: Al Viro @ 2020-05-11 4:45 UTC (permalink / raw) To: netdev; +Cc: davem, viro, linux-kernel From: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> --- net/ipv6/ipv6_sockglue.c | 65 +++++++++++++++++++++++++++--------------------- 1 file changed, 36 insertions(+), 29 deletions(-) diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c index b386a2b3668c..fc525ad9ed3c 100644 --- a/net/ipv6/ipv6_sockglue.c +++ b/net/ipv6/ipv6_sockglue.c @@ -136,6 +136,41 @@ static bool setsockopt_needs_rtnl(int optname) return false; } +static int do_ipv6_mcast_group_source(struct sock *sk, int optname, + struct group_source_req *greqs) +{ + int omode, add; + + if (greqs->gsr_group.ss_family != AF_INET6 || + greqs->gsr_source.ss_family != AF_INET6) + return -EADDRNOTAVAIL; + + if (optname == MCAST_BLOCK_SOURCE) { + omode = MCAST_EXCLUDE; + add = 1; + } else if (optname == MCAST_UNBLOCK_SOURCE) { + omode = MCAST_EXCLUDE; + add = 0; + } else if (optname == MCAST_JOIN_SOURCE_GROUP) { + struct sockaddr_in6 *psin6; + int retv; + + psin6 = (struct sockaddr_in6 *)&greqs->gsr_group; + retv = ipv6_sock_mc_join_ssm(sk, greqs->gsr_interface, + &psin6->sin6_addr, + MCAST_INCLUDE); + /* prior join w/ different source is ok */ + if (retv && retv != -EADDRINUSE) + return retv; + omode = MCAST_INCLUDE; + add = 1; + } else /* MCAST_LEAVE_SOURCE_GROUP */ { + omode = MCAST_INCLUDE; + add = 0; + } + return ip6_mc_source(add, omode, sk, greqs); +} + static int do_ipv6_setsockopt(struct sock *sk, int level, int optname, char __user *optval, unsigned int optlen) { @@ -715,7 +750,6 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname, case MCAST_UNBLOCK_SOURCE: { struct group_source_req greqs; - int omode, add; if (optlen < sizeof(struct group_source_req)) goto e_inval; @@ -723,34 +757,7 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname, retv = -EFAULT; break; } - if (greqs.gsr_group.ss_family != AF_INET6 || - greqs.gsr_source.ss_family != AF_INET6) { - retv = -EADDRNOTAVAIL; - break; - } - if (optname == MCAST_BLOCK_SOURCE) { - omode = MCAST_EXCLUDE; - add = 1; - } else if (optname == MCAST_UNBLOCK_SOURCE) { - omode = MCAST_EXCLUDE; - add = 0; - } else if (optname == MCAST_JOIN_SOURCE_GROUP) { - struct sockaddr_in6 *psin6; - - psin6 = (struct sockaddr_in6 *)&greqs.gsr_group; - retv = ipv6_sock_mc_join_ssm(sk, greqs.gsr_interface, - &psin6->sin6_addr, - MCAST_INCLUDE); - /* prior join w/ different source is ok */ - if (retv && retv != -EADDRINUSE) - break; - omode = MCAST_INCLUDE; - add = 1; - } else /* MCAST_LEAVE_SOURCE_GROUP */ { - omode = MCAST_INCLUDE; - add = 0; - } - retv = ip6_mc_source(add, omode, sk, &greqs); + retv = do_ipv6_mcast_group_source(sk, optname, &greqs); break; } case MCAST_MSFILTER: -- 2.11.0 ^ permalink raw reply related [flat|nested] 42+ messages in thread
* [PATCH 12/19] handle the group_source_req options directly 2020-05-11 4:45 ` [PATCH 01/19] lift compat definitions of mcast [sg]etsockopt requests into net/compat.h Al Viro ` (9 preceding siblings ...) 2020-05-11 4:45 ` [PATCH 11/19] ipv6: " Al Viro @ 2020-05-11 4:45 ` Al Viro 2020-05-11 4:45 ` [PATCH 13/19] get rid of compat_mc_setsockopt() Al Viro ` (6 subsequent siblings) 17 siblings, 0 replies; 42+ messages in thread From: Al Viro @ 2020-05-11 4:45 UTC (permalink / raw) To: netdev; +Cc: davem, viro, linux-kernel From: Al Viro <viro@zeniv.linux.org.uk> Native ->setsockopt() handling of these options (MCAST_..._SOURCE_GROUP and MCAST_{,UN}BLOCK_SOURCE) consists of copyin + call of a helper that does the actual work. The only change needed for ->compat_setsockopt() is a slightly different copyin - the helpers can be reused as-is. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> --- net/ipv4/ip_sockglue.c | 23 +++++++++++++++++++++-- net/ipv6/ipv6_sockglue.c | 23 +++++++++++++++++++++-- 2 files changed, 42 insertions(+), 4 deletions(-) diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c index 4f412b0bdda4..8a3b879dc0f5 100644 --- a/net/ipv4/ip_sockglue.c +++ b/net/ipv4/ip_sockglue.c @@ -1322,8 +1322,27 @@ int compat_ip_setsockopt(struct sock *sk, int level, int optname, case MCAST_LEAVE_SOURCE_GROUP: case MCAST_BLOCK_SOURCE: case MCAST_UNBLOCK_SOURCE: - return compat_mc_setsockopt(sk, level, optname, optval, optlen, - ip_setsockopt); + { + struct compat_group_source_req __user *gsr32 = (void __user *)optval; + struct group_source_req greqs; + + if (optlen != sizeof(struct compat_group_source_req)) + return -EINVAL; + + if (get_user(greqs.gsr_interface, &gsr32->gsr_interface) || + copy_from_user(&greqs.gsr_group, &gsr32->gsr_group, + sizeof(greqs.gsr_group)) || + copy_from_user(&greqs.gsr_source, &gsr32->gsr_source, + sizeof(greqs.gsr_source))) + return -EFAULT; + + rtnl_lock(); + lock_sock(sk); + err = do_mcast_group_source(sk, optname, &greqs); + release_sock(sk); + rtnl_unlock(); + return err; + } case MCAST_MSFILTER: { const int size0 = offsetof(struct compat_group_filter, gf_slist); diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c index fc525ad9ed3c..4c9a9f2f83cf 100644 --- a/net/ipv6/ipv6_sockglue.c +++ b/net/ipv6/ipv6_sockglue.c @@ -1015,8 +1015,27 @@ int compat_ipv6_setsockopt(struct sock *sk, int level, int optname, case MCAST_LEAVE_SOURCE_GROUP: case MCAST_BLOCK_SOURCE: case MCAST_UNBLOCK_SOURCE: - return compat_mc_setsockopt(sk, level, optname, optval, optlen, - ipv6_setsockopt); + { + struct compat_group_source_req __user *gsr32 = (void __user *)optval; + struct group_source_req greqs; + + if (optlen < sizeof(struct compat_group_source_req)) + return -EINVAL; + + if (get_user(greqs.gsr_interface, &gsr32->gsr_interface) || + copy_from_user(&greqs.gsr_group, &gsr32->gsr_group, + sizeof(greqs.gsr_group)) || + copy_from_user(&greqs.gsr_source, &gsr32->gsr_source, + sizeof(greqs.gsr_source))) + return -EFAULT; + + rtnl_lock(); + lock_sock(sk); + err = do_ipv6_mcast_group_source(sk, optname, &greqs); + release_sock(sk); + rtnl_unlock(); + return err; + } case MCAST_MSFILTER: { const int size0 = offsetof(struct compat_group_filter, gf_slist); -- 2.11.0 ^ permalink raw reply related [flat|nested] 42+ messages in thread
* [PATCH 13/19] get rid of compat_mc_setsockopt() 2020-05-11 4:45 ` [PATCH 01/19] lift compat definitions of mcast [sg]etsockopt requests into net/compat.h Al Viro ` (10 preceding siblings ...) 2020-05-11 4:45 ` [PATCH 12/19] handle the group_source_req options directly Al Viro @ 2020-05-11 4:45 ` Al Viro 2020-05-11 4:45 ` [PATCH 14/19] batadv_socket_read(): get rid of pointless access_ok() Al Viro ` (5 subsequent siblings) 17 siblings, 0 replies; 42+ messages in thread From: Al Viro @ 2020-05-11 4:45 UTC (permalink / raw) To: netdev; +Cc: davem, viro, linux-kernel From: Al Viro <viro@zeniv.linux.org.uk> not used anymore Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> --- include/net/compat.h | 4 --- net/compat.c | 90 ---------------------------------------------------- 2 files changed, 94 deletions(-) diff --git a/include/net/compat.h b/include/net/compat.h index b6043e759cde..2de4dfcdc11f 100644 --- a/include/net/compat.h +++ b/include/net/compat.h @@ -49,10 +49,6 @@ int put_cmsg_compat(struct msghdr*, int, int, int, void *); int cmsghdr_from_user_compat_to_kern(struct msghdr *, struct sock *, unsigned char *, int); -int compat_mc_setsockopt(struct sock *, int, int, char __user *, unsigned int, - int (*)(struct sock *, int, int, char __user *, - unsigned int)); - struct compat_group_req { __u32 gr_interface; struct __kernel_sockaddr_storage gr_group diff --git a/net/compat.c b/net/compat.c index 6191481b5ef0..a47ce3a6e7af 100644 --- a/net/compat.c +++ b/net/compat.c @@ -447,96 +447,6 @@ COMPAT_SYSCALL_DEFINE5(getsockopt, int, fd, int, level, int, optname, return __compat_sys_getsockopt(fd, level, optname, optval, optlen); } -#define __COMPAT_GF0_SIZE (sizeof(struct compat_group_filter) - \ - sizeof(struct __kernel_sockaddr_storage)) - -int compat_mc_setsockopt(struct sock *sock, int level, int optname, - char __user *optval, unsigned int optlen, - int (*setsockopt)(struct sock *, int, int, char __user *, unsigned int)) -{ - char __user *koptval = optval; - int koptlen = optlen; - - switch (optname) { - case MCAST_JOIN_GROUP: - case MCAST_LEAVE_GROUP: - { - struct compat_group_req __user *gr32 = (void __user *)optval; - struct group_req __user *kgr = - compat_alloc_user_space(sizeof(struct group_req)); - u32 interface; - - if (!access_ok(gr32, sizeof(*gr32)) || - !access_ok(kgr, sizeof(struct group_req)) || - __get_user(interface, &gr32->gr_interface) || - __put_user(interface, &kgr->gr_interface) || - copy_in_user(&kgr->gr_group, &gr32->gr_group, - sizeof(kgr->gr_group))) - return -EFAULT; - koptval = (char __user *)kgr; - koptlen = sizeof(struct group_req); - break; - } - case MCAST_JOIN_SOURCE_GROUP: - case MCAST_LEAVE_SOURCE_GROUP: - case MCAST_BLOCK_SOURCE: - case MCAST_UNBLOCK_SOURCE: - { - struct compat_group_source_req __user *gsr32 = (void __user *)optval; - struct group_source_req __user *kgsr = compat_alloc_user_space( - sizeof(struct group_source_req)); - u32 interface; - - if (!access_ok(gsr32, sizeof(*gsr32)) || - !access_ok(kgsr, - sizeof(struct group_source_req)) || - __get_user(interface, &gsr32->gsr_interface) || - __put_user(interface, &kgsr->gsr_interface) || - copy_in_user(&kgsr->gsr_group, &gsr32->gsr_group, - sizeof(kgsr->gsr_group)) || - copy_in_user(&kgsr->gsr_source, &gsr32->gsr_source, - sizeof(kgsr->gsr_source))) - return -EFAULT; - koptval = (char __user *)kgsr; - koptlen = sizeof(struct group_source_req); - break; - } - case MCAST_MSFILTER: - { - struct compat_group_filter __user *gf32 = (void __user *)optval; - struct group_filter __user *kgf; - u32 interface, fmode, numsrc; - - if (!access_ok(gf32, __COMPAT_GF0_SIZE) || - __get_user(interface, &gf32->gf_interface) || - __get_user(fmode, &gf32->gf_fmode) || - __get_user(numsrc, &gf32->gf_numsrc)) - return -EFAULT; - koptlen = optlen + sizeof(struct group_filter) - - sizeof(struct compat_group_filter); - if (koptlen < GROUP_FILTER_SIZE(numsrc)) - return -EINVAL; - kgf = compat_alloc_user_space(koptlen); - if (!access_ok(kgf, koptlen) || - __put_user(interface, &kgf->gf_interface) || - __put_user(fmode, &kgf->gf_fmode) || - __put_user(numsrc, &kgf->gf_numsrc) || - copy_in_user(&kgf->gf_group, &gf32->gf_group, - sizeof(kgf->gf_group)) || - (numsrc && copy_in_user(kgf->gf_slist, gf32->gf_slist, - numsrc * sizeof(kgf->gf_slist[0])))) - return -EFAULT; - koptval = (char __user *)kgf; - break; - } - - default: - break; - } - return setsockopt(sock, level, optname, koptval, koptlen); -} -EXPORT_SYMBOL(compat_mc_setsockopt); - /* Argument list sizes for compat_sys_socketcall */ #define AL(x) ((x) * sizeof(u32)) static unsigned char nas[21] = { -- 2.11.0 ^ permalink raw reply related [flat|nested] 42+ messages in thread
* [PATCH 14/19] batadv_socket_read(): get rid of pointless access_ok() 2020-05-11 4:45 ` [PATCH 01/19] lift compat definitions of mcast [sg]etsockopt requests into net/compat.h Al Viro ` (11 preceding siblings ...) 2020-05-11 4:45 ` [PATCH 13/19] get rid of compat_mc_setsockopt() Al Viro @ 2020-05-11 4:45 ` Al Viro 2020-05-11 4:45 ` [PATCH 15/19] atm: separate ATM_GETNAMES handling from the rest of atm_dev_ioctl() Al Viro ` (4 subsequent siblings) 17 siblings, 0 replies; 42+ messages in thread From: Al Viro @ 2020-05-11 4:45 UTC (permalink / raw) To: netdev; +Cc: davem, viro, linux-kernel From: Al Viro <viro@zeniv.linux.org.uk> address is passed only to copy_to_user() Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> --- net/batman-adv/icmp_socket.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/net/batman-adv/icmp_socket.c b/net/batman-adv/icmp_socket.c index ccb535c77e5d..8bdabc03b0b2 100644 --- a/net/batman-adv/icmp_socket.c +++ b/net/batman-adv/icmp_socket.c @@ -135,9 +135,6 @@ static ssize_t batadv_socket_read(struct file *file, char __user *buf, if (!buf || count < sizeof(struct batadv_icmp_packet)) return -EINVAL; - if (!access_ok(buf, count)) - return -EFAULT; - error = wait_event_interruptible(socket_client->queue_wait, socket_client->queue_len); -- 2.11.0 ^ permalink raw reply related [flat|nested] 42+ messages in thread
* [PATCH 15/19] atm: separate ATM_GETNAMES handling from the rest of atm_dev_ioctl() 2020-05-11 4:45 ` [PATCH 01/19] lift compat definitions of mcast [sg]etsockopt requests into net/compat.h Al Viro ` (12 preceding siblings ...) 2020-05-11 4:45 ` [PATCH 14/19] batadv_socket_read(): get rid of pointless access_ok() Al Viro @ 2020-05-11 4:45 ` Al Viro 2020-05-11 4:45 ` [PATCH 16/19] atm: move copyin from atm_getnames() into the caller Al Viro ` (3 subsequent siblings) 17 siblings, 0 replies; 42+ messages in thread From: Al Viro @ 2020-05-11 4:45 UTC (permalink / raw) To: netdev; +Cc: davem, viro, linux-kernel From: Al Viro <viro@zeniv.linux.org.uk> atm_dev_ioctl() does copyin in two different ways - one for ATM_GETNAMES, another for everything else. Start with separating the former into a new helper (atm_getnames()). The next step will be to lift the copyin into the callers. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> --- net/atm/ioctl.c | 6 +++- net/atm/resources.c | 88 +++++++++++++++++++++++++++-------------------------- net/atm/resources.h | 1 + 3 files changed, 51 insertions(+), 44 deletions(-) diff --git a/net/atm/ioctl.c b/net/atm/ioctl.c index d955b683aa7c..0b4b07740fe4 100644 --- a/net/atm/ioctl.c +++ b/net/atm/ioctl.c @@ -162,7 +162,11 @@ static int do_vcc_ioctl(struct socket *sock, unsigned int cmd, if (error != -ENOIOCTLCMD) goto done; - error = atm_dev_ioctl(cmd, argp, compat); + if (cmd == ATM_GETNAMES) { + error = atm_getnames(argp, compat); + } else { + error = atm_dev_ioctl(cmd, argp, compat); + } done: return error; diff --git a/net/atm/resources.c b/net/atm/resources.c index 889349c6d90d..a2ab75929eec 100644 --- a/net/atm/resources.c +++ b/net/atm/resources.c @@ -193,61 +193,63 @@ static int fetch_stats(struct atm_dev *dev, struct atm_dev_stats __user *arg, return error ? -EFAULT : 0; } -int atm_dev_ioctl(unsigned int cmd, void __user *arg, int compat) +int atm_getnames(void __user *arg, int compat) { void __user *buf; - int error, len, number, size = 0; + int error, len, size = 0; struct atm_dev *dev; struct list_head *p; int *tmp_buf, *tmp_p; - int __user *sioc_len; int __user *iobuf_len; - switch (cmd) { - case ATM_GETNAMES: - if (IS_ENABLED(CONFIG_COMPAT) && compat) { + if (IS_ENABLED(CONFIG_COMPAT) && compat) { #ifdef CONFIG_COMPAT - struct compat_atm_iobuf __user *ciobuf = arg; - compat_uptr_t cbuf; - iobuf_len = &ciobuf->length; - if (get_user(cbuf, &ciobuf->buffer)) - return -EFAULT; - buf = compat_ptr(cbuf); + struct compat_atm_iobuf __user *ciobuf = arg; + compat_uptr_t cbuf; + iobuf_len = &ciobuf->length; + if (get_user(cbuf, &ciobuf->buffer)) + return -EFAULT; + buf = compat_ptr(cbuf); #endif - } else { - struct atm_iobuf __user *iobuf = arg; - iobuf_len = &iobuf->length; - if (get_user(buf, &iobuf->buffer)) - return -EFAULT; - } - if (get_user(len, iobuf_len)) + } else { + struct atm_iobuf __user *iobuf = arg; + iobuf_len = &iobuf->length; + if (get_user(buf, &iobuf->buffer)) return -EFAULT; - mutex_lock(&atm_dev_mutex); - list_for_each(p, &atm_devs) - size += sizeof(int); - if (size > len) { - mutex_unlock(&atm_dev_mutex); - return -E2BIG; - } - tmp_buf = kmalloc(size, GFP_ATOMIC); - if (!tmp_buf) { - mutex_unlock(&atm_dev_mutex); - return -ENOMEM; - } - tmp_p = tmp_buf; - list_for_each(p, &atm_devs) { - dev = list_entry(p, struct atm_dev, dev_list); - *tmp_p++ = dev->number; - } + } + if (get_user(len, iobuf_len)) + return -EFAULT; + mutex_lock(&atm_dev_mutex); + list_for_each(p, &atm_devs) + size += sizeof(int); + if (size > len) { mutex_unlock(&atm_dev_mutex); - error = ((copy_to_user(buf, tmp_buf, size)) || - put_user(size, iobuf_len)) - ? -EFAULT : 0; - kfree(tmp_buf); - return error; - default: - break; + return -E2BIG; } + tmp_buf = kmalloc(size, GFP_ATOMIC); + if (!tmp_buf) { + mutex_unlock(&atm_dev_mutex); + return -ENOMEM; + } + tmp_p = tmp_buf; + list_for_each(p, &atm_devs) { + dev = list_entry(p, struct atm_dev, dev_list); + *tmp_p++ = dev->number; + } + mutex_unlock(&atm_dev_mutex); + error = ((copy_to_user(buf, tmp_buf, size)) || + put_user(size, iobuf_len)) + ? -EFAULT : 0; + kfree(tmp_buf); + return error; +} + +int atm_dev_ioctl(unsigned int cmd, void __user *arg, int compat) +{ + void __user *buf; + int error, len, number, size = 0; + struct atm_dev *dev; + int __user *sioc_len; if (IS_ENABLED(CONFIG_COMPAT) && compat) { #ifdef CONFIG_COMPAT diff --git a/net/atm/resources.h b/net/atm/resources.h index 048232e4d4c6..18f8e5948ce4 100644 --- a/net/atm/resources.h +++ b/net/atm/resources.h @@ -14,6 +14,7 @@ extern struct list_head atm_devs; extern struct mutex atm_dev_mutex; +int atm_getnames(void __user *arg, int compat); int atm_dev_ioctl(unsigned int cmd, void __user *arg, int compat); -- 2.11.0 ^ permalink raw reply related [flat|nested] 42+ messages in thread
* [PATCH 16/19] atm: move copyin from atm_getnames() into the caller 2020-05-11 4:45 ` [PATCH 01/19] lift compat definitions of mcast [sg]etsockopt requests into net/compat.h Al Viro ` (13 preceding siblings ...) 2020-05-11 4:45 ` [PATCH 15/19] atm: separate ATM_GETNAMES handling from the rest of atm_dev_ioctl() Al Viro @ 2020-05-11 4:45 ` Al Viro 2020-05-11 4:45 ` [PATCH 17/19] atm: switch do_atm_iobuf() to direct use of atm_getnames() Al Viro ` (2 subsequent siblings) 17 siblings, 0 replies; 42+ messages in thread From: Al Viro @ 2020-05-11 4:45 UTC (permalink / raw) To: netdev; +Cc: davem, viro, linux-kernel From: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> --- net/atm/ioctl.c | 19 ++++++++++++++++++- net/atm/resources.c | 19 +------------------ net/atm/resources.h | 2 +- 3 files changed, 20 insertions(+), 20 deletions(-) diff --git a/net/atm/ioctl.c b/net/atm/ioctl.c index 0b4b07740fe4..e239cebf48da 100644 --- a/net/atm/ioctl.c +++ b/net/atm/ioctl.c @@ -56,6 +56,8 @@ static int do_vcc_ioctl(struct socket *sock, unsigned int cmd, int error; struct list_head *pos; void __user *argp = (void __user *)arg; + void __user *buf; + int __user *len; vcc = ATM_SD(sock); switch (cmd) { @@ -163,7 +165,22 @@ static int do_vcc_ioctl(struct socket *sock, unsigned int cmd, goto done; if (cmd == ATM_GETNAMES) { - error = atm_getnames(argp, compat); + if (IS_ENABLED(CONFIG_COMPAT) && compat) { +#ifdef CONFIG_COMPAT + struct compat_atm_iobuf __user *ciobuf = argp; + compat_uptr_t cbuf; + len = &ciobuf->length; + if (get_user(cbuf, &ciobuf->buffer)) + return -EFAULT; + buf = compat_ptr(cbuf); +#endif + } else { + struct atm_iobuf __user *iobuf = argp; + len = &iobuf->length; + if (get_user(buf, &iobuf->buffer)) + return -EFAULT; + } + error = atm_getnames(buf, len); } else { error = atm_dev_ioctl(cmd, argp, compat); } diff --git a/net/atm/resources.c b/net/atm/resources.c index a2ab75929eec..5507cc608969 100644 --- a/net/atm/resources.c +++ b/net/atm/resources.c @@ -193,30 +193,13 @@ static int fetch_stats(struct atm_dev *dev, struct atm_dev_stats __user *arg, return error ? -EFAULT : 0; } -int atm_getnames(void __user *arg, int compat) +int atm_getnames(void __user *buf, int __user *iobuf_len) { - void __user *buf; int error, len, size = 0; struct atm_dev *dev; struct list_head *p; int *tmp_buf, *tmp_p; - int __user *iobuf_len; - if (IS_ENABLED(CONFIG_COMPAT) && compat) { -#ifdef CONFIG_COMPAT - struct compat_atm_iobuf __user *ciobuf = arg; - compat_uptr_t cbuf; - iobuf_len = &ciobuf->length; - if (get_user(cbuf, &ciobuf->buffer)) - return -EFAULT; - buf = compat_ptr(cbuf); -#endif - } else { - struct atm_iobuf __user *iobuf = arg; - iobuf_len = &iobuf->length; - if (get_user(buf, &iobuf->buffer)) - return -EFAULT; - } if (get_user(len, iobuf_len)) return -EFAULT; mutex_lock(&atm_dev_mutex); diff --git a/net/atm/resources.h b/net/atm/resources.h index 18f8e5948ce4..5e2c68d37d63 100644 --- a/net/atm/resources.h +++ b/net/atm/resources.h @@ -14,7 +14,7 @@ extern struct list_head atm_devs; extern struct mutex atm_dev_mutex; -int atm_getnames(void __user *arg, int compat); +int atm_getnames(void __user *buf, int __user *iobuf_len); int atm_dev_ioctl(unsigned int cmd, void __user *arg, int compat); -- 2.11.0 ^ permalink raw reply related [flat|nested] 42+ messages in thread
* [PATCH 17/19] atm: switch do_atm_iobuf() to direct use of atm_getnames() 2020-05-11 4:45 ` [PATCH 01/19] lift compat definitions of mcast [sg]etsockopt requests into net/compat.h Al Viro ` (14 preceding siblings ...) 2020-05-11 4:45 ` [PATCH 16/19] atm: move copyin from atm_getnames() into the caller Al Viro @ 2020-05-11 4:45 ` Al Viro 2020-05-11 4:45 ` [PATCH 18/19] atm: lift copyin from atm_dev_ioctl() Al Viro 2020-05-11 4:45 ` [PATCH 19/19] atm: switch do_atmif_sioc() to direct use of atm_dev_ioctl() Al Viro 17 siblings, 0 replies; 42+ messages in thread From: Al Viro @ 2020-05-11 4:45 UTC (permalink / raw) To: netdev; +Cc: davem, viro, linux-kernel From: Al Viro <viro@zeniv.linux.org.uk> ... and sod the compat_alloc_user_space() with its complications Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> --- net/atm/ioctl.c | 25 +++---------------------- 1 file changed, 3 insertions(+), 22 deletions(-) diff --git a/net/atm/ioctl.c b/net/atm/ioctl.c index e239cebf48da..fdd0e3434523 100644 --- a/net/atm/ioctl.c +++ b/net/atm/ioctl.c @@ -251,32 +251,13 @@ static struct { static int do_atm_iobuf(struct socket *sock, unsigned int cmd, unsigned long arg) { - struct atm_iobuf __user *iobuf; - struct compat_atm_iobuf __user *iobuf32; + struct compat_atm_iobuf __user *iobuf32 = compat_ptr(arg); u32 data; - void __user *datap; - int len, err; - - iobuf = compat_alloc_user_space(sizeof(*iobuf)); - iobuf32 = compat_ptr(arg); - if (get_user(len, &iobuf32->length) || - get_user(data, &iobuf32->buffer)) - return -EFAULT; - datap = compat_ptr(data); - if (put_user(len, &iobuf->length) || - put_user(datap, &iobuf->buffer)) + if (get_user(data, &iobuf32->buffer)) return -EFAULT; - err = do_vcc_ioctl(sock, cmd, (unsigned long) iobuf, 0); - - if (!err) { - if (copy_in_user(&iobuf32->length, &iobuf->length, - sizeof(int))) - err = -EFAULT; - } - - return err; + return atm_getnames(&iobuf32->length, compat_ptr(data)); } static int do_atmif_sioc(struct socket *sock, unsigned int cmd, -- 2.11.0 ^ permalink raw reply related [flat|nested] 42+ messages in thread
* [PATCH 18/19] atm: lift copyin from atm_dev_ioctl() 2020-05-11 4:45 ` [PATCH 01/19] lift compat definitions of mcast [sg]etsockopt requests into net/compat.h Al Viro ` (15 preceding siblings ...) 2020-05-11 4:45 ` [PATCH 17/19] atm: switch do_atm_iobuf() to direct use of atm_getnames() Al Viro @ 2020-05-11 4:45 ` Al Viro 2020-05-11 4:45 ` [PATCH 19/19] atm: switch do_atmif_sioc() to direct use of atm_dev_ioctl() Al Viro 17 siblings, 0 replies; 42+ messages in thread From: Al Viro @ 2020-05-11 4:45 UTC (permalink / raw) To: netdev; +Cc: davem, viro, linux-kernel From: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> --- net/atm/ioctl.c | 25 ++++++++++++++++++++++++- net/atm/resources.c | 35 +++++------------------------------ net/atm/resources.h | 4 ++-- 3 files changed, 31 insertions(+), 33 deletions(-) diff --git a/net/atm/ioctl.c b/net/atm/ioctl.c index fdd0e3434523..52f2c77e656f 100644 --- a/net/atm/ioctl.c +++ b/net/atm/ioctl.c @@ -182,7 +182,30 @@ static int do_vcc_ioctl(struct socket *sock, unsigned int cmd, } error = atm_getnames(buf, len); } else { - error = atm_dev_ioctl(cmd, argp, compat); + int number; + + if (IS_ENABLED(CONFIG_COMPAT) && compat) { +#ifdef CONFIG_COMPAT + struct compat_atmif_sioc __user *csioc = argp; + compat_uptr_t carg; + + len = &csioc->length; + if (get_user(carg, &csioc->arg)) + return -EFAULT; + buf = compat_ptr(carg); + if (get_user(number, &csioc->number)) + return -EFAULT; +#endif + } else { + struct atmif_sioc __user *sioc = argp; + + len = &sioc->length; + if (get_user(buf, &sioc->arg)) + return -EFAULT; + if (get_user(number, &sioc->number)) + return -EFAULT; + } + error = atm_dev_ioctl(cmd, buf, len, number, compat); } done: diff --git a/net/atm/resources.c b/net/atm/resources.c index 5507cc608969..94bdc6527ee8 100644 --- a/net/atm/resources.c +++ b/net/atm/resources.c @@ -227,39 +227,14 @@ int atm_getnames(void __user *buf, int __user *iobuf_len) return error; } -int atm_dev_ioctl(unsigned int cmd, void __user *arg, int compat) +int atm_dev_ioctl(unsigned int cmd, void __user *buf, int __user *sioc_len, + int number, int compat) { - void __user *buf; - int error, len, number, size = 0; + int error, len, size = 0; struct atm_dev *dev; - int __user *sioc_len; - if (IS_ENABLED(CONFIG_COMPAT) && compat) { -#ifdef CONFIG_COMPAT - struct compat_atmif_sioc __user *csioc = arg; - compat_uptr_t carg; - - sioc_len = &csioc->length; - if (get_user(carg, &csioc->arg)) - return -EFAULT; - buf = compat_ptr(carg); - - if (get_user(len, &csioc->length)) - return -EFAULT; - if (get_user(number, &csioc->number)) - return -EFAULT; -#endif - } else { - struct atmif_sioc __user *sioc = arg; - - sioc_len = &sioc->length; - if (get_user(buf, &sioc->arg)) - return -EFAULT; - if (get_user(len, &sioc->length)) - return -EFAULT; - if (get_user(number, &sioc->number)) - return -EFAULT; - } + if (get_user(len, sioc_len)) + return -EFAULT; dev = try_then_request_module(atm_dev_lookup(number), "atm-device-%d", number); diff --git a/net/atm/resources.h b/net/atm/resources.h index 5e2c68d37d63..4a0839e92ff3 100644 --- a/net/atm/resources.h +++ b/net/atm/resources.h @@ -15,8 +15,8 @@ extern struct list_head atm_devs; extern struct mutex atm_dev_mutex; int atm_getnames(void __user *buf, int __user *iobuf_len); -int atm_dev_ioctl(unsigned int cmd, void __user *arg, int compat); - +int atm_dev_ioctl(unsigned int cmd, void __user *buf, int __user *sioc_len, + int number, int compat); #ifdef CONFIG_PROC_FS -- 2.11.0 ^ permalink raw reply related [flat|nested] 42+ messages in thread
* [PATCH 19/19] atm: switch do_atmif_sioc() to direct use of atm_dev_ioctl() 2020-05-11 4:45 ` [PATCH 01/19] lift compat definitions of mcast [sg]etsockopt requests into net/compat.h Al Viro ` (16 preceding siblings ...) 2020-05-11 4:45 ` [PATCH 18/19] atm: lift copyin from atm_dev_ioctl() Al Viro @ 2020-05-11 4:45 ` Al Viro 17 siblings, 0 replies; 42+ messages in thread From: Al Viro @ 2020-05-11 4:45 UTC (permalink / raw) To: netdev; +Cc: davem, viro, linux-kernel From: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> --- net/atm/ioctl.c | 25 ++++--------------------- 1 file changed, 4 insertions(+), 21 deletions(-) diff --git a/net/atm/ioctl.c b/net/atm/ioctl.c index 52f2c77e656f..838ebf0cabbf 100644 --- a/net/atm/ioctl.c +++ b/net/atm/ioctl.c @@ -286,30 +286,13 @@ static int do_atm_iobuf(struct socket *sock, unsigned int cmd, static int do_atmif_sioc(struct socket *sock, unsigned int cmd, unsigned long arg) { - struct atmif_sioc __user *sioc; - struct compat_atmif_sioc __user *sioc32; + struct compat_atmif_sioc __user *sioc32 = compat_ptr(arg); + int number; u32 data; - void __user *datap; - int err; - sioc = compat_alloc_user_space(sizeof(*sioc)); - sioc32 = compat_ptr(arg); - - if (copy_in_user(&sioc->number, &sioc32->number, 2 * sizeof(int)) || - get_user(data, &sioc32->arg)) - return -EFAULT; - datap = compat_ptr(data); - if (put_user(datap, &sioc->arg)) + if (get_user(data, &sioc32->arg) || get_user(number, &sioc32->number)) return -EFAULT; - - err = do_vcc_ioctl(sock, cmd, (unsigned long) sioc, 0); - - if (!err) { - if (copy_in_user(&sioc32->length, &sioc->length, - sizeof(int))) - err = -EFAULT; - } - return err; + return atm_dev_ioctl(cmd, compat_ptr(data), &sioc32->length, number, 0); } static int do_atm_ioctl(struct socket *sock, unsigned int cmd32, -- 2.11.0 ^ permalink raw reply related [flat|nested] 42+ messages in thread
* Re: [RFC][PATCHES] uaccess-related stuff in net/* 2020-05-11 4:43 [RFC][PATCHES] uaccess-related stuff in net/* Al Viro 2020-05-11 4:45 ` [PATCH 01/19] lift compat definitions of mcast [sg]etsockopt requests into net/compat.h Al Viro @ 2020-05-12 0:02 ` David Miller 2020-05-21 0:36 ` Al Viro 1 sibling, 1 reply; 42+ messages in thread From: David Miller @ 2020-05-12 0:02 UTC (permalink / raw) To: viro; +Cc: netdev, linux-kernel From: Al Viro <viro@zeniv.linux.org.uk> Date: Mon, 11 May 2020 05:43:28 +0100 > Assorted uaccess-related work in net/*. First, there's > getting rid of compat_alloc_user_space() mess in MCAST_... > [gs]etsockopt() - no need to play with copying to/from temporary > object on userland stack, etc., when ->compat_[sg]etsockopt() > instances in question can easly do everything without that. > That's the first 13 patches. Then there's a trivial bit in > net/batman-adv (completely unrelated to everything else) and > finally getting the atm compat ioctls into simpler shape. > > Please, review and comment. Individual patches in followups, > the entire branch (on top of current net/master) is in > git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git #uaccess.net I have no problems with this series: Acked-by: David S. Miller <davem@davemloft.net> ^ permalink raw reply [flat|nested] 42+ messages in thread
* Re: [RFC][PATCHES] uaccess-related stuff in net/* 2020-05-12 0:02 ` [RFC][PATCHES] uaccess-related stuff in net/* David Miller @ 2020-05-21 0:36 ` Al Viro 2020-05-21 0:37 ` [PATCH net-next 01/19] lift compat definitions of mcast [sg]etsockopt requests into net/compat.h Al Viro 2020-05-21 2:24 ` [RFC][PATCHES] uaccess-related stuff in net/* David Miller 0 siblings, 2 replies; 42+ messages in thread From: Al Viro @ 2020-05-21 0:36 UTC (permalink / raw) To: David Miller; +Cc: netdev, linux-kernel On Mon, May 11, 2020 at 05:02:51PM -0700, David Miller wrote: > From: Al Viro <viro@zeniv.linux.org.uk> > Date: Mon, 11 May 2020 05:43:28 +0100 > > > Assorted uaccess-related work in net/*. First, there's > > getting rid of compat_alloc_user_space() mess in MCAST_... > > [gs]etsockopt() - no need to play with copying to/from temporary > > object on userland stack, etc., when ->compat_[sg]etsockopt() > > instances in question can easly do everything without that. > > That's the first 13 patches. Then there's a trivial bit in > > net/batman-adv (completely unrelated to everything else) and > > finally getting the atm compat ioctls into simpler shape. > > > > Please, review and comment. Individual patches in followups, > > the entire branch (on top of current net/master) is in > > git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git #uaccess.net > > I have no problems with this series: > > Acked-by: David S. Miller <davem@davemloft.net> OK, rebased on top of current net/master (no conflicts) and pushed out to the same branch. Patches (for net-next) in followups ^ permalink raw reply [flat|nested] 42+ messages in thread
* [PATCH net-next 01/19] lift compat definitions of mcast [sg]etsockopt requests into net/compat.h 2020-05-21 0:36 ` Al Viro @ 2020-05-21 0:37 ` Al Viro 2020-05-21 0:37 ` [PATCH net-next 02/19] compat_ip{,v6}_setsockopt(): enumerate MCAST_... options explicitly Al Viro ` (17 more replies) 2020-05-21 2:24 ` [RFC][PATCHES] uaccess-related stuff in net/* David Miller 1 sibling, 18 replies; 42+ messages in thread From: Al Viro @ 2020-05-21 0:37 UTC (permalink / raw) To: netdev; +Cc: davem, viro, linux-kernel From: Al Viro <viro@zeniv.linux.org.uk> We want to get rid of compat_mc_[sg]etsockopt() and to have that stuff handled without compat_alloc_user_space(), extra copying through userland, etc. To do that we'll need ipv4 and ipv6 instances of ->compat_[sg]etsockopt() to manipulate the 32bit variants of mcast requests, so we need to move the definitions of those out of net/compat.c and into a public header. This patch just does a mechanical move to include/net/compat.h Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> --- include/net/compat.h | 24 ++++++++++++++++++++++++ net/compat.c | 25 ------------------------- 2 files changed, 24 insertions(+), 25 deletions(-) diff --git a/include/net/compat.h b/include/net/compat.h index 2b5e1f7ba153..69a8cd29c0ae 100644 --- a/include/net/compat.h +++ b/include/net/compat.h @@ -74,4 +74,28 @@ int compat_mc_getsockopt(struct sock *, int, int, char __user *, int __user *, int (*)(struct sock *, int, int, char __user *, int __user *)); +struct compat_group_req { + __u32 gr_interface; + struct __kernel_sockaddr_storage gr_group + __aligned(4); +} __packed; + +struct compat_group_source_req { + __u32 gsr_interface; + struct __kernel_sockaddr_storage gsr_group + __aligned(4); + struct __kernel_sockaddr_storage gsr_source + __aligned(4); +} __packed; + +struct compat_group_filter { + __u32 gf_interface; + struct __kernel_sockaddr_storage gf_group + __aligned(4); + __u32 gf_fmode; + __u32 gf_numsrc; + struct __kernel_sockaddr_storage gf_slist[1] + __aligned(4); +} __packed; + #endif /* NET_COMPAT_H */ diff --git a/net/compat.c b/net/compat.c index 69fc6d1e4e6e..032114de4fec 100644 --- a/net/compat.c +++ b/net/compat.c @@ -448,34 +448,9 @@ COMPAT_SYSCALL_DEFINE5(getsockopt, int, fd, int, level, int, optname, return __compat_sys_getsockopt(fd, level, optname, optval, optlen); } -struct compat_group_req { - __u32 gr_interface; - struct __kernel_sockaddr_storage gr_group - __aligned(4); -} __packed; - -struct compat_group_source_req { - __u32 gsr_interface; - struct __kernel_sockaddr_storage gsr_group - __aligned(4); - struct __kernel_sockaddr_storage gsr_source - __aligned(4); -} __packed; - -struct compat_group_filter { - __u32 gf_interface; - struct __kernel_sockaddr_storage gf_group - __aligned(4); - __u32 gf_fmode; - __u32 gf_numsrc; - struct __kernel_sockaddr_storage gf_slist[1] - __aligned(4); -} __packed; - #define __COMPAT_GF0_SIZE (sizeof(struct compat_group_filter) - \ sizeof(struct __kernel_sockaddr_storage)) - int compat_mc_setsockopt(struct sock *sock, int level, int optname, char __user *optval, unsigned int optlen, int (*setsockopt)(struct sock *, int, int, char __user *, unsigned int)) -- 2.11.0 ^ permalink raw reply related [flat|nested] 42+ messages in thread
* [PATCH net-next 02/19] compat_ip{,v6}_setsockopt(): enumerate MCAST_... options explicitly 2020-05-21 0:37 ` [PATCH net-next 01/19] lift compat definitions of mcast [sg]etsockopt requests into net/compat.h Al Viro @ 2020-05-21 0:37 ` Al Viro 2020-05-21 0:37 ` [PATCH net-next 03/19] ip*_mc_gsfget(): lift copyout of struct group_filter into callers Al Viro ` (16 subsequent siblings) 17 siblings, 0 replies; 42+ messages in thread From: Al Viro @ 2020-05-21 0:37 UTC (permalink / raw) To: netdev; +Cc: davem, viro, linux-kernel From: Al Viro <viro@zeniv.linux.org.uk> We want to check if optname is among the MCAST_... ones; do that as an explicit switch. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> --- net/ipv4/ip_sockglue.c | 10 +++++++++- net/ipv6/ipv6_sockglue.c | 10 +++++++++- 2 files changed, 18 insertions(+), 2 deletions(-) diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c index 8206047d70b6..3c2c6cd3933b 100644 --- a/net/ipv4/ip_sockglue.c +++ b/net/ipv4/ip_sockglue.c @@ -1272,9 +1272,17 @@ int compat_ip_setsockopt(struct sock *sk, int level, int optname, if (level != SOL_IP) return -ENOPROTOOPT; - if (optname >= MCAST_JOIN_GROUP && optname <= MCAST_MSFILTER) + switch (optname) { + case MCAST_JOIN_GROUP: + case MCAST_LEAVE_GROUP: + case MCAST_JOIN_SOURCE_GROUP: + case MCAST_LEAVE_SOURCE_GROUP: + case MCAST_BLOCK_SOURCE: + case MCAST_UNBLOCK_SOURCE: + case MCAST_MSFILTER: return compat_mc_setsockopt(sk, level, optname, optval, optlen, ip_setsockopt); + } err = do_ip_setsockopt(sk, level, optname, optval, optlen); #ifdef CONFIG_NETFILTER diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c index a0e50cc57e54..96e3f603c8d8 100644 --- a/net/ipv6/ipv6_sockglue.c +++ b/net/ipv6/ipv6_sockglue.c @@ -973,9 +973,17 @@ int compat_ipv6_setsockopt(struct sock *sk, int level, int optname, if (level != SOL_IPV6) return -ENOPROTOOPT; - if (optname >= MCAST_JOIN_GROUP && optname <= MCAST_MSFILTER) + switch (optname) { + case MCAST_JOIN_GROUP: + case MCAST_LEAVE_GROUP: + case MCAST_JOIN_SOURCE_GROUP: + case MCAST_LEAVE_SOURCE_GROUP: + case MCAST_BLOCK_SOURCE: + case MCAST_UNBLOCK_SOURCE: + case MCAST_MSFILTER: return compat_mc_setsockopt(sk, level, optname, optval, optlen, ipv6_setsockopt); + } err = do_ipv6_setsockopt(sk, level, optname, optval, optlen); #ifdef CONFIG_NETFILTER -- 2.11.0 ^ permalink raw reply related [flat|nested] 42+ messages in thread
* [PATCH net-next 03/19] ip*_mc_gsfget(): lift copyout of struct group_filter into callers 2020-05-21 0:37 ` [PATCH net-next 01/19] lift compat definitions of mcast [sg]etsockopt requests into net/compat.h Al Viro 2020-05-21 0:37 ` [PATCH net-next 02/19] compat_ip{,v6}_setsockopt(): enumerate MCAST_... options explicitly Al Viro @ 2020-05-21 0:37 ` Al Viro 2020-05-21 0:37 ` [PATCH net-next 04/19] get rid of compat_mc_getsockopt() Al Viro ` (15 subsequent siblings) 17 siblings, 0 replies; 42+ messages in thread From: Al Viro @ 2020-05-21 0:37 UTC (permalink / raw) To: netdev; +Cc: davem, viro, linux-kernel From: Al Viro <viro@zeniv.linux.org.uk> pass the userland pointer to the array in its tail, so that part gets copied out by our functions; copyout of everything else is done in the callers. Rationale: reuse for compat; the array is the same in native and compat, the layout of parts before it is different for compat. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> --- include/linux/igmp.h | 2 +- include/net/ipv6.h | 2 +- net/ipv4/igmp.c | 18 +++++------------- net/ipv4/ip_sockglue.c | 19 ++++++++++++++----- net/ipv6/ipv6_sockglue.c | 18 ++++++++++++++---- net/ipv6/mcast.c | 10 +++------- 6 files changed, 38 insertions(+), 31 deletions(-) diff --git a/include/linux/igmp.h b/include/linux/igmp.h index faa6586a5783..64ce8cd1cfaf 100644 --- a/include/linux/igmp.h +++ b/include/linux/igmp.h @@ -123,7 +123,7 @@ extern int ip_mc_msfilter(struct sock *sk, struct ip_msfilter *msf,int ifindex); extern int ip_mc_msfget(struct sock *sk, struct ip_msfilter *msf, struct ip_msfilter __user *optval, int __user *optlen); extern int ip_mc_gsfget(struct sock *sk, struct group_filter *gsf, - struct group_filter __user *optval, int __user *optlen); + struct sockaddr_storage __user *p); extern int ip_mc_sf_allow(struct sock *sk, __be32 local, __be32 rmt, int dif, int sdif); extern void ip_mc_init_dev(struct in_device *); diff --git a/include/net/ipv6.h b/include/net/ipv6.h index 5fc3a9d7b053..c45eb78d970f 100644 --- a/include/net/ipv6.h +++ b/include/net/ipv6.h @@ -1138,7 +1138,7 @@ int ip6_mc_source(int add, int omode, struct sock *sk, struct group_source_req *pgsr); int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf); int ip6_mc_msfget(struct sock *sk, struct group_filter *gsf, - struct group_filter __user *optval, int __user *optlen); + struct sockaddr_storage __user *p); #ifdef CONFIG_PROC_FS int ac6_proc_init(struct net *net); diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c index 47f0502b2101..7b272bbed2b4 100644 --- a/net/ipv4/igmp.c +++ b/net/ipv4/igmp.c @@ -2565,9 +2565,9 @@ int ip_mc_msfget(struct sock *sk, struct ip_msfilter *msf, } int ip_mc_gsfget(struct sock *sk, struct group_filter *gsf, - struct group_filter __user *optval, int __user *optlen) + struct sockaddr_storage __user *p) { - int err, i, count, copycount; + int i, count, copycount; struct sockaddr_in *psin; __be32 addr; struct ip_mc_socklist *pmc; @@ -2583,37 +2583,29 @@ int ip_mc_gsfget(struct sock *sk, struct group_filter *gsf, if (!ipv4_is_multicast(addr)) return -EINVAL; - err = -EADDRNOTAVAIL; - for_each_pmc_rtnl(inet, pmc) { if (pmc->multi.imr_multiaddr.s_addr == addr && pmc->multi.imr_ifindex == gsf->gf_interface) break; } if (!pmc) /* must have a prior join */ - goto done; + return -EADDRNOTAVAIL; gsf->gf_fmode = pmc->sfmode; psl = rtnl_dereference(pmc->sflist); count = psl ? psl->sl_count : 0; copycount = count < gsf->gf_numsrc ? count : gsf->gf_numsrc; gsf->gf_numsrc = count; - if (put_user(GROUP_FILTER_SIZE(copycount), optlen) || - copy_to_user(optval, gsf, GROUP_FILTER_SIZE(0))) { - return -EFAULT; - } - for (i = 0; i < copycount; i++) { + for (i = 0; i < copycount; i++, p++) { struct sockaddr_storage ss; psin = (struct sockaddr_in *)&ss; memset(&ss, 0, sizeof(ss)); psin->sin_family = AF_INET; psin->sin_addr.s_addr = psl->sl_addr[i]; - if (copy_to_user(&optval->gf_slist[i], &ss, sizeof(ss))) + if (copy_to_user(p, &ss, sizeof(ss))) return -EFAULT; } return 0; -done: - return err; } /* diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c index 3c2c6cd3933b..e3703a3e7ef4 100644 --- a/net/ipv4/ip_sockglue.c +++ b/net/ipv4/ip_sockglue.c @@ -1473,19 +1473,28 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname, } case MCAST_MSFILTER: { + struct group_filter __user *p = (void __user *)optval; struct group_filter gsf; + const int size0 = offsetof(struct group_filter, gf_slist); + int num; - if (len < GROUP_FILTER_SIZE(0)) { + if (len < size0) { err = -EINVAL; goto out; } - if (copy_from_user(&gsf, optval, GROUP_FILTER_SIZE(0))) { + if (copy_from_user(&gsf, p, size0)) { err = -EFAULT; goto out; } - err = ip_mc_gsfget(sk, &gsf, - (struct group_filter __user *)optval, - optlen); + num = gsf.gf_numsrc; + err = ip_mc_gsfget(sk, &gsf, p->gf_slist); + if (err) + goto out; + if (gsf.gf_numsrc < num) + num = gsf.gf_numsrc; + if (put_user(GROUP_FILTER_SIZE(num), optlen) || + copy_to_user(p, &gsf, size0)) + err = -EFAULT; goto out; } case IP_MULTICAST_ALL: diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c index 96e3f603c8d8..e4a62ca1a3d0 100644 --- a/net/ipv6/ipv6_sockglue.c +++ b/net/ipv6/ipv6_sockglue.c @@ -1056,18 +1056,28 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname, break; case MCAST_MSFILTER: { + struct group_filter __user *p = (void __user *)optval; struct group_filter gsf; + const int size0 = offsetof(struct group_filter, gf_slist); + int num; int err; - if (len < GROUP_FILTER_SIZE(0)) + if (len < size0) return -EINVAL; - if (copy_from_user(&gsf, optval, GROUP_FILTER_SIZE(0))) + if (copy_from_user(&gsf, p, size0)) return -EFAULT; if (gsf.gf_group.ss_family != AF_INET6) return -EADDRNOTAVAIL; + num = gsf.gf_numsrc; lock_sock(sk); - err = ip6_mc_msfget(sk, &gsf, - (struct group_filter __user *)optval, optlen); + err = ip6_mc_msfget(sk, &gsf, p->gf_slist); + if (!err) { + if (num > gsf.gf_numsrc) + num = gsf.gf_numsrc; + if (put_user(GROUP_FILTER_SIZE(num), optlen) || + copy_to_user(p, &gsf, size0)) + err = -EFAULT; + } release_sock(sk); return err; } diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c index eaa4c2cc2fbb..97d796c7d6c0 100644 --- a/net/ipv6/mcast.c +++ b/net/ipv6/mcast.c @@ -547,7 +547,7 @@ int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf) } int ip6_mc_msfget(struct sock *sk, struct group_filter *gsf, - struct group_filter __user *optval, int __user *optlen) + struct sockaddr_storage *p) { int err, i, count, copycount; const struct in6_addr *group; @@ -592,14 +592,10 @@ int ip6_mc_msfget(struct sock *sk, struct group_filter *gsf, copycount = count < gsf->gf_numsrc ? count : gsf->gf_numsrc; gsf->gf_numsrc = count; - if (put_user(GROUP_FILTER_SIZE(copycount), optlen) || - copy_to_user(optval, gsf, GROUP_FILTER_SIZE(0))) { - return -EFAULT; - } /* changes to psl require the socket lock, and a write lock * on pmc->sflock. We have the socket lock so reading here is safe. */ - for (i = 0; i < copycount; i++) { + for (i = 0; i < copycount; i++, p++) { struct sockaddr_in6 *psin6; struct sockaddr_storage ss; @@ -607,7 +603,7 @@ int ip6_mc_msfget(struct sock *sk, struct group_filter *gsf, memset(&ss, 0, sizeof(ss)); psin6->sin6_family = AF_INET6; psin6->sin6_addr = psl->sl_addr[i]; - if (copy_to_user(&optval->gf_slist[i], &ss, sizeof(ss))) + if (copy_to_user(p, &ss, sizeof(ss))) return -EFAULT; } return 0; -- 2.11.0 ^ permalink raw reply related [flat|nested] 42+ messages in thread
* [PATCH net-next 04/19] get rid of compat_mc_getsockopt() 2020-05-21 0:37 ` [PATCH net-next 01/19] lift compat definitions of mcast [sg]etsockopt requests into net/compat.h Al Viro 2020-05-21 0:37 ` [PATCH net-next 02/19] compat_ip{,v6}_setsockopt(): enumerate MCAST_... options explicitly Al Viro 2020-05-21 0:37 ` [PATCH net-next 03/19] ip*_mc_gsfget(): lift copyout of struct group_filter into callers Al Viro @ 2020-05-21 0:37 ` Al Viro 2020-05-21 0:37 ` [PATCH net-next 05/19] set_mcast_msfilter(): take the guts of setsockopt(MCAST_MSFILTER) into a helper Al Viro ` (14 subsequent siblings) 17 siblings, 0 replies; 42+ messages in thread From: Al Viro @ 2020-05-21 0:37 UTC (permalink / raw) To: netdev; +Cc: davem, viro, linux-kernel From: Al Viro <viro@zeniv.linux.org.uk> now we can do MCAST_MSFILTER in compat ->getsockopt() without playing silly buggers with copying things back and forth. We can form a native struct group_filter (sans the variable-length tail) on stack, pass that + pointer to the tail of original request to the helper doing the bulk of the work, then do the rest of copyout - same as the native getsockopt() does. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> --- include/net/compat.h | 3 -- net/compat.c | 79 ------------------------------------------------ net/ipv4/ip_sockglue.c | 44 +++++++++++++++++++++++++-- net/ipv6/ipv6_sockglue.c | 41 +++++++++++++++++++++++-- 4 files changed, 79 insertions(+), 88 deletions(-) diff --git a/include/net/compat.h b/include/net/compat.h index 69a8cd29c0ae..d714076d63d5 100644 --- a/include/net/compat.h +++ b/include/net/compat.h @@ -70,9 +70,6 @@ int cmsghdr_from_user_compat_to_kern(struct msghdr *, struct sock *, int compat_mc_setsockopt(struct sock *, int, int, char __user *, unsigned int, int (*)(struct sock *, int, int, char __user *, unsigned int)); -int compat_mc_getsockopt(struct sock *, int, int, char __user *, int __user *, - int (*)(struct sock *, int, int, char __user *, - int __user *)); struct compat_group_req { __u32 gr_interface; diff --git a/net/compat.c b/net/compat.c index 032114de4fec..7bdfda2b382a 100644 --- a/net/compat.c +++ b/net/compat.c @@ -538,85 +538,6 @@ int compat_mc_setsockopt(struct sock *sock, int level, int optname, } EXPORT_SYMBOL(compat_mc_setsockopt); -int compat_mc_getsockopt(struct sock *sock, int level, int optname, - char __user *optval, int __user *optlen, - int (*getsockopt)(struct sock *, int, int, char __user *, int __user *)) -{ - struct compat_group_filter __user *gf32 = (void __user *)optval; - struct group_filter __user *kgf; - int __user *koptlen; - u32 interface, fmode, numsrc; - int klen, ulen, err; - - if (optname != MCAST_MSFILTER) - return getsockopt(sock, level, optname, optval, optlen); - - koptlen = compat_alloc_user_space(sizeof(*koptlen)); - if (!access_ok(optlen, sizeof(*optlen)) || - __get_user(ulen, optlen)) - return -EFAULT; - - /* adjust len for pad */ - klen = ulen + sizeof(*kgf) - sizeof(*gf32); - - if (klen < GROUP_FILTER_SIZE(0)) - return -EINVAL; - - if (!access_ok(koptlen, sizeof(*koptlen)) || - __put_user(klen, koptlen)) - return -EFAULT; - - /* have to allow space for previous compat_alloc_user_space, too */ - kgf = compat_alloc_user_space(klen+sizeof(*optlen)); - - if (!access_ok(gf32, __COMPAT_GF0_SIZE) || - __get_user(interface, &gf32->gf_interface) || - __get_user(fmode, &gf32->gf_fmode) || - __get_user(numsrc, &gf32->gf_numsrc) || - __put_user(interface, &kgf->gf_interface) || - __put_user(fmode, &kgf->gf_fmode) || - __put_user(numsrc, &kgf->gf_numsrc) || - copy_in_user(&kgf->gf_group, &gf32->gf_group, sizeof(kgf->gf_group))) - return -EFAULT; - - err = getsockopt(sock, level, optname, (char __user *)kgf, koptlen); - if (err) - return err; - - if (!access_ok(koptlen, sizeof(*koptlen)) || - __get_user(klen, koptlen)) - return -EFAULT; - - ulen = klen - (sizeof(*kgf)-sizeof(*gf32)); - - if (!access_ok(optlen, sizeof(*optlen)) || - __put_user(ulen, optlen)) - return -EFAULT; - - if (!access_ok(kgf, klen) || - !access_ok(gf32, ulen) || - __get_user(interface, &kgf->gf_interface) || - __get_user(fmode, &kgf->gf_fmode) || - __get_user(numsrc, &kgf->gf_numsrc) || - __put_user(interface, &gf32->gf_interface) || - __put_user(fmode, &gf32->gf_fmode) || - __put_user(numsrc, &gf32->gf_numsrc)) - return -EFAULT; - if (numsrc) { - int copylen; - - klen -= GROUP_FILTER_SIZE(0); - copylen = numsrc * sizeof(gf32->gf_slist[0]); - if (copylen > klen) - copylen = klen; - if (copy_in_user(gf32->gf_slist, kgf->gf_slist, copylen)) - return -EFAULT; - } - return err; -} -EXPORT_SYMBOL(compat_mc_getsockopt); - - /* Argument list sizes for compat_sys_socketcall */ #define AL(x) ((x) * sizeof(u32)) static unsigned char nas[21] = { diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c index e3703a3e7ef4..65a30e7672ff 100644 --- a/net/ipv4/ip_sockglue.c +++ b/net/ipv4/ip_sockglue.c @@ -1607,9 +1607,47 @@ int compat_ip_getsockopt(struct sock *sk, int level, int optname, { int err; - if (optname == MCAST_MSFILTER) - return compat_mc_getsockopt(sk, level, optname, optval, optlen, - ip_getsockopt); + if (optname == MCAST_MSFILTER) { + const int size0 = offsetof(struct compat_group_filter, gf_slist); + struct compat_group_filter __user *p = (void __user *)optval; + struct compat_group_filter gf32; + struct group_filter gf; + int ulen, err; + int num; + + if (level != SOL_IP) + return -EOPNOTSUPP; + + if (get_user(ulen, optlen)) + return -EFAULT; + + if (ulen < size0) + return -EINVAL; + + if (copy_from_user(&gf32, p, size0)) + return -EFAULT; + + gf.gf_interface = gf32.gf_interface; + gf.gf_fmode = gf32.gf_fmode; + num = gf.gf_numsrc = gf32.gf_numsrc; + gf.gf_group = gf32.gf_group; + + rtnl_lock(); + lock_sock(sk); + err = ip_mc_gsfget(sk, &gf, p->gf_slist); + release_sock(sk); + rtnl_unlock(); + if (err) + return err; + if (gf.gf_numsrc < num) + num = gf.gf_numsrc; + ulen = GROUP_FILTER_SIZE(num) - (sizeof(gf) - sizeof(gf32)); + if (put_user(ulen, optlen) || + put_user(gf.gf_fmode, &p->gf_fmode) || + put_user(gf.gf_numsrc, &p->gf_numsrc)) + return -EFAULT; + return 0; + } err = do_ip_getsockopt(sk, level, optname, optval, optlen, MSG_CMSG_COMPAT); diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c index e4a62ca1a3d0..0bbafe73bdde 100644 --- a/net/ipv6/ipv6_sockglue.c +++ b/net/ipv6/ipv6_sockglue.c @@ -1446,9 +1446,44 @@ int compat_ipv6_getsockopt(struct sock *sk, int level, int optname, if (level != SOL_IPV6) return -ENOPROTOOPT; - if (optname == MCAST_MSFILTER) - return compat_mc_getsockopt(sk, level, optname, optval, optlen, - ipv6_getsockopt); + if (optname == MCAST_MSFILTER) { + const int size0 = offsetof(struct compat_group_filter, gf_slist); + struct compat_group_filter __user *p = (void __user *)optval; + struct compat_group_filter gf32; + struct group_filter gf; + int ulen, err; + int num; + + if (get_user(ulen, optlen)) + return -EFAULT; + + if (ulen < size0) + return -EINVAL; + + if (copy_from_user(&gf32, p, size0)) + return -EFAULT; + + gf.gf_interface = gf32.gf_interface; + gf.gf_fmode = gf32.gf_fmode; + num = gf.gf_numsrc = gf32.gf_numsrc; + gf.gf_group = gf32.gf_group; + + if (gf.gf_group.ss_family != AF_INET6) + return -EADDRNOTAVAIL; + lock_sock(sk); + err = ip6_mc_msfget(sk, &gf, p->gf_slist); + release_sock(sk); + if (err) + return err; + if (num > gf.gf_numsrc) + num = gf.gf_numsrc; + ulen = GROUP_FILTER_SIZE(num) - (sizeof(gf)-sizeof(gf32)); + if (put_user(ulen, optlen) || + put_user(gf.gf_fmode, &p->gf_fmode) || + put_user(gf.gf_numsrc, &p->gf_numsrc)) + return -EFAULT; + return 0; + } err = do_ipv6_getsockopt(sk, level, optname, optval, optlen, MSG_CMSG_COMPAT); -- 2.11.0 ^ permalink raw reply related [flat|nested] 42+ messages in thread
* [PATCH net-next 05/19] set_mcast_msfilter(): take the guts of setsockopt(MCAST_MSFILTER) into a helper 2020-05-21 0:37 ` [PATCH net-next 01/19] lift compat definitions of mcast [sg]etsockopt requests into net/compat.h Al Viro ` (2 preceding siblings ...) 2020-05-21 0:37 ` [PATCH net-next 04/19] get rid of compat_mc_getsockopt() Al Viro @ 2020-05-21 0:37 ` Al Viro 2020-05-21 0:37 ` [PATCH net-next 06/19] ipv4: do compat setsockopt for MCAST_MSFILTER directly Al Viro ` (13 subsequent siblings) 17 siblings, 0 replies; 42+ messages in thread From: Al Viro @ 2020-05-21 0:37 UTC (permalink / raw) To: netdev; +Cc: davem, viro, linux-kernel From: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> --- net/ipv4/ip_sockglue.c | 73 +++++++++++++++++++++++++++----------------------- 1 file changed, 40 insertions(+), 33 deletions(-) diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c index 65a30e7672ff..cc0441157b02 100644 --- a/net/ipv4/ip_sockglue.c +++ b/net/ipv4/ip_sockglue.c @@ -587,6 +587,43 @@ static bool setsockopt_needs_rtnl(int optname) return false; } +static int set_mcast_msfilter(struct sock *sk, int ifindex, + int numsrc, int fmode, + struct sockaddr_storage *group, + struct sockaddr_storage *list) +{ + int msize = IP_MSFILTER_SIZE(numsrc); + struct ip_msfilter *msf; + struct sockaddr_in *psin; + int err, i; + + msf = kmalloc(msize, GFP_KERNEL); + if (!msf) + return -ENOBUFS; + + psin = (struct sockaddr_in *)group; + if (psin->sin_family != AF_INET) + goto Eaddrnotavail; + msf->imsf_multiaddr = psin->sin_addr.s_addr; + msf->imsf_interface = 0; + msf->imsf_fmode = fmode; + msf->imsf_numsrc = numsrc; + for (i = 0; i < numsrc; ++i) { + psin = (struct sockaddr_in *)&list[i]; + + if (psin->sin_family != AF_INET) + goto Eaddrnotavail; + msf->imsf_slist[i] = psin->sin_addr.s_addr; + } + err = ip_mc_msfilter(sk, msf, ifindex); + kfree(msf); + return err; + +Eaddrnotavail: + kfree(msf); + return -EADDRNOTAVAIL; +} + static int do_ip_setsockopt(struct sock *sk, int level, int optname, char __user *optval, unsigned int optlen) { @@ -1079,10 +1116,7 @@ static int do_ip_setsockopt(struct sock *sk, int level, } case MCAST_MSFILTER: { - struct sockaddr_in *psin; - struct ip_msfilter *msf = NULL; struct group_filter *gsf = NULL; - int msize, i, ifindex; if (optlen < GROUP_FILTER_SIZE(0)) goto e_inval; @@ -1095,7 +1129,6 @@ static int do_ip_setsockopt(struct sock *sk, int level, err = PTR_ERR(gsf); break; } - /* numsrc >= (4G-140)/128 overflow in 32 bits */ if (gsf->gf_numsrc >= 0x1ffffff || gsf->gf_numsrc > net->ipv4.sysctl_igmp_max_msf) { @@ -1106,36 +1139,10 @@ static int do_ip_setsockopt(struct sock *sk, int level, err = -EINVAL; goto mc_msf_out; } - msize = IP_MSFILTER_SIZE(gsf->gf_numsrc); - msf = kmalloc(msize, GFP_KERNEL); - if (!msf) { - err = -ENOBUFS; - goto mc_msf_out; - } - ifindex = gsf->gf_interface; - psin = (struct sockaddr_in *)&gsf->gf_group; - if (psin->sin_family != AF_INET) { - err = -EADDRNOTAVAIL; - goto mc_msf_out; - } - msf->imsf_multiaddr = psin->sin_addr.s_addr; - msf->imsf_interface = 0; - msf->imsf_fmode = gsf->gf_fmode; - msf->imsf_numsrc = gsf->gf_numsrc; - err = -EADDRNOTAVAIL; - for (i = 0; i < gsf->gf_numsrc; ++i) { - psin = (struct sockaddr_in *)&gsf->gf_slist[i]; - - if (psin->sin_family != AF_INET) - goto mc_msf_out; - msf->imsf_slist[i] = psin->sin_addr.s_addr; - } - kfree(gsf); - gsf = NULL; - - err = ip_mc_msfilter(sk, msf, ifindex); + err = set_mcast_msfilter(sk, gsf->gf_interface, + gsf->gf_numsrc, gsf->gf_fmode, + &gsf->gf_group, gsf->gf_slist); mc_msf_out: - kfree(msf); kfree(gsf); break; } -- 2.11.0 ^ permalink raw reply related [flat|nested] 42+ messages in thread
* [PATCH net-next 06/19] ipv4: do compat setsockopt for MCAST_MSFILTER directly 2020-05-21 0:37 ` [PATCH net-next 01/19] lift compat definitions of mcast [sg]etsockopt requests into net/compat.h Al Viro ` (3 preceding siblings ...) 2020-05-21 0:37 ` [PATCH net-next 05/19] set_mcast_msfilter(): take the guts of setsockopt(MCAST_MSFILTER) into a helper Al Viro @ 2020-05-21 0:37 ` Al Viro 2020-05-21 0:37 ` [PATCH net-next 07/19] ip6_mc_msfilter(): pass the address list separately Al Viro ` (12 subsequent siblings) 17 siblings, 0 replies; 42+ messages in thread From: Al Viro @ 2020-05-21 0:37 UTC (permalink / raw) To: netdev; +Cc: davem, viro, linux-kernel From: Al Viro <viro@zeniv.linux.org.uk> Parallel to what the native setsockopt() does, except that unlike the native setsockopt() we do not use memdup_user() - we want the sockaddr_storage fields properly aligned, so we allocate 4 bytes more and copy compat_group_filter at the offset 4, which yields the proper alignments. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> --- net/ipv4/ip_sockglue.c | 48 +++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 47 insertions(+), 1 deletion(-) diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c index cc0441157b02..b6b889b5dacf 100644 --- a/net/ipv4/ip_sockglue.c +++ b/net/ipv4/ip_sockglue.c @@ -1286,9 +1286,55 @@ int compat_ip_setsockopt(struct sock *sk, int level, int optname, case MCAST_LEAVE_SOURCE_GROUP: case MCAST_BLOCK_SOURCE: case MCAST_UNBLOCK_SOURCE: - case MCAST_MSFILTER: return compat_mc_setsockopt(sk, level, optname, optval, optlen, ip_setsockopt); + case MCAST_MSFILTER: + { + const int size0 = offsetof(struct compat_group_filter, gf_slist); + struct compat_group_filter *gf32; + void *p; + int n; + + if (optlen < size0) + return -EINVAL; + if (optlen > sysctl_optmem_max - 4) + return -ENOBUFS; + + p = kmalloc(optlen + 4, GFP_KERNEL); + if (!p) + return -ENOMEM; + gf32 = p + 4; /* we want ->gf_group and ->gf_slist aligned */ + if (copy_from_user(gf32, optval, optlen)) { + err = -EFAULT; + goto mc_msf_out; + } + + n = gf32->gf_numsrc; + /* numsrc >= (4G-140)/128 overflow in 32 bits */ + if (n >= 0x1ffffff) { + err = -ENOBUFS; + goto mc_msf_out; + } + if (offsetof(struct compat_group_filter, gf_slist[n]) > optlen) { + err = -EINVAL; + goto mc_msf_out; + } + + rtnl_lock(); + lock_sock(sk); + /* numsrc >= (4G-140)/128 overflow in 32 bits */ + if (n > sock_net(sk)->ipv4.sysctl_igmp_max_msf) + err = -ENOBUFS; + else + err = set_mcast_msfilter(sk, gf32->gf_interface, + n, gf32->gf_fmode, + &gf32->gf_group, gf32->gf_slist); + release_sock(sk); + rtnl_unlock(); +mc_msf_out: + kfree(p); + return err; + } } err = do_ip_setsockopt(sk, level, optname, optval, optlen); -- 2.11.0 ^ permalink raw reply related [flat|nested] 42+ messages in thread
* [PATCH net-next 07/19] ip6_mc_msfilter(): pass the address list separately 2020-05-21 0:37 ` [PATCH net-next 01/19] lift compat definitions of mcast [sg]etsockopt requests into net/compat.h Al Viro ` (4 preceding siblings ...) 2020-05-21 0:37 ` [PATCH net-next 06/19] ipv4: do compat setsockopt for MCAST_MSFILTER directly Al Viro @ 2020-05-21 0:37 ` Al Viro 2020-05-21 0:37 ` [PATCH net-next 08/19] ipv6: do compat setsockopt for MCAST_MSFILTER directly Al Viro ` (11 subsequent siblings) 17 siblings, 0 replies; 42+ messages in thread From: Al Viro @ 2020-05-21 0:37 UTC (permalink / raw) To: netdev; +Cc: davem, viro, linux-kernel From: Al Viro <viro@zeniv.linux.org.uk> that way we'll be able to reuse it for compat case Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> --- include/net/ipv6.h | 3 ++- net/ipv6/ipv6_sockglue.c | 2 +- net/ipv6/mcast.c | 7 ++++--- 3 files changed, 7 insertions(+), 5 deletions(-) diff --git a/include/net/ipv6.h b/include/net/ipv6.h index c45eb78d970f..39a00d3ef5e2 100644 --- a/include/net/ipv6.h +++ b/include/net/ipv6.h @@ -1136,7 +1136,8 @@ struct group_filter; int ip6_mc_source(int add, int omode, struct sock *sk, struct group_source_req *pgsr); -int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf); +int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf, + struct sockaddr_storage *list); int ip6_mc_msfget(struct sock *sk, struct group_filter *gsf, struct sockaddr_storage __user *p); diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c index 0bbafe73bdde..7d3ecc0e69d1 100644 --- a/net/ipv6/ipv6_sockglue.c +++ b/net/ipv6/ipv6_sockglue.c @@ -780,7 +780,7 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname, retv = -EINVAL; break; } - retv = ip6_mc_msfilter(sk, gsf); + retv = ip6_mc_msfilter(sk, gsf, gsf->gf_slist); kfree(gsf); break; diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c index 97d796c7d6c0..7e12d2114158 100644 --- a/net/ipv6/mcast.c +++ b/net/ipv6/mcast.c @@ -457,7 +457,8 @@ int ip6_mc_source(int add, int omode, struct sock *sk, return err; } -int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf) +int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf, + struct sockaddr_storage *list) { const struct in6_addr *group; struct ipv6_mc_socklist *pmc; @@ -509,10 +510,10 @@ int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf) goto done; } newpsl->sl_max = newpsl->sl_count = gsf->gf_numsrc; - for (i = 0; i < newpsl->sl_count; ++i) { + for (i = 0; i < newpsl->sl_count; ++i, ++list) { struct sockaddr_in6 *psin6; - psin6 = (struct sockaddr_in6 *)&gsf->gf_slist[i]; + psin6 = (struct sockaddr_in6 *)list; newpsl->sl_addr[i] = psin6->sin6_addr; } err = ip6_mc_add_src(idev, group, gsf->gf_fmode, -- 2.11.0 ^ permalink raw reply related [flat|nested] 42+ messages in thread
* [PATCH net-next 08/19] ipv6: do compat setsockopt for MCAST_MSFILTER directly 2020-05-21 0:37 ` [PATCH net-next 01/19] lift compat definitions of mcast [sg]etsockopt requests into net/compat.h Al Viro ` (5 preceding siblings ...) 2020-05-21 0:37 ` [PATCH net-next 07/19] ip6_mc_msfilter(): pass the address list separately Al Viro @ 2020-05-21 0:37 ` Al Viro 2020-05-21 0:37 ` [PATCH net-next 09/19] ipv[46]: do compat setsockopt for MCAST_{JOIN,LEAVE}_GROUP directly Al Viro ` (10 subsequent siblings) 17 siblings, 0 replies; 42+ messages in thread From: Al Viro @ 2020-05-21 0:37 UTC (permalink / raw) To: netdev; +Cc: davem, viro, linux-kernel From: Al Viro <viro@zeniv.linux.org.uk> similar to the ipv4 counterpart of that patch - the same trick used to align the tail array properly. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> --- net/ipv6/ipv6_sockglue.c | 48 +++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 47 insertions(+), 1 deletion(-) diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c index 7d3ecc0e69d1..2b5029df8f1e 100644 --- a/net/ipv6/ipv6_sockglue.c +++ b/net/ipv6/ipv6_sockglue.c @@ -980,9 +980,55 @@ int compat_ipv6_setsockopt(struct sock *sk, int level, int optname, case MCAST_LEAVE_SOURCE_GROUP: case MCAST_BLOCK_SOURCE: case MCAST_UNBLOCK_SOURCE: - case MCAST_MSFILTER: return compat_mc_setsockopt(sk, level, optname, optval, optlen, ipv6_setsockopt); + case MCAST_MSFILTER: + { + const int size0 = offsetof(struct compat_group_filter, gf_slist); + struct compat_group_filter *gf32; + void *p; + int n; + + if (optlen < size0) + return -EINVAL; + if (optlen > sysctl_optmem_max - 4) + return -ENOBUFS; + + p = kmalloc(optlen + 4, GFP_KERNEL); + if (!p) + return -ENOMEM; + + gf32 = p + 4; /* we want ->gf_group and ->gf_slist aligned */ + if (copy_from_user(gf32, optval, optlen)) { + err = -EFAULT; + goto mc_msf_out; + } + + n = gf32->gf_numsrc; + /* numsrc >= (4G-140)/128 overflow in 32 bits */ + if (n >= 0x1ffffffU || + n > sysctl_mld_max_msf) { + err = -ENOBUFS; + goto mc_msf_out; + } + if (offsetof(struct compat_group_filter, gf_slist[n]) > optlen) { + err = -EINVAL; + goto mc_msf_out; + } + + rtnl_lock(); + lock_sock(sk); + err = ip6_mc_msfilter(sk, &(struct group_filter){ + .gf_interface = gf32->gf_interface, + .gf_group = gf32->gf_group, + .gf_fmode = gf32->gf_fmode, + .gf_numsrc = gf32->gf_numsrc}, gf32->gf_slist); + release_sock(sk); + rtnl_unlock(); +mc_msf_out: + kfree(p); + return err; + } } err = do_ipv6_setsockopt(sk, level, optname, optval, optlen); -- 2.11.0 ^ permalink raw reply related [flat|nested] 42+ messages in thread
* [PATCH net-next 09/19] ipv[46]: do compat setsockopt for MCAST_{JOIN,LEAVE}_GROUP directly 2020-05-21 0:37 ` [PATCH net-next 01/19] lift compat definitions of mcast [sg]etsockopt requests into net/compat.h Al Viro ` (6 preceding siblings ...) 2020-05-21 0:37 ` [PATCH net-next 08/19] ipv6: do compat setsockopt for MCAST_MSFILTER directly Al Viro @ 2020-05-21 0:37 ` Al Viro 2020-05-21 0:37 ` [PATCH net-next 10/19] ipv4: take handling of group_source_req options into a helper Al Viro ` (9 subsequent siblings) 17 siblings, 0 replies; 42+ messages in thread From: Al Viro @ 2020-05-21 0:37 UTC (permalink / raw) To: netdev; +Cc: davem, viro, linux-kernel From: Al Viro <viro@zeniv.linux.org.uk> direct parallel to the way these two are handled in the native ->setsockopt() instances - the helpers that do the real work are already separated and can be reused as-is in this case. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> --- net/ipv4/ip_sockglue.c | 31 +++++++++++++++++++++++++++++++ net/ipv6/ipv6_sockglue.c | 28 ++++++++++++++++++++++++++++ 2 files changed, 59 insertions(+) diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c index b6b889b5dacf..34c3a43a9c98 100644 --- a/net/ipv4/ip_sockglue.c +++ b/net/ipv4/ip_sockglue.c @@ -1282,6 +1282,37 @@ int compat_ip_setsockopt(struct sock *sk, int level, int optname, switch (optname) { case MCAST_JOIN_GROUP: case MCAST_LEAVE_GROUP: + { + struct compat_group_req __user *gr32 = (void __user *)optval; + struct group_req greq; + struct sockaddr_in *psin = (struct sockaddr_in *)&greq.gr_group; + struct ip_mreqn mreq; + + if (optlen < sizeof(struct compat_group_req)) + return -EINVAL; + + if (get_user(greq.gr_interface, &gr32->gr_interface) || + copy_from_user(&greq.gr_group, &gr32->gr_group, + sizeof(greq.gr_group))) + return -EFAULT; + + if (psin->sin_family != AF_INET) + return -EINVAL; + + memset(&mreq, 0, sizeof(mreq)); + mreq.imr_multiaddr = psin->sin_addr; + mreq.imr_ifindex = greq.gr_interface; + + rtnl_lock(); + lock_sock(sk); + if (optname == MCAST_JOIN_GROUP) + err = ip_mc_join_group(sk, &mreq); + else + err = ip_mc_leave_group(sk, &mreq); + release_sock(sk); + rtnl_unlock(); + return err; + } case MCAST_JOIN_SOURCE_GROUP: case MCAST_LEAVE_SOURCE_GROUP: case MCAST_BLOCK_SOURCE: diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c index 2b5029df8f1e..209d827950cc 100644 --- a/net/ipv6/ipv6_sockglue.c +++ b/net/ipv6/ipv6_sockglue.c @@ -976,6 +976,34 @@ int compat_ipv6_setsockopt(struct sock *sk, int level, int optname, switch (optname) { case MCAST_JOIN_GROUP: case MCAST_LEAVE_GROUP: + { + struct compat_group_req __user *gr32 = (void __user *)optval; + struct group_req greq; + struct sockaddr_in6 *psin6 = (struct sockaddr_in6 *)&greq.gr_group; + + if (optlen < sizeof(struct compat_group_req)) + return -EINVAL; + + if (get_user(greq.gr_interface, &gr32->gr_interface) || + copy_from_user(&greq.gr_group, &gr32->gr_group, + sizeof(greq.gr_group))) + return -EFAULT; + + if (greq.gr_group.ss_family != AF_INET6) + return -EADDRNOTAVAIL; + + rtnl_lock(); + lock_sock(sk); + if (optname == MCAST_JOIN_GROUP) + err = ipv6_sock_mc_join(sk, greq.gr_interface, + &psin6->sin6_addr); + else + err = ipv6_sock_mc_drop(sk, greq.gr_interface, + &psin6->sin6_addr); + release_sock(sk); + rtnl_unlock(); + return err; + } case MCAST_JOIN_SOURCE_GROUP: case MCAST_LEAVE_SOURCE_GROUP: case MCAST_BLOCK_SOURCE: -- 2.11.0 ^ permalink raw reply related [flat|nested] 42+ messages in thread
* [PATCH net-next 10/19] ipv4: take handling of group_source_req options into a helper 2020-05-21 0:37 ` [PATCH net-next 01/19] lift compat definitions of mcast [sg]etsockopt requests into net/compat.h Al Viro ` (7 preceding siblings ...) 2020-05-21 0:37 ` [PATCH net-next 09/19] ipv[46]: do compat setsockopt for MCAST_{JOIN,LEAVE}_GROUP directly Al Viro @ 2020-05-21 0:37 ` Al Viro 2020-05-21 0:37 ` [PATCH net-next 11/19] ipv6: " Al Viro ` (8 subsequent siblings) 17 siblings, 0 replies; 42+ messages in thread From: Al Viro @ 2020-05-21 0:37 UTC (permalink / raw) To: netdev; +Cc: davem, viro, linux-kernel From: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> --- net/ipv4/ip_sockglue.c | 83 ++++++++++++++++++++++++++------------------------ 1 file changed, 44 insertions(+), 39 deletions(-) diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c index 34c3a43a9c98..7f065a68664e 100644 --- a/net/ipv4/ip_sockglue.c +++ b/net/ipv4/ip_sockglue.c @@ -624,6 +624,49 @@ static int set_mcast_msfilter(struct sock *sk, int ifindex, return -EADDRNOTAVAIL; } +static int do_mcast_group_source(struct sock *sk, int optname, + struct group_source_req *greqs) +{ + struct ip_mreq_source mreqs; + struct sockaddr_in *psin; + int omode, add, err; + + if (greqs->gsr_group.ss_family != AF_INET || + greqs->gsr_source.ss_family != AF_INET) + return -EADDRNOTAVAIL; + + psin = (struct sockaddr_in *)&greqs->gsr_group; + mreqs.imr_multiaddr = psin->sin_addr.s_addr; + psin = (struct sockaddr_in *)&greqs->gsr_source; + mreqs.imr_sourceaddr = psin->sin_addr.s_addr; + mreqs.imr_interface = 0; /* use index for mc_source */ + + if (optname == MCAST_BLOCK_SOURCE) { + omode = MCAST_EXCLUDE; + add = 1; + } else if (optname == MCAST_UNBLOCK_SOURCE) { + omode = MCAST_EXCLUDE; + add = 0; + } else if (optname == MCAST_JOIN_SOURCE_GROUP) { + struct ip_mreqn mreq; + + psin = (struct sockaddr_in *)&greqs->gsr_group; + mreq.imr_multiaddr = psin->sin_addr; + mreq.imr_address.s_addr = 0; + mreq.imr_ifindex = greqs->gsr_interface; + err = ip_mc_join_group_ssm(sk, &mreq, MCAST_INCLUDE); + if (err && err != -EADDRINUSE) + return err; + greqs->gsr_interface = mreq.imr_ifindex; + omode = MCAST_INCLUDE; + add = 1; + } else /* MCAST_LEAVE_SOURCE_GROUP */ { + omode = MCAST_INCLUDE; + add = 0; + } + return ip_mc_source(add, omode, sk, &mreqs, greqs->gsr_interface); +} + static int do_ip_setsockopt(struct sock *sk, int level, int optname, char __user *optval, unsigned int optlen) { @@ -1066,9 +1109,6 @@ static int do_ip_setsockopt(struct sock *sk, int level, case MCAST_UNBLOCK_SOURCE: { struct group_source_req greqs; - struct ip_mreq_source mreqs; - struct sockaddr_in *psin; - int omode, add; if (optlen != sizeof(struct group_source_req)) goto e_inval; @@ -1076,42 +1116,7 @@ static int do_ip_setsockopt(struct sock *sk, int level, err = -EFAULT; break; } - if (greqs.gsr_group.ss_family != AF_INET || - greqs.gsr_source.ss_family != AF_INET) { - err = -EADDRNOTAVAIL; - break; - } - psin = (struct sockaddr_in *)&greqs.gsr_group; - mreqs.imr_multiaddr = psin->sin_addr.s_addr; - psin = (struct sockaddr_in *)&greqs.gsr_source; - mreqs.imr_sourceaddr = psin->sin_addr.s_addr; - mreqs.imr_interface = 0; /* use index for mc_source */ - - if (optname == MCAST_BLOCK_SOURCE) { - omode = MCAST_EXCLUDE; - add = 1; - } else if (optname == MCAST_UNBLOCK_SOURCE) { - omode = MCAST_EXCLUDE; - add = 0; - } else if (optname == MCAST_JOIN_SOURCE_GROUP) { - struct ip_mreqn mreq; - - psin = (struct sockaddr_in *)&greqs.gsr_group; - mreq.imr_multiaddr = psin->sin_addr; - mreq.imr_address.s_addr = 0; - mreq.imr_ifindex = greqs.gsr_interface; - err = ip_mc_join_group_ssm(sk, &mreq, MCAST_INCLUDE); - if (err && err != -EADDRINUSE) - break; - greqs.gsr_interface = mreq.imr_ifindex; - omode = MCAST_INCLUDE; - add = 1; - } else /* MCAST_LEAVE_SOURCE_GROUP */ { - omode = MCAST_INCLUDE; - add = 0; - } - err = ip_mc_source(add, omode, sk, &mreqs, - greqs.gsr_interface); + err = do_mcast_group_source(sk, optname, &greqs); break; } case MCAST_MSFILTER: -- 2.11.0 ^ permalink raw reply related [flat|nested] 42+ messages in thread
* [PATCH net-next 11/19] ipv6: take handling of group_source_req options into a helper 2020-05-21 0:37 ` [PATCH net-next 01/19] lift compat definitions of mcast [sg]etsockopt requests into net/compat.h Al Viro ` (8 preceding siblings ...) 2020-05-21 0:37 ` [PATCH net-next 10/19] ipv4: take handling of group_source_req options into a helper Al Viro @ 2020-05-21 0:37 ` Al Viro 2020-05-21 0:37 ` [PATCH net-next 12/19] handle the group_source_req options directly Al Viro ` (7 subsequent siblings) 17 siblings, 0 replies; 42+ messages in thread From: Al Viro @ 2020-05-21 0:37 UTC (permalink / raw) To: netdev; +Cc: davem, viro, linux-kernel From: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> --- net/ipv6/ipv6_sockglue.c | 65 +++++++++++++++++++++++++++--------------------- 1 file changed, 36 insertions(+), 29 deletions(-) diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c index 209d827950cc..bb049feeb787 100644 --- a/net/ipv6/ipv6_sockglue.c +++ b/net/ipv6/ipv6_sockglue.c @@ -136,6 +136,41 @@ static bool setsockopt_needs_rtnl(int optname) return false; } +static int do_ipv6_mcast_group_source(struct sock *sk, int optname, + struct group_source_req *greqs) +{ + int omode, add; + + if (greqs->gsr_group.ss_family != AF_INET6 || + greqs->gsr_source.ss_family != AF_INET6) + return -EADDRNOTAVAIL; + + if (optname == MCAST_BLOCK_SOURCE) { + omode = MCAST_EXCLUDE; + add = 1; + } else if (optname == MCAST_UNBLOCK_SOURCE) { + omode = MCAST_EXCLUDE; + add = 0; + } else if (optname == MCAST_JOIN_SOURCE_GROUP) { + struct sockaddr_in6 *psin6; + int retv; + + psin6 = (struct sockaddr_in6 *)&greqs->gsr_group; + retv = ipv6_sock_mc_join_ssm(sk, greqs->gsr_interface, + &psin6->sin6_addr, + MCAST_INCLUDE); + /* prior join w/ different source is ok */ + if (retv && retv != -EADDRINUSE) + return retv; + omode = MCAST_INCLUDE; + add = 1; + } else /* MCAST_LEAVE_SOURCE_GROUP */ { + omode = MCAST_INCLUDE; + add = 0; + } + return ip6_mc_source(add, omode, sk, greqs); +} + static int do_ipv6_setsockopt(struct sock *sk, int level, int optname, char __user *optval, unsigned int optlen) { @@ -715,7 +750,6 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname, case MCAST_UNBLOCK_SOURCE: { struct group_source_req greqs; - int omode, add; if (optlen < sizeof(struct group_source_req)) goto e_inval; @@ -723,34 +757,7 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname, retv = -EFAULT; break; } - if (greqs.gsr_group.ss_family != AF_INET6 || - greqs.gsr_source.ss_family != AF_INET6) { - retv = -EADDRNOTAVAIL; - break; - } - if (optname == MCAST_BLOCK_SOURCE) { - omode = MCAST_EXCLUDE; - add = 1; - } else if (optname == MCAST_UNBLOCK_SOURCE) { - omode = MCAST_EXCLUDE; - add = 0; - } else if (optname == MCAST_JOIN_SOURCE_GROUP) { - struct sockaddr_in6 *psin6; - - psin6 = (struct sockaddr_in6 *)&greqs.gsr_group; - retv = ipv6_sock_mc_join_ssm(sk, greqs.gsr_interface, - &psin6->sin6_addr, - MCAST_INCLUDE); - /* prior join w/ different source is ok */ - if (retv && retv != -EADDRINUSE) - break; - omode = MCAST_INCLUDE; - add = 1; - } else /* MCAST_LEAVE_SOURCE_GROUP */ { - omode = MCAST_INCLUDE; - add = 0; - } - retv = ip6_mc_source(add, omode, sk, &greqs); + retv = do_ipv6_mcast_group_source(sk, optname, &greqs); break; } case MCAST_MSFILTER: -- 2.11.0 ^ permalink raw reply related [flat|nested] 42+ messages in thread
* [PATCH net-next 12/19] handle the group_source_req options directly 2020-05-21 0:37 ` [PATCH net-next 01/19] lift compat definitions of mcast [sg]etsockopt requests into net/compat.h Al Viro ` (9 preceding siblings ...) 2020-05-21 0:37 ` [PATCH net-next 11/19] ipv6: " Al Viro @ 2020-05-21 0:37 ` Al Viro 2020-05-21 0:37 ` [PATCH net-next 13/19] get rid of compat_mc_setsockopt() Al Viro ` (6 subsequent siblings) 17 siblings, 0 replies; 42+ messages in thread From: Al Viro @ 2020-05-21 0:37 UTC (permalink / raw) To: netdev; +Cc: davem, viro, linux-kernel From: Al Viro <viro@zeniv.linux.org.uk> Native ->setsockopt() handling of these options (MCAST_..._SOURCE_GROUP and MCAST_{,UN}BLOCK_SOURCE) consists of copyin + call of a helper that does the actual work. The only change needed for ->compat_setsockopt() is a slightly different copyin - the helpers can be reused as-is. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> --- net/ipv4/ip_sockglue.c | 23 +++++++++++++++++++++-- net/ipv6/ipv6_sockglue.c | 23 +++++++++++++++++++++-- 2 files changed, 42 insertions(+), 4 deletions(-) diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c index 7f065a68664e..a2469bc57cfe 100644 --- a/net/ipv4/ip_sockglue.c +++ b/net/ipv4/ip_sockglue.c @@ -1322,8 +1322,27 @@ int compat_ip_setsockopt(struct sock *sk, int level, int optname, case MCAST_LEAVE_SOURCE_GROUP: case MCAST_BLOCK_SOURCE: case MCAST_UNBLOCK_SOURCE: - return compat_mc_setsockopt(sk, level, optname, optval, optlen, - ip_setsockopt); + { + struct compat_group_source_req __user *gsr32 = (void __user *)optval; + struct group_source_req greqs; + + if (optlen != sizeof(struct compat_group_source_req)) + return -EINVAL; + + if (get_user(greqs.gsr_interface, &gsr32->gsr_interface) || + copy_from_user(&greqs.gsr_group, &gsr32->gsr_group, + sizeof(greqs.gsr_group)) || + copy_from_user(&greqs.gsr_source, &gsr32->gsr_source, + sizeof(greqs.gsr_source))) + return -EFAULT; + + rtnl_lock(); + lock_sock(sk); + err = do_mcast_group_source(sk, optname, &greqs); + release_sock(sk); + rtnl_unlock(); + return err; + } case MCAST_MSFILTER: { const int size0 = offsetof(struct compat_group_filter, gf_slist); diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c index bb049feeb787..e10258c2210e 100644 --- a/net/ipv6/ipv6_sockglue.c +++ b/net/ipv6/ipv6_sockglue.c @@ -1015,8 +1015,27 @@ int compat_ipv6_setsockopt(struct sock *sk, int level, int optname, case MCAST_LEAVE_SOURCE_GROUP: case MCAST_BLOCK_SOURCE: case MCAST_UNBLOCK_SOURCE: - return compat_mc_setsockopt(sk, level, optname, optval, optlen, - ipv6_setsockopt); + { + struct compat_group_source_req __user *gsr32 = (void __user *)optval; + struct group_source_req greqs; + + if (optlen < sizeof(struct compat_group_source_req)) + return -EINVAL; + + if (get_user(greqs.gsr_interface, &gsr32->gsr_interface) || + copy_from_user(&greqs.gsr_group, &gsr32->gsr_group, + sizeof(greqs.gsr_group)) || + copy_from_user(&greqs.gsr_source, &gsr32->gsr_source, + sizeof(greqs.gsr_source))) + return -EFAULT; + + rtnl_lock(); + lock_sock(sk); + err = do_ipv6_mcast_group_source(sk, optname, &greqs); + release_sock(sk); + rtnl_unlock(); + return err; + } case MCAST_MSFILTER: { const int size0 = offsetof(struct compat_group_filter, gf_slist); -- 2.11.0 ^ permalink raw reply related [flat|nested] 42+ messages in thread
* [PATCH net-next 13/19] get rid of compat_mc_setsockopt() 2020-05-21 0:37 ` [PATCH net-next 01/19] lift compat definitions of mcast [sg]etsockopt requests into net/compat.h Al Viro ` (10 preceding siblings ...) 2020-05-21 0:37 ` [PATCH net-next 12/19] handle the group_source_req options directly Al Viro @ 2020-05-21 0:37 ` Al Viro 2020-05-21 0:37 ` [PATCH net-next 14/19] batadv_socket_read(): get rid of pointless access_ok() Al Viro ` (5 subsequent siblings) 17 siblings, 0 replies; 42+ messages in thread From: Al Viro @ 2020-05-21 0:37 UTC (permalink / raw) To: netdev; +Cc: davem, viro, linux-kernel From: Al Viro <viro@zeniv.linux.org.uk> not used anymore Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> --- include/net/compat.h | 4 --- net/compat.c | 90 ---------------------------------------------------- 2 files changed, 94 deletions(-) diff --git a/include/net/compat.h b/include/net/compat.h index d714076d63d5..f241666117d8 100644 --- a/include/net/compat.h +++ b/include/net/compat.h @@ -67,10 +67,6 @@ int put_cmsg_compat(struct msghdr*, int, int, int, void *); int cmsghdr_from_user_compat_to_kern(struct msghdr *, struct sock *, unsigned char *, int); -int compat_mc_setsockopt(struct sock *, int, int, char __user *, unsigned int, - int (*)(struct sock *, int, int, char __user *, - unsigned int)); - struct compat_group_req { __u32 gr_interface; struct __kernel_sockaddr_storage gr_group diff --git a/net/compat.c b/net/compat.c index 7bdfda2b382a..afd7b444e0bf 100644 --- a/net/compat.c +++ b/net/compat.c @@ -448,96 +448,6 @@ COMPAT_SYSCALL_DEFINE5(getsockopt, int, fd, int, level, int, optname, return __compat_sys_getsockopt(fd, level, optname, optval, optlen); } -#define __COMPAT_GF0_SIZE (sizeof(struct compat_group_filter) - \ - sizeof(struct __kernel_sockaddr_storage)) - -int compat_mc_setsockopt(struct sock *sock, int level, int optname, - char __user *optval, unsigned int optlen, - int (*setsockopt)(struct sock *, int, int, char __user *, unsigned int)) -{ - char __user *koptval = optval; - int koptlen = optlen; - - switch (optname) { - case MCAST_JOIN_GROUP: - case MCAST_LEAVE_GROUP: - { - struct compat_group_req __user *gr32 = (void __user *)optval; - struct group_req __user *kgr = - compat_alloc_user_space(sizeof(struct group_req)); - u32 interface; - - if (!access_ok(gr32, sizeof(*gr32)) || - !access_ok(kgr, sizeof(struct group_req)) || - __get_user(interface, &gr32->gr_interface) || - __put_user(interface, &kgr->gr_interface) || - copy_in_user(&kgr->gr_group, &gr32->gr_group, - sizeof(kgr->gr_group))) - return -EFAULT; - koptval = (char __user *)kgr; - koptlen = sizeof(struct group_req); - break; - } - case MCAST_JOIN_SOURCE_GROUP: - case MCAST_LEAVE_SOURCE_GROUP: - case MCAST_BLOCK_SOURCE: - case MCAST_UNBLOCK_SOURCE: - { - struct compat_group_source_req __user *gsr32 = (void __user *)optval; - struct group_source_req __user *kgsr = compat_alloc_user_space( - sizeof(struct group_source_req)); - u32 interface; - - if (!access_ok(gsr32, sizeof(*gsr32)) || - !access_ok(kgsr, - sizeof(struct group_source_req)) || - __get_user(interface, &gsr32->gsr_interface) || - __put_user(interface, &kgsr->gsr_interface) || - copy_in_user(&kgsr->gsr_group, &gsr32->gsr_group, - sizeof(kgsr->gsr_group)) || - copy_in_user(&kgsr->gsr_source, &gsr32->gsr_source, - sizeof(kgsr->gsr_source))) - return -EFAULT; - koptval = (char __user *)kgsr; - koptlen = sizeof(struct group_source_req); - break; - } - case MCAST_MSFILTER: - { - struct compat_group_filter __user *gf32 = (void __user *)optval; - struct group_filter __user *kgf; - u32 interface, fmode, numsrc; - - if (!access_ok(gf32, __COMPAT_GF0_SIZE) || - __get_user(interface, &gf32->gf_interface) || - __get_user(fmode, &gf32->gf_fmode) || - __get_user(numsrc, &gf32->gf_numsrc)) - return -EFAULT; - koptlen = optlen + sizeof(struct group_filter) - - sizeof(struct compat_group_filter); - if (koptlen < GROUP_FILTER_SIZE(numsrc)) - return -EINVAL; - kgf = compat_alloc_user_space(koptlen); - if (!access_ok(kgf, koptlen) || - __put_user(interface, &kgf->gf_interface) || - __put_user(fmode, &kgf->gf_fmode) || - __put_user(numsrc, &kgf->gf_numsrc) || - copy_in_user(&kgf->gf_group, &gf32->gf_group, - sizeof(kgf->gf_group)) || - (numsrc && copy_in_user(kgf->gf_slist, gf32->gf_slist, - numsrc * sizeof(kgf->gf_slist[0])))) - return -EFAULT; - koptval = (char __user *)kgf; - break; - } - - default: - break; - } - return setsockopt(sock, level, optname, koptval, koptlen); -} -EXPORT_SYMBOL(compat_mc_setsockopt); - /* Argument list sizes for compat_sys_socketcall */ #define AL(x) ((x) * sizeof(u32)) static unsigned char nas[21] = { -- 2.11.0 ^ permalink raw reply related [flat|nested] 42+ messages in thread
* [PATCH net-next 14/19] batadv_socket_read(): get rid of pointless access_ok() 2020-05-21 0:37 ` [PATCH net-next 01/19] lift compat definitions of mcast [sg]etsockopt requests into net/compat.h Al Viro ` (11 preceding siblings ...) 2020-05-21 0:37 ` [PATCH net-next 13/19] get rid of compat_mc_setsockopt() Al Viro @ 2020-05-21 0:37 ` Al Viro 2020-05-21 0:37 ` [PATCH net-next 15/19] atm: separate ATM_GETNAMES handling from the rest of atm_dev_ioctl() Al Viro ` (4 subsequent siblings) 17 siblings, 0 replies; 42+ messages in thread From: Al Viro @ 2020-05-21 0:37 UTC (permalink / raw) To: netdev; +Cc: davem, viro, linux-kernel From: Al Viro <viro@zeniv.linux.org.uk> address is passed only to copy_to_user() Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> --- net/batman-adv/icmp_socket.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/net/batman-adv/icmp_socket.c b/net/batman-adv/icmp_socket.c index ccb535c77e5d..8bdabc03b0b2 100644 --- a/net/batman-adv/icmp_socket.c +++ b/net/batman-adv/icmp_socket.c @@ -135,9 +135,6 @@ static ssize_t batadv_socket_read(struct file *file, char __user *buf, if (!buf || count < sizeof(struct batadv_icmp_packet)) return -EINVAL; - if (!access_ok(buf, count)) - return -EFAULT; - error = wait_event_interruptible(socket_client->queue_wait, socket_client->queue_len); -- 2.11.0 ^ permalink raw reply related [flat|nested] 42+ messages in thread
* [PATCH net-next 15/19] atm: separate ATM_GETNAMES handling from the rest of atm_dev_ioctl() 2020-05-21 0:37 ` [PATCH net-next 01/19] lift compat definitions of mcast [sg]etsockopt requests into net/compat.h Al Viro ` (12 preceding siblings ...) 2020-05-21 0:37 ` [PATCH net-next 14/19] batadv_socket_read(): get rid of pointless access_ok() Al Viro @ 2020-05-21 0:37 ` Al Viro 2020-05-21 0:37 ` [PATCH net-next 16/19] atm: move copyin from atm_getnames() into the caller Al Viro ` (3 subsequent siblings) 17 siblings, 0 replies; 42+ messages in thread From: Al Viro @ 2020-05-21 0:37 UTC (permalink / raw) To: netdev; +Cc: davem, viro, linux-kernel From: Al Viro <viro@zeniv.linux.org.uk> atm_dev_ioctl() does copyin in two different ways - one for ATM_GETNAMES, another for everything else. Start with separating the former into a new helper (atm_getnames()). The next step will be to lift the copyin into the callers. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> --- net/atm/ioctl.c | 6 +++- net/atm/resources.c | 88 +++++++++++++++++++++++++++-------------------------- net/atm/resources.h | 1 + 3 files changed, 51 insertions(+), 44 deletions(-) diff --git a/net/atm/ioctl.c b/net/atm/ioctl.c index d955b683aa7c..0b4b07740fe4 100644 --- a/net/atm/ioctl.c +++ b/net/atm/ioctl.c @@ -162,7 +162,11 @@ static int do_vcc_ioctl(struct socket *sock, unsigned int cmd, if (error != -ENOIOCTLCMD) goto done; - error = atm_dev_ioctl(cmd, argp, compat); + if (cmd == ATM_GETNAMES) { + error = atm_getnames(argp, compat); + } else { + error = atm_dev_ioctl(cmd, argp, compat); + } done: return error; diff --git a/net/atm/resources.c b/net/atm/resources.c index 889349c6d90d..a2ab75929eec 100644 --- a/net/atm/resources.c +++ b/net/atm/resources.c @@ -193,61 +193,63 @@ static int fetch_stats(struct atm_dev *dev, struct atm_dev_stats __user *arg, return error ? -EFAULT : 0; } -int atm_dev_ioctl(unsigned int cmd, void __user *arg, int compat) +int atm_getnames(void __user *arg, int compat) { void __user *buf; - int error, len, number, size = 0; + int error, len, size = 0; struct atm_dev *dev; struct list_head *p; int *tmp_buf, *tmp_p; - int __user *sioc_len; int __user *iobuf_len; - switch (cmd) { - case ATM_GETNAMES: - if (IS_ENABLED(CONFIG_COMPAT) && compat) { + if (IS_ENABLED(CONFIG_COMPAT) && compat) { #ifdef CONFIG_COMPAT - struct compat_atm_iobuf __user *ciobuf = arg; - compat_uptr_t cbuf; - iobuf_len = &ciobuf->length; - if (get_user(cbuf, &ciobuf->buffer)) - return -EFAULT; - buf = compat_ptr(cbuf); + struct compat_atm_iobuf __user *ciobuf = arg; + compat_uptr_t cbuf; + iobuf_len = &ciobuf->length; + if (get_user(cbuf, &ciobuf->buffer)) + return -EFAULT; + buf = compat_ptr(cbuf); #endif - } else { - struct atm_iobuf __user *iobuf = arg; - iobuf_len = &iobuf->length; - if (get_user(buf, &iobuf->buffer)) - return -EFAULT; - } - if (get_user(len, iobuf_len)) + } else { + struct atm_iobuf __user *iobuf = arg; + iobuf_len = &iobuf->length; + if (get_user(buf, &iobuf->buffer)) return -EFAULT; - mutex_lock(&atm_dev_mutex); - list_for_each(p, &atm_devs) - size += sizeof(int); - if (size > len) { - mutex_unlock(&atm_dev_mutex); - return -E2BIG; - } - tmp_buf = kmalloc(size, GFP_ATOMIC); - if (!tmp_buf) { - mutex_unlock(&atm_dev_mutex); - return -ENOMEM; - } - tmp_p = tmp_buf; - list_for_each(p, &atm_devs) { - dev = list_entry(p, struct atm_dev, dev_list); - *tmp_p++ = dev->number; - } + } + if (get_user(len, iobuf_len)) + return -EFAULT; + mutex_lock(&atm_dev_mutex); + list_for_each(p, &atm_devs) + size += sizeof(int); + if (size > len) { mutex_unlock(&atm_dev_mutex); - error = ((copy_to_user(buf, tmp_buf, size)) || - put_user(size, iobuf_len)) - ? -EFAULT : 0; - kfree(tmp_buf); - return error; - default: - break; + return -E2BIG; } + tmp_buf = kmalloc(size, GFP_ATOMIC); + if (!tmp_buf) { + mutex_unlock(&atm_dev_mutex); + return -ENOMEM; + } + tmp_p = tmp_buf; + list_for_each(p, &atm_devs) { + dev = list_entry(p, struct atm_dev, dev_list); + *tmp_p++ = dev->number; + } + mutex_unlock(&atm_dev_mutex); + error = ((copy_to_user(buf, tmp_buf, size)) || + put_user(size, iobuf_len)) + ? -EFAULT : 0; + kfree(tmp_buf); + return error; +} + +int atm_dev_ioctl(unsigned int cmd, void __user *arg, int compat) +{ + void __user *buf; + int error, len, number, size = 0; + struct atm_dev *dev; + int __user *sioc_len; if (IS_ENABLED(CONFIG_COMPAT) && compat) { #ifdef CONFIG_COMPAT diff --git a/net/atm/resources.h b/net/atm/resources.h index 048232e4d4c6..18f8e5948ce4 100644 --- a/net/atm/resources.h +++ b/net/atm/resources.h @@ -14,6 +14,7 @@ extern struct list_head atm_devs; extern struct mutex atm_dev_mutex; +int atm_getnames(void __user *arg, int compat); int atm_dev_ioctl(unsigned int cmd, void __user *arg, int compat); -- 2.11.0 ^ permalink raw reply related [flat|nested] 42+ messages in thread
* [PATCH net-next 16/19] atm: move copyin from atm_getnames() into the caller 2020-05-21 0:37 ` [PATCH net-next 01/19] lift compat definitions of mcast [sg]etsockopt requests into net/compat.h Al Viro ` (13 preceding siblings ...) 2020-05-21 0:37 ` [PATCH net-next 15/19] atm: separate ATM_GETNAMES handling from the rest of atm_dev_ioctl() Al Viro @ 2020-05-21 0:37 ` Al Viro 2020-05-21 0:37 ` [PATCH net-next 17/19] atm: switch do_atm_iobuf() to direct use of atm_getnames() Al Viro ` (2 subsequent siblings) 17 siblings, 0 replies; 42+ messages in thread From: Al Viro @ 2020-05-21 0:37 UTC (permalink / raw) To: netdev; +Cc: davem, viro, linux-kernel From: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> --- net/atm/ioctl.c | 19 ++++++++++++++++++- net/atm/resources.c | 19 +------------------ net/atm/resources.h | 2 +- 3 files changed, 20 insertions(+), 20 deletions(-) diff --git a/net/atm/ioctl.c b/net/atm/ioctl.c index 0b4b07740fe4..e239cebf48da 100644 --- a/net/atm/ioctl.c +++ b/net/atm/ioctl.c @@ -56,6 +56,8 @@ static int do_vcc_ioctl(struct socket *sock, unsigned int cmd, int error; struct list_head *pos; void __user *argp = (void __user *)arg; + void __user *buf; + int __user *len; vcc = ATM_SD(sock); switch (cmd) { @@ -163,7 +165,22 @@ static int do_vcc_ioctl(struct socket *sock, unsigned int cmd, goto done; if (cmd == ATM_GETNAMES) { - error = atm_getnames(argp, compat); + if (IS_ENABLED(CONFIG_COMPAT) && compat) { +#ifdef CONFIG_COMPAT + struct compat_atm_iobuf __user *ciobuf = argp; + compat_uptr_t cbuf; + len = &ciobuf->length; + if (get_user(cbuf, &ciobuf->buffer)) + return -EFAULT; + buf = compat_ptr(cbuf); +#endif + } else { + struct atm_iobuf __user *iobuf = argp; + len = &iobuf->length; + if (get_user(buf, &iobuf->buffer)) + return -EFAULT; + } + error = atm_getnames(buf, len); } else { error = atm_dev_ioctl(cmd, argp, compat); } diff --git a/net/atm/resources.c b/net/atm/resources.c index a2ab75929eec..5507cc608969 100644 --- a/net/atm/resources.c +++ b/net/atm/resources.c @@ -193,30 +193,13 @@ static int fetch_stats(struct atm_dev *dev, struct atm_dev_stats __user *arg, return error ? -EFAULT : 0; } -int atm_getnames(void __user *arg, int compat) +int atm_getnames(void __user *buf, int __user *iobuf_len) { - void __user *buf; int error, len, size = 0; struct atm_dev *dev; struct list_head *p; int *tmp_buf, *tmp_p; - int __user *iobuf_len; - if (IS_ENABLED(CONFIG_COMPAT) && compat) { -#ifdef CONFIG_COMPAT - struct compat_atm_iobuf __user *ciobuf = arg; - compat_uptr_t cbuf; - iobuf_len = &ciobuf->length; - if (get_user(cbuf, &ciobuf->buffer)) - return -EFAULT; - buf = compat_ptr(cbuf); -#endif - } else { - struct atm_iobuf __user *iobuf = arg; - iobuf_len = &iobuf->length; - if (get_user(buf, &iobuf->buffer)) - return -EFAULT; - } if (get_user(len, iobuf_len)) return -EFAULT; mutex_lock(&atm_dev_mutex); diff --git a/net/atm/resources.h b/net/atm/resources.h index 18f8e5948ce4..5e2c68d37d63 100644 --- a/net/atm/resources.h +++ b/net/atm/resources.h @@ -14,7 +14,7 @@ extern struct list_head atm_devs; extern struct mutex atm_dev_mutex; -int atm_getnames(void __user *arg, int compat); +int atm_getnames(void __user *buf, int __user *iobuf_len); int atm_dev_ioctl(unsigned int cmd, void __user *arg, int compat); -- 2.11.0 ^ permalink raw reply related [flat|nested] 42+ messages in thread
* [PATCH net-next 17/19] atm: switch do_atm_iobuf() to direct use of atm_getnames() 2020-05-21 0:37 ` [PATCH net-next 01/19] lift compat definitions of mcast [sg]etsockopt requests into net/compat.h Al Viro ` (14 preceding siblings ...) 2020-05-21 0:37 ` [PATCH net-next 16/19] atm: move copyin from atm_getnames() into the caller Al Viro @ 2020-05-21 0:37 ` Al Viro 2020-05-21 0:37 ` [PATCH net-next 18/19] atm: lift copyin from atm_dev_ioctl() Al Viro 2020-05-21 0:37 ` [PATCH net-next 19/19] atm: switch do_atmif_sioc() to direct use of atm_dev_ioctl() Al Viro 17 siblings, 0 replies; 42+ messages in thread From: Al Viro @ 2020-05-21 0:37 UTC (permalink / raw) To: netdev; +Cc: davem, viro, linux-kernel From: Al Viro <viro@zeniv.linux.org.uk> ... and sod the compat_alloc_user_space() with its complications Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> --- net/atm/ioctl.c | 25 +++---------------------- 1 file changed, 3 insertions(+), 22 deletions(-) diff --git a/net/atm/ioctl.c b/net/atm/ioctl.c index e239cebf48da..fdd0e3434523 100644 --- a/net/atm/ioctl.c +++ b/net/atm/ioctl.c @@ -251,32 +251,13 @@ static struct { static int do_atm_iobuf(struct socket *sock, unsigned int cmd, unsigned long arg) { - struct atm_iobuf __user *iobuf; - struct compat_atm_iobuf __user *iobuf32; + struct compat_atm_iobuf __user *iobuf32 = compat_ptr(arg); u32 data; - void __user *datap; - int len, err; - - iobuf = compat_alloc_user_space(sizeof(*iobuf)); - iobuf32 = compat_ptr(arg); - if (get_user(len, &iobuf32->length) || - get_user(data, &iobuf32->buffer)) - return -EFAULT; - datap = compat_ptr(data); - if (put_user(len, &iobuf->length) || - put_user(datap, &iobuf->buffer)) + if (get_user(data, &iobuf32->buffer)) return -EFAULT; - err = do_vcc_ioctl(sock, cmd, (unsigned long) iobuf, 0); - - if (!err) { - if (copy_in_user(&iobuf32->length, &iobuf->length, - sizeof(int))) - err = -EFAULT; - } - - return err; + return atm_getnames(&iobuf32->length, compat_ptr(data)); } static int do_atmif_sioc(struct socket *sock, unsigned int cmd, -- 2.11.0 ^ permalink raw reply related [flat|nested] 42+ messages in thread
* [PATCH net-next 18/19] atm: lift copyin from atm_dev_ioctl() 2020-05-21 0:37 ` [PATCH net-next 01/19] lift compat definitions of mcast [sg]etsockopt requests into net/compat.h Al Viro ` (15 preceding siblings ...) 2020-05-21 0:37 ` [PATCH net-next 17/19] atm: switch do_atm_iobuf() to direct use of atm_getnames() Al Viro @ 2020-05-21 0:37 ` Al Viro 2020-05-21 0:37 ` [PATCH net-next 19/19] atm: switch do_atmif_sioc() to direct use of atm_dev_ioctl() Al Viro 17 siblings, 0 replies; 42+ messages in thread From: Al Viro @ 2020-05-21 0:37 UTC (permalink / raw) To: netdev; +Cc: davem, viro, linux-kernel From: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> --- net/atm/ioctl.c | 25 ++++++++++++++++++++++++- net/atm/resources.c | 35 +++++------------------------------ net/atm/resources.h | 4 ++-- 3 files changed, 31 insertions(+), 33 deletions(-) diff --git a/net/atm/ioctl.c b/net/atm/ioctl.c index fdd0e3434523..52f2c77e656f 100644 --- a/net/atm/ioctl.c +++ b/net/atm/ioctl.c @@ -182,7 +182,30 @@ static int do_vcc_ioctl(struct socket *sock, unsigned int cmd, } error = atm_getnames(buf, len); } else { - error = atm_dev_ioctl(cmd, argp, compat); + int number; + + if (IS_ENABLED(CONFIG_COMPAT) && compat) { +#ifdef CONFIG_COMPAT + struct compat_atmif_sioc __user *csioc = argp; + compat_uptr_t carg; + + len = &csioc->length; + if (get_user(carg, &csioc->arg)) + return -EFAULT; + buf = compat_ptr(carg); + if (get_user(number, &csioc->number)) + return -EFAULT; +#endif + } else { + struct atmif_sioc __user *sioc = argp; + + len = &sioc->length; + if (get_user(buf, &sioc->arg)) + return -EFAULT; + if (get_user(number, &sioc->number)) + return -EFAULT; + } + error = atm_dev_ioctl(cmd, buf, len, number, compat); } done: diff --git a/net/atm/resources.c b/net/atm/resources.c index 5507cc608969..94bdc6527ee8 100644 --- a/net/atm/resources.c +++ b/net/atm/resources.c @@ -227,39 +227,14 @@ int atm_getnames(void __user *buf, int __user *iobuf_len) return error; } -int atm_dev_ioctl(unsigned int cmd, void __user *arg, int compat) +int atm_dev_ioctl(unsigned int cmd, void __user *buf, int __user *sioc_len, + int number, int compat) { - void __user *buf; - int error, len, number, size = 0; + int error, len, size = 0; struct atm_dev *dev; - int __user *sioc_len; - if (IS_ENABLED(CONFIG_COMPAT) && compat) { -#ifdef CONFIG_COMPAT - struct compat_atmif_sioc __user *csioc = arg; - compat_uptr_t carg; - - sioc_len = &csioc->length; - if (get_user(carg, &csioc->arg)) - return -EFAULT; - buf = compat_ptr(carg); - - if (get_user(len, &csioc->length)) - return -EFAULT; - if (get_user(number, &csioc->number)) - return -EFAULT; -#endif - } else { - struct atmif_sioc __user *sioc = arg; - - sioc_len = &sioc->length; - if (get_user(buf, &sioc->arg)) - return -EFAULT; - if (get_user(len, &sioc->length)) - return -EFAULT; - if (get_user(number, &sioc->number)) - return -EFAULT; - } + if (get_user(len, sioc_len)) + return -EFAULT; dev = try_then_request_module(atm_dev_lookup(number), "atm-device-%d", number); diff --git a/net/atm/resources.h b/net/atm/resources.h index 5e2c68d37d63..4a0839e92ff3 100644 --- a/net/atm/resources.h +++ b/net/atm/resources.h @@ -15,8 +15,8 @@ extern struct list_head atm_devs; extern struct mutex atm_dev_mutex; int atm_getnames(void __user *buf, int __user *iobuf_len); -int atm_dev_ioctl(unsigned int cmd, void __user *arg, int compat); - +int atm_dev_ioctl(unsigned int cmd, void __user *buf, int __user *sioc_len, + int number, int compat); #ifdef CONFIG_PROC_FS -- 2.11.0 ^ permalink raw reply related [flat|nested] 42+ messages in thread
* [PATCH net-next 19/19] atm: switch do_atmif_sioc() to direct use of atm_dev_ioctl() 2020-05-21 0:37 ` [PATCH net-next 01/19] lift compat definitions of mcast [sg]etsockopt requests into net/compat.h Al Viro ` (16 preceding siblings ...) 2020-05-21 0:37 ` [PATCH net-next 18/19] atm: lift copyin from atm_dev_ioctl() Al Viro @ 2020-05-21 0:37 ` Al Viro 17 siblings, 0 replies; 42+ messages in thread From: Al Viro @ 2020-05-21 0:37 UTC (permalink / raw) To: netdev; +Cc: davem, viro, linux-kernel From: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> --- net/atm/ioctl.c | 25 ++++--------------------- 1 file changed, 4 insertions(+), 21 deletions(-) diff --git a/net/atm/ioctl.c b/net/atm/ioctl.c index 52f2c77e656f..838ebf0cabbf 100644 --- a/net/atm/ioctl.c +++ b/net/atm/ioctl.c @@ -286,30 +286,13 @@ static int do_atm_iobuf(struct socket *sock, unsigned int cmd, static int do_atmif_sioc(struct socket *sock, unsigned int cmd, unsigned long arg) { - struct atmif_sioc __user *sioc; - struct compat_atmif_sioc __user *sioc32; + struct compat_atmif_sioc __user *sioc32 = compat_ptr(arg); + int number; u32 data; - void __user *datap; - int err; - sioc = compat_alloc_user_space(sizeof(*sioc)); - sioc32 = compat_ptr(arg); - - if (copy_in_user(&sioc->number, &sioc32->number, 2 * sizeof(int)) || - get_user(data, &sioc32->arg)) - return -EFAULT; - datap = compat_ptr(data); - if (put_user(datap, &sioc->arg)) + if (get_user(data, &sioc32->arg) || get_user(number, &sioc32->number)) return -EFAULT; - - err = do_vcc_ioctl(sock, cmd, (unsigned long) sioc, 0); - - if (!err) { - if (copy_in_user(&sioc32->length, &sioc->length, - sizeof(int))) - err = -EFAULT; - } - return err; + return atm_dev_ioctl(cmd, compat_ptr(data), &sioc32->length, number, 0); } static int do_atm_ioctl(struct socket *sock, unsigned int cmd32, -- 2.11.0 ^ permalink raw reply related [flat|nested] 42+ messages in thread
* Re: [RFC][PATCHES] uaccess-related stuff in net/* 2020-05-21 0:36 ` Al Viro 2020-05-21 0:37 ` [PATCH net-next 01/19] lift compat definitions of mcast [sg]etsockopt requests into net/compat.h Al Viro @ 2020-05-21 2:24 ` David Miller 1 sibling, 0 replies; 42+ messages in thread From: David Miller @ 2020-05-21 2:24 UTC (permalink / raw) To: viro; +Cc: netdev, linux-kernel From: Al Viro <viro@zeniv.linux.org.uk> Date: Thu, 21 May 2020 01:36:57 +0100 > On Mon, May 11, 2020 at 05:02:51PM -0700, David Miller wrote: >> From: Al Viro <viro@zeniv.linux.org.uk> >> Date: Mon, 11 May 2020 05:43:28 +0100 >> >> > Assorted uaccess-related work in net/*. First, there's >> > getting rid of compat_alloc_user_space() mess in MCAST_... >> > [gs]etsockopt() - no need to play with copying to/from temporary >> > object on userland stack, etc., when ->compat_[sg]etsockopt() >> > instances in question can easly do everything without that. >> > That's the first 13 patches. Then there's a trivial bit in >> > net/batman-adv (completely unrelated to everything else) and >> > finally getting the atm compat ioctls into simpler shape. >> > >> > Please, review and comment. Individual patches in followups, >> > the entire branch (on top of current net/master) is in >> > git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git #uaccess.net >> >> I have no problems with this series: >> >> Acked-by: David S. Miller <davem@davemloft.net> > > OK, rebased on top of current net/master (no conflicts) and pushed out > to the same branch. Patches (for net-next) in followups Looks good, pulled into net-next. ^ permalink raw reply [flat|nested] 42+ messages in thread
end of thread, other threads:[~2020-05-21 2:25 UTC | newest]
Thread overview: 42+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-05-11 4:43 [RFC][PATCHES] uaccess-related stuff in net/* Al Viro
2020-05-11 4:45 ` [PATCH 01/19] lift compat definitions of mcast [sg]etsockopt requests into net/compat.h Al Viro
2020-05-11 4:45 ` [PATCH 02/19] compat_ip{,v6}_setsockopt(): enumerate MCAST_... options explicitly Al Viro
2020-05-11 4:45 ` [PATCH 03/19] ip*_mc_gsfget(): lift copyout of struct group_filter into callers Al Viro
2020-05-11 4:45 ` [PATCH 04/19] get rid of compat_mc_getsockopt() Al Viro
2020-05-11 4:45 ` [PATCH 05/19] set_mcast_msfilter(): take the guts of setsockopt(MCAST_MSFILTER) into a helper Al Viro
2020-05-11 4:45 ` [PATCH 06/19] ipv4: do compat setsockopt for MCAST_MSFILTER directly Al Viro
2020-05-11 4:45 ` [PATCH 07/19] ip6_mc_msfilter(): pass the address list separately Al Viro
2020-05-11 4:45 ` [PATCH 08/19] ipv6: do compat setsockopt for MCAST_MSFILTER directly Al Viro
2020-05-11 4:45 ` [PATCH 09/19] ipv[46]: do compat setsockopt for MCAST_{JOIN,LEAVE}_GROUP directly Al Viro
2020-05-11 4:45 ` [PATCH 10/19] ipv4: take handling of group_source_req options into a helper Al Viro
2020-05-11 4:45 ` [PATCH 11/19] ipv6: " Al Viro
2020-05-11 4:45 ` [PATCH 12/19] handle the group_source_req options directly Al Viro
2020-05-11 4:45 ` [PATCH 13/19] get rid of compat_mc_setsockopt() Al Viro
2020-05-11 4:45 ` [PATCH 14/19] batadv_socket_read(): get rid of pointless access_ok() Al Viro
2020-05-11 4:45 ` [PATCH 15/19] atm: separate ATM_GETNAMES handling from the rest of atm_dev_ioctl() Al Viro
2020-05-11 4:45 ` [PATCH 16/19] atm: move copyin from atm_getnames() into the caller Al Viro
2020-05-11 4:45 ` [PATCH 17/19] atm: switch do_atm_iobuf() to direct use of atm_getnames() Al Viro
2020-05-11 4:45 ` [PATCH 18/19] atm: lift copyin from atm_dev_ioctl() Al Viro
2020-05-11 4:45 ` [PATCH 19/19] atm: switch do_atmif_sioc() to direct use of atm_dev_ioctl() Al Viro
2020-05-12 0:02 ` [RFC][PATCHES] uaccess-related stuff in net/* David Miller
2020-05-21 0:36 ` Al Viro
2020-05-21 0:37 ` [PATCH net-next 01/19] lift compat definitions of mcast [sg]etsockopt requests into net/compat.h Al Viro
2020-05-21 0:37 ` [PATCH net-next 02/19] compat_ip{,v6}_setsockopt(): enumerate MCAST_... options explicitly Al Viro
2020-05-21 0:37 ` [PATCH net-next 03/19] ip*_mc_gsfget(): lift copyout of struct group_filter into callers Al Viro
2020-05-21 0:37 ` [PATCH net-next 04/19] get rid of compat_mc_getsockopt() Al Viro
2020-05-21 0:37 ` [PATCH net-next 05/19] set_mcast_msfilter(): take the guts of setsockopt(MCAST_MSFILTER) into a helper Al Viro
2020-05-21 0:37 ` [PATCH net-next 06/19] ipv4: do compat setsockopt for MCAST_MSFILTER directly Al Viro
2020-05-21 0:37 ` [PATCH net-next 07/19] ip6_mc_msfilter(): pass the address list separately Al Viro
2020-05-21 0:37 ` [PATCH net-next 08/19] ipv6: do compat setsockopt for MCAST_MSFILTER directly Al Viro
2020-05-21 0:37 ` [PATCH net-next 09/19] ipv[46]: do compat setsockopt for MCAST_{JOIN,LEAVE}_GROUP directly Al Viro
2020-05-21 0:37 ` [PATCH net-next 10/19] ipv4: take handling of group_source_req options into a helper Al Viro
2020-05-21 0:37 ` [PATCH net-next 11/19] ipv6: " Al Viro
2020-05-21 0:37 ` [PATCH net-next 12/19] handle the group_source_req options directly Al Viro
2020-05-21 0:37 ` [PATCH net-next 13/19] get rid of compat_mc_setsockopt() Al Viro
2020-05-21 0:37 ` [PATCH net-next 14/19] batadv_socket_read(): get rid of pointless access_ok() Al Viro
2020-05-21 0:37 ` [PATCH net-next 15/19] atm: separate ATM_GETNAMES handling from the rest of atm_dev_ioctl() Al Viro
2020-05-21 0:37 ` [PATCH net-next 16/19] atm: move copyin from atm_getnames() into the caller Al Viro
2020-05-21 0:37 ` [PATCH net-next 17/19] atm: switch do_atm_iobuf() to direct use of atm_getnames() Al Viro
2020-05-21 0:37 ` [PATCH net-next 18/19] atm: lift copyin from atm_dev_ioctl() Al Viro
2020-05-21 0:37 ` [PATCH net-next 19/19] atm: switch do_atmif_sioc() to direct use of atm_dev_ioctl() Al Viro
2020-05-21 2:24 ` [RFC][PATCHES] uaccess-related stuff in net/* David Miller
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).