From: Johannes Berg <johannes@sipsolutions.net>
To: Al Viro <viro@zeniv.linux.org.uk>
Cc: netdev@vger.kernel.org, Robert O'Callahan <robert@ocallahan.org>
Subject: Re: [PATCH net 2/4] Revert "kill dev_ifsioc()"
Date: Sat, 26 Jan 2019 19:53:21 +0100 [thread overview]
Message-ID: <f0b002c6bd103a7af06cbf606aa71e73bf222e0f.camel@sipsolutions.net> (raw)
In-Reply-To: <5812aacf62c99fcf98da7d4fc7eaa0ef9cd6afa1.camel@sipsolutions.net>
On Sat, 2019-01-26 at 18:49 +0100, Johannes Berg wrote:
> On Sat, 2019-01-26 at 18:45 +0100, Johannes Berg wrote:
> >
> > Yes and no. It *sometimes* (actually rarely, since we don't really have
> > dev_ioctls that much, afaict) hits this, but it could also just hit
>
> Actually, no, I'm wrong. We do mostly hit dev_ioctl(), since that's the
> common case for things like SIOCGIFNAME.
>
> However, e.g. for SIOCGIFADDR we do go into
>
> > static long sock_do_ioctl(struct net *net, struct socket *sock,
> > unsigned int cmd, unsigned long arg)
> > {
> > [...]
> > err = sock->ops->ioctl(sock, cmd, arg);
> > [...]
> > if (err != -ENOIOCTLCMD)
> > return err;
>
> This, and like I said, plumbing the whole compat stuff through to the
> sock->ops->ioctl() there doesn't seem like a great idea.
So - discussing this further on IRC I thought we could get away with
making struct ifreq just not include the members that are too big
(ifr_map and ifr_settings), but that's also a non-starter because we
need to copy.
Al also points out that all of these reverts break decnet, because that
does some really messy things in dn_dev_ioctl(). Turns out though that
on 64-bit decnet is already broken anyway, because DN_IFREQ_SIZE is
actually wrong. It should presumably be equivalent to something like
struct ifreq_dn {
char ifrn_name[IFNAMSIZ];
struct sockaddr_dn ifru_dnaddr;
};
but in fact *isn't* because
#define DN_IFREQ_SIZE (sizeof(struct ifreq) - sizeof(struct sockaddr) + sizeof(struct sockaddr_dn))
wouldn't be sizeof(struct ifreq_dn), because in this expression
"sizeof(struct ifreq) - sizeof(struct sockaddr)" isn't the same as
"offsetof(struct ifreq, ifr_ifru)" which would be the right thing.
So with these patches we go back to the original state before Al's
patches, but that does mean:
* decnet doesn't work right on 64-bit (kernel & userland) because it
will attempt to copy a bigger buffer than the user would presumably
be expected to provide a struct ifreq_dn like I defined above to
SIOCGIFADDR, and if this is at the end of a page boundary it faults
* 32-bit userland on 64-bit kernel is completely broken here for decnet
ioctls because we copy too little data (struct ifreq, while struct
ifreq_dn is bigger)
The first of these isn't that hard to fix, just fix the DN_IFREQ_SIZE.
The second one I don't see a good way to fix at all.
johannes
next prev parent reply other threads:[~2019-01-26 18:53 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-01-25 21:43 [PATCH net 0/4] various compat ioctl fixes Johannes Berg
2019-01-25 21:43 ` [PATCH net 1/4] Revert "socket: fix struct ifreq size in compat ioctl" Johannes Berg
2019-01-25 21:43 ` [PATCH net 2/4] Revert "kill dev_ifsioc()" Johannes Berg
2019-01-26 17:29 ` Al Viro
2019-01-26 17:45 ` Johannes Berg
2019-01-26 17:49 ` Johannes Berg
2019-01-26 18:53 ` Johannes Berg [this message]
2019-01-25 21:43 ` [PATCH net 3/4] net: socket: fix SIOCGIFNAME in compat Johannes Berg
2019-01-25 21:43 ` [PATCH net 4/4] net: socket: make bond ioctls go through compat_ifreq_ioctl() Johannes Berg
2019-01-28 19:22 ` [PATCH net 0/4] various compat ioctl fixes David Miller
2019-01-28 21:32 ` Johannes Berg
2019-01-30 6:19 ` David Miller
2019-01-30 15:40 ` Al Viro
2019-01-30 18:20 ` David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=f0b002c6bd103a7af06cbf606aa71e73bf222e0f.camel@sipsolutions.net \
--to=johannes@sipsolutions.net \
--cc=netdev@vger.kernel.org \
--cc=robert@ocallahan.org \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).