netdev
[Top] [All Lists]

Re: [PATCH] compat bug in sys_recvmsg, MSG_CMSG_COMPAT check missing

To: "David S. Miller" <davem@xxxxxxxxxx>
Subject: Re: [PATCH] compat bug in sys_recvmsg, MSG_CMSG_COMPAT check missing
From: Andreas Schwab <schwab@xxxxxxx>
Date: Sun, 06 Jun 2004 00:05:58 +0200
Cc: olh@xxxxxxx, linux-kernel@xxxxxxxxxxxxxxx, netdev@xxxxxxxxxxx
In-reply-to: <20040605145333.11c80173.davem@xxxxxxxxxx> (David S. Miller's message of "Sat, 5 Jun 2004 14:53:33 -0700")
References: <20040605204334.GA1134@xxxxxxx> <20040605140153.6c5945a0.davem@xxxxxxxxxx> <20040605140544.0de4034d.davem@xxxxxxxxxx> <jer7st7lam.fsf@xxxxxxxxxxxxx> <20040605143649.3fd6c22b.davem@xxxxxxxxxx> <jen03h7k45.fsf@xxxxxxxxxxxxx> <20040605145333.11c80173.davem@xxxxxxxxxx>
Sender: netdev-bounce@xxxxxxxxxxx
User-agent: Gnus/5.110002 (No Gnus v0.2) Emacs/21.3.50 (gnu/linux)
"David S. Miller" <davem@xxxxxxxxxx> writes:

> On Sat, 05 Jun 2004 23:47:22 +0200
> Andreas Schwab <schwab@xxxxxxx> wrote:
>
>> > Olaf's patch, it said:
>> >
>> > -  if (flags & ~(MSG_PEEK|MSG_DONTWAIT|MSG_TRUNC))
>> > +  if (flags & ~(MSG_PEEK|MSG_DONTWAIT|MSG_TRUNC|MSG_CMSG_COMPAT))
>> 
>> Yes, and where is the problem?
>
> If MSG_CMSG_COMPAT is "ZERO", which it will be if CONFIG_COMPAT is
> not set, then "~0" is all bits, therefore if any bit (even the ones
> we want to accept) is set we will return failure.  The test ends
> up amounting to:
>
>       if (flags & ~0)
>
> which is true if any bit is set, that's not what we want.

Can you say DeMorgan?

> diff -Nru a/include/linux/socket.h b/include/linux/socket.h
> --- a/include/linux/socket.h  2004-06-05 14:53:34 -07:00
> +++ b/include/linux/socket.h  2004-06-05 14:53:34 -07:00
> @@ -241,8 +241,10 @@
>  
>  #if defined(CONFIG_COMPAT)
>  #define MSG_CMSG_COMPAT      0x80000000      /* This message needs 32 bit 
> fixups */
> +#define MSG_FLAGS_USER(X)    ((X) & ~MSG_CMSG_COMPAT)
>  #else
>  #define MSG_CMSG_COMPAT      0               /* We never have 32 bit fixups 
> */
> +#define MSG_FLAGS_USER(X)    (X)
>  #endif
>  
>  
> diff -Nru a/net/appletalk/ddp.c b/net/appletalk/ddp.c
> --- a/net/appletalk/ddp.c     2004-06-05 14:53:35 -07:00
> +++ b/net/appletalk/ddp.c     2004-06-05 14:53:35 -07:00
> @@ -1567,7 +1567,7 @@
>       struct atalk_route *rt;
>       int err;
>  
> -     if (flags & ~MSG_DONTWAIT)
> +     if (MSG_FLAGS_USER(flags) & ~MSG_DONTWAIT)
>               return -EINVAL;
>  
>       if (len > DDP_MAXSZ)

This is exactly equivalent to Olaf's version.

Andreas.

-- 
Andreas Schwab, SuSE Labs, schwab@xxxxxxx
SuSE Linux AG, Maxfeldstraße 5, 90409 Nürnberg, Germany
Key fingerprint = 58CA 54C7 6D53 942B 1756  01D3 44D5 214B 8276 4ED5
"And now for something completely different."


<Prev in Thread] Current Thread [Next in Thread>