This ioctl copies kernel data to the user, so we
must have a compat helper to copy it out to the
32-bit structure; the current code had it backward,
and translated the 32-bit arg to 64-bit, and called
the native ioctl, which copied it back as if it were
talking to 64-bit userspace. Because the 64-bit arg
has padding on the end on intel, I think this risked
corruption in userspace..
Signed-off-by: Eric Sandeen <sandeen@xxxxxxxxxxx>
--
Index: linux-2.6-xfs/fs/xfs/linux-2.6/xfs_ioctl32.c
===================================================================
--- linux-2.6-xfs.orig/fs/xfs/linux-2.6/xfs_ioctl32.c
+++ linux-2.6-xfs/fs/xfs/linux-2.6/xfs_ioctl32.c
@@ -44,6 +44,7 @@
#include "xfs_error.h"
#include "xfs_dfrag.h"
#include "xfs_vnodeops.h"
+#include "xfs_fsops.h"
#include "xfs_ioctl32.h"
#define _NATIVE_IOC(cmd, type) \
@@ -68,15 +69,22 @@ xfs_ioctl32_flock_copyin(unsigned long a
return (unsigned long)p;
}
-STATIC unsigned long
-xfs_ioctl32_geom_v1_copyin(unsigned long arg)
+/* This handles a copy-out, where the 32-bit user struct lacks padding */
+STATIC int
+xfs_ioc_fsgeometry_v1_compat(
+ xfs_mount_t *mp,
+ void __user *arg)
{
- compat_xfs_fsop_geom_v1_t __user *p32 = (void __user *)arg;
- xfs_fsop_geom_v1_t __user *p = compat_alloc_user_space(sizeof(*p));
+ xfs_fsop_geom_v1_t fsgeo;
+ int error;
- if (copy_in_user(p, p32, sizeof(*p32)))
+ error = xfs_fs_geometry(mp, (xfs_fsop_geom_t *)&fsgeo, 3);
+ if (error)
+ return -error;
+
+ if (copy_to_user(arg, &fsgeo, sizeof(struct compat_xfs_fsop_geom_v1)))
return -XFS_ERROR(EFAULT);
- return (unsigned long)p;
+ return 0;
}
STATIC int
@@ -300,9 +308,8 @@ xfs_compat_ioctl(
cmd = _NATIVE_IOC(cmd, struct xfs_flock64);
break;
case XFS_IOC_FSGEOMETRY_V1_32:
- arg = xfs_ioctl32_geom_v1_copyin(arg);
- cmd = _NATIVE_IOC(cmd, struct xfs_fsop_geom_v1);
- break;
+ return xfs_ioc_fsgeometry_v1_compat(XFS_I(inode)->i_mount,
+ (void __user*)arg);
#else /* These are handled fine if no alignment issues */
case XFS_IOC_ALLOCSP:
--
|