xfs
[Top] [All Lists]

[patch 02/11] Fix the compat XFS_IOC_FSGEOMETRY_V1 ioctl

To: xfs@xxxxxxxxxxx
Subject: [patch 02/11] Fix the compat XFS_IOC_FSGEOMETRY_V1 ioctl
From: sandeen@xxxxxxxxxxx
Date: Tue, 18 Nov 2008 22:44:03 -0600
Cc: hch@xxxxxxxxxxxxx, david@xxxxxxxxxxxxx
References: <20081119044401.573365619@xxxxxxxxxxx>
User-agent: quilt/0.46-1
This ioctl copies kernel data to the user, so we
must have a compat helper to copy it out to the
32-bit structure; the current code had it backward,
and translated the 32-bit arg to 64-bit, and called
the native ioctl, which copied it back as if it were
talking to 64-bit userspace.  Because the 64-bit arg
has padding on the end on intel, I think this risked
corruption in userspace..

Signed-off-by: Eric Sandeen <sandeen@xxxxxxxxxxx>
--

Index: linux-2.6-xfs/fs/xfs/linux-2.6/xfs_ioctl32.c
===================================================================
--- linux-2.6-xfs.orig/fs/xfs/linux-2.6/xfs_ioctl32.c
+++ linux-2.6-xfs/fs/xfs/linux-2.6/xfs_ioctl32.c
@@ -44,6 +44,7 @@
 #include "xfs_error.h"
 #include "xfs_dfrag.h"
 #include "xfs_vnodeops.h"
+#include "xfs_fsops.h"
 #include "xfs_ioctl32.h"
 
 #define  _NATIVE_IOC(cmd, type) \
@@ -68,15 +69,22 @@ xfs_ioctl32_flock_copyin(unsigned long a
        return (unsigned long)p;
 }
 
-STATIC unsigned long
-xfs_ioctl32_geom_v1_copyin(unsigned long arg)
+/* This handles a copy-out, where the 32-bit user struct lacks padding */
+STATIC int
+xfs_ioc_fsgeometry_v1_compat(
+       xfs_mount_t             *mp,
+       void                    __user *arg)
 {
-       compat_xfs_fsop_geom_v1_t __user *p32 = (void __user *)arg;
-       xfs_fsop_geom_v1_t __user *p = compat_alloc_user_space(sizeof(*p));
+       xfs_fsop_geom_v1_t      fsgeo;
+       int                     error;
 
-       if (copy_in_user(p, p32, sizeof(*p32)))
+       error = xfs_fs_geometry(mp, (xfs_fsop_geom_t *)&fsgeo, 3);
+       if (error)
+               return -error;
+
+       if (copy_to_user(arg, &fsgeo, sizeof(struct compat_xfs_fsop_geom_v1)))
                return -XFS_ERROR(EFAULT);
-       return (unsigned long)p;
+       return 0;
 }
 
 STATIC int
@@ -300,9 +308,8 @@ xfs_compat_ioctl(
                cmd = _NATIVE_IOC(cmd, struct xfs_flock64);
                break;
        case XFS_IOC_FSGEOMETRY_V1_32:
-               arg = xfs_ioctl32_geom_v1_copyin(arg);
-               cmd = _NATIVE_IOC(cmd, struct xfs_fsop_geom_v1);
-               break;
+               return xfs_ioc_fsgeometry_v1_compat(XFS_I(inode)->i_mount,
+                                                   (void __user*)arg);
 
 #else /* These are handled fine if no alignment issues */
        case XFS_IOC_ALLOCSP:

-- 

<Prev in Thread] Current Thread [Next in Thread>