Commit 0003041e authored by David S. Miller's avatar David S. Miller

Merge branch 'sockptr_t-fixes-v2'

Christoph Hellwig says:

====================
sockptr_t fixes v2

a bunch of fixes for the sockptr_t conversion

Changes since v1:
 - fix a user pointer dereference braino in bpfilter
====================
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 21db923e a31edb20
......@@ -525,9 +525,9 @@ static int do_chtls_setsockopt(struct sock *sk, int optname,
/* Obtain version and type from previous copy */
crypto_info[0] = tmp_crypto_info;
/* Now copy the following data */
sockptr_advance(optval, sizeof(*crypto_info));
rc = copy_from_sockptr((char *)crypto_info + sizeof(*crypto_info),
optval,
rc = copy_from_sockptr_offset((char *)crypto_info +
sizeof(*crypto_info),
optval, sizeof(*crypto_info),
sizeof(struct tls12_crypto_info_aes_gcm_128)
- sizeof(*crypto_info));
......@@ -542,9 +542,9 @@ static int do_chtls_setsockopt(struct sock *sk, int optname,
}
case TLS_CIPHER_AES_GCM_256: {
crypto_info[0] = tmp_crypto_info;
sockptr_advance(optval, sizeof(*crypto_info));
rc = copy_from_sockptr((char *)crypto_info + sizeof(*crypto_info),
optval,
rc = copy_from_sockptr_offset((char *)crypto_info +
sizeof(*crypto_info),
optval, sizeof(*crypto_info),
sizeof(struct tls12_crypto_info_aes_gcm_256)
- sizeof(*crypto_info));
......
......@@ -27,14 +27,6 @@ static inline sockptr_t KERNEL_SOCKPTR(void *p)
{
return (sockptr_t) { .kernel = p };
}
static inline int __must_check init_user_sockptr(sockptr_t *sp, void __user *p)
{
if ((unsigned long)p >= TASK_SIZE)
return -EFAULT;
sp->user = p;
return 0;
}
#else /* CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE */
typedef struct {
union {
......@@ -53,33 +45,44 @@ static inline sockptr_t KERNEL_SOCKPTR(void *p)
{
return (sockptr_t) { .kernel = p, .is_kernel = true };
}
#endif /* CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE */
static inline int __must_check init_user_sockptr(sockptr_t *sp, void __user *p)
static inline int __must_check init_user_sockptr(sockptr_t *sp, void __user *p,
size_t size)
{
sp->user = p;
sp->is_kernel = false;
if (!access_ok(p, size))
return -EFAULT;
*sp = (sockptr_t) { .user = p };
return 0;
}
#endif /* CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE */
static inline bool sockptr_is_null(sockptr_t sockptr)
{
return !sockptr.user && !sockptr.kernel;
if (sockptr_is_kernel(sockptr))
return !sockptr.kernel;
return !sockptr.user;
}
static inline int copy_from_sockptr(void *dst, sockptr_t src, size_t size)
static inline int copy_from_sockptr_offset(void *dst, sockptr_t src,
size_t offset, size_t size)
{
if (!sockptr_is_kernel(src))
return copy_from_user(dst, src.user, size);
memcpy(dst, src.kernel, size);
return copy_from_user(dst, src.user + offset, size);
memcpy(dst, src.kernel + offset, size);
return 0;
}
static inline int copy_to_sockptr(sockptr_t dst, const void *src, size_t size)
static inline int copy_from_sockptr(void *dst, sockptr_t src, size_t size)
{
return copy_from_sockptr_offset(dst, src, 0, size);
}
static inline int copy_to_sockptr_offset(sockptr_t dst, size_t offset,
const void *src, size_t size)
{
if (!sockptr_is_kernel(dst))
return copy_to_user(dst.user, src, size);
memcpy(dst.kernel, src, size);
return copy_to_user(dst.user + offset, src, size);
memcpy(dst.kernel + offset, src, size);
return 0;
}
......@@ -110,14 +113,6 @@ static inline void *memdup_sockptr_nul(sockptr_t src, size_t len)
return p;
}
static inline void sockptr_advance(sockptr_t sockptr, size_t len)
{
if (sockptr_is_kernel(sockptr))
sockptr.kernel += len;
else
sockptr.user += len;
}
static inline long strncpy_from_sockptr(char *dst, sockptr_t src, size_t count)
{
if (sockptr_is_kernel(src)) {
......
......@@ -426,9 +426,8 @@ static int dccp_setsockopt_service(struct sock *sk, const __be32 service,
return -ENOMEM;
sl->dccpsl_nr = optlen / sizeof(u32) - 1;
sockptr_advance(optval, sizeof(service));
if (copy_from_sockptr(sl->dccpsl_list, optval,
optlen - sizeof(service)) ||
if (copy_from_sockptr_offset(sl->dccpsl_list, optval,
sizeof(service), optlen - sizeof(service)) ||
dccp_list_has_service(sl, DCCP_SERVICE_INVALID_VALUE)) {
kfree(sl);
return -EFAULT;
......
......@@ -65,7 +65,7 @@ int bpfilter_ip_get_sockopt(struct sock *sk, int optname,
if (get_user(len, optlen))
return -EFAULT;
err = init_user_sockptr(&optval, user_optval);
err = init_user_sockptr(&optval, user_optval, len);
if (err)
return err;
return bpfilter_mbox_request(sk, optname, optval, len, false);
......
// SPDX-License-Identifier: GPL-2.0-only
/*
* Packet matching code for ARP packets.
*
......@@ -971,8 +971,8 @@ static int do_replace(struct net *net, sockptr_t arg, unsigned int len)
return -ENOMEM;
loc_cpu_entry = newinfo->entries;
sockptr_advance(arg, sizeof(tmp));
if (copy_from_sockptr(loc_cpu_entry, arg, tmp.size) != 0) {
if (copy_from_sockptr_offset(loc_cpu_entry, arg, sizeof(tmp),
tmp.size) != 0) {
ret = -EFAULT;
goto free_newinfo;
}
......@@ -1267,8 +1267,8 @@ static int compat_do_replace(struct net *net, sockptr_t arg, unsigned int len)
return -ENOMEM;
loc_cpu_entry = newinfo->entries;
sockptr_advance(arg, sizeof(tmp));
if (copy_from_sockptr(loc_cpu_entry, arg, tmp.size) != 0) {
if (copy_from_sockptr_offset(loc_cpu_entry, arg, sizeof(tmp),
tmp.size) != 0) {
ret = -EFAULT;
goto free_newinfo;
}
......
......@@ -1126,8 +1126,8 @@ do_replace(struct net *net, sockptr_t arg, unsigned int len)
return -ENOMEM;
loc_cpu_entry = newinfo->entries;
sockptr_advance(arg, sizeof(tmp));
if (copy_from_sockptr(loc_cpu_entry, arg, tmp.size) != 0) {
if (copy_from_sockptr_offset(loc_cpu_entry, arg, sizeof(tmp),
tmp.size) != 0) {
ret = -EFAULT;
goto free_newinfo;
}
......@@ -1508,8 +1508,8 @@ compat_do_replace(struct net *net, sockptr_t arg, unsigned int len)
return -ENOMEM;
loc_cpu_entry = newinfo->entries;
sockptr_advance(arg, sizeof(tmp));
if (copy_from_sockptr(loc_cpu_entry, arg, tmp.size) != 0) {
if (copy_from_sockptr_offset(loc_cpu_entry, arg, sizeof(tmp),
tmp.size) != 0) {
ret = -EFAULT;
goto free_newinfo;
}
......
......@@ -2801,12 +2801,13 @@ static int tcp_repair_options_est(struct sock *sk, sockptr_t optbuf,
{
struct tcp_sock *tp = tcp_sk(sk);
struct tcp_repair_opt opt;
size_t offset = 0;
while (len >= sizeof(opt)) {
if (copy_from_sockptr(&opt, optbuf, sizeof(opt)))
if (copy_from_sockptr_offset(&opt, optbuf, offset, sizeof(opt)))
return -EFAULT;
sockptr_advance(optbuf, sizeof(opt));
offset += sizeof(opt);
len -= sizeof(opt);
switch (opt.opt_code) {
......
......@@ -401,8 +401,8 @@ fl_create(struct net *net, struct sock *sk, struct in6_flowlabel_req *freq,
memset(fl->opt, 0, sizeof(*fl->opt));
fl->opt->tot_len = sizeof(*fl->opt) + olen;
err = -EFAULT;
sockptr_advance(optval, CMSG_ALIGN(sizeof(*freq)));
if (copy_from_sockptr(fl->opt + 1, optval, olen))
if (copy_from_sockptr_offset(fl->opt + 1, optval,
CMSG_ALIGN(sizeof(*freq)), olen))
goto done;
msg.msg_controllen = olen;
......@@ -703,9 +703,10 @@ static int ipv6_flowlabel_get(struct sock *sk, struct in6_flowlabel_req *freq,
goto recheck;
if (!freq->flr_label) {
sockptr_advance(optval,
offsetof(struct in6_flowlabel_req, flr_label));
if (copy_to_sockptr(optval, &fl->label, sizeof(fl->label))) {
size_t offset = offsetof(struct in6_flowlabel_req, flr_label);
if (copy_to_sockptr_offset(optval, offset, &fl->label,
sizeof(fl->label))) {
/* Intentionally ignore fault. */
}
}
......
......@@ -1143,8 +1143,8 @@ do_replace(struct net *net, sockptr_t arg, unsigned int len)
return -ENOMEM;
loc_cpu_entry = newinfo->entries;
sockptr_advance(arg, sizeof(tmp));
if (copy_from_sockptr(loc_cpu_entry, arg, tmp.size) != 0) {
if (copy_from_sockptr_offset(loc_cpu_entry, arg, sizeof(tmp),
tmp.size) != 0) {
ret = -EFAULT;
goto free_newinfo;
}
......@@ -1517,8 +1517,8 @@ compat_do_replace(struct net *net, sockptr_t arg, unsigned int len)
return -ENOMEM;
loc_cpu_entry = newinfo->entries;
sockptr_advance(arg, sizeof(tmp));
if (copy_from_sockptr(loc_cpu_entry, arg, tmp.size) != 0) {
if (copy_from_sockptr_offset(loc_cpu_entry, arg, sizeof(tmp),
tmp.size) != 0) {
ret = -EFAULT;
goto free_newinfo;
}
......
......@@ -1050,6 +1050,7 @@ EXPORT_SYMBOL_GPL(xt_check_target);
void *xt_copy_counters(sockptr_t arg, unsigned int len,
struct xt_counters_info *info)
{
size_t offset;
void *mem;
u64 size;
......@@ -1067,7 +1068,7 @@ void *xt_copy_counters(sockptr_t arg, unsigned int len,
memcpy(info->name, compat_tmp.name, sizeof(info->name) - 1);
info->num_counters = compat_tmp.num_counters;
sockptr_advance(arg, sizeof(compat_tmp));
offset = sizeof(compat_tmp);
} else
#endif
{
......@@ -1078,7 +1079,7 @@ void *xt_copy_counters(sockptr_t arg, unsigned int len,
if (copy_from_sockptr(info, arg, sizeof(*info)) != 0)
return ERR_PTR(-EFAULT);
sockptr_advance(arg, sizeof(*info));
offset = sizeof(*info);
}
info->name[sizeof(info->name) - 1] = '\0';
......@@ -1092,7 +1093,7 @@ void *xt_copy_counters(sockptr_t arg, unsigned int len,
if (!mem)
return ERR_PTR(-ENOMEM);
if (copy_from_sockptr(mem, arg, len) == 0)
if (copy_from_sockptr_offset(mem, arg, offset, len) == 0)
return mem;
vfree(mem);
......
......@@ -2105,7 +2105,7 @@ int __sys_setsockopt(int fd, int level, int optname, char __user *user_optval,
if (optlen < 0)
return -EINVAL;
err = init_user_sockptr(&optval, user_optval);
err = init_user_sockptr(&optval, user_optval, optlen);
if (err)
return err;
......
......@@ -522,8 +522,8 @@ static int do_tls_setsockopt_conf(struct sock *sk, sockptr_t optval,
goto err_crypto_info;
}
sockptr_advance(optval, sizeof(*crypto_info));
rc = copy_from_sockptr(crypto_info + 1, optval,
rc = copy_from_sockptr_offset(crypto_info + 1, optval,
sizeof(*crypto_info),
optlen - sizeof(*crypto_info));
if (rc) {
rc = -EFAULT;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment