linux-kernel - Re: is avoiding compat ioctls possible?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <200910281640.18491.arnd@arndb.de>
Date:	Wed, 28 Oct 2009 16:40:18 +0100
From:	Arnd Bergmann <arndbergmann@...glemail.com>
To:	David Miller <davem@...emloft.net>
Cc:	arndbergmann@...glemail.com, airlied@...ux.ie,
	dri-devel@...ts.sourceforge.net, andi@...stfloor.org,
	linux-kernel@...r.kernel.org,
	Martin Schwidefsky <schwidefsky@...ibm.com>,
	Heiko Carstens <heiko.carstens@...ibm.com>
Subject: Re: is avoiding compat ioctls possible?

On Wednesday 28 October 2009, David Miller wrote:
> > The ioctl argument actually needs a compat_ptr() conversion as well.
> > For the s390 case, we can't do that in common code, because some
> > ioctl methods put a 32 bit integer into the argument. Not sure if we
> > want to fix that everywhere, the problem is very common and the
> > impact is minimal.
> 
> What does s390 do with the 'arg' argument to sys_ioctl()?

It clears the top 32 bits, but not bit 31, because that is significant
for a few ioctl handlers passing data directly instead of a pointer.

> That assumption that you can cast this to a pointer is everywhere.

Yes, I know :(

> If someone wants to fix this up, feel free to do an audit and go
> over that seperately from my work :-)

Cc'ing Heiko and Martin, since I'm not working on s390 any more.

I'm pretty sure it was ok when we started adding the compat_ioctl
handlers years ago. I think most people just ignored these for
the majority of drivers that can't possibly run on s390. Even
on s390, gcc will always do the right thing if you call call ioctl
with a pointer to a normal object in the .data section, heap or stack,
but hand-written assembly or other compilers may not.

	Arnd <><
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/