linux-kernel - How does the size field work in IOCTL numbers?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CABV8kRyzR1-0XYjY2i-imU51NF3hkg-HQmvRMVTgggyOyHV2FQ@mail.gmail.com>
Date:   Fri, 2 Sep 2016 19:27:27 -0400
From:   Keno Fischer <keno@...iacomputing.com>
To:     linux-kernel@...r.kernel.org, vincent.weaver@...ne.edu,
        peterz@...radead.org, mingo@...hat.com
Subject: How does the size field work in IOCTL numbers?

Hi folks,

this is more of a general linux question, but since I noticed it
while looking perf_events code, I'm ccing perf_events folks
in case the answer is perf_events specific (hope that's ok).

uapi/linux/perf_event.h has the following:
#define PERF_EVENT_IOC_PERIOD _IOW('$', 4, __u64)
#define PERF_EVENT_IOC_SET_OUTPUT _IO ('$', 5)
#define PERF_EVENT_IOC_SET_FILTER _IOW('$', 6, char *)
#define PERF_EVENT_IOC_ID _IOR('$', 7, __u64 *)
#define PERF_EVENT_IOC_SET_BPF _IOW('$', 8, __u32)

Now, my question is how to interpret the last argument to the
_IO* macros. The man page for ioctl(2) says, it encodes the
"size of the argument argp in bytes", but I'm not sure how to
interpret that.

For example, IOC_PERIOD takes a pointer to a 64-bit value,
so the __u64 makes sense for me. But as far as I know,
IOC_ID also takes a pointer to a 64-bit value
(and writes the ID to it), but it has `__64 *` rather than
`__u64`. The we have IOC_SET_FILTER which as far as I know
takes a pointer to a variable-length string (but with the
above definition the size field is sizeof(char*)), and
IOC_SET_BPF which doesn't take a pointer at all,
but interprets the argument as a file descriptor (similar to
IOC_SET_OUTPUT, which doesn't have a size at all).

I don't understand what the rule is for what to put in that third
argument, or is it ioctl specific? Please let me know if I missed
something.

Thanks,
Keno