linux-kernel - Re: [f2fs-dev] [PATCH RFC] f2fs: fix compat F2FS_IOC_{MOVE, GARBAGE_COLLECT}

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 3 Nov 2020 18:29:08 -0800
From:   Eric Biggers <ebiggers@...nel.org>
To:     Chao Yu <yuchao0@...wei.com>
Cc:     jaegeuk@...nel.org, linux-kernel@...r.kernel.org,
        linux-f2fs-devel@...ts.sourceforge.net
Subject: Re: [f2fs-dev] [PATCH RFC] f2fs: fix compat F2FS_IOC_{MOVE,
 GARBAGE_COLLECT}_RANGE

On Wed, Nov 04, 2020 at 10:19:06AM +0800, Chao Yu wrote:
> Eric reported a ioctl bug in below link:
> 
> https://lore.kernel.org/linux-f2fs-devel/20201103032234.GB2875@sol.localdomain/
> 
> That said, on some 32-bit architectures, u64 has only 32-bit alignment,
> notably i386 and x86_32, so that size of struct f2fs_gc_range compiled
> in x86_32 is 20 bytes, however the size in x86_64 is 24 bytes, binary
> compiled in x86_32 can not call F2FS_IOC_GARBAGE_COLLECT_RANGE successfully
> due to mismatched value of ioctl command in betweeen binary and f2fs
> module, similarly, F2FS_IOC_MOVE_RANGE will fail too.
> 
> In this patch we introduce two ioctls for compatibility of above special
> 32-bit binary:
> - F2FS_IOC32_GARBAGE_COLLECT_RANGE
> - F2FS_IOC32_MOVE_RANGE
> 
> Signed-off-by: Chao Yu <yuchao0@...wei.com>
> ---
> 
> Jaegeuk, Eric,
> 
> I have no 32-bit machine now, so I don't run any test on this patch,
> please take a look at this RFC patch first.

You can test this by running a 32-bit binary on a machine with a 64-bit kernel.
E.g. on x86_64, compile a binary with 'gcc -m32'.

>  #ifdef CONFIG_COMPAT
> +static int f2fs_compat_ioc_gc_range(struct file *file, unsigned long arg)
> +{
> +	struct compat_f2fs_gc_range __user *urange;
> +	struct f2fs_gc_range range;
> +	int err;
> +
> +	urange = compat_ptr(arg);
> +	err = get_user(range.sync, &urange->sync);
> +	err |= get_user(range.start, &urange->start);
> +	err |= get_user(range.len, &urange->len);
> +	if (err)
> +		return -EFAULT;
> +	if (unlikely(f2fs_cp_error(F2FS_I_SB(file_inode(file)))))
> +		return -EIO;
> +	if (!f2fs_is_checkpoint_ready(F2FS_I_SB(file_inode(file))))
> +		return -ENOSPC;
> +	return f2fs_ioc_gc_range(file, (unsigned long)&range);
> +}

This won't work because f2fs_ioc_gc_range() expects a user pointer.  You'll need
to make the native and compat versions do the copy from user separately, and
have them call a helper function that takes a pointer to the argument in kernel
memory.

- Eric