| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Fri, 21 Dec 2007 20:56:48 -0800 (PST)
From: David Miller <davem@...emloft.net>
To: linux-wireless@...r.kernel.org
CC: netdev@...r.kernel.org
Subject: [WEXT 9/12]: Dispatch and handle compat ioctls entirely in
net/wireless/wext.c
[WEXT]: Dispatch and handle compat ioctls entirely in net/wireless/wext.c
Next we can kill the hacks in fs/compat_ioctl.c and also
dispatch compat ioctls down into the driver and 80211 protocol
helper layers in order to handle iw_point objects embedded in
stream replies which need to be translated.
Signed-off-by: David S. Miller <davem@...emloft.net>
---
fs/compat_ioctl.c | 6 ---
include/linux/wireless.h | 9 ++++
include/net/wext.h | 7 +++
net/socket.c | 10 ++++
net/wireless/wext.c | 104 ++++++++++++++++++++++++++++++++++++++++++++++
5 files changed, 130 insertions(+), 6 deletions(-)
diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
index e8b7c3a..e98e950 100644
--- a/fs/compat_ioctl.c
+++ b/fs/compat_ioctl.c
@@ -1756,12 +1756,6 @@ static int do_i2c_smbus_ioctl(unsigned int fd, unsigned int cmd, unsigned long a
return sys_ioctl(fd, cmd, (unsigned long)tdata);
}
-struct compat_iw_point {
- compat_caddr_t pointer;
- __u16 length;
- __u16 flags;
-};
-
static int do_wireless_ioctl(unsigned int fd, unsigned int cmd, unsigned long arg)
{
struct iwreq __user *iwr;
diff --git a/include/linux/wireless.h b/include/linux/wireless.h
index 0987aa7..2088524 100644
--- a/include/linux/wireless.h
+++ b/include/linux/wireless.h
@@ -76,6 +76,7 @@
#include <linux/types.h> /* for "caddr_t" et al */
#include <linux/socket.h> /* for "struct sockaddr" et al */
#include <linux/if.h> /* for IFNAMSIZ and co... */
+#include <linux/compat.h>
#endif /* __KERNEL__ */
/***************************** VERSION *****************************/
@@ -669,6 +670,14 @@ struct iw_point
__u16 flags; /* Optional params */
};
+#if defined(__KERNEL__) && defined(CONFIG_COMPAT)
+struct compat_iw_point {
+ compat_caddr_t pointer;
+ __u16 length;
+ __u16 flags;
+};
+#endif
+
/*
* A frequency
* For numbers lower than 10^9, we encode the number in 'm' and
diff --git a/include/net/wext.h b/include/net/wext.h
index 80b31d8..6d76a39 100644
--- a/include/net/wext.h
+++ b/include/net/wext.h
@@ -12,6 +12,8 @@ extern int wext_proc_init(struct net *net);
extern void wext_proc_exit(struct net *net);
extern int wext_handle_ioctl(struct net *net, struct ifreq *ifr, unsigned int cmd,
void __user *arg);
+extern int compat_wext_handle_ioctl(struct net *net, unsigned int cmd,
+ unsigned long arg);
#else
static inline int wext_proc_init(struct net *net)
{
@@ -26,6 +28,11 @@ static inline int wext_handle_ioctl(struct net *net, struct ifreq *ifr, unsigned
{
return -EINVAL;
}
+static inline int compat_wext_handle_ioctl(struct net *net, unsigned int cmd,
+ unsigned long arg)
+{
+ return -EINVAL;
+}
#endif
#endif /* __NET_WEXT_H */
diff --git a/net/socket.c b/net/socket.c
index 74784df..475f08f 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -90,6 +90,7 @@
#include <asm/unistd.h>
#include <net/compat.h>
+#include <net/wext.h>
#include <net/sock.h>
#include <linux/netfilter.h>
@@ -2207,10 +2208,19 @@ static long compat_sock_ioctl(struct file *file, unsigned cmd,
{
struct socket *sock = file->private_data;
int ret = -ENOIOCTLCMD;
+ struct sock *sk;
+ struct net *net;
+
+ sk = sock->sk;
+ net = sk->sk_net;
if (sock->ops->compat_ioctl)
ret = sock->ops->compat_ioctl(sock, cmd, arg);
+ if (ret == -ENOIOCTLCMD &&
+ (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST))
+ ret = compat_wext_handle_ioctl(net, cmd, arg);
+
return ret;
}
#endif
diff --git a/net/wireless/wext.c b/net/wireless/wext.c
index 03b0051..5869b70 100644
--- a/net/wireless/wext.c
+++ b/net/wireless/wext.c
@@ -1144,6 +1144,110 @@ int wext_handle_ioctl(struct net *net, struct ifreq *ifr, unsigned int cmd,
return ret;
}
+#ifdef CONFIG_COMPAT
+static int compat_standard_call(struct net_device * dev,
+ struct iwreq * iwr,
+ unsigned int cmd,
+ iw_handler handler)
+{
+ const struct iw_ioctl_description *descr;
+ struct compat_iw_point *iwp_compat;
+ struct iw_request_info info;
+ struct iw_point iwp;
+ int err;
+
+ descr = standard_ioctl + (cmd - SIOCIWFIRST);
+
+ if (descr->header_type != IW_HEADER_TYPE_POINT)
+ return ioctl_standard_call(dev, iwr, cmd, handler);
+
+ iwp_compat = (struct compat_iw_point *) &iwr->u.data;
+ iwp.pointer = compat_ptr(iwp_compat->pointer);
+ iwp.length = iwp_compat->length;
+ iwp.flags = iwp_compat->flags;
+
+ info.cmd = cmd;
+ info.flags = 0;
+
+ err = ioctl_standard_iw_point(&iwp, cmd, descr, handler, dev, &info);
+
+ iwp_compat->pointer = ptr_to_compat(iwp.pointer);
+ iwp_compat->length = iwp.length;
+ iwp_compat->flags = iwp.flags;
+
+ return err;
+}
+
+static int compat_private_call(struct net_device *dev, struct iwreq *iwr,
+ unsigned int cmd, iw_handler handler)
+{
+ const struct iw_priv_args *descr;
+ struct iw_request_info info;
+ int ret, extra_size;
+
+ extra_size = get_priv_descr_and_size(dev, cmd, &descr);
+
+ /* Prepare the call */
+ info.cmd = cmd;
+ info.flags = 0;
+
+ /* Check if we have a pointer to user space data or not. */
+ if (extra_size == 0) {
+ /* No extra arguments. Trivial to handle */
+ ret = handler(dev, &info, &(iwr->u), (char *) &(iwr->u));
+ } else {
+ struct compat_iw_point *iwp_compat;
+ struct iw_point iwp;
+
+ iwp_compat = (struct compat_iw_point *) &iwr->u.data;
+ iwp.pointer = compat_ptr(iwp_compat->pointer);
+ iwp.length = iwp_compat->length;
+ iwp.flags = iwp_compat->flags;
+
+ ret = ioctl_private_iw_point(&iwp, cmd, descr,
+ handler, dev, &info, extra_size);
+
+ iwp_compat->pointer = ptr_to_compat(iwp.pointer);
+ iwp_compat->length = iwp.length;
+ iwp_compat->flags = iwp.flags;
+ }
+
+ /* Call commit handler if needed and defined */
+ if (ret == -EIWCOMMIT)
+ ret = call_commit_handler(dev);
+
+ return ret;
+}
+
+int compat_wext_handle_ioctl(struct net *net, unsigned int cmd,
+ unsigned long arg)
+{
+ void __user *argp = (void __user *)arg;
+ struct iwreq iwr;
+ char *colon;
+ int ret;
+
+ if (copy_from_user(&iwr, argp, sizeof(struct iwreq)))
+ return -EFAULT;
+
+ iwr.ifr_name[IFNAMSIZ-1] = 0;
+ colon = strchr(iwr.ifr_name, ':');
+ if (colon)
+ *colon = 0;
+
+ ret = wext_ioctl_dispatch(net, (struct ifreq *) &iwr, cmd,
+ compat_standard_call,
+ compat_private_call);
+
+ if (ret > 0 &&
+ IW_IS_GET(cmd) &&
+ copy_to_user(argp, &iwr, sizeof(struct iwreq)))
+ return -EFAULT;
+
+ return ret;
+}
+#endif
+
/************************* EVENT PROCESSING *************************/
/*
* Process events generated by the wireless layer or the driver.
--
1.5.4.rc1
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists