netdev - Re: [PATCH 5/5] net: sock_aio_write: set CMSG_MSG_COMPAT flag if is_compat

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20100226100305.GA16504@Chamillionaire.breakpoint.cc>
Date:	Fri, 26 Feb 2010 11:03:05 +0100
From:	Florian Westphal <fw@...len.de>
To:	David Miller <davem@...emloft.net>
Cc:	netdev@...r.kernel.org, johannes@...solutions.net
Subject: Re: [PATCH 5/5] net: sock_aio_write: set CMSG_MSG_COMPAT flag if
 is_compat_task

David Miller <davem@...emloft.net> wrote:
> From: Florian Westphal <fwestphal@...aro.com>
> Date: Fri, 19 Feb 2010 13:41:47 +0100
> 
> > some programs (e.g. pluto ike daemon), send netlink data to the
> > kernel via write().
> > 
> > So far, the CMSG_MSG_COMPAT flag is not set in this case, which
> > results in the kernel interpreting the netlink data the wrong way.
> > 
> > An alternative solution is to switch userspace to sendmsg() when
> > using netlink sockets.
> > 
> > Cc: Johannes Berg <johannes@...solutions.net>
> > Signed-off-by: Florian Westphal <fwestphal@...aro.com>
> 
> I was about to apply this entire patch set, but thinking about this
> one patch we have to do it differently:
> 
> > @@ -837,6 +837,10 @@ static ssize_t do_sock_write(struct msghdr *msg, struct kiocb *iocb,
> >  	msg->msg_iov = (struct iovec *)iov;
> >  	msg->msg_iovlen = nr_segs;
> >  	msg->msg_flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0;
> > +#ifdef CONFIG_COMPAT
> > +	if (is_compat_task())
> > +		msg->msg_flags |= MSG_CMSG_COMPAT;
> > +#endif
> >  	if (sock->type == SOCK_SEQPACKET)
> >  		msg->msg_flags |= MSG_EOR;
> >  
> 
> What if the kernel itself does a socket write, say from a software
> interrupt or to generate events in response to a user event,
> and the current process happens to be a compat task?
> 
> I think this could even occur for NFS perhaps?

I do not know. But it certainly shows that this patch should not be
applied.

> Anyways, that isn't going to work properly.
> 
> We might need to add ->compat_write to file operations to do
> it properly.

Fair enough.

If its necessary to set MSG_CMSG_COMPAT properly for plain
write() as well to have the patch set merged then
I'll see about adding such a ->compat_write and will resubmit
the entire set again once net-next opens again for 2.6.35.

Thanks,
	Florian
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html