Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1461935 > unrolled thread

[PATCH 3.2 44/94] wext: Fix 32 bit iwpriv compatibility issue with 64 bit Kernel

Back to article view | Back to linux.kernel

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  [PATCH 3.2 44/94] wext: Fix 32 bit iwpriv compatibility issue  with 64 bit Kernel Ben Hutchings <ben@decadent.org.uk> - 2016-08-14 13:30 +0200
    Re: [PATCH 3.2 44/94] wext: Fix 32 bit iwpriv compatibility issue  with 64 bit Kernel Johannes Berg <johannes@sipsolutions.net> - 2016-08-15 08:00 +0200
      Re: [PATCH 3.2 44/94] wext: Fix 32 bit iwpriv compatibility issue  with 64 bit Kernel Ben Hutchings <ben@decadent.org.uk> - 2016-08-16 00:10 +0200

#1461935 — [PATCH 3.2 44/94] wext: Fix 32 bit iwpriv compatibility issue with 64 bit Kernel

3.2.82-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Prasun Maiti <prasunmaiti87@gmail.com>

commit 3d5fdff46c4b2b9534fa2f9fc78e90a48e0ff724 upstream.

iwpriv app uses iw_point structure to send data to Kernel. The iw_point
structure holds a pointer. For compatibility Kernel converts the pointer
as required for WEXT IOCTLs (SIOCIWFIRST to SIOCIWLAST). Some drivers
may use iw_handler_def.private_args to populate iwpriv commands instead
of iw_handler_def.private. For those case, the IOCTLs from
SIOCIWFIRSTPRIV to SIOCIWLASTPRIV will follow the path ndo_do_ioctl().
Accordingly when the filled up iw_point structure comes from 32 bit
iwpriv to 64 bit Kernel, Kernel will not convert the pointer and sends
it to driver. So, the driver may get the invalid data.

The pointer conversion for the IOCTLs (SIOCIWFIRSTPRIV to
SIOCIWLASTPRIV), which follow the path ndo_do_ioctl(), is mandatory.
This patch adds pointer conversion from 32 bit to 64 bit and vice versa,
if the ioctl comes from 32 bit iwpriv to 64 bit Kernel.

Signed-off-by: Prasun Maiti <prasunmaiti87@gmail.com>
Signed-off-by: Ujjal Roy <royujjal@gmail.com>
Tested-by: Dibyajyoti Ghosh <dibyajyotig@gmail.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 net/wireless/wext-core.c | 25 +++++++++++++++++++++++--
 1 file changed, 23 insertions(+), 2 deletions(-)

--- a/net/wireless/wext-core.c
+++ b/net/wireless/wext-core.c
@@ -952,8 +952,29 @@ static int wireless_process_ioctl(struct
 			return private(dev, iwr, cmd, info, handler);
 	}
 	/* Old driver API : call driver ioctl handler */
-	if (dev->netdev_ops->ndo_do_ioctl)
-		return dev->netdev_ops->ndo_do_ioctl(dev, ifr, cmd);
+	if (dev->netdev_ops->ndo_do_ioctl) {
+#ifdef CONFIG_COMPAT
+		if (info->flags & IW_REQUEST_FLAG_COMPAT) {
+			int ret = 0;
+			struct iwreq iwr_lcl;
+			struct compat_iw_point *iwp_compat = (void *) &iwr->u.data;
+
+			memcpy(&iwr_lcl, iwr, sizeof(struct iwreq));
+			iwr_lcl.u.data.pointer = compat_ptr(iwp_compat->pointer);
+			iwr_lcl.u.data.length = iwp_compat->length;
+			iwr_lcl.u.data.flags = iwp_compat->flags;
+
+			ret = dev->netdev_ops->ndo_do_ioctl(dev, (void *) &iwr_lcl, cmd);
+
+			iwp_compat->pointer = ptr_to_compat(iwr_lcl.u.data.pointer);
+			iwp_compat->length = iwr_lcl.u.data.length;
+			iwp_compat->flags = iwr_lcl.u.data.flags;
+
+			return ret;
+		} else
+#endif
+			return dev->netdev_ops->ndo_do_ioctl(dev, ifr, cmd);
+	}
 	return -EOPNOTSUPP;
 }
 

[toc] | [next] | [standalone]

#1462560

On Sat, 2016-08-13 at 17:42 +0000, Ben Hutchings wrote:
> 3.2.82-rc1 review patch.  If anyone has any objections, please let me
> know.
> 
> ------------------
> 
> From: Prasun Maiti <prasunmaiti87@gmail.com>
> 
> commit 3d5fdff46c4b2b9534fa2f9fc78e90a48e0ff724 upstream.
> 

Did you just include this by accident? You had pointed out yourself
that this was broken if anything but iwpoint was transferred, and since
the Marvell people shouldn't be using wext anyway I reverted it
already.

johannes

[toc] | [prev] | [next] | [standalone]

#1463201

[Multipart message — attachments visible in raw view] — view raw

On Mon, 2016-08-15 at 07:51 +0200, Johannes Berg wrote:
> On Sat, 2016-08-13 at 17:42 +0000, Ben Hutchings wrote:
> > 
> > 3.2.82-rc1 review patch.  If anyone has any objections, please let me
> > know.
> > 
> > ------------------
> > 
> > > > From: Prasun Maiti <prasunmaiti87@gmail.com>
> > 
> > commit 3d5fdff46c4b2b9534fa2f9fc78e90a48e0ff724 upstream.
> > 
> 
> Did you just include this by accident? You had pointed out yourself
> that this was broken if anything but iwpoint was transferred, and since
> the Marvell people shouldn't be using wext anyway I reverted it
> already.

Yes, this was an accident and I'll drop it.

Ben.

-- 
Ben Hutchings
This sentence contradicts itself - no actually it doesn't.

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web