[PATCH] compat. ifconf: fix limits

[PATCH] compat. ifconf: fix limits

[Randy.Dunlap]

From: Randy Dunlap <rdunlap@xenotime.net>

A recent change to compat. dev_ifconf() in fs/compat_ioctl.c
causes ifconf data to be truncated 1 entry too early when copying it
to userspace.  The correct amount of data (length) is returned,
but the final entry is empty (zero, not filled in).
The for-loop 'i' check should use <= to allow the final struct
ifreq32 to be copied.  I also used the ifconf-corruption program
in kernel bugzilla #4746 to make sure that this change does not
re-introduce the corruption.

Signed-off-by: Randy Dunlap <rdunlap@xenotime.net>
---
 fs/compat_ioctl.c |    2 +-
 1 files changed, 1 insertion(+), 1 deletion(-)

--- linux-2616-rc5.orig/fs/compat_ioctl.c
+++ linux-2616-rc5/fs/compat_ioctl.c
@@ -446,7 +446,7 @@ static int dev_ifconf(unsigned int fd, u
 	ifr = ifc.ifc_req;
 	ifr32 = compat_ptr(ifc32.ifcbuf);
 	for (i = 0, j = 0;
-             i + sizeof (struct ifreq32) < ifc32.ifc_len && j < ifc.ifc_len;
+             i + sizeof (struct ifreq32) <= ifc32.ifc_len && j < ifc.ifc_len;
 	     i += sizeof (struct ifreq32), j += sizeof (struct ifreq)) {
 		if (copy_in_user(ifr32, ifr, sizeof (struct ifreq32)))
 			return -EFAULT;


---

Re: [PATCH] compat. ifconf: fix limits

[David S. Miller]

From: "Randy.Dunlap" <rdunlap@xenotime.net>
Date: Wed, 8 Mar 2006 09:16:08 -0800

> From: Randy Dunlap <rdunlap@xenotime.net>
> 
> A recent change to compat. dev_ifconf() in fs/compat_ioctl.c
> causes ifconf data to be truncated 1 entry too early when copying it
> to userspace.  The correct amount of data (length) is returned,
> but the final entry is empty (zero, not filled in).
> The for-loop 'i' check should use <= to allow the final struct
> ifreq32 to be copied.  I also used the ifconf-corruption program
> in kernel bugzilla #4746 to make sure that this change does not
> re-introduce the corruption.
> 
> Signed-off-by: Randy Dunlap <rdunlap@xenotime.net>

Good catch, applied.  Thanks Randy.

Is this one relevant for -stable?

Re: [PATCH] compat. ifconf: fix limits

[David S. Miller]

From: "Randy.Dunlap" <rdunlap@xenotime.net>
Date: Wed, 8 Mar 2006 17:41:16 -0800

> On Wed, 08 Mar 2006 16:46:27 -0800 (PST) David S. Miller wrote:
> 
> > Is this one relevant for -stable?
> 
> Yes, IMO.  Have to wait for it to be merged upstream, right?

I'll take care of everything, thanks Randy.

Re: [PATCH] compat. ifconf: fix limits

[Randy.Dunlap]

On Wed, 08 Mar 2006 16:46:27 -0800 (PST) David S. Miller wrote:

> From: "Randy.Dunlap" <rdunlap@xenotime.net>
> Date: Wed, 8 Mar 2006 09:16:08 -0800
> 
> > From: Randy Dunlap <rdunlap@xenotime.net>
> > 
> > A recent change to compat. dev_ifconf() in fs/compat_ioctl.c
> > causes ifconf data to be truncated 1 entry too early when copying it
> > to userspace.  The correct amount of data (length) is returned,
> > but the final entry is empty (zero, not filled in).
> > The for-loop 'i' check should use <= to allow the final struct
> > ifreq32 to be copied.  I also used the ifconf-corruption program
> > in kernel bugzilla #4746 to make sure that this change does not
> > re-introduce the corruption.
> > 
> > Signed-off-by: Randy Dunlap <rdunlap@xenotime.net>
> 
> Good catch, applied.  Thanks Randy.
> 
> Is this one relevant for -stable?

Yes, IMO.  Have to wait for it to be merged upstream, right?

---
~Randy