Re: [PATCH 5/5] net: Block MSG_CMSG_COMPAT in send(m)msg and recv(m)msg

Re: [PATCH 5/5] net: Block MSG_CMSG_COMPAT in send(m)msg and recv(m)msg

[Michael Neuling]

On Thu, May 23, 2013 at 7:07 AM, Andy Lutomirski <luto@amacapital.net> wrote:
> MSG_CMSG_COMPAT is (AFAIK) not intended to be part of the API --
> it's a hack that steals a bit to indicate to other networking code
> that a compat entry was used.  So don't allow it from a non-compat
> syscall.

Dave & Linus

This is causing a regression on 64bit powerpc with 32bit usermode.
When I hit userspace, udev is broken and I suspect all networking is
broken as well.

Can we please revert 1be374a0518a288147c6a7398792583200a67261 upstream?

Found via bisect.

Mikey

>
> This prevents an oops when running this code:
>
> int main()
> {
>         int s;
>         struct sockaddr_in addr;
>         struct msghdr *hdr;
>
>         char *highpage = mmap((void*)(TASK_SIZE_MAX - 4096), 4096,
>                               PROT_READ | PROT_WRITE,
>                               MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED, -1, 0);
>         if (highpage == MAP_FAILED)
>                 err(1, "mmap");
>
>         s = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
>         if (s == -1)
>                 err(1, "socket");
>
>         addr.sin_family = AF_INET;
>         addr.sin_port = htons(1);
>         addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);This is upster

>         if (connect(s, (struct sockaddr*)&addr, sizeof(addr)) != 0)
>                 err(1, "connect");
>
>         void *evil = highpage + 4096 - COMPAT_MSGHDR_SIZE;
>         printf("Evil address is %p\n", evil);
>
>         if (syscall(__NR_sendmmsg, s, evil, 1, MSG_CMSG_COMPAT) < 0)
>                 err(1, "sendmmsg");
>
>         return 0;
> }
>
> Cc: David S. Miller <davem@davemloft.net>
> Signed-off-by: Andy Lutomirski <luto@amacapital.net>
> ---
>  net/socket.c | 33 +++++++++++++++++++++++++++++++--
>  1 file changed, 31 insertions(+), 2 deletions(-)
>
> diff --git a/net/socket.c b/net/socket.c
> index 88f759a..0e16888 100644
> --- a/net/socket.c
> +++ b/net/socket.c
> @@ -2097,8 +2097,12 @@ SYSCALL_DEFINE3(sendmsg, int, fd, struct msghdr __user *, msg, unsigned int, fla
>  {
>         int fput_needed, err;
>         struct msghdr msg_sys;
> -       struct socket *sock = sockfd_lookup_light(fd, &err, &fput_needed);
> +       struct socket *sock;
> +
> +       if (flags & MSG_CMSG_COMPAT)
> +               return -EINVAL;
>
> +       sock = sockfd_lookup_light(fd, &err, &fput_needed);
>         if (!sock)
>                 goto out;
>
> @@ -2171,6 +2175,8 @@ int __sys_sendmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
>  SYSCALL_DEFINE4(sendmmsg, int, fd, struct mmsghdr __user *, mmsg,
>                 unsigned int, vlen, unsigned int, flags)
>  {
> +       if (flags & MSG_CMSG_COMPAT)
> +               return -EINVAL;
>         return __sys_sendmmsg(fd, mmsg, vlen, flags);
>  }
>
> @@ -2271,8 +2277,12 @@ SYSCALL_DEFINE3(recvmsg, int, fd, struct msghdr __user *, msg,
>  {
>         int fput_needed, err;
>         struct msghdr msg_sys;
> -       struct socket *sock = sockfd_lookup_light(fd, &err, &fput_needed);
> +       struct socket *sock;
> +
> +       if (flags & MSG_CMSG_COMPAT)
> +               return -EINVAL;
>
> +       sock = sockfd_lookup_light(fd, &err, &fput_needed);
>         if (!sock)
>                 goto out;
>
> @@ -2397,6 +2407,9 @@ SYSCALL_DEFINE5(recvmmsg, int, fd, struct mmsghdr __user *, mmsg,
>         int datagrams;
>         struct timespec timeout_sys;
>
> +       if (flags & MSG_CMSG_COMPAT)
> +               return -EINVAL;
> +
>         if (!timeout)
>                 return __sys_recvmmsg(fd, mmsg, vlen, flags, NULL);
>
> @@ -2512,15 +2525,31 @@ SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args)
>                                    (int __user *)a[4]);
>                 break;
>         case SYS_SENDMSG:
> +               if (a[2] & MSG_CMSG_COMPAT) {
> +                       err = -EINVAL;
> +                       break;
> +               }
>                 err = sys_sendmsg(a0, (struct msghdr __user *)a1, a[2]);
>                 break;
>         case SYS_SENDMMSG:
> +               if (a[3] & MSG_CMSG_COMPAT) {
> +                       err = -EINVAL;
> +                       break;
> +               }
>                 err = sys_sendmmsg(a0, (struct mmsghdr __user *)a1, a[2], a[3]);
>                 break;
>         case SYS_RECVMSG:
> +               if (a[2] & MSG_CMSG_COMPAT) {
> +                       err = -EINVAL;
> +                       break;
> +               }
>                 err = sys_recvmsg(a0, (struct msghdr __user *)a1, a[2]);
>                 break;
>         case SYS_RECVMMSG:
> +               if (a[3] & MSG_CMSG_COMPAT) {
> +                       err = -EINVAL;
> +                       break;
> +               }
>                 err = sys_recvmmsg(a0, (struct mmsghdr __user *)a1, a[2], a[3],
>                                    (struct timespec __user *)a[4]);
>                 break;
> --
> 1.8.1.4
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/
>

Re: [PATCH 5/5] net: Block MSG_CMSG_COMPAT in send(m)msg and recv(m)msg

[Anton Blanchard]

Hi,

> This is causing a regression on 64bit powerpc with 32bit usermode.
> When I hit userspace, udev is broken and I suspect all networking is
> broken as well.
> 
> Can we please revert 1be374a0518a288147c6a7398792583200a67261
> upstream?
> 
> Found via bisect.

Doesn't this patch break compat_sys_sendmsg and compat_sys_recvmsg?
We'd need to move the guts of sys_* into compat_sys_* to fix it.

Anton

Re: [PATCH 5/5] net: Block MSG_CMSG_COMPAT in send(m)msg and recv(m)msg

[Stephen Rothwell]

[-- Attachment #1: Type: text/plain, Size: 826 bytes --]

Hi Anton,

On Thu, 6 Jun 2013 13:01:05 +1000 Anton Blanchard <anton@samba.org> wrote:
>
> > This is causing a regression on 64bit powerpc with 32bit usermode.
> > When I hit userspace, udev is broken and I suspect all networking is
> > broken as well.
> > 
> > Can we please revert 1be374a0518a288147c6a7398792583200a67261
> > upstream?
> > 
> > Found via bisect.
> 
> Doesn't this patch break compat_sys_sendmsg and compat_sys_recvmsg?
> We'd need to move the guts of sys_* into compat_sys_* to fix it.

What you really need is a set of common functions that the sys_ and
compat_sys_ functions can call - with the sys_ funtions forbidding
MSG_CMSG_COMPAT and the compat_sys_ functions setting it.

-- 
Cheers,
Stephen Rothwell                    sfr@canb.auug.org.au
http://www.canb.auug.org.au/~sfr/

[-- Attachment #2: Type: application/pgp-signature, Size: 836 bytes --]

Re: [PATCH 5/5] net: Block MSG_CMSG_COMPAT in send(m)msg and recv(m)msg

[Eric Dumazet]

On Thu, 2013-06-06 at 12:56 +1000, Michael Neuling wrote:
> On Thu, May 23, 2013 at 7:07 AM, Andy Lutomirski <luto@amacapital.net> wrote:
> > MSG_CMSG_COMPAT is (AFAIK) not intended to be part of the API --
> > it's a hack that steals a bit to indicate to other networking code
> > that a compat entry was used.  So don't allow it from a non-compat
> > syscall.
> 
> Dave & Linus
> 
> This is causing a regression on 64bit powerpc with 32bit usermode.
> When I hit userspace, udev is broken and I suspect all networking is
> broken as well.
> 
> Can we please revert 1be374a0518a288147c6a7398792583200a67261 upstream?
> 

It seems to also break x86_64, if using 32bit usermode.

Re: [PATCH 5/5] net: Block MSG_CMSG_COMPAT in send(m)msg and recv(m)msg

[David Miller]

From: Eric Dumazet <eric.dumazet@gmail.com>
Date: Wed, 05 Jun 2013 21:35:25 -0700

> On Thu, 2013-06-06 at 12:56 +1000, Michael Neuling wrote:
>> On Thu, May 23, 2013 at 7:07 AM, Andy Lutomirski <luto@amacapital.net> wrote:
>> > MSG_CMSG_COMPAT is (AFAIK) not intended to be part of the API --
>> > it's a hack that steals a bit to indicate to other networking code
>> > that a compat entry was used.  So don't allow it from a non-compat
>> > syscall.
>> 
>> Dave & Linus
>> 
>> This is causing a regression on 64bit powerpc with 32bit usermode.
>> When I hit userspace, udev is broken and I suspect all networking is
>> broken as well.
>> 
>> Can we please revert 1be374a0518a288147c6a7398792583200a67261 upstream?
>> 
> 
> It seems to also break x86_64, if using 32bit usermode.

Sorry, I only merged this because Ingo Molnar and others kept beating
me over the head about merging this fix.

Linus please revert, and I will not bow to such pressure in the future,
I should know better.

[PATCH] net: Unbreak compat_sys_{send,recv}msg

[Andy Lutomirski]

I broke them in this commit:

    commit 1be374a0518a288147c6a7398792583200a67261
    Author: Andy Lutomirski <luto@amacapital.net>
    Date:   Wed May 22 14:07:44 2013 -0700

        net: Block MSG_CMSG_COMPAT in send(m)msg and recv(m)msg

This patch adds __sys_sendmsg and __sys_sendmsg as common helpers that accept
MSG_CMSG_COMPAT and blocks MSG_CMSG_COMPAT at the syscall entrypoints.  It
also reverts some unnecessary checks in sys_socketcall.

Apparently I was suffering from underscore blindness the first time around.

Signed-off-by: Andy Lutomirski <luto@amacapital.net>
---

I've tested this a little, but I'm not sure I have a great test case.

If the decision is that it's better to leave this for the 3.11, I can send
a squashed version.  Note that the oops that this fixes is only an oops if
the other patches in the original series are applied.

(FWIW, I wasn't sure how to submit this stuff in the first place.  I submitted
some kernel hardening patches for the x86 tree that converted an access_ok
oddity in the net code into an actual oops.  In a bit of looking, I couldn't
find any failure mode other than a -EFAULT return without the other patches
applied.  This was clear in the patch series description but not in the
change log message for the net part.)

 include/linux/socket.h |  3 +++
 net/compat.c           | 13 +++++++--
 net/socket.c           | 72 +++++++++++++++++++++++---------------------------
 3 files changed, 47 insertions(+), 41 deletions(-)

diff --git a/include/linux/socket.h b/include/linux/socket.h
index 2b9f74b..e897bdc 100644
--- a/include/linux/socket.h
+++ b/include/linux/socket.h
@@ -321,6 +321,9 @@ extern int put_cmsg(struct msghdr*, int level, int type, int len, void *data);
 
 struct timespec;
 
+/* The __sys_...msg variants allow MSG_CMSG_COMPAT */
+extern long __sys_recvmsg(int fd, struct msghdr __user *msg, unsigned flags);
+extern long __sys_sendmsg(int fd, struct msghdr __user *msg, unsigned flags);
 extern int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
 			  unsigned int flags, struct timespec *timeout);
 extern int __sys_sendmmsg(int fd, struct mmsghdr __user *mmsg,
diff --git a/net/compat.c b/net/compat.c
index 79ae884..f0a1ba6 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -734,19 +734,25 @@ static unsigned char nas[21] = {
 
 asmlinkage long compat_sys_sendmsg(int fd, struct compat_msghdr __user *msg, unsigned int flags)
 {
-	return sys_sendmsg(fd, (struct msghdr __user *)msg, flags | MSG_CMSG_COMPAT);
+	if (flags & MSG_CMSG_COMPAT)
+		return -EINVAL;
+	return __sys_sendmsg(fd, (struct msghdr __user *)msg, flags | MSG_CMSG_COMPAT);
 }
 
 asmlinkage long compat_sys_sendmmsg(int fd, struct compat_mmsghdr __user *mmsg,
 				    unsigned int vlen, unsigned int flags)
 {
+	if (flags & MSG_CMSG_COMPAT)
+		return -EINVAL;
 	return __sys_sendmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
 			      flags | MSG_CMSG_COMPAT);
 }
 
 asmlinkage long compat_sys_recvmsg(int fd, struct compat_msghdr __user *msg, unsigned int flags)
 {
-	return sys_recvmsg(fd, (struct msghdr __user *)msg, flags | MSG_CMSG_COMPAT);
+	if (flags & MSG_CMSG_COMPAT)
+		return -EINVAL;
+	return __sys_recvmsg(fd, (struct msghdr __user *)msg, flags | MSG_CMSG_COMPAT);
 }
 
 asmlinkage long compat_sys_recv(int fd, void __user *buf, size_t len, unsigned int flags)
@@ -768,6 +774,9 @@ asmlinkage long compat_sys_recvmmsg(int fd, struct compat_mmsghdr __user *mmsg,
 	int datagrams;
 	struct timespec ktspec;
 
+	if (flags & MSG_CMSG_COMPAT)
+		return -EINVAL;
+
 	if (COMPAT_USE_64BIT_TIME)
 		return __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
 				      flags | MSG_CMSG_COMPAT,
diff --git a/net/socket.c b/net/socket.c
index 0e16888..e216502 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -1978,7 +1978,7 @@ struct used_address {
 	unsigned int name_len;
 };
 
-static int __sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
+static int ___sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
 			 struct msghdr *msg_sys, unsigned int flags,
 			 struct used_address *used_address)
 {
@@ -2093,26 +2093,30 @@ out:
  *	BSD sendmsg interface
  */
 
-SYSCALL_DEFINE3(sendmsg, int, fd, struct msghdr __user *, msg, unsigned int, flags)
+long __sys_sendmsg(int fd, struct msghdr __user *msg, unsigned flags)
 {
 	int fput_needed, err;
 	struct msghdr msg_sys;
 	struct socket *sock;
 
-	if (flags & MSG_CMSG_COMPAT)
-		return -EINVAL;
-
 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
 	if (!sock)
 		goto out;
 
-	err = __sys_sendmsg(sock, msg, &msg_sys, flags, NULL);
+	err = ___sys_sendmsg(sock, msg, &msg_sys, flags, NULL);
 
 	fput_light(sock->file, fput_needed);
 out:
 	return err;
 }
 
+SYSCALL_DEFINE3(sendmsg, int, fd, struct msghdr __user *, msg, unsigned int, flags)
+{
+	if (flags & MSG_CMSG_COMPAT)
+		return -EINVAL;
+	return __sys_sendmsg(fd, msg, flags);
+}
+
 /*
  *	Linux sendmmsg interface
  */
@@ -2143,15 +2147,16 @@ int __sys_sendmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
 
 	while (datagrams < vlen) {
 		if (MSG_CMSG_COMPAT & flags) {
-			err = __sys_sendmsg(sock, (struct msghdr __user *)compat_entry,
-					    &msg_sys, flags, &used_address);
+			err = ___sys_sendmsg(sock, (struct msghdr __user *)compat_entry,
+					     &msg_sys, flags, &used_address);
 			if (err < 0)
 				break;
 			err = __put_user(err, &compat_entry->msg_len);
 			++compat_entry;
 		} else {
-			err = __sys_sendmsg(sock, (struct msghdr __user *)entry,
-					    &msg_sys, flags, &used_address);
+			err = ___sys_sendmsg(sock,
+					     (struct msghdr __user *)entry,
+					     &msg_sys, flags, &used_address);
 			if (err < 0)
 				break;
 			err = put_user(err, &entry->msg_len);
@@ -2180,7 +2185,7 @@ SYSCALL_DEFINE4(sendmmsg, int, fd, struct mmsghdr __user *, mmsg,
 	return __sys_sendmmsg(fd, mmsg, vlen, flags);
 }
 
-static int __sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
+static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
 			 struct msghdr *msg_sys, unsigned int flags, int nosec)
 {
 	struct compat_msghdr __user *msg_compat =
@@ -2272,27 +2277,31 @@ out:
  *	BSD recvmsg interface
  */
 
-SYSCALL_DEFINE3(recvmsg, int, fd, struct msghdr __user *, msg,
-		unsigned int, flags)
+long __sys_recvmsg(int fd, struct msghdr __user *msg, unsigned flags)
 {
 	int fput_needed, err;
 	struct msghdr msg_sys;
 	struct socket *sock;
 
-	if (flags & MSG_CMSG_COMPAT)
-		return -EINVAL;
-
 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
 	if (!sock)
 		goto out;
 
-	err = __sys_recvmsg(sock, msg, &msg_sys, flags, 0);
+	err = ___sys_recvmsg(sock, msg, &msg_sys, flags, 0);
 
 	fput_light(sock->file, fput_needed);
 out:
 	return err;
 }
 
+SYSCALL_DEFINE3(recvmsg, int, fd, struct msghdr __user *, msg,
+		unsigned int, flags)
+{
+	if (flags & MSG_CMSG_COMPAT)
+		return -EINVAL;
+	return __sys_recvmsg(fd, msg, flags);
+}
+
 /*
  *     Linux recvmmsg interface
  */
@@ -2330,17 +2339,18 @@ int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
 		 * No need to ask LSM for more than the first datagram.
 		 */
 		if (MSG_CMSG_COMPAT & flags) {
-			err = __sys_recvmsg(sock, (struct msghdr __user *)compat_entry,
-					    &msg_sys, flags & ~MSG_WAITFORONE,
-					    datagrams);
+			err = ___sys_recvmsg(sock, (struct msghdr __user *)compat_entry,
+					     &msg_sys, flags & ~MSG_WAITFORONE,
+					     datagrams);
 			if (err < 0)
 				break;
 			err = __put_user(err, &compat_entry->msg_len);
 			++compat_entry;
 		} else {
-			err = __sys_recvmsg(sock, (struct msghdr __user *)entry,
-					    &msg_sys, flags & ~MSG_WAITFORONE,
-					    datagrams);
+			err = ___sys_recvmsg(sock,
+					     (struct msghdr __user *)entry,
+					     &msg_sys, flags & ~MSG_WAITFORONE,
+					     datagrams);
 			if (err < 0)
 				break;
 			err = put_user(err, &entry->msg_len);
@@ -2525,31 +2535,15 @@ SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args)
 				   (int __user *)a[4]);
 		break;
 	case SYS_SENDMSG:
-		if (a[2] & MSG_CMSG_COMPAT) {
-			err = -EINVAL;
-			break;
-		}
 		err = sys_sendmsg(a0, (struct msghdr __user *)a1, a[2]);
 		break;
 	case SYS_SENDMMSG:
-		if (a[3] & MSG_CMSG_COMPAT) {
-			err = -EINVAL;
-			break;
-		}
 		err = sys_sendmmsg(a0, (struct mmsghdr __user *)a1, a[2], a[3]);
 		break;
 	case SYS_RECVMSG:
-		if (a[2] & MSG_CMSG_COMPAT) {
-			err = -EINVAL;
-			break;
-		}
 		err = sys_recvmsg(a0, (struct msghdr __user *)a1, a[2]);
 		break;
 	case SYS_RECVMMSG:
-		if (a[3] & MSG_CMSG_COMPAT) {
-			err = -EINVAL;
-			break;
-		}
 		err = sys_recvmmsg(a0, (struct mmsghdr __user *)a1, a[2], a[3],
 				   (struct timespec __user *)a[4]);
 		break;
-- 
1.8.1.4

Re: [PATCH] net: Unbreak compat_sys_{send,recv}msg

[Michael Neuling]

Andy Lutomirski <luto@amacapital.net> wrote:

> I broke them in this commit:
> 
>     commit 1be374a0518a288147c6a7398792583200a67261
>     Author: Andy Lutomirski <luto@amacapital.net>
>     Date:   Wed May 22 14:07:44 2013 -0700
> 
>         net: Block MSG_CMSG_COMPAT in send(m)msg and recv(m)msg
> 
> This patch adds __sys_sendmsg and __sys_sendmsg as common helpers that accept
> MSG_CMSG_COMPAT and blocks MSG_CMSG_COMPAT at the syscall entrypoints.  It
> also reverts some unnecessary checks in sys_socketcall.
> 
> Apparently I was suffering from underscore blindness the first time around.

FWIW This fixes the problem I was seeing with powerpc 32bit user on 64
bit kernel.

Mikey

> 
> Signed-off-by: Andy Lutomirski <luto@amacapital.net>
> ---
> 
> I've tested this a little, but I'm not sure I have a great test case.
> 
> If the decision is that it's better to leave this for the 3.11, I can send
> a squashed version.  Note that the oops that this fixes is only an oops if
> the other patches in the original series are applied.
> 
> (FWIW, I wasn't sure how to submit this stuff in the first place.  I submitted
> some kernel hardening patches for the x86 tree that converted an access_ok
> oddity in the net code into an actual oops.  In a bit of looking, I couldn't
> find any failure mode other than a -EFAULT return without the other patches
> applied.  This was clear in the patch series description but not in the
> change log message for the net part.)
> 
>  include/linux/socket.h |  3 +++
>  net/compat.c           | 13 +++++++--
>  net/socket.c           | 72 +++++++++++++++++++++++---------------------------
>  3 files changed, 47 insertions(+), 41 deletions(-)
> 
> diff --git a/include/linux/socket.h b/include/linux/socket.h
> index 2b9f74b..e897bdc 100644
> --- a/include/linux/socket.h
> +++ b/include/linux/socket.h
> @@ -321,6 +321,9 @@ extern int put_cmsg(struct msghdr*, int level, int type, int len, void *data);
>  
>  struct timespec;
>  
> +/* The __sys_...msg variants allow MSG_CMSG_COMPAT */
> +extern long __sys_recvmsg(int fd, struct msghdr __user *msg, unsigned flags);
> +extern long __sys_sendmsg(int fd, struct msghdr __user *msg, unsigned flags);
>  extern int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
>  			  unsigned int flags, struct timespec *timeout);
>  extern int __sys_sendmmsg(int fd, struct mmsghdr __user *mmsg,
> diff --git a/net/compat.c b/net/compat.c
> index 79ae884..f0a1ba6 100644
> --- a/net/compat.c
> +++ b/net/compat.c
> @@ -734,19 +734,25 @@ static unsigned char nas[21] = {
>  
>  asmlinkage long compat_sys_sendmsg(int fd, struct compat_msghdr __user *msg, unsigned int flags)
>  {
> -	return sys_sendmsg(fd, (struct msghdr __user *)msg, flags | MSG_CMSG_COMPAT);
> +	if (flags & MSG_CMSG_COMPAT)
> +		return -EINVAL;
> +	return __sys_sendmsg(fd, (struct msghdr __user *)msg, flags | MSG_CMSG_COMPAT);
>  }
>  
>  asmlinkage long compat_sys_sendmmsg(int fd, struct compat_mmsghdr __user *mmsg,
>  				    unsigned int vlen, unsigned int flags)
>  {
> +	if (flags & MSG_CMSG_COMPAT)
> +		return -EINVAL;
>  	return __sys_sendmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
>  			      flags | MSG_CMSG_COMPAT);
>  }
>  
>  asmlinkage long compat_sys_recvmsg(int fd, struct compat_msghdr __user *msg, unsigned int flags)
>  {
> -	return sys_recvmsg(fd, (struct msghdr __user *)msg, flags | MSG_CMSG_COMPAT);
> +	if (flags & MSG_CMSG_COMPAT)
> +		return -EINVAL;
> +	return __sys_recvmsg(fd, (struct msghdr __user *)msg, flags | MSG_CMSG_COMPAT);
>  }
>  
>  asmlinkage long compat_sys_recv(int fd, void __user *buf, size_t len, unsigned int flags)
> @@ -768,6 +774,9 @@ asmlinkage long compat_sys_recvmmsg(int fd, struct compat_mmsghdr __user *mmsg,
>  	int datagrams;
>  	struct timespec ktspec;
>  
> +	if (flags & MSG_CMSG_COMPAT)
> +		return -EINVAL;
> +
>  	if (COMPAT_USE_64BIT_TIME)
>  		return __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
>  				      flags | MSG_CMSG_COMPAT,
> diff --git a/net/socket.c b/net/socket.c
> index 0e16888..e216502 100644
> --- a/net/socket.c
> +++ b/net/socket.c
> @@ -1978,7 +1978,7 @@ struct used_address {
>  	unsigned int name_len;
>  };
>  
> -static int __sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
> +static int ___sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
>  			 struct msghdr *msg_sys, unsigned int flags,
>  			 struct used_address *used_address)
>  {
> @@ -2093,26 +2093,30 @@ out:
>   *	BSD sendmsg interface
>   */
>  
> -SYSCALL_DEFINE3(sendmsg, int, fd, struct msghdr __user *, msg, unsigned int, flags)
> +long __sys_sendmsg(int fd, struct msghdr __user *msg, unsigned flags)
>  {
>  	int fput_needed, err;
>  	struct msghdr msg_sys;
>  	struct socket *sock;
>  
> -	if (flags & MSG_CMSG_COMPAT)
> -		return -EINVAL;
> -
>  	sock = sockfd_lookup_light(fd, &err, &fput_needed);
>  	if (!sock)
>  		goto out;
>  
> -	err = __sys_sendmsg(sock, msg, &msg_sys, flags, NULL);
> +	err = ___sys_sendmsg(sock, msg, &msg_sys, flags, NULL);
>  
>  	fput_light(sock->file, fput_needed);
>  out:
>  	return err;
>  }
>  
> +SYSCALL_DEFINE3(sendmsg, int, fd, struct msghdr __user *, msg, unsigned int, flags)
> +{
> +	if (flags & MSG_CMSG_COMPAT)
> +		return -EINVAL;
> +	return __sys_sendmsg(fd, msg, flags);
> +}
> +
>  /*
>   *	Linux sendmmsg interface
>   */
> @@ -2143,15 +2147,16 @@ int __sys_sendmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
>  
>  	while (datagrams < vlen) {
>  		if (MSG_CMSG_COMPAT & flags) {
> -			err = __sys_sendmsg(sock, (struct msghdr __user *)compat_entry,
> -					    &msg_sys, flags, &used_address);
> +			err = ___sys_sendmsg(sock, (struct msghdr __user *)compat_entry,
> +					     &msg_sys, flags, &used_address);
>  			if (err < 0)
>  				break;
>  			err = __put_user(err, &compat_entry->msg_len);
>  			++compat_entry;
>  		} else {
> -			err = __sys_sendmsg(sock, (struct msghdr __user *)entry,
> -					    &msg_sys, flags, &used_address);
> +			err = ___sys_sendmsg(sock,
> +					     (struct msghdr __user *)entry,
> +					     &msg_sys, flags, &used_address);
>  			if (err < 0)
>  				break;
>  			err = put_user(err, &entry->msg_len);
> @@ -2180,7 +2185,7 @@ SYSCALL_DEFINE4(sendmmsg, int, fd, struct mmsghdr __user *, mmsg,
>  	return __sys_sendmmsg(fd, mmsg, vlen, flags);
>  }
>  
> -static int __sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
> +static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
>  			 struct msghdr *msg_sys, unsigned int flags, int nosec)
>  {
>  	struct compat_msghdr __user *msg_compat =
> @@ -2272,27 +2277,31 @@ out:
>   *	BSD recvmsg interface
>   */
>  
> -SYSCALL_DEFINE3(recvmsg, int, fd, struct msghdr __user *, msg,
> -		unsigned int, flags)
> +long __sys_recvmsg(int fd, struct msghdr __user *msg, unsigned flags)
>  {
>  	int fput_needed, err;
>  	struct msghdr msg_sys;
>  	struct socket *sock;
>  
> -	if (flags & MSG_CMSG_COMPAT)
> -		return -EINVAL;
> -
>  	sock = sockfd_lookup_light(fd, &err, &fput_needed);
>  	if (!sock)
>  		goto out;
>  
> -	err = __sys_recvmsg(sock, msg, &msg_sys, flags, 0);
> +	err = ___sys_recvmsg(sock, msg, &msg_sys, flags, 0);
>  
>  	fput_light(sock->file, fput_needed);
>  out:
>  	return err;
>  }
>  
> +SYSCALL_DEFINE3(recvmsg, int, fd, struct msghdr __user *, msg,
> +		unsigned int, flags)
> +{
> +	if (flags & MSG_CMSG_COMPAT)
> +		return -EINVAL;
> +	return __sys_recvmsg(fd, msg, flags);
> +}
> +
>  /*
>   *     Linux recvmmsg interface
>   */
> @@ -2330,17 +2339,18 @@ int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
>  		 * No need to ask LSM for more than the first datagram.
>  		 */
>  		if (MSG_CMSG_COMPAT & flags) {
> -			err = __sys_recvmsg(sock, (struct msghdr __user *)compat_entry,
> -					    &msg_sys, flags & ~MSG_WAITFORONE,
> -					    datagrams);
> +			err = ___sys_recvmsg(sock, (struct msghdr __user *)compat_entry,
> +					     &msg_sys, flags & ~MSG_WAITFORONE,
> +					     datagrams);
>  			if (err < 0)
>  				break;
>  			err = __put_user(err, &compat_entry->msg_len);
>  			++compat_entry;
>  		} else {
> -			err = __sys_recvmsg(sock, (struct msghdr __user *)entry,
> -					    &msg_sys, flags & ~MSG_WAITFORONE,
> -					    datagrams);
> +			err = ___sys_recvmsg(sock,
> +					     (struct msghdr __user *)entry,
> +					     &msg_sys, flags & ~MSG_WAITFORONE,
> +					     datagrams);
>  			if (err < 0)
>  				break;
>  			err = put_user(err, &entry->msg_len);
> @@ -2525,31 +2535,15 @@ SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args)
>  				   (int __user *)a[4]);
>  		break;
>  	case SYS_SENDMSG:
> -		if (a[2] & MSG_CMSG_COMPAT) {
> -			err = -EINVAL;
> -			break;
> -		}
>  		err = sys_sendmsg(a0, (struct msghdr __user *)a1, a[2]);
>  		break;
>  	case SYS_SENDMMSG:
> -		if (a[3] & MSG_CMSG_COMPAT) {
> -			err = -EINVAL;
> -			break;
> -		}
>  		err = sys_sendmmsg(a0, (struct mmsghdr __user *)a1, a[2], a[3]);
>  		break;
>  	case SYS_RECVMSG:
> -		if (a[2] & MSG_CMSG_COMPAT) {
> -			err = -EINVAL;
> -			break;
> -		}
>  		err = sys_recvmsg(a0, (struct msghdr __user *)a1, a[2]);
>  		break;
>  	case SYS_RECVMMSG:
> -		if (a[3] & MSG_CMSG_COMPAT) {
> -			err = -EINVAL;
> -			break;
> -		}
>  		err = sys_recvmmsg(a0, (struct mmsghdr __user *)a1, a[2], a[3],
>  				   (struct timespec __user *)a[4]);
>  		break;
> -- 
> 1.8.1.4
> 

Re: [PATCH] net: Unbreak compat_sys_{send,recv}msg

[David Miller]

From: Andy Lutomirski <luto@amacapital.net>
Date: Wed,  5 Jun 2013 22:38:26 -0700

> I broke them in this commit:
> 
>     commit 1be374a0518a288147c6a7398792583200a67261
>     Author: Andy Lutomirski <luto@amacapital.net>
>     Date:   Wed May 22 14:07:44 2013 -0700
> 
>         net: Block MSG_CMSG_COMPAT in send(m)msg and recv(m)msg
> 
> This patch adds __sys_sendmsg and __sys_sendmsg as common helpers that accept
> MSG_CMSG_COMPAT and blocks MSG_CMSG_COMPAT at the syscall entrypoints.  It
> also reverts some unnecessary checks in sys_socketcall.
> 
> Apparently I was suffering from underscore blindness the first time around.
> 
> Signed-off-by: Andy Lutomirski <luto@amacapital.net>

Eric, can you test this patch too?

Thanks.

> ---
> 
> I've tested this a little, but I'm not sure I have a great test case.
> 
> If the decision is that it's better to leave this for the 3.11, I can send
> a squashed version.  Note that the oops that this fixes is only an oops if
> the other patches in the original series are applied.
> 
> (FWIW, I wasn't sure how to submit this stuff in the first place.  I submitted
> some kernel hardening patches for the x86 tree that converted an access_ok
> oddity in the net code into an actual oops.  In a bit of looking, I couldn't
> find any failure mode other than a -EFAULT return without the other patches
> applied.  This was clear in the patch series description but not in the
> change log message for the net part.)
> 
>  include/linux/socket.h |  3 +++
>  net/compat.c           | 13 +++++++--
>  net/socket.c           | 72 +++++++++++++++++++++++---------------------------
>  3 files changed, 47 insertions(+), 41 deletions(-)
> 
> diff --git a/include/linux/socket.h b/include/linux/socket.h
> index 2b9f74b..e897bdc 100644
> --- a/include/linux/socket.h
> +++ b/include/linux/socket.h
> @@ -321,6 +321,9 @@ extern int put_cmsg(struct msghdr*, int level, int type, int len, void *data);
>  
>  struct timespec;
>  
> +/* The __sys_...msg variants allow MSG_CMSG_COMPAT */
> +extern long __sys_recvmsg(int fd, struct msghdr __user *msg, unsigned flags);
> +extern long __sys_sendmsg(int fd, struct msghdr __user *msg, unsigned flags);
>  extern int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
>  			  unsigned int flags, struct timespec *timeout);
>  extern int __sys_sendmmsg(int fd, struct mmsghdr __user *mmsg,
> diff --git a/net/compat.c b/net/compat.c
> index 79ae884..f0a1ba6 100644
> --- a/net/compat.c
> +++ b/net/compat.c
> @@ -734,19 +734,25 @@ static unsigned char nas[21] = {
>  
>  asmlinkage long compat_sys_sendmsg(int fd, struct compat_msghdr __user *msg, unsigned int flags)
>  {
> -	return sys_sendmsg(fd, (struct msghdr __user *)msg, flags | MSG_CMSG_COMPAT);
> +	if (flags & MSG_CMSG_COMPAT)
> +		return -EINVAL;
> +	return __sys_sendmsg(fd, (struct msghdr __user *)msg, flags | MSG_CMSG_COMPAT);
>  }
>  
>  asmlinkage long compat_sys_sendmmsg(int fd, struct compat_mmsghdr __user *mmsg,
>  				    unsigned int vlen, unsigned int flags)
>  {
> +	if (flags & MSG_CMSG_COMPAT)
> +		return -EINVAL;
>  	return __sys_sendmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
>  			      flags | MSG_CMSG_COMPAT);
>  }
>  
>  asmlinkage long compat_sys_recvmsg(int fd, struct compat_msghdr __user *msg, unsigned int flags)
>  {
> -	return sys_recvmsg(fd, (struct msghdr __user *)msg, flags | MSG_CMSG_COMPAT);
> +	if (flags & MSG_CMSG_COMPAT)
> +		return -EINVAL;
> +	return __sys_recvmsg(fd, (struct msghdr __user *)msg, flags | MSG_CMSG_COMPAT);
>  }
>  
>  asmlinkage long compat_sys_recv(int fd, void __user *buf, size_t len, unsigned int flags)
> @@ -768,6 +774,9 @@ asmlinkage long compat_sys_recvmmsg(int fd, struct compat_mmsghdr __user *mmsg,
>  	int datagrams;
>  	struct timespec ktspec;
>  
> +	if (flags & MSG_CMSG_COMPAT)
> +		return -EINVAL;
> +
>  	if (COMPAT_USE_64BIT_TIME)
>  		return __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
>  				      flags | MSG_CMSG_COMPAT,
> diff --git a/net/socket.c b/net/socket.c
> index 0e16888..e216502 100644
> --- a/net/socket.c
> +++ b/net/socket.c
> @@ -1978,7 +1978,7 @@ struct used_address {
>  	unsigned int name_len;
>  };
>  
> -static int __sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
> +static int ___sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
>  			 struct msghdr *msg_sys, unsigned int flags,
>  			 struct used_address *used_address)
>  {
> @@ -2093,26 +2093,30 @@ out:
>   *	BSD sendmsg interface
>   */
>  
> -SYSCALL_DEFINE3(sendmsg, int, fd, struct msghdr __user *, msg, unsigned int, flags)
> +long __sys_sendmsg(int fd, struct msghdr __user *msg, unsigned flags)
>  {
>  	int fput_needed, err;
>  	struct msghdr msg_sys;
>  	struct socket *sock;
>  
> -	if (flags & MSG_CMSG_COMPAT)
> -		return -EINVAL;
> -
>  	sock = sockfd_lookup_light(fd, &err, &fput_needed);
>  	if (!sock)
>  		goto out;
>  
> -	err = __sys_sendmsg(sock, msg, &msg_sys, flags, NULL);
> +	err = ___sys_sendmsg(sock, msg, &msg_sys, flags, NULL);
>  
>  	fput_light(sock->file, fput_needed);
>  out:
>  	return err;
>  }
>  
> +SYSCALL_DEFINE3(sendmsg, int, fd, struct msghdr __user *, msg, unsigned int, flags)
> +{
> +	if (flags & MSG_CMSG_COMPAT)
> +		return -EINVAL;
> +	return __sys_sendmsg(fd, msg, flags);
> +}
> +
>  /*
>   *	Linux sendmmsg interface
>   */
> @@ -2143,15 +2147,16 @@ int __sys_sendmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
>  
>  	while (datagrams < vlen) {
>  		if (MSG_CMSG_COMPAT & flags) {
> -			err = __sys_sendmsg(sock, (struct msghdr __user *)compat_entry,
> -					    &msg_sys, flags, &used_address);
> +			err = ___sys_sendmsg(sock, (struct msghdr __user *)compat_entry,
> +					     &msg_sys, flags, &used_address);
>  			if (err < 0)
>  				break;
>  			err = __put_user(err, &compat_entry->msg_len);
>  			++compat_entry;
>  		} else {
> -			err = __sys_sendmsg(sock, (struct msghdr __user *)entry,
> -					    &msg_sys, flags, &used_address);
> +			err = ___sys_sendmsg(sock,
> +					     (struct msghdr __user *)entry,
> +					     &msg_sys, flags, &used_address);
>  			if (err < 0)
>  				break;
>  			err = put_user(err, &entry->msg_len);
> @@ -2180,7 +2185,7 @@ SYSCALL_DEFINE4(sendmmsg, int, fd, struct mmsghdr __user *, mmsg,
>  	return __sys_sendmmsg(fd, mmsg, vlen, flags);
>  }
>  
> -static int __sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
> +static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
>  			 struct msghdr *msg_sys, unsigned int flags, int nosec)
>  {
>  	struct compat_msghdr __user *msg_compat =
> @@ -2272,27 +2277,31 @@ out:
>   *	BSD recvmsg interface
>   */
>  
> -SYSCALL_DEFINE3(recvmsg, int, fd, struct msghdr __user *, msg,
> -		unsigned int, flags)
> +long __sys_recvmsg(int fd, struct msghdr __user *msg, unsigned flags)
>  {
>  	int fput_needed, err;
>  	struct msghdr msg_sys;
>  	struct socket *sock;
>  
> -	if (flags & MSG_CMSG_COMPAT)
> -		return -EINVAL;
> -
>  	sock = sockfd_lookup_light(fd, &err, &fput_needed);
>  	if (!sock)
>  		goto out;
>  
> -	err = __sys_recvmsg(sock, msg, &msg_sys, flags, 0);
> +	err = ___sys_recvmsg(sock, msg, &msg_sys, flags, 0);
>  
>  	fput_light(sock->file, fput_needed);
>  out:
>  	return err;
>  }
>  
> +SYSCALL_DEFINE3(recvmsg, int, fd, struct msghdr __user *, msg,
> +		unsigned int, flags)
> +{
> +	if (flags & MSG_CMSG_COMPAT)
> +		return -EINVAL;
> +	return __sys_recvmsg(fd, msg, flags);
> +}
> +
>  /*
>   *     Linux recvmmsg interface
>   */
> @@ -2330,17 +2339,18 @@ int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
>  		 * No need to ask LSM for more than the first datagram.
>  		 */
>  		if (MSG_CMSG_COMPAT & flags) {
> -			err = __sys_recvmsg(sock, (struct msghdr __user *)compat_entry,
> -					    &msg_sys, flags & ~MSG_WAITFORONE,
> -					    datagrams);
> +			err = ___sys_recvmsg(sock, (struct msghdr __user *)compat_entry,
> +					     &msg_sys, flags & ~MSG_WAITFORONE,
> +					     datagrams);
>  			if (err < 0)
>  				break;
>  			err = __put_user(err, &compat_entry->msg_len);
>  			++compat_entry;
>  		} else {
> -			err = __sys_recvmsg(sock, (struct msghdr __user *)entry,
> -					    &msg_sys, flags & ~MSG_WAITFORONE,
> -					    datagrams);
> +			err = ___sys_recvmsg(sock,
> +					     (struct msghdr __user *)entry,
> +					     &msg_sys, flags & ~MSG_WAITFORONE,
> +					     datagrams);
>  			if (err < 0)
>  				break;
>  			err = put_user(err, &entry->msg_len);
> @@ -2525,31 +2535,15 @@ SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args)
>  				   (int __user *)a[4]);
>  		break;
>  	case SYS_SENDMSG:
> -		if (a[2] & MSG_CMSG_COMPAT) {
> -			err = -EINVAL;
> -			break;
> -		}
>  		err = sys_sendmsg(a0, (struct msghdr __user *)a1, a[2]);
>  		break;
>  	case SYS_SENDMMSG:
> -		if (a[3] & MSG_CMSG_COMPAT) {
> -			err = -EINVAL;
> -			break;
> -		}
>  		err = sys_sendmmsg(a0, (struct mmsghdr __user *)a1, a[2], a[3]);
>  		break;
>  	case SYS_RECVMSG:
> -		if (a[2] & MSG_CMSG_COMPAT) {
> -			err = -EINVAL;
> -			break;
> -		}
>  		err = sys_recvmsg(a0, (struct msghdr __user *)a1, a[2]);
>  		break;
>  	case SYS_RECVMMSG:
> -		if (a[3] & MSG_CMSG_COMPAT) {
> -			err = -EINVAL;
> -			break;
> -		}
>  		err = sys_recvmmsg(a0, (struct mmsghdr __user *)a1, a[2], a[3],
>  				   (struct timespec __user *)a[4]);
>  		break;
> -- 
> 1.8.1.4
> 
> --
> To unsubscribe from this list: send the line "unsubscribe trinity" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> 

Re: [PATCH] net: Unbreak compat_sys_{send,recv}msg

[Eric Dumazet]

On Thu, 2013-06-06 at 00:26 -0700, David Miller wrote:
> From: Andy Lutomirski <luto@amacapital.net>
> Date: Wed,  5 Jun 2013 22:38:26 -0700
> 
> > I broke them in this commit:
> > 
> >     commit 1be374a0518a288147c6a7398792583200a67261
> >     Author: Andy Lutomirski <luto@amacapital.net>
> >     Date:   Wed May 22 14:07:44 2013 -0700
> > 
> >         net: Block MSG_CMSG_COMPAT in send(m)msg and recv(m)msg
> > 
> > This patch adds __sys_sendmsg and __sys_sendmsg as common helpers that accept
> > MSG_CMSG_COMPAT and blocks MSG_CMSG_COMPAT at the syscall entrypoints.  It
> > also reverts some unnecessary checks in sys_socketcall.
> > 
> > Apparently I was suffering from underscore blindness the first time around.
> > 
> > Signed-off-by: Andy Lutomirski <luto@amacapital.net>
> 
> Eric, can you test this patch too?

Yes, this fixes the problem as well on x86_64

Tested-by: Eric Dumazet <edumazet@google.com>

Thanks !

PS: I had following fuzz while applying on Linus tree :

patching file include/linux/socket.h
Hunk #1 succeeded at 320 (offset -1 lines).
patching file net/compat.c
patching file net/socket.c
Hunk #1 succeeded at 1956 (offset -22 lines).
Hunk #2 succeeded at 2071 (offset -22 lines).
Hunk #3 succeeded at 2125 (offset -22 lines).
Hunk #4 succeeded at 2163 (offset -22 lines).
Hunk #5 succeeded at 2255 (offset -22 lines).
Hunk #6 succeeded at 2317 (offset -22 lines).
Hunk #7 succeeded at 2515 (offset -20 lines).

Re: [PATCH] net: Unbreak compat_sys_{send,recv}msg

[David Miller]

From: Eric Dumazet <eric.dumazet@gmail.com>
Date: Thu, 06 Jun 2013 06:45:37 -0700

> On Thu, 2013-06-06 at 00:26 -0700, David Miller wrote:
>> From: Andy Lutomirski <luto@amacapital.net>
>> Date: Wed,  5 Jun 2013 22:38:26 -0700
>> 
>> > I broke them in this commit:
>> > 
>> >     commit 1be374a0518a288147c6a7398792583200a67261
>> >     Author: Andy Lutomirski <luto@amacapital.net>
>> >     Date:   Wed May 22 14:07:44 2013 -0700
>> > 
>> >         net: Block MSG_CMSG_COMPAT in send(m)msg and recv(m)msg
>> > 
>> > This patch adds __sys_sendmsg and __sys_sendmsg as common helpers that accept
>> > MSG_CMSG_COMPAT and blocks MSG_CMSG_COMPAT at the syscall entrypoints.  It
>> > also reverts some unnecessary checks in sys_socketcall.
>> > 
>> > Apparently I was suffering from underscore blindness the first time around.
>> > 
>> > Signed-off-by: Andy Lutomirski <luto@amacapital.net>
>> 
>> Eric, can you test this patch too?
> 
> Yes, this fixes the problem as well on x86_64
> 
> Tested-by: Eric Dumazet <edumazet@google.com>

Applied, thanks.