[PATCH] Check for SOL_SOCKET in compat_sys_getsockopt

[PATCH] Check for SOL_SOCKET in compat_sys_getsockopt

[Olaf Kirch]

[-- Attachment #1: Type: text/plain, Size: 417 bytes --]

compat_sys_getsockopt checks for SO_RCVTIMEO/SO_SNDTIMEO without
making sure that the level is actually SOL_SOCKET. This can break
getsockopt() requests for other protocols.

Cheers, and a happy new year to everyone!
Olaf
-- 
Olaf Kirch     | Things that make Monday morning interesting, #2:
okir@suse.de   |        "We have 8,000 NFS mount points, why do we keep
---------------+ 	 running out of privileged ports?"

[-- Attachment #2: setsockopt-compat --]
[-- Type: text/plain, Size: 962 bytes --]

Subject: check for SOL_SOCKET in compat_sys_getsocket

compat_sys_getsockopt checks for SO_RCVTIMEO/SO_SNDTIMEO without
making sure that the level is actually SOL_SOCKET. This can break
getsockopt() requests for other protocols.

Signed-off-by: Olaf Kirch <okir@suse.de>

Index: linux-2.6.9/net/compat.c
===================================================================
--- linux-2.6.9.orig/net/compat.c	2005-01-03 15:25:11.000000000 +0100
+++ linux-2.6.9/net/compat.c	2005-01-03 15:25:29.000000000 +0100
@@ -507,7 +507,8 @@ static int do_get_sock_timeout(int fd, i
 asmlinkage long compat_sys_getsockopt(int fd, int level, int optname,
 				char __user *optval, int __user *optlen)
 {
-	if (optname == SO_RCVTIMEO || optname == SO_SNDTIMEO)
+	if (level == SOL_SOCKET &&
+	    (optname == SO_RCVTIMEO || optname == SO_SNDTIMEO))
 		return do_get_sock_timeout(fd, level, optname, optval, optlen);
 	return sys_getsockopt(fd, level, optname, optval, optlen);
 }

Re: [PATCH] Check for SOL_SOCKET in compat_sys_getsockopt

[David Woodhouse]

On Mon, 2005-01-03 at 15:33 +0100, Olaf Kirch wrote:
> compat_sys_getsockopt checks for SO_RCVTIMEO/SO_SNDTIMEO without
> making sure that the level is actually SOL_SOCKET. This can break
> getsockopt() requests for other protocols.

It's a band-aid, not a fix. Trying to do the conversion in
compat_sys_getsockopt() for _all_ possible sockopts is broken.

I think we need to let each protocol offer compat [gs]etsockopt()
methods of its own, or at least have the existing [gs]etsockopt()
methods check whether the current process is 32-bit or 64-bit and do the
right thing.

Have you started looking at netfilter with 32-bit userspace yet? :)

-- 
dwmw2