I think this has already been addressed. But forwarding for sure. Begin forwarded message:
Date: Mon, 23 Apr 2018 01:26:46 +0000 From: bugzilla-dae...@bugzilla.kernel.org To: step...@networkplumber.org Subject: [Bug 199469] New: Regression in 32-bit-compat dev_ioctl due to bf4405737f9f85a06db2b0ce5d76a818b61992e2 https://bugzilla.kernel.org/show_bug.cgi?id=199469 Bug ID: 199469 Summary: Regression in 32-bit-compat dev_ioctl due to bf4405737f9f85a06db2b0ce5d76a818b61992e2 Product: Networking Version: 2.5 Kernel Version: 4.16.0-0.rc4.git0.1.fc28.x86_64 Hardware: All OS: Linux Tree: Mainline Status: NEW Severity: normal Priority: P1 Component: Other Assignee: step...@networkplumber.org Reporter: rob...@ocallahan.org Regression: No Created attachment 275501 --> https://bugzilla.kernel.org/attachment.cgi?id=275501&action=edit Test program The commit says Once upon a time net/socket.c:dev_ifsioc() used to handle SIOCSHWTSTAMP and SIOCSIFMAP. These have different native and compat layout, so the format conversion had been needed. In 2009 these two cases had been taken out, turning the rest into a convoluted way to calling sock_do_ioctl(). We copy compat structure into native one, call sock_do_ioctl() on that and copy the result back for the in/out ioctls. No layout transformation anywhere, so we might as well just call sock_do_ioctl() and skip all the headache with copying. However there is one problem: 32-bit 'struct ifreq' and 64-bit 'struct ifreq' are not the same size. The former is 32 bytes and the latter is 40 bytes. Thus, if you place a 32-bit 'struct ifreq' immediately before an unmapped page and try to pass it to one of these ioctls, the syscall fails with EFAULT due to this commit. Steps to reproduce: Copy attached file to /tmp/test.c, then: [roc@localhost-live ~]$ gcc -o /tmp/test /tmp/test.c && /tmp/test Index: 1 [roc@localhost-live ~]$ gcc -m32 -o /tmp/test /tmp/test.c && /tmp/test Failed SIOCGIFINDEX: Bad address -- You are receiving this mail because: You are the assignee for the bug.
