1 files changed, 63 insertions, 19 deletions

diff --git a/net/socket.c b/net/socket.c
index e89884e2197b..d80d87a395ea 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -941,8 +941,7 @@ void dlci_ioctl_set(int (*hook) (unsigned int, void __user *))
 EXPORT_SYMBOL(dlci_ioctl_set);
 
 static long sock_do_ioctl(struct net *net, struct socket *sock,
-                          unsigned int cmd, unsigned long arg,
-                          unsigned int ifreq_size)
+                          unsigned int cmd, unsigned long arg)
 {
         int err;
         void __user *argp = (void __user *)arg;
@@ -968,11 +967,11 @@ static long sock_do_ioctl(struct net *net, struct socket *sock,
         } else {
                 struct ifreq ifr;
                 bool need_copyout;
-                if (copy_from_user(&ifr, argp, ifreq_size))
+                if (copy_from_user(&ifr, argp, sizeof(struct ifreq)))
                         return -EFAULT;
                 err = dev_ioctl(net, cmd, &ifr, &need_copyout);
                 if (!err && need_copyout)
-                        if (copy_to_user(argp, &ifr, ifreq_size))
+                        if (copy_to_user(argp, &ifr, sizeof(struct ifreq)))
                                 return -EFAULT;
         }
         return err;
@@ -1071,8 +1070,7 @@ static long sock_ioctl(struct file *file, unsigned cmd, unsigned long arg)
                         err = open_related_ns(&net->ns, get_net_ns);
                         break;
                 default:
-                        err = sock_do_ioctl(net, sock, cmd, arg,
-                                            sizeof(struct ifreq));
+                        err = sock_do_ioctl(net, sock, cmd, arg);
                         break;
                 }
         return err;
@@ -2780,8 +2778,7 @@ static int do_siocgstamp(struct net *net, struct socket *sock,
         int err;
 
         set_fs(KERNEL_DS);
-        err = sock_do_ioctl(net, sock, cmd, (unsigned long)&ktv,
-                            sizeof(struct compat_ifreq));
+        err = sock_do_ioctl(net, sock, cmd, (unsigned long)&ktv);
         set_fs(old_fs);
         if (!err)
                 err = compat_put_timeval(&ktv, up);
@@ -2797,8 +2794,7 @@ static int do_siocgstampns(struct net *net, struct socket *sock,
         int err;
 
         set_fs(KERNEL_DS);
-        err = sock_do_ioctl(net, sock, cmd, (unsigned long)&kts,
-                            sizeof(struct compat_ifreq));
+        err = sock_do_ioctl(net, sock, cmd, (unsigned long)&kts);
         set_fs(old_fs);
         if (!err)
                 err = compat_put_timespec(&kts, up);
@@ -2994,6 +2990,54 @@ static int compat_ifr_data_ioctl(struct net *net, unsigned int cmd,
         return dev_ioctl(net, cmd, &ifreq, NULL);
 }
 
+static int compat_ifreq_ioctl(struct net *net, struct socket *sock,
+                              unsigned int cmd,
+                              struct compat_ifreq __user *uifr32)
+{
+        struct ifreq __user *uifr;
+        int err;
+
+        /* Handle the fact that while struct ifreq has the same *layout* on
+         * 32/64 for everything but ifreq::ifru_ifmap and ifreq::ifru_data,
+         * which are handled elsewhere, it still has different *size* due to
+         * ifreq::ifru_ifmap (which is 16 bytes on 32 bit, 24 bytes on 64-bit,
+         * resulting in struct ifreq being 32 and 40 bytes respectively).
+         * As a result, if the struct happens to be at the end of a page and
+         * the next page isn't readable/writable, we get a fault. To prevent
+         * that, copy back and forth to the full size.
+         */
+
+        uifr = compat_alloc_user_space(sizeof(*uifr));
+        if (copy_in_user(uifr, uifr32, sizeof(*uifr32)))
+                return -EFAULT;
+
+        err = sock_do_ioctl(net, sock, cmd, (unsigned long)uifr);
+
+        if (!err) {
+                switch (cmd) {
+                case SIOCGIFFLAGS:
+                case SIOCGIFMETRIC:
+                case SIOCGIFMTU:
+                case SIOCGIFMEM:
+                case SIOCGIFHWADDR:
+                case SIOCGIFINDEX:
+                case SIOCGIFADDR:
+                case SIOCGIFBRDADDR:
+                case SIOCGIFDSTADDR:
+                case SIOCGIFNETMASK:
+                case SIOCGIFPFLAGS:
+                case SIOCGIFTXQLEN:
+                case SIOCGMIIPHY:
+                case SIOCGMIIREG:
+                case SIOCGIFNAME:
+                        if (copy_in_user(uifr32, uifr, sizeof(*uifr32)))
+                                err = -EFAULT;
+                        break;
+                }
+        }
+        return err;
+}
+
 static int compat_sioc_ifmap(struct net *net, unsigned int cmd,
                         struct compat_ifreq __user *uifr32)
 {
@@ -3109,8 +3153,7 @@ static int routing_ioctl(struct net *net, struct socket *sock,
         }
 
         set_fs(KERNEL_DS);
-        ret = sock_do_ioctl(net, sock, cmd, (unsigned long) r,
-                            sizeof(struct compat_ifreq));
+        ret = sock_do_ioctl(net, sock, cmd, (unsigned long) r);
         set_fs(old_fs);
 
 out:
@@ -3210,21 +3253,22 @@ static int compat_sock_ioctl_trans(struct file *file, struct socket *sock,
         case SIOCSIFTXQLEN:
         case SIOCBRADDIF:
         case SIOCBRDELIF:
+        case SIOCGIFNAME:
         case SIOCSIFNAME:
         case SIOCGMIIPHY:
         case SIOCGMIIREG:
         case SIOCSMIIREG:
-        case SIOCSARP:
-        case SIOCGARP:
-        case SIOCDARP:
-        case SIOCATMARK:
         case SIOCBONDENSLAVE:
         case SIOCBONDRELEASE:
         case SIOCBONDSETHWADDR:
         case SIOCBONDCHANGEACTIVE:
-        case SIOCGIFNAME:
-                return sock_do_ioctl(net, sock, cmd, arg,
-                                     sizeof(struct compat_ifreq));
+                return compat_ifreq_ioctl(net, sock, cmd, argp);
+
+        case SIOCSARP:
+        case SIOCGARP:
+        case SIOCDARP:
+        case SIOCATMARK:
+                return sock_do_ioctl(net, sock, cmd, arg);
         }
 
         return -ENOIOCTLCMD;