net, compat_ioctl: handle socket ioctl abuses in tty drivers

Slip and a few other drivers use the same ioctl numbers on
tty devices that are normally meant for sockets. This causes
problems with our compat_ioctl handling that tries to convert
the data structures in a different format.

Fortunately, these five drivers all use 32 bit compatible
data structures in the ioctl numbers, so we can just add
a trivial compat_ioctl conversion function to each of them.

SIOCSIFENCAP and SIOCGIFENCAP do not need to live in
fs/compat_ioctl.c after this any more, and they are not
used on any sockets.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: David S. Miller <davem@davemloft.net>

2 files changed, 42 insertions, 0 deletions

diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c
index fb588301a05d..689b9bd377a5 100644
--- a/drivers/net/hamradio/6pack.c
+++ b/drivers/net/hamradio/6pack.c
@@ -34,6 +34,7 @@
 #include <linux/ip.h>
 #include <linux/tcp.h>
 #include <linux/semaphore.h>
+#include <linux/compat.h>
 #include <asm/atomic.h>
 
 #define SIXPACK_VERSION    "Revision: 0.3.0"
@@ -777,6 +778,23 @@ static int sixpack_ioctl(struct tty_struct *tty, struct file *file,
         return err;
 }
 
+#ifdef CONFIG_COMPAT
+static long sixpack_compat_ioctl(struct tty_struct * tty, struct file * file,
+                                unsigned int cmd, unsigned long arg)
+{
+        switch (cmd) {
+        case SIOCGIFNAME:
+        case SIOCGIFENCAP:
+        case SIOCSIFENCAP:
+        case SIOCSIFHWADDR:
+                return sixpack_ioctl(tty, file, cmd,
+                                (unsigned long)compat_ptr(arg));
+        }
+
+        return -ENOIOCTLCMD;
+}
+#endif
+
 static struct tty_ldisc_ops sp_ldisc = {
         .owner          = THIS_MODULE,
         .magic          = TTY_LDISC_MAGIC,
@@ -784,6 +802,9 @@ static struct tty_ldisc_ops sp_ldisc = {
         .open           = sixpack_open,
         .close          = sixpack_close,
         .ioctl          = sixpack_ioctl,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl   = sixpack_compat_ioctl,
+#endif
         .receive_buf    = sixpack_receive_buf,
         .write_wakeup   = sixpack_write_wakeup,
 };
diff --git a/drivers/net/hamradio/mkiss.c b/drivers/net/hamradio/mkiss.c
index db4b7f1603f6..fc9c57893f8a 100644
--- a/drivers/net/hamradio/mkiss.c
+++ b/drivers/net/hamradio/mkiss.c
@@ -36,6 +36,7 @@
 #include <linux/skbuff.h>
 #include <linux/if_arp.h>
 #include <linux/jiffies.h>
+#include <linux/compat.h>
 
 #include <net/ax25.h>
 
@@ -898,6 +899,23 @@ static int mkiss_ioctl(struct tty_struct *tty, struct file *file,
         return err;
 }
 
+#ifdef CONFIG_COMPAT
+static long mkiss_compat_ioctl(struct tty_struct *tty, struct file *file,
+        unsigned int cmd, unsigned long arg)
+{
+        switch (arg) {
+        case SIOCGIFNAME:
+        case SIOCGIFENCAP:
+        case SIOCSIFENCAP:
+        case SIOCSIFHWADDR:
+                return mkiss_ioctl(tty, file, cmd,
+                                   (unsigned long)compat_ptr(arg));
+        }
+
+        return -ENOIOCTLCMD;
+}
+#endif
+
 /*
  * Handle the 'receiver data ready' interrupt.
  * This function is called by the 'tty_io' module in the kernel when
@@ -972,6 +990,9 @@ static struct tty_ldisc_ops ax_ldisc = {
         .open           = mkiss_open,
         .close          = mkiss_close,
         .ioctl          = mkiss_ioctl,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl   = mkiss_compat_ioctl,
+#endif
         .receive_buf    = mkiss_receive_buf,
         .write_wakeup   = mkiss_write_wakeup
 };