Our ABI for write() uses a s32 for FDs and a u32 for IDRs, but internally we ended up implicitly casting these ABI values into an 'int'. For ioctl() we use a s64 for FDs and a u64 for IDRs, again casting to an int. The various casts to int are all missing range checks which can cause userspace values that should be considered invalid to be accepted. Fix this by making the generic lookup routine accept a s64, which does not truncate the write API's u32/s32 or the ioctl API's s64. Then push the detailed range checking down to the actual type implementations to be shared by both interfaces. Finally, change the copy of the uobj->id to sign extend into a s64, so eg, if we ever wish to return a negative value for a FD it is carried properly. This ensures that userspace values are never weirdly interpreted due to the various trunctations and everything that is really out of range gets an EINVAL.
Showing the changes to include/uapi (1 of 7 files). Show all
Unified · Split
| @@ -62,7 +62,12 @@ struct ib_uverbs_attr { · 61 unmodified lines | ||
| 62 | 62 | } enum_data; |
| 63 | 63 | __u16 reserved; |
| 64 | 64 | } attr_data; |
| 65 | − __aligned_u64 data; /* ptr to command, inline data or idr/fd */ | |
| 65 | + union { | |
| 66 | + /* Used by PTR_IN/OUT, ENUM_IN and IDR */ | |
| 67 | + __aligned_u64 data; | |
| 68 | + /* Used by FD_IN and FD_OUT */ | |
| 69 | + __s64 data_s64; | |
| 70 | + }; | |
| 66 | 71 | }; |
| 67 | 72 | |
| 68 | 73 | struct ib_uverbs_ioctl_hdr { |