mirror/freebsd
1
0
Fork 0
mirror of https://git.FreeBSD.org/src.git synced 2024-12-23 11:18:54 +00:00
Code Issues Releases Activity

Partially revert r257696/r257713, which have an issue with writing to user

Browse Source 
controlled address. Restore the old code that emulated OSIOCGIFCONF in if.c.

Noticed by:	C Turt
This commit is contained in:
Gleb Smirnoff 2016-07-24 10:10:09 +00:00
parent fb112f72a8
commit 32e0ade6c4
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=303263
2 changed files with 18 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
sys/compat/svr4/svr4_sockio.c
View File

@ -73,6 +73,8 @@ bsd_to_svr4_flags(bf)
return sf;
}
#define OSIOCGIFCONF _IOWR('i', 20, struct ifconf)
int
svr4_sock_ioctl(fp, td, retval, fd, cmd, data)
struct file *fp;
@ -144,7 +146,6 @@ svr4_sock_ioctl(fp, td, retval, fd, cmd, data)
case SVR4_SIOCGIFCONF:
{
struct svr4_ifconf sc;
struct ifconf *ifc;
if ((error = copyin(data, &sc, sizeof(sc))) != 0)
return error;
@ -153,19 +154,9 @@ svr4_sock_ioctl(fp, td, retval, fd, cmd, data)
sizeof(struct ifreq), sizeof(struct svr4_ifreq),
sc.svr4_ifc_len));
ifc = (struct ifconf *)≻
ifc->ifc_req->ifr_addr.sa_family =
sc.svr4_ifc_req->svr4_ifr_addr.sa_family;
ifc->ifc_req->ifr_addr.sa_len =
sizeof(struct osockaddr);
error = fo_ioctl(fp, SIOCGIFCONF, &sc, td->td_ucred,
td);
sc.svr4_ifc_req->svr4_ifr_addr.sa_family =
ifc->ifc_req->ifr_addr.sa_family;
if (error != 0)
if ((error = fo_ioctl(fp, OSIOCGIFCONF,
(caddr_t) &sc, td->td_ucred,
td)) != 0)
return error;
DPRINTF(("SIOCGIFCONF\n"));

13
sys/net/if.c
View File

@ -2699,6 +2699,9 @@ ifhwioctl(u_long cmd, struct ifnet *ifp, caddr_t data, struct thread *td)
return (error);
}
/* COMPAT_SVR4 */
#define OSIOCGIFCONF _IOWR('i', 20, struct ifconf)
#ifdef COMPAT_FREEBSD32
struct ifconf32 {
int32_t ifc_len;
@ -2738,6 +2741,7 @@ ifioctl(struct socket *so, u_long cmd, caddr_t data, struct thread *td)
switch (cmd) {
case SIOCGIFCONF:
case OSIOCGIFCONF: /* COMPAT_SVR4 */
error = ifconf(cmd, data);
CURVNET_RESTORE();
return (error);
@ -3009,6 +3013,15 @@ ifconf(u_long cmd, caddr_t data)
if (prison_if(curthread->td_ucred, sa) != 0)
continue;
addrs++;
/* COMPAT_SVR4 */
if (cmd == OSIOCGIFCONF) {
struct osockaddr *osa =
(struct osockaddr *)&ifr.ifr_addr;
ifr.ifr_addr = *sa;
osa->sa_family = sa->sa_family;
sbuf_bcat(sb, &ifr, sizeof(ifr));
max_len += sizeof(ifr);
} else
if (sa->sa_len <= sizeof(*sa)) {
ifr.ifr_addr = *sa;
sbuf_bcat(sb, &ifr, sizeof(ifr));