Peter Collingbourne 532b873b6b net: don't unconditionally copy_from_user a struct ifreq for socket ioctls ... commit d0efb16294d145d157432feda83877ae9d7cdf37 upstream. A common implementation of isatty(3) involves calling a ioctl passing a dummy struct argument and checking whether the syscall failed -- bionic and glibc use TCGETS (passing a struct termios), and musl uses TIOCGWINSZ (passing a struct winsize). If the FD is a socket, we will copy sizeof(struct ifreq) bytes of data from the argument and return -EFAULT if that fails. The result is that the isatty implementations may return a non-POSIX-compliant value in errno in the case where part of the dummy struct argument is inaccessible, as both struct termios and struct winsize are smaller than struct ifreq (at least on arm64). Although there is usually enough stack space following the argument on the stack that this did not present a practical problem up to now, with MTE stack instrumentation it's more likely for the copy to fail, as the memory following the struct may have a different tag. Fix the problem by adding an early check for whether the ioctl is a valid socket ioctl, and return -ENOTTY if it isn't. Fixes: 44c02a2c3d ("dev_ioctl(): move copyin/copyout to callers") Link: https://linux-review.googlesource.com/id/I869da6cf6daabc3e4b7b82ac979683ba05e27d4d Signed-off-by: Peter Collingbourne <pcc@google.com> Cc: <stable@vger.kernel.org> # 4.19 Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2024-07-05 19:02:28 +02:00
..
6lowpan
9p	net: 9p: advance iov on empty read	2021-04-07 15:00:08 +02:00
802	net/802/garp: fix memleak in garp_request_join()	2021-07-31 08:16:11 +02:00
8021q	net: vlan: avoid leaks on register_vlan_dev() failures	2021-01-17 14:16:55 +01:00
appletalk	appletalk: Fix skb allocation size in loopback case	2021-04-07 15:00:08 +02:00
atm	net: atm: fix update of position index in lec_seq_next	2020-10-31 12:26:30 -07:00
ax25	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-07-25 17:49:04 -07:00
batman-adv	batman-adv: Avoid WARN_ON timing related checks	2021-06-23 14:42:41 +02:00
bluetooth	Bluetooth: hidp: use correct wait queue when removing ctrl_wait	2024-07-05 18:55:44 +02:00
bpf	bpf: Fix NULL pointer dereference in bpf_get_local_storage() helper	2024-07-05 18:56:10 +02:00
bpfilter	bpfilter: Specify the log level for the kmsg message	2021-07-14 16:56:29 +02:00
bridge	net: bridge: fix memleak in br_add_if()	2024-07-05 18:54:25 +02:00
caif	net: fix uninit-value in caif_seqpkt_sendmsg	2021-07-28 14:35:38 +02:00
can	can: j1939: j1939_session_deactivate(): clarify lifetime of session object	2024-07-05 18:06:34 +02:00
ceph	init: add dsm gpl source	2024-07-05 18:00:04 +02:00
core	rtnetlink: Return correct error on changing device netns	2024-07-05 19:00:12 +02:00
dcb	net: dcb: Accept RTM_GETDCB messages carrying set-like DCB commands	2021-01-23 16:04:01 +01:00
dccp	dccp: add do-while-0 stubs for dccp_pr_debug macros	2024-07-05 18:55:45 +02:00
decnet	net: decnet: Fix sleeping inside in af_decnet	2021-07-28 14:35:38 +02:00
dns_resolver
dsa	net: dsa: properly check for the bridge_leave methods in dsa_switch_bridge_leave()	2021-07-25 14:36:20 +02:00
ethernet	init: add dsm gpl source	2024-07-05 18:00:04 +02:00
ethtool	net: ethtool: clear heap allocations for ethtool function	2021-06-30 08:47:20 -04:00
hsr	net: hsr: fix mac_len checks	2021-06-03 09:00:50 +02:00
ieee802154	net: Fix memory leak in ieee802154_raw_deliver	2024-07-05 18:54:24 +02:00
ife
ipv4	net: igmp: increase size of mr_ifc_count	2024-07-05 18:54:39 +02:00
ipv6	init: add dsm gpl source	2024-07-05 18:00:04 +02:00
iucv	net/af_iucv: remove WARN_ONCE on malformed RX packets	2021-03-07 12:34:05 +01:00
kcm	net: pass a sockptr_t into ->setsockopt	2020-07-24 15:41:54 -07:00
key	init: add dsm gpl source	2024-07-05 18:00:04 +02:00
l2tp	net: l2tp: reduce log level of messages in receive path, add counter instead	2021-03-17 17:06:11 +01:00
l3mdev	net: Fix some comments	2020-08-27 07:55:59 -07:00
lapb	net: lapb: Copy the skb before sending a packet	2021-02-10 09:29:14 +01:00
llc	net: llc: fix skb_over_panic	2024-07-05 18:04:53 +02:00
mac80211	mac80211: fix enabling 4-address mode on a sta vif after assoc	2024-07-05 18:04:07 +02:00
mac802154	net: mac802154: Fix general protection fault	2021-04-14 08:42:13 +02:00
mpls	net: avoid infinite loop in mpls_gso_segment when mpls_hlen == 0	2021-03-17 17:06:11 +01:00
mptcp	mptcp: fix warning in __skb_flow_dissect() when do syn cookie for subflow join	2021-07-28 14:35:34 +02:00
ncsi	net/ncsi: Avoid channel_monitor hrtimer deadlock	2021-04-14 08:42:08 +02:00
netfilter	netfilter: conntrack: collect all entries in one cycle	2024-07-05 18:56:55 +02:00
netlabel	netlabel: Fix memory leak in netlbl_mgmt_add_common	2021-07-14 16:56:22 +02:00
netlink	netlink: disable IRQs for netlink_lock_table()	2021-06-16 12:01:36 +02:00
netrom	netrom: Decrease sock refcount when sock timers expire	2021-07-28 14:35:38 +02:00
nfc	net/nfc/rawsock.c: fix a permission check bug	2021-06-16 12:01:35 +02:00
nsh
openvswitch	ovs: clear skb->tstamp in forwarding path	2024-07-05 18:55:47 +02:00
packet	init: add dsm gpl source	2024-07-05 18:00:04 +02:00
phonet	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
psample	net: psample: Fix netlink skb length with tunnel info	2021-03-07 12:34:07 +01:00
qrtr	net: qrtr: fix another OOB Read in qrtr_endpoint_post	2024-07-05 18:56:10 +02:00
rds	net/rds: dma_map_sg is entitled to merge entries	2024-07-05 19:00:50 +02:00
rfkill	rfkill: Fix use-after-free in rfkill_resume()	2020-11-12 09:18:06 +01:00
rose	rose: Fix Null pointer dereference in rose_send_frame()	2020-11-20 10:04:58 -08:00
rxrpc	rxrpc: Fix clearance of Tx/Rx ring when releasing a call	2021-02-17 11:02:28 +01:00
sched	net/sched: ets: fix crash when flipping from 'strict' to 'quantum'	2024-07-05 18:59:37 +02:00
sctp	sctp: move the active_key update after sh_keys is added	2024-07-05 18:52:08 +02:00
smc	net/smc: fix wait on already cleared link	2024-07-05 18:54:23 +02:00
strparser
sunrpc	init: add dsm gpl source	2024-07-05 18:00:04 +02:00
switchdev	net: switchdev: don't set port_obj_info->handled true when -EOPNOTSUPP	2021-02-07 15:37:12 +01:00
tipc	tipc: call tipc_wait_for_connect only when dlen is not 0	2024-07-05 19:00:51 +02:00
tls	tls: prevent oversized sendfile() hangs by ignoring MSG_MORE	2021-07-14 16:56:24 +02:00
unix	init: add dsm gpl source	2024-07-05 18:00:04 +02:00
vmw_vsock	vsock/virtio: avoid potential deadlock when vsock device remove	2024-07-05 18:54:39 +02:00
wimax	genetlink: move to smaller ops wherever possible	2020-10-02 19:11:11 -07:00
wireless	cfg80211: Fix possible memory leak in function cfg80211_bss_update	2024-07-05 18:03:16 +02:00
x25	net/x25: Return the correct errno code	2021-06-18 10:00:06 +02:00
xdp	xsk: Fix broken Tx ring validation	2021-07-14 16:56:23 +02:00
xfrm	net: xfrm: Fix end of loop tests for list_for_each_entry	2024-07-05 18:55:30 +02:00
compat.c	net: Return the correct errno code	2021-06-18 10:00:06 +02:00
devres.c	net: devres: rename the release callback of devm_register_netdev()	2020-06-30 15:57:34 -07:00
Kconfig	init: add dsm gpl source	2024-07-05 18:00:04 +02:00
Makefile
socket.c	net: don't unconditionally copy_from_user a struct ifreq for socket ioctls	2024-07-05 19:02:28 +02:00
sysctl_net.c