Skip to content

Commit

Permalink
firewire: cdev: fix 32 bit userland on 64 bit kernel compat corner cases
Browse files Browse the repository at this point in the history
Clemens points out that we need to use compat_ptr() in order to safely
cast from u64 to addresses of a 32-bit usermode client.

Before, our conversion went wrong
  - in practice if the client cast from pointer to integer such that
    sign-extension happened, (libraw1394 and libdc1394 at least were not
    doing that, IOW were not affected)
or
  - in theory on s390 (which doesn't have FireWire though) and on the
    tile architecture, regardless of what the client does.
The bug would usually be observed as the initial get_info ioctl failing
with "Bad address" (EFAULT).

Reported-by: Carl Karsten <carl@personnelware.com>
Reported-by: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
  • Loading branch information
Stefan Richter committed Aug 12, 2011
1 parent 9a00c24 commit 9c1176b
Showing 1 changed file with 21 additions and 3 deletions.
24 changes: 21 additions & 3 deletions drivers/firewire/core-cdev.c
Original file line number Diff line number Diff line change
Expand Up @@ -216,15 +216,33 @@ struct inbound_phy_packet_event {
struct fw_cdev_event_phy_packet phy_packet;
};

static inline void __user *u64_to_uptr(__u64 value)
#ifdef CONFIG_COMPAT
static void __user *u64_to_uptr(u64 value)
{
if (is_compat_task())
return compat_ptr(value);
else
return (void __user *)(unsigned long)value;
}

static u64 uptr_to_u64(void __user *ptr)
{
if (is_compat_task())
return ptr_to_compat(ptr);
else
return (u64)(unsigned long)ptr;
}
#else
static inline void __user *u64_to_uptr(u64 value)
{
return (void __user *)(unsigned long)value;
}

static inline __u64 uptr_to_u64(void __user *ptr)
static inline u64 uptr_to_u64(void __user *ptr)
{
return (__u64)(unsigned long)ptr;
return (u64)(unsigned long)ptr;
}
#endif /* CONFIG_COMPAT */

static int fw_device_op_open(struct inode *inode, struct file *file)
{
Expand Down

0 comments on commit 9c1176b

Please sign in to comment.