Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9c1176b6 authored by Stefan Richter's avatar Stefan Richter
Browse files

firewire: cdev: fix 32 bit userland on 64 bit kernel compat corner cases 



Clemens points out that we need to use compat_ptr() in order to safely
cast from u64 to addresses of a 32-bit usermode client.

Before, our conversion went wrong
  - in practice if the client cast from pointer to integer such that
    sign-extension happened, (libraw1394 and libdc1394 at least were not
    doing that, IOW were not affected)
or
  - in theory on s390 (which doesn't have FireWire though) and on the
    tile architecture, regardless of what the client does.
The bug would usually be observed as the initial get_info ioctl failing
with "Bad address" (EFAULT).

Reported-by: default avatarCarl Karsten <carl@personnelware.com>
Reported-by: default avatarClemens Ladisch <clemens@ladisch.de>
Signed-off-by: default avatarStefan Richter <stefanr@s5r6.in-berlin.de>
parent 9a00c24a

drivers/firewire/core-cdev.c

+21 −3
Original line number Diff line number Diff line
@@ -216,15 +216,33 @@ struct inbound_phy_packet_event { 
	struct fw_cdev_event_phy_packet phy_packet;

};



static inline void __user *u64_to_uptr(__u64 value)

#ifdef CONFIG_COMPAT

static void __user *u64_to_uptr(u64 value)

{

	if (is_compat_task())

		return compat_ptr(value);

	else

		return (void __user *)(unsigned long)value;

}



static u64 uptr_to_u64(void __user *ptr)

{

	if (is_compat_task())

		return ptr_to_compat(ptr);

	else

		return (u64)(unsigned long)ptr;

}

#else

static inline void __user *u64_to_uptr(u64 value)

{

	return (void __user *)(unsigned long)value;

}



static inline __u64 uptr_to_u64(void __user *ptr)

static inline u64 uptr_to_u64(void __user *ptr)

{

	return (__u64)(unsigned long)ptr;

	return (u64)(unsigned long)ptr;

}

#endif /* CONFIG_COMPAT */



static int fw_device_op_open(struct inode *inode, struct file *file)

{