Check for SOL_SOCKET in compat_sys_getsockopt

compat_sys_getsockopt checks for SO_RCVTIMEO/SO_SNDTIMEO without making sure that the level is actually SOL_SOCKET. This can break getsockopt() requests for other protocols.

Cheers, and a happy new year to everyone!
Olaf

Olaf Kirch     | Things that make Monday morning interesting, #2:
[email protected]   |        "We have 8,000 NFS mount points, why do we keep
---------------+ 	 running out of privileged ports?"

Subject: check for SOL_SOCKET in compat_sys_getsocket

compat_sys_getsockopt checks for SO_RCVTIMEO/SO_SNDTIMEO without making sure that the level is actually SOL_SOCKET. This can break getsockopt() requests for other protocols.

Index: linux-2.6.9/net/compat.c
===================================================================
@@ -507,7 +507,8 @@ static int do_get_sock_timeout(int fd, i
 asmlinkage long compat_sys_getsockopt(int fd, int level, int optname,
 				char __user *optval, int __user *optlen)
 {
-	if (optname == SO_RCVTIMEO || optname == SO_SNDTIMEO)
+	if (level == SOL_SOCKET &&
+	    (optname == SO_RCVTIMEO || optname == SO_SNDTIMEO))
 		return do_get_sock_timeout(fd, level, optname, optval, optlen);
 	return sys_getsockopt(fd, level, optname, optval, optlen);
 }

It's a band-aid, not a fix. Trying to do the conversion in compat_sys_getsockopt() for _all_ possible sockopts is broken.

I think we need to let each protocol offer compat [gs]etsockopt() methods of its own, or at least have the existing [gs]etsockopt() methods check whether the current process is 32-bit or 64-bit and do the right thing.

Have you started looking at netfilter with 32-bit userspace yet? :)

dwmw2