Skip to contentSkip to conversation

unix_diag: fix incorrect sign extension in unix_lookup_by_ino

PATCH In review Dmitry V. Levin 3 participants 3 messages Feb 19, 2016 – Feb 20, 2016

Subsystems (3)
Networking Network drivers Networking unix sockets
lore
Share & tools
lore

Dmitry V. Levin

author
#0 lore raw

PATCH 1/1 unix_diag: fix incorrect sign extension in unix_lookup_by_ino

The value passed by unix_diag_get_exact to unix_lookup_by_ino has type __u32, but unix_lookup_by_ino's argument ino has type int, which is not a problem yet.
However, when ino is compared with sock_i_ino return value of type unsigned long, ino is sign extended to signed long, and this results to incorrect comparison on 64-bit architectures for inode numbers greater than INT_MAX.

This bug was found by strace test suite.

Signed-off-by Dmitry V. Levin <[email protected]>
Cc <[email protected]>
---
 net/unix/diag.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
net/unix/diag.c +1 -1
index c512f64..4d96797 100644
@@ -220,23 +220,23 @@ done:
 	return skb->len;
 }
 
-static struct sock *unix_lookup_by_ino(int ino)
+static struct sock *unix_lookup_by_ino(unsigned int ino)
 {
 	int i;
 	struct sock *sk;
 
 	spin_lock(&unix_table_lock);
 	for (i = 0; i < ARRAY_SIZE(unix_socket_table); i++) {
 		sk_for_each(sk, &unix_socket_table[i])
 			if (ino == sock_i_ino(sk)) {
 				sock_hold(sk);
 				spin_unlock(&unix_table_lock);
 
 				return sk;
 			}
 	}
 
 	spin_unlock(&unix_table_lock);
 	return NULL;
 }
Signature · 1 line
ldv
Acked-by on v1 1/1
#1 lore raw
Quoted 8 lines · Dmitry V. Levin

The value passed by unix_diag_get_exact to unix_lookup_by_ino has type __u32, but unix_lookup_by_ino's argument ino has type int, which is not a problem yet.
However, when ino is compared with sock_i_ino return value of type unsigned long, ino is sign extended to signed long, and this results to incorrect comparison on 64-bit architectures for inode numbers greater than INT_MAX.

Quoted 4 lines

This bug was found by strace test suite.

Signed-off-by Dmitry V. Levin <[email protected]>
Cc <[email protected]>
Fixes 5d3cae8bc39d ("unix_diag: Dumping exact socket core")
Acked-by Cong Wang <[email protected]>

Thanks.

maintainer
#2 lore raw

From: Cong Wang <[email protected]>
Date: Fri, 19 Feb 2016 16:21:14 -0800

Quoted 9 lines · Dmitry V. Levin
Quoted 8 lines

The value passed by unix_diag_get_exact to unix_lookup_by_ino has type __u32, but unix_lookup_by_ino's argument ino has type int, which is not a problem yet.
However, when ino is compared with sock_i_ino return value of type unsigned long, ino is sign extended to signed long, and this results to incorrect comparison on 64-bit architectures for inode numbers greater than INT_MAX.

Quoted 7 lines
Quoted 4 lines

This bug was found by strace test suite.

Signed-off-by Dmitry V. Levin <[email protected]>
Cc <[email protected]>
Fixes 5d3cae8bc39d ("unix_diag: Dumping exact socket core")
Acked-by Cong Wang <[email protected]>

Applied and queued up for -stable.