New: On big-endian machines getsockopt returns 0 (via optval) for optlen==1 when returned value should 255
Subsystems (3)
A message that is not in the archive (sent off-list or not yet received): [email protected]/
Quoted 59 lines · On Mon, 31 Mar 2008 08:16:05 -0700 (PDT) [email protected] wrote:
http://bugzilla.kernel.org/show_bug.cgi?id=10371
Summary: On big-endian machines getsockopt returns 0 (via optval) for optlen==1 when returned value should 255 Product: Networking Version: 2.5 KernelVersion: 2.6.24 Platform: All OS/Version: Linux Tree: Mainline Status: NEW Severity: normal Priority: P1 Component: IPV4 AssignedTo: [email protected] ReportedBy: [email protected]Latest working kernel version:
Earliest failing kernel version: all 2.6
Distribution:
Hardware Environment:
Software Environment:
Problem Description:On big-endian machines getsockopt fails for optlen==1 when returned value is 255.
Eg. after calling
unsigned char ttl = 255;
socklen_tlen = sizeof(ttl);
setsockopt(socket, IPPROTO_IP, IP_MULTICAST_TTL, &ttl, &len);
the following call will fail:
getsockopt(socket, IPPROTO_IP, IP_MULTICAST_TTL, &ttl, &len);
"ttl" returned will be 0.It's because of bug in /net/ipv4/ip_sockglue.c:
static int do_ip_getsockopt(struct sock *sk, int level, int optname,
char__user*optval, int__user*optlen)
....if (len < sizeof(int) && len > 0 && val>=0 && val<255) { unsigned char ucval = (unsigned char)val; len = 1; if (put_user(len, optlen)) return -EFAULT; if (copy_to_user(optval,&ucval,1)) return -EFAULT; } else { len = min_t(unsigned int, sizeof(int), len); if (put_user(len, optlen)) return -EFAULT; if (copy_to_user(optval,&val,len)) return -EFAULT; } return 0; }The comparision in if-statement should be:
Quoted 9 lines
if (len < sizeof(int) && len > 0 && val>=0 && val<=255)Otherwise on big-endian machines
copy_to_user(optval,&val,len)routine copies first (highest) byte which is 0 in that case.This bug does not occur on low-endian machines since
copy_to_user(optval,&val,len)copies right (lowest) byte in that case.
You've done all the hard work - please email us a tested patch?
David Miller
maintainerFrom: Andrew Morton <[email protected]>
Date: Mon, 31 Mar 2008 11:33:49 -0700
Quoted 3 lines · On Mon, 31 Mar 2008 08:16:05 -0700 (PDT) [email protected] wrote:
Quoted 2 lines
...
Quoted 1 line
You've done all the hard work - please email us a tested patch?
I've checked in the following fix for this bug, thanks!
commit 951e07c930f5f66b676eaa4c32a1b0d8e2d7d06a
Author: David S. Miller <[email protected]> Date: Thu Apr 10 01:29:36 2008 -0700
[IPV4]: Fix byte value boundary check in do_ip_getsockopt().
This fixes kernel bugzilla 10371.
As reported by [email protected], if we try to grab a char sized socket option value, as in:
unsigned char ttl = 255;
socklen_t len = sizeof(ttl);
setsockopt(socket, IPPROTO_IP, IP_MULTICAST_TTL, &ttl, &len);
getsockopt(socket, IPPROTO_IP, IP_MULTICAST_TTL, &ttl, &len);
The ttl returned will be wrong on big-endian, and on both little- endian and big-endian the next three bytes in userspace are written with garbage.
It's because of this test in do_ip_getsockopt():
if (len < sizeof(int) && len > 0 && val>=0 && val<255) {
It should allow a 'val' of 255 to pass here, but it doesn't so it copies a full 'int' back to userspace.
On little-endian that will write the correct value into the location but it spams on the next three bytes in userspace. On big endian it writes the wrong value into the location and spams the next three bytes.
net/ipv4/ip_sockglue.c +1 -1
@@ -1132,7 +1132,7 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname, }release_sock (sk); -if (len <sizeof (int ) && len >0 && val>=0 && val<255 ) { +if (len <sizeof (int ) && len >0 && val>=0 && val<=255 ) {unsigned char ucval = (unsigned char )val; len =1 ;if (put_user (len, optlen))