On Thu, 2019-10-17 at 16:33 +0200, Arnd Bergmann wrote:
> On Thu, Oct 17, 2019 at 3:42 PM Ben Hutchings
> <ben.hutchings@xxxxxxxxxxxxxxx> wrote:
> > On Wed, 2019-10-09 at 21:10 +0200, Arnd Bergmann wrote:
> > > We no longer need the rtc compat handling to be in common code, now that
> > > all drivers are either moved to the rtc-class framework, or (rarely)
> > > exist in drivers/char for architectures without compat mode (m68k,
> > > alpha and ia64, respectively).
> > >
> > > I checked the list of ioctl commands in drivers, and the ones that are
> > > not already handled are all compatible, again with the one exception of
> > > m68k driver, which implements RTC_PLL_GET and RTC_PLL_SET, but has no
> > > compat mode.
> > >
> > > Since the ioctl commands are either compatible or differ in both structure
> > > and command code between 32-bit and 64-bit, we can merge the compat
> > > handler into the native one and just implement the two common compat
> > > commands (RTC_IRQP_READ, RTC_IRQP_SET) there.
> > [...]
> >
> > I don't think this can work properly on s390, because some of them take
> > integers and some take pointers.
>
> Thanks a lot for taking a look at the patch and pointing this out!
>
> I don't remember how I got to this, either I missed the problem or I
> decided that it was ok, since it will still do the right thing:
> On s390 only the highest bit is cleared in a pointer value, and we
> ensure that the RTC_IRQP_SET argument is between 1 and 8192.
>
> Passing a value of (0x80000000 + n) where n is in the valid range
> would lead to the call succeeding unexpectedly on compat s390
> (if it had an RTC, which it does not) which is clearly not good but
> mostly harmless. I certainly had not considered this case.
>
> However, looking at this again after your comment I found a rather
> more serious bug in my new RTC_IRQP_SET handling: Any 64-bit
> machine can now bypass the permission check for RTC_IRQP_SET by
> calling RTC_IRQP_SET32 instead.
>
> I'll fix it both issues by adding a rtc_compat_dev_ioctl() to handle
> RTC_IRQP_SET32/RTC_IRQP_READ32:
Reviewed-by: Ben Hutchings <ben.hutchings@xxxxxxxxxxxxxxx>
> diff --git a/drivers/rtc/dev.c b/drivers/rtc/dev.c
> index 1dc5063f78c9..9e4fd5088ead 100644
> --- a/drivers/rtc/dev.c
> +++ b/drivers/rtc/dev.c
> @@ -358,16 +358,6 @@ static long rtc_dev_ioctl(struct file *file,
> mutex_unlock(&rtc->ops_lock);
> return rtc_update_irq_enable(rtc, 0);
>
> -#ifdef CONFIG_64BIT
> -#define RTC_IRQP_SET32 _IOW('p', 0x0c, __u32)
> -#define RTC_IRQP_READ32 _IOR('p', 0x0b, __u32)
> - case RTC_IRQP_SET32:
> - err = rtc_irq_set_freq(rtc, arg);
> - break;
> - case RTC_IRQP_READ32:
> - err = put_user(rtc->irq_freq, (unsigned int __user *)uarg);
> - break;
> -#endif
> case RTC_IRQP_SET:
> err = rtc_irq_set_freq(rtc, arg);
> break;
> @@ -409,6 +399,29 @@ static long rtc_dev_ioctl(struct file *file,
> return err;
> }
>
> +#ifdef CONFIG_COMPAT
> +#define RTC_IRQP_SET32 _IOW('p', 0x0c, __u32)
> +#define RTC_IRQP_READ32 _IOR('p', 0x0b, __u32)
> +
> +static long rtc_dev_compat_ioctl(struct file *file,
> + unsigned int cmd, unsigned long arg)
> +{
> + struct rtc_device *rtc = file->private_data;
> + void __user *uarg = compat_ptr(arg);
> +
> + switch (cmd) {
> + case RTC_IRQP_READ32:
> + return put_user(rtc->irq_freq, (__u32 __user *)uarg);
> +
> + case RTC_IRQP_SET32:
> + /* arg is a plain integer, not pointer */
> + return rtc_dev_ioctl(file, RTC_IRQP_SET, arg);
> + }
> +
> + return rtc_dev_ioctl(file, cmd, (unsigned long)uarg);
> +}
> +#endif
> +
> static int rtc_dev_fasync(int fd, struct file *file, int on)
> {
> struct rtc_device *rtc = file->private_data;
> @@ -444,7 +457,7 @@ static const struct file_operations rtc_dev_fops = {
> .read = rtc_dev_read,
> .poll = rtc_dev_poll,
> .unlocked_ioctl = rtc_dev_ioctl,
> - .compat_ioctl = compat_ptr_ioctl,
> + .compat_ioctl = rtc_dev_compat_ioctl,
> .open = rtc_dev_open,
> .release = rtc_dev_release,
> .fasync = rtc_dev_fasync,
>
> If you and Alexandre are both happy with this version, I'll fold it into
> my original patch.
>
> Arnd
>
--
Ben Hutchings, Software Developer Codethink Ltd
https://www.codethink.co.uk/ Dale House, 35 Dale Street
Manchester, M1 2HF, United Kingdom
