| Message ID | 20160219012748.GA17251@altlinux.org |
|---|---|
| State | Accepted, archived |
| Delegated to: | David Miller |
| Headers | show |
On Thu, Feb 18, 2016 at 5:27 PM, Dmitry V. Levin <ldv@altlinux.org> wrote: > The value passed by unix_diag_get_exact to unix_lookup_by_ino has type > __u32, but unix_lookup_by_ino's argument ino has type int, which is not > a problem yet. > However, when ino is compared with sock_i_ino return value of type > unsigned long, ino is sign extended to signed long, and this results > to incorrect comparison on 64-bit architectures for inode numbers > greater than INT_MAX. > > This bug was found by strace test suite. > > Signed-off-by: Dmitry V. Levin <ldv@altlinux.org> > Cc: <stable@vger.kernel.org> Fixes: 5d3cae8bc39d ("unix_diag: Dumping exact socket core") Acked-by: Cong Wang <xiyou.wangcong@gmail.com> Thanks.
From: Cong Wang <xiyou.wangcong@gmail.com> Date: Fri, 19 Feb 2016 16:21:14 -0800 > On Thu, Feb 18, 2016 at 5:27 PM, Dmitry V. Levin <ldv@altlinux.org> wrote: >> The value passed by unix_diag_get_exact to unix_lookup_by_ino has type >> __u32, but unix_lookup_by_ino's argument ino has type int, which is not >> a problem yet. >> However, when ino is compared with sock_i_ino return value of type >> unsigned long, ino is sign extended to signed long, and this results >> to incorrect comparison on 64-bit architectures for inode numbers >> greater than INT_MAX. >> >> This bug was found by strace test suite. >> >> Signed-off-by: Dmitry V. Levin <ldv@altlinux.org> >> Cc: <stable@vger.kernel.org> > > Fixes: 5d3cae8bc39d ("unix_diag: Dumping exact socket core") > Acked-by: Cong Wang <xiyou.wangcong@gmail.com> Applied and queued up for -stable.
diff --git a/net/unix/diag.c b/net/unix/diag.c index c512f64..4d96797 100644 --- a/net/unix/diag.c +++ b/net/unix/diag.c @@ -220,23 +220,23 @@ done: return skb->len; } -static struct sock *unix_lookup_by_ino(int ino) +static struct sock *unix_lookup_by_ino(unsigned int ino) { int i; struct sock *sk; spin_lock(&unix_table_lock); for (i = 0; i < ARRAY_SIZE(unix_socket_table); i++) { sk_for_each(sk, &unix_socket_table[i]) if (ino == sock_i_ino(sk)) { sock_hold(sk); spin_unlock(&unix_table_lock); return sk; } } spin_unlock(&unix_table_lock); return NULL; }
The value passed by unix_diag_get_exact to unix_lookup_by_ino has type __u32, but unix_lookup_by_ino's argument ino has type int, which is not a problem yet. However, when ino is compared with sock_i_ino return value of type unsigned long, ino is sign extended to signed long, and this results to incorrect comparison on 64-bit architectures for inode numbers greater than INT_MAX. This bug was found by strace test suite. Signed-off-by: Dmitry V. Levin <ldv@altlinux.org> Cc: <stable@vger.kernel.org> --- net/unix/diag.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)