From patchwork Fri Jan 7 20:37:55 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dan Carpenter X-Patchwork-Id: 77908 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 6B6D4B710D for ; Sat, 8 Jan 2011 07:38:22 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752071Ab1AGUiL (ORCPT ); Fri, 7 Jan 2011 15:38:11 -0500 Received: from mail-wy0-f174.google.com ([74.125.82.174]:46615 "EHLO mail-wy0-f174.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751972Ab1AGUiJ (ORCPT ); Fri, 7 Jan 2011 15:38:09 -0500 Received: by wyb28 with SMTP id 28so17750717wyb.19 for ; Fri, 07 Jan 2011 12:38:07 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:date:from:to:cc:subject :message-id:mime-version:content-type:content-disposition:user-agent; bh=0tvKj8zRf3NnAaBg4V5d2APnNn1aHuqDkld4bCg13Uc=; b=K6jX5HiikVy6+ZpP+7ELxYlw16+aGL+V3fZjD8om+5dG0g1Wv+4bJoMQWq/2Y5BT6y 81EAGDlLQEDaI3NiDEwXf0o6yW48tLbuz7AoFwHUYN5+PW1iqQ2it8gyu8xh8OwKrdCj eJoZAWCRB6ICtXurzfTLSJvc/8hWi1JrRqrGo= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=date:from:to:cc:subject:message-id:mime-version:content-type :content-disposition:user-agent; b=Gq2nZbQX7Wze739VQ/fP3MQC61DfQLqrp9GFcu/XZGCnD+E/JJCgj+MVqR1xd1QAMW Q/TsgsjJv7pfurdXI9HOJEtr0Wb0GXRiHDpEnb9MzRc5/CX/QnZbVV0DK+qoQHEWHkUy 6WjLbBdVUgbrfxI8d7a5YB4lGF48in5OdD/Bc= Received: by 10.227.179.77 with SMTP id bp13mr16212964wbb.226.1294432687606; Fri, 07 Jan 2011 12:38:07 -0800 (PST) Received: from bicker ([41.202.225.145]) by mx.google.com with ESMTPS id o51sm12649186wes.15.2011.01.07.12.38.03 (version=TLSv1/SSLv3 cipher=RC4-MD5); Fri, 07 Jan 2011 12:38:06 -0800 (PST) Date: Fri, 7 Jan 2011 23:37:55 +0300 From: Dan Carpenter To: Remi Denis-Courmont Cc: "David S. Miller" , netdev@vger.kernel.org, kernel-janitors@vger.kernel.org, dan.j.rosenberg@gmail.com Subject: [patch] phonet: some signedness bugs Message-ID: <20110107203755.GB1959@bicker> MIME-Version: 1.0 Content-Disposition: inline User-Agent: Mutt/1.5.20 (2009-06-14) Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Dan Rosenberg pointed out that there were some signed comparison bugs in the phonet protocol. http://marc.info/?l=full-disclosure&m=129424528425330&w=2 If you have already have CAP_SYS_ADMIN then you could use the bugs to get root, or someone could cause an oops by mistake. Signed-off-by: Dan Carpenter --- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/include/net/phonet/phonet.h b/include/net/phonet/phonet.h index d5df797..5395e09 100644 --- a/include/net/phonet/phonet.h +++ b/include/net/phonet/phonet.h @@ -107,8 +107,8 @@ struct phonet_protocol { int sock_type; }; -int phonet_proto_register(int protocol, struct phonet_protocol *pp); -void phonet_proto_unregister(int protocol, struct phonet_protocol *pp); +int phonet_proto_register(unsigned int protocol, struct phonet_protocol *pp); +void phonet_proto_unregister(unsigned int protocol, struct phonet_protocol *pp); int phonet_sysctl_init(void); void phonet_sysctl_exit(void); diff --git a/net/phonet/af_phonet.c b/net/phonet/af_phonet.c index fd95beb..c627d2e 100644 --- a/net/phonet/af_phonet.c +++ b/net/phonet/af_phonet.c @@ -37,7 +37,7 @@ /* Transport protocol registration */ static struct phonet_protocol *proto_tab[PHONET_NPROTO] __read_mostly; -static struct phonet_protocol *phonet_proto_get(int protocol) +static struct phonet_protocol *phonet_proto_get(unsigned int protocol) { struct phonet_protocol *pp; @@ -60,8 +60,8 @@ static inline void phonet_proto_put(struct phonet_protocol *pp) /* protocol family functions */ -static int pn_socket_create(struct net *net, struct socket *sock, int protocol, - int kern) +static int pn_socket_create(struct net *net, struct socket *sock, + unsigned int protocol, int kern) { struct sock *sk; struct pn_sock *pn; @@ -458,7 +458,7 @@ static struct packet_type phonet_packet_type __read_mostly = { static DEFINE_MUTEX(proto_tab_lock); -int __init_or_module phonet_proto_register(int protocol, +int __init_or_module phonet_proto_register(unsigned int protocol, struct phonet_protocol *pp) { int err = 0; @@ -481,7 +481,7 @@ int __init_or_module phonet_proto_register(int protocol, } EXPORT_SYMBOL(phonet_proto_register); -void phonet_proto_unregister(int protocol, struct phonet_protocol *pp) +void phonet_proto_unregister(unsigned int protocol, struct phonet_protocol *pp) { mutex_lock(&proto_tab_lock); BUG_ON(proto_tab[protocol] != pp);