kernel-wide: fix missing validations on __get/__put/__copy_to/__copy_from_user()

[~andy/linux] / net / socket.c

diff --git a/net/socket.c b/net/socket.c
index b2d7c629eeb9f2de785600ed189080af9be02a3e..0ceaa5cb9ead7720bbc12921f658bf7658bc2729 100644 (file)
--- a/net/socket.c
+++ b/net/socket.c
@@ -3072,12 +3072,12 @@ static int compat_sioc_ifmap(struct net *net, unsigned int cmd,
 
        uifmap32 = &uifr32->ifr_ifru.ifru_map;
        err = copy_from_user(&ifr, uifr32, sizeof(ifr.ifr_name));
-       err |= __get_user(ifr.ifr_map.mem_start, &uifmap32->mem_start);
-       err |= __get_user(ifr.ifr_map.mem_end, &uifmap32->mem_end);
-       err |= __get_user(ifr.ifr_map.base_addr, &uifmap32->base_addr);
-       err |= __get_user(ifr.ifr_map.irq, &uifmap32->irq);
-       err |= __get_user(ifr.ifr_map.dma, &uifmap32->dma);
-       err |= __get_user(ifr.ifr_map.port, &uifmap32->port);
+       err |= get_user(ifr.ifr_map.mem_start, &uifmap32->mem_start);
+       err |= get_user(ifr.ifr_map.mem_end, &uifmap32->mem_end);
+       err |= get_user(ifr.ifr_map.base_addr, &uifmap32->base_addr);
+       err |= get_user(ifr.ifr_map.irq, &uifmap32->irq);
+       err |= get_user(ifr.ifr_map.dma, &uifmap32->dma);
+       err |= get_user(ifr.ifr_map.port, &uifmap32->port);
        if (err)
                return -EFAULT;
 
@@ -3088,12 +3088,12 @@ static int compat_sioc_ifmap(struct net *net, unsigned int cmd,
 
        if (cmd == SIOCGIFMAP && !err) {
                err = copy_to_user(uifr32, &ifr, sizeof(ifr.ifr_name));
-               err |= __put_user(ifr.ifr_map.mem_start, &uifmap32->mem_start);
-               err |= __put_user(ifr.ifr_map.mem_end, &uifmap32->mem_end);
-               err |= __put_user(ifr.ifr_map.base_addr, &uifmap32->base_addr);
-               err |= __put_user(ifr.ifr_map.irq, &uifmap32->irq);
-               err |= __put_user(ifr.ifr_map.dma, &uifmap32->dma);
-               err |= __put_user(ifr.ifr_map.port, &uifmap32->port);
+               err |= put_user(ifr.ifr_map.mem_start, &uifmap32->mem_start);
+               err |= put_user(ifr.ifr_map.mem_end, &uifmap32->mem_end);
+               err |= put_user(ifr.ifr_map.base_addr, &uifmap32->base_addr);
+               err |= put_user(ifr.ifr_map.irq, &uifmap32->irq);
+               err |= put_user(ifr.ifr_map.dma, &uifmap32->dma);
+               err |= put_user(ifr.ifr_map.port, &uifmap32->port);
                if (err)
                        err = -EFAULT;
        }
@@ -3167,25 +3167,25 @@ static int routing_ioctl(struct net *net, struct socket *sock,
                struct in6_rtmsg32 __user *ur6 = argp;
                ret = copy_from_user(&r6.rtmsg_dst, &(ur6->rtmsg_dst),
                        3 * sizeof(struct in6_addr));
-               ret |= __get_user(r6.rtmsg_type, &(ur6->rtmsg_type));
-               ret |= __get_user(r6.rtmsg_dst_len, &(ur6->rtmsg_dst_len));
-               ret |= __get_user(r6.rtmsg_src_len, &(ur6->rtmsg_src_len));
-               ret |= __get_user(r6.rtmsg_metric, &(ur6->rtmsg_metric));
-               ret |= __get_user(r6.rtmsg_info, &(ur6->rtmsg_info));
-               ret |= __get_user(r6.rtmsg_flags, &(ur6->rtmsg_flags));
-               ret |= __get_user(r6.rtmsg_ifindex, &(ur6->rtmsg_ifindex));
+               ret |= get_user(r6.rtmsg_type, &(ur6->rtmsg_type));
+               ret |= get_user(r6.rtmsg_dst_len, &(ur6->rtmsg_dst_len));
+               ret |= get_user(r6.rtmsg_src_len, &(ur6->rtmsg_src_len));
+               ret |= get_user(r6.rtmsg_metric, &(ur6->rtmsg_metric));
+               ret |= get_user(r6.rtmsg_info, &(ur6->rtmsg_info));
+               ret |= get_user(r6.rtmsg_flags, &(ur6->rtmsg_flags));
+               ret |= get_user(r6.rtmsg_ifindex, &(ur6->rtmsg_ifindex));
 
                r = (void *) &r6;
        } else { /* ipv4 */
                struct rtentry32 __user *ur4 = argp;
                ret = copy_from_user(&r4.rt_dst, &(ur4->rt_dst),
                                        3 * sizeof(struct sockaddr));
-               ret |= __get_user(r4.rt_flags, &(ur4->rt_flags));
-               ret |= __get_user(r4.rt_metric, &(ur4->rt_metric));
-               ret |= __get_user(r4.rt_mtu, &(ur4->rt_mtu));
-               ret |= __get_user(r4.rt_window, &(ur4->rt_window));
-               ret |= __get_user(r4.rt_irtt, &(ur4->rt_irtt));
-               ret |= __get_user(rtdev, &(ur4->rt_dev));
+               ret |= get_user(r4.rt_flags, &(ur4->rt_flags));
+               ret |= get_user(r4.rt_metric, &(ur4->rt_metric));
+               ret |= get_user(r4.rt_mtu, &(ur4->rt_mtu));
+               ret |= get_user(r4.rt_window, &(ur4->rt_window));
+               ret |= get_user(r4.rt_irtt, &(ur4->rt_irtt));
+               ret |= get_user(rtdev, &(ur4->rt_dev));
                if (rtdev) {
                        ret |= copy_from_user(devname, compat_ptr(rtdev), 15);
                        r4.rt_dev = (char __user __force *)devname;