xref: /openbmc/linux/net/compat.c (revision 06267eb2)
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * 32bit Socket syscall emulation. Based on arch/sparc64/kernel/sys_sparc32.c.
4  *
5  * Copyright (C) 2000		VA Linux Co
6  * Copyright (C) 2000		Don Dugger <n0ano@valinux.com>
7  * Copyright (C) 1999 		Arun Sharma <arun.sharma@intel.com>
8  * Copyright (C) 1997,1998 	Jakub Jelinek (jj@sunsite.mff.cuni.cz)
9  * Copyright (C) 1997 		David S. Miller (davem@caip.rutgers.edu)
10  * Copyright (C) 2000		Hewlett-Packard Co.
11  * Copyright (C) 2000		David Mosberger-Tang <davidm@hpl.hp.com>
12  * Copyright (C) 2000,2001	Andi Kleen, SuSE Labs
13  */
14 
15 #include <linux/kernel.h>
16 #include <linux/gfp.h>
17 #include <linux/fs.h>
18 #include <linux/types.h>
19 #include <linux/file.h>
20 #include <linux/icmpv6.h>
21 #include <linux/socket.h>
22 #include <linux/syscalls.h>
23 #include <linux/filter.h>
24 #include <linux/compat.h>
25 #include <linux/security.h>
26 #include <linux/audit.h>
27 #include <linux/export.h>
28 
29 #include <net/scm.h>
30 #include <net/sock.h>
31 #include <net/ip.h>
32 #include <net/ipv6.h>
33 #include <linux/uaccess.h>
34 #include <net/compat.h>
35 
36 int __get_compat_msghdr(struct msghdr *kmsg,
37 			struct compat_msghdr *msg,
38 			struct sockaddr __user **save_addr)
39 {
40 	ssize_t err;
41 
42 	kmsg->msg_flags = msg->msg_flags;
43 	kmsg->msg_namelen = msg->msg_namelen;
44 
45 	if (!msg->msg_name)
46 		kmsg->msg_namelen = 0;
47 
48 	if (kmsg->msg_namelen < 0)
49 		return -EINVAL;
50 
51 	if (kmsg->msg_namelen > sizeof(struct sockaddr_storage))
52 		kmsg->msg_namelen = sizeof(struct sockaddr_storage);
53 
54 	kmsg->msg_control_is_user = true;
55 	kmsg->msg_get_inq = 0;
56 	kmsg->msg_control_user = compat_ptr(msg->msg_control);
57 	kmsg->msg_controllen = msg->msg_controllen;
58 
59 	if (save_addr)
60 		*save_addr = compat_ptr(msg->msg_name);
61 
62 	if (msg->msg_name && kmsg->msg_namelen) {
63 		if (!save_addr) {
64 			err = move_addr_to_kernel(compat_ptr(msg->msg_name),
65 						  kmsg->msg_namelen,
66 						  kmsg->msg_name);
67 			if (err < 0)
68 				return err;
69 		}
70 	} else {
71 		kmsg->msg_name = NULL;
72 		kmsg->msg_namelen = 0;
73 	}
74 
75 	if (msg->msg_iovlen > UIO_MAXIOV)
76 		return -EMSGSIZE;
77 
78 	kmsg->msg_iocb = NULL;
79 	kmsg->msg_ubuf = NULL;
80 	return 0;
81 }
82 
83 int get_compat_msghdr(struct msghdr *kmsg,
84 		      struct compat_msghdr __user *umsg,
85 		      struct sockaddr __user **save_addr,
86 		      struct iovec **iov)
87 {
88 	struct compat_msghdr msg;
89 	ssize_t err;
90 
91 	if (copy_from_user(&msg, umsg, sizeof(*umsg)))
92 		return -EFAULT;
93 
94 	err = __get_compat_msghdr(kmsg, &msg, save_addr);
95 	if (err)
96 		return err;
97 
98 	err = import_iovec(save_addr ? READ : WRITE, compat_ptr(msg.msg_iov), msg.msg_iovlen,
99 			   UIO_FASTIOV, iov, &kmsg->msg_iter);
100 	return err < 0 ? err : 0;
101 }
102 
103 /* Bleech... */
104 #define CMSG_COMPAT_ALIGN(len)	ALIGN((len), sizeof(s32))
105 
106 #define CMSG_COMPAT_DATA(cmsg)				\
107 	((void __user *)((char __user *)(cmsg) + sizeof(struct compat_cmsghdr)))
108 #define CMSG_COMPAT_SPACE(len)				\
109 	(sizeof(struct compat_cmsghdr) + CMSG_COMPAT_ALIGN(len))
110 #define CMSG_COMPAT_LEN(len)				\
111 	(sizeof(struct compat_cmsghdr) + (len))
112 
113 #define CMSG_COMPAT_FIRSTHDR(msg)			\
114 	(((msg)->msg_controllen) >= sizeof(struct compat_cmsghdr) ?	\
115 	 (struct compat_cmsghdr __user *)((msg)->msg_control) :		\
116 	 (struct compat_cmsghdr __user *)NULL)
117 
118 #define CMSG_COMPAT_OK(ucmlen, ucmsg, mhdr) \
119 	((ucmlen) >= sizeof(struct compat_cmsghdr) && \
120 	 (ucmlen) <= (unsigned long) \
121 	 ((mhdr)->msg_controllen - \
122 	  ((char __user *)(ucmsg) - (char __user *)(mhdr)->msg_control_user)))
123 
124 static inline struct compat_cmsghdr __user *cmsg_compat_nxthdr(struct msghdr *msg,
125 		struct compat_cmsghdr __user *cmsg, int cmsg_len)
126 {
127 	char __user *ptr = (char __user *)cmsg + CMSG_COMPAT_ALIGN(cmsg_len);
128 	if ((unsigned long)(ptr + 1 - (char __user *)msg->msg_control) >
129 			msg->msg_controllen)
130 		return NULL;
131 	return (struct compat_cmsghdr __user *)ptr;
132 }
133 
134 /* There is a lot of hair here because the alignment rules (and
135  * thus placement) of cmsg headers and length are different for
136  * 32-bit apps.  -DaveM
137  */
138 int cmsghdr_from_user_compat_to_kern(struct msghdr *kmsg, struct sock *sk,
139 			       unsigned char *stackbuf, int stackbuf_size)
140 {
141 	struct compat_cmsghdr __user *ucmsg;
142 	struct cmsghdr *kcmsg, *kcmsg_base;
143 	compat_size_t ucmlen;
144 	__kernel_size_t kcmlen, tmp;
145 	int err = -EFAULT;
146 
147 	BUILD_BUG_ON(sizeof(struct compat_cmsghdr) !=
148 		     CMSG_COMPAT_ALIGN(sizeof(struct compat_cmsghdr)));
149 
150 	kcmlen = 0;
151 	kcmsg_base = kcmsg = (struct cmsghdr *)stackbuf;
152 	ucmsg = CMSG_COMPAT_FIRSTHDR(kmsg);
153 	while (ucmsg != NULL) {
154 		if (get_user(ucmlen, &ucmsg->cmsg_len))
155 			return -EFAULT;
156 
157 		/* Catch bogons. */
158 		if (!CMSG_COMPAT_OK(ucmlen, ucmsg, kmsg))
159 			return -EINVAL;
160 
161 		tmp = ((ucmlen - sizeof(*ucmsg)) + sizeof(struct cmsghdr));
162 		tmp = CMSG_ALIGN(tmp);
163 		kcmlen += tmp;
164 		ucmsg = cmsg_compat_nxthdr(kmsg, ucmsg, ucmlen);
165 	}
166 	if (kcmlen == 0)
167 		return -EINVAL;
168 
169 	/* The kcmlen holds the 64-bit version of the control length.
170 	 * It may not be modified as we do not stick it into the kmsg
171 	 * until we have successfully copied over all of the data
172 	 * from the user.
173 	 */
174 	if (kcmlen > stackbuf_size)
175 		kcmsg_base = kcmsg = sock_kmalloc(sk, kcmlen, GFP_KERNEL);
176 	if (kcmsg == NULL)
177 		return -ENOMEM;
178 
179 	/* Now copy them over neatly. */
180 	memset(kcmsg, 0, kcmlen);
181 	ucmsg = CMSG_COMPAT_FIRSTHDR(kmsg);
182 	while (ucmsg != NULL) {
183 		struct compat_cmsghdr cmsg;
184 		if (copy_from_user(&cmsg, ucmsg, sizeof(cmsg)))
185 			goto Efault;
186 		if (!CMSG_COMPAT_OK(cmsg.cmsg_len, ucmsg, kmsg))
187 			goto Einval;
188 		tmp = ((cmsg.cmsg_len - sizeof(*ucmsg)) + sizeof(struct cmsghdr));
189 		if ((char *)kcmsg_base + kcmlen - (char *)kcmsg < CMSG_ALIGN(tmp))
190 			goto Einval;
191 		kcmsg->cmsg_len = tmp;
192 		kcmsg->cmsg_level = cmsg.cmsg_level;
193 		kcmsg->cmsg_type = cmsg.cmsg_type;
194 		tmp = CMSG_ALIGN(tmp);
195 		if (copy_from_user(CMSG_DATA(kcmsg),
196 				   CMSG_COMPAT_DATA(ucmsg),
197 				   (cmsg.cmsg_len - sizeof(*ucmsg))))
198 			goto Efault;
199 
200 		/* Advance. */
201 		kcmsg = (struct cmsghdr *)((char *)kcmsg + tmp);
202 		ucmsg = cmsg_compat_nxthdr(kmsg, ucmsg, cmsg.cmsg_len);
203 	}
204 
205 	/*
206 	 * check the length of messages copied in is the same as the
207 	 * what we get from the first loop
208 	 */
209 	if ((char *)kcmsg - (char *)kcmsg_base != kcmlen)
210 		goto Einval;
211 
212 	/* Ok, looks like we made it.  Hook it up and return success. */
213 	kmsg->msg_control = kcmsg_base;
214 	kmsg->msg_controllen = kcmlen;
215 	return 0;
216 
217 Einval:
218 	err = -EINVAL;
219 Efault:
220 	if (kcmsg_base != (struct cmsghdr *)stackbuf)
221 		sock_kfree_s(sk, kcmsg_base, kcmlen);
222 	return err;
223 }
224 
225 int put_cmsg_compat(struct msghdr *kmsg, int level, int type, int len, void *data)
226 {
227 	struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __user *) kmsg->msg_control;
228 	struct compat_cmsghdr cmhdr;
229 	struct old_timeval32 ctv;
230 	struct old_timespec32 cts[3];
231 	int cmlen;
232 
233 	if (cm == NULL || kmsg->msg_controllen < sizeof(*cm)) {
234 		kmsg->msg_flags |= MSG_CTRUNC;
235 		return 0; /* XXX: return error? check spec. */
236 	}
237 
238 	if (!COMPAT_USE_64BIT_TIME) {
239 		if (level == SOL_SOCKET && type == SO_TIMESTAMP_OLD) {
240 			struct __kernel_old_timeval *tv = (struct __kernel_old_timeval *)data;
241 			ctv.tv_sec = tv->tv_sec;
242 			ctv.tv_usec = tv->tv_usec;
243 			data = &ctv;
244 			len = sizeof(ctv);
245 		}
246 		if (level == SOL_SOCKET &&
247 		    (type == SO_TIMESTAMPNS_OLD || type == SO_TIMESTAMPING_OLD)) {
248 			int count = type == SO_TIMESTAMPNS_OLD ? 1 : 3;
249 			int i;
250 			struct __kernel_old_timespec *ts = data;
251 			for (i = 0; i < count; i++) {
252 				cts[i].tv_sec = ts[i].tv_sec;
253 				cts[i].tv_nsec = ts[i].tv_nsec;
254 			}
255 			data = &cts;
256 			len = sizeof(cts[0]) * count;
257 		}
258 	}
259 
260 	cmlen = CMSG_COMPAT_LEN(len);
261 	if (kmsg->msg_controllen < cmlen) {
262 		kmsg->msg_flags |= MSG_CTRUNC;
263 		cmlen = kmsg->msg_controllen;
264 	}
265 	cmhdr.cmsg_level = level;
266 	cmhdr.cmsg_type = type;
267 	cmhdr.cmsg_len = cmlen;
268 
269 	if (copy_to_user(cm, &cmhdr, sizeof cmhdr))
270 		return -EFAULT;
271 	if (copy_to_user(CMSG_COMPAT_DATA(cm), data, cmlen - sizeof(struct compat_cmsghdr)))
272 		return -EFAULT;
273 	cmlen = CMSG_COMPAT_SPACE(len);
274 	if (kmsg->msg_controllen < cmlen)
275 		cmlen = kmsg->msg_controllen;
276 	kmsg->msg_control += cmlen;
277 	kmsg->msg_controllen -= cmlen;
278 	return 0;
279 }
280 
281 static int scm_max_fds_compat(struct msghdr *msg)
282 {
283 	if (msg->msg_controllen <= sizeof(struct compat_cmsghdr))
284 		return 0;
285 	return (msg->msg_controllen - sizeof(struct compat_cmsghdr)) / sizeof(int);
286 }
287 
288 void scm_detach_fds_compat(struct msghdr *msg, struct scm_cookie *scm)
289 {
290 	struct compat_cmsghdr __user *cm =
291 		(struct compat_cmsghdr __user *)msg->msg_control;
292 	unsigned int o_flags = (msg->msg_flags & MSG_CMSG_CLOEXEC) ? O_CLOEXEC : 0;
293 	int fdmax = min_t(int, scm_max_fds_compat(msg), scm->fp->count);
294 	int __user *cmsg_data = CMSG_COMPAT_DATA(cm);
295 	int err = 0, i;
296 
297 	for (i = 0; i < fdmax; i++) {
298 		err = receive_fd_user(scm->fp->fp[i], cmsg_data + i, o_flags);
299 		if (err < 0)
300 			break;
301 	}
302 
303 	if (i > 0) {
304 		int cmlen = CMSG_COMPAT_LEN(i * sizeof(int));
305 
306 		err = put_user(SOL_SOCKET, &cm->cmsg_level);
307 		if (!err)
308 			err = put_user(SCM_RIGHTS, &cm->cmsg_type);
309 		if (!err)
310 			err = put_user(cmlen, &cm->cmsg_len);
311 		if (!err) {
312 			cmlen = CMSG_COMPAT_SPACE(i * sizeof(int));
313 			if (msg->msg_controllen < cmlen)
314 				cmlen = msg->msg_controllen;
315 			msg->msg_control += cmlen;
316 			msg->msg_controllen -= cmlen;
317 		}
318 	}
319 
320 	if (i < scm->fp->count || (scm->fp->count && fdmax <= 0))
321 		msg->msg_flags |= MSG_CTRUNC;
322 
323 	/*
324 	 * All of the files that fit in the message have had their usage counts
325 	 * incremented, so we just free the list.
326 	 */
327 	__scm_destroy(scm);
328 }
329 
330 /* Argument list sizes for compat_sys_socketcall */
331 #define AL(x) ((x) * sizeof(u32))
332 static unsigned char nas[21] = {
333 	AL(0), AL(3), AL(3), AL(3), AL(2), AL(3),
334 	AL(3), AL(3), AL(4), AL(4), AL(4), AL(6),
335 	AL(6), AL(2), AL(5), AL(5), AL(3), AL(3),
336 	AL(4), AL(5), AL(4)
337 };
338 #undef AL
339 
340 static inline long __compat_sys_sendmsg(int fd,
341 					struct compat_msghdr __user *msg,
342 					unsigned int flags)
343 {
344 	return __sys_sendmsg(fd, (struct user_msghdr __user *)msg,
345 			     flags | MSG_CMSG_COMPAT, false);
346 }
347 
348 COMPAT_SYSCALL_DEFINE3(sendmsg, int, fd, struct compat_msghdr __user *, msg,
349 		       unsigned int, flags)
350 {
351 	return __compat_sys_sendmsg(fd, msg, flags);
352 }
353 
354 static inline long __compat_sys_sendmmsg(int fd,
355 					 struct compat_mmsghdr __user *mmsg,
356 					 unsigned int vlen, unsigned int flags)
357 {
358 	return __sys_sendmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
359 			      flags | MSG_CMSG_COMPAT, false);
360 }
361 
362 COMPAT_SYSCALL_DEFINE4(sendmmsg, int, fd, struct compat_mmsghdr __user *, mmsg,
363 		       unsigned int, vlen, unsigned int, flags)
364 {
365 	return __compat_sys_sendmmsg(fd, mmsg, vlen, flags);
366 }
367 
368 static inline long __compat_sys_recvmsg(int fd,
369 					struct compat_msghdr __user *msg,
370 					unsigned int flags)
371 {
372 	return __sys_recvmsg(fd, (struct user_msghdr __user *)msg,
373 			     flags | MSG_CMSG_COMPAT, false);
374 }
375 
376 COMPAT_SYSCALL_DEFINE3(recvmsg, int, fd, struct compat_msghdr __user *, msg,
377 		       unsigned int, flags)
378 {
379 	return __compat_sys_recvmsg(fd, msg, flags);
380 }
381 
382 static inline long __compat_sys_recvfrom(int fd, void __user *buf,
383 					 compat_size_t len, unsigned int flags,
384 					 struct sockaddr __user *addr,
385 					 int __user *addrlen)
386 {
387 	return __sys_recvfrom(fd, buf, len, flags | MSG_CMSG_COMPAT, addr,
388 			      addrlen);
389 }
390 
391 COMPAT_SYSCALL_DEFINE4(recv, int, fd, void __user *, buf, compat_size_t, len, unsigned int, flags)
392 {
393 	return __compat_sys_recvfrom(fd, buf, len, flags, NULL, NULL);
394 }
395 
396 COMPAT_SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, buf, compat_size_t, len,
397 		       unsigned int, flags, struct sockaddr __user *, addr,
398 		       int __user *, addrlen)
399 {
400 	return __compat_sys_recvfrom(fd, buf, len, flags, addr, addrlen);
401 }
402 
403 COMPAT_SYSCALL_DEFINE5(recvmmsg_time64, int, fd, struct compat_mmsghdr __user *, mmsg,
404 		       unsigned int, vlen, unsigned int, flags,
405 		       struct __kernel_timespec __user *, timeout)
406 {
407 	return __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
408 			      flags | MSG_CMSG_COMPAT, timeout, NULL);
409 }
410 
411 #ifdef CONFIG_COMPAT_32BIT_TIME
412 COMPAT_SYSCALL_DEFINE5(recvmmsg_time32, int, fd, struct compat_mmsghdr __user *, mmsg,
413 		       unsigned int, vlen, unsigned int, flags,
414 		       struct old_timespec32 __user *, timeout)
415 {
416 	return __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
417 			      flags | MSG_CMSG_COMPAT, NULL, timeout);
418 }
419 #endif
420 
421 COMPAT_SYSCALL_DEFINE2(socketcall, int, call, u32 __user *, args)
422 {
423 	u32 a[AUDITSC_ARGS];
424 	unsigned int len;
425 	u32 a0, a1;
426 	int ret;
427 
428 	if (call < SYS_SOCKET || call > SYS_SENDMMSG)
429 		return -EINVAL;
430 	len = nas[call];
431 	if (len > sizeof(a))
432 		return -EINVAL;
433 
434 	if (copy_from_user(a, args, len))
435 		return -EFAULT;
436 
437 	ret = audit_socketcall_compat(len / sizeof(a[0]), a);
438 	if (ret)
439 		return ret;
440 
441 	a0 = a[0];
442 	a1 = a[1];
443 
444 	switch (call) {
445 	case SYS_SOCKET:
446 		ret = __sys_socket(a0, a1, a[2]);
447 		break;
448 	case SYS_BIND:
449 		ret = __sys_bind(a0, compat_ptr(a1), a[2]);
450 		break;
451 	case SYS_CONNECT:
452 		ret = __sys_connect(a0, compat_ptr(a1), a[2]);
453 		break;
454 	case SYS_LISTEN:
455 		ret = __sys_listen(a0, a1);
456 		break;
457 	case SYS_ACCEPT:
458 		ret = __sys_accept4(a0, compat_ptr(a1), compat_ptr(a[2]), 0);
459 		break;
460 	case SYS_GETSOCKNAME:
461 		ret = __sys_getsockname(a0, compat_ptr(a1), compat_ptr(a[2]));
462 		break;
463 	case SYS_GETPEERNAME:
464 		ret = __sys_getpeername(a0, compat_ptr(a1), compat_ptr(a[2]));
465 		break;
466 	case SYS_SOCKETPAIR:
467 		ret = __sys_socketpair(a0, a1, a[2], compat_ptr(a[3]));
468 		break;
469 	case SYS_SEND:
470 		ret = __sys_sendto(a0, compat_ptr(a1), a[2], a[3], NULL, 0);
471 		break;
472 	case SYS_SENDTO:
473 		ret = __sys_sendto(a0, compat_ptr(a1), a[2], a[3],
474 				   compat_ptr(a[4]), a[5]);
475 		break;
476 	case SYS_RECV:
477 		ret = __compat_sys_recvfrom(a0, compat_ptr(a1), a[2], a[3],
478 					    NULL, NULL);
479 		break;
480 	case SYS_RECVFROM:
481 		ret = __compat_sys_recvfrom(a0, compat_ptr(a1), a[2], a[3],
482 					    compat_ptr(a[4]),
483 					    compat_ptr(a[5]));
484 		break;
485 	case SYS_SHUTDOWN:
486 		ret = __sys_shutdown(a0, a1);
487 		break;
488 	case SYS_SETSOCKOPT:
489 		ret = __sys_setsockopt(a0, a1, a[2], compat_ptr(a[3]), a[4]);
490 		break;
491 	case SYS_GETSOCKOPT:
492 		ret = __sys_getsockopt(a0, a1, a[2], compat_ptr(a[3]),
493 				       compat_ptr(a[4]));
494 		break;
495 	case SYS_SENDMSG:
496 		ret = __compat_sys_sendmsg(a0, compat_ptr(a1), a[2]);
497 		break;
498 	case SYS_SENDMMSG:
499 		ret = __compat_sys_sendmmsg(a0, compat_ptr(a1), a[2], a[3]);
500 		break;
501 	case SYS_RECVMSG:
502 		ret = __compat_sys_recvmsg(a0, compat_ptr(a1), a[2]);
503 		break;
504 	case SYS_RECVMMSG:
505 		ret = __sys_recvmmsg(a0, compat_ptr(a1), a[2],
506 				     a[3] | MSG_CMSG_COMPAT, NULL,
507 				     compat_ptr(a[4]));
508 		break;
509 	case SYS_ACCEPT4:
510 		ret = __sys_accept4(a0, compat_ptr(a1), compat_ptr(a[2]), a[3]);
511 		break;
512 	default:
513 		ret = -EINVAL;
514 		break;
515 	}
516 	return ret;
517 }
518