Project

General

Profile

Bug #12043

Streams ioctl for _I_CMD within kernel causes EFAULT

Added by Andy Fiddaman 3 days ago. Updated 2 days ago.

Status:
Closed
Priority:
Normal
Assignee:
Category:
-
Start date:
Due date:
% Done:

100%

Estimated time:
Difficulty:
Bite-size
Tags:

Description

If a kernel module issues a streams ioctl call for _I_CMD, then it will fail with EFAULT.
This is because strioctl() wrongly attempts to use copyin() on the data despite the presence of the FKIOCTL flag.

Example code (vp is a pointer to a TLI vnode).

                strcmd_t strcmd;
                int32_t rval;

                strcmd.sc_cmd = TI_GETMYNAME;
                strcmd.sc_timeout = 1;
                strcmd.sc_len = STRCMDBUFSIZE;

                ASSERT0(VOP_IOCTL(vp, _I_CMD, (intptr_t)&strcmd, FKIOCTL, CRED(), &rval, NULL));

Related issues

Blocks illumos gate - Feature #12046: Provide /proc/<PID>/fdinfo/In Progress

Actions

History

#2

Updated by Andy Fiddaman 3 days ago

At present, nothing in the kernel calls strioctl with _I_CMD but I've
tested that it now works from a kernel module, and exercised the
user- to kernel-space path using pfiles on TLI sockets, and verified it
still works.

#3

Updated by Andy Fiddaman 2 days ago

#4

Updated by Electric Monk 2 days ago

  • Status changed from In Progress to Closed
  • % Done changed from 0 to 100

git commit e63ea1f970505bef26ee06b3cef54076ad25b94e

commit  e63ea1f970505bef26ee06b3cef54076ad25b94e
Author: Andy Fiddaman <omnios@citrus-it.co.uk>
Date:   2019-12-03T18:28:38.000Z

    12043 Streams ioctl for _I_CMD within kernel causes EFAULT
    Reviewed by: John Levon <john.levon@joyent.com>
    Reviewed by: Jason King <jason.king@joyent.com>
    Approved by: Robert Mustacchi <rm@fingolfin.org>

Also available in: Atom PDF