diff options
| author | Christian Brauner <brauner@kernel.org> | 2025-09-12 13:52:24 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-10-19 16:37:44 +0200 |
| commit | bf0fbf5e8b0aff8a4a0fb35e32b10083baa83c04 (patch) | |
| tree | 51a82bfaafd9cac7c9251b46289124b2232d0b1b | |
| parent | 9f0f659ea927a5c3cf655338ad6c37dc257f3460 (diff) | |
| download | linux-bf0fbf5e8b0aff8a4a0fb35e32b10083baa83c04.tar.gz linux-bf0fbf5e8b0aff8a4a0fb35e32b10083baa83c04.tar.bz2 linux-bf0fbf5e8b0aff8a4a0fb35e32b10083baa83c04.zip | |
pidfs: validate extensible ioctls
[ Upstream commit 3c17001b21b9f168c957ced9384abe969019b609 ]
Validate extensible ioctls stricter than we do now.
Reviewed-by: Aleksa Sarai <cyphar@cyphar.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | fs/pidfs.c | 2 | ||||
| -rw-r--r-- | include/linux/fs.h | 14 |
2 files changed, 15 insertions, 1 deletions
diff --git a/fs/pidfs.c b/fs/pidfs.c index 108e7527f837..2c9c7636253a 100644 --- a/fs/pidfs.c +++ b/fs/pidfs.c @@ -440,7 +440,7 @@ static bool pidfs_ioctl_valid(unsigned int cmd) * erronously mistook the file descriptor for a pidfd. * This is not perfect but will catch most cases. */ - return (_IOC_TYPE(cmd) == _IOC_TYPE(PIDFD_GET_INFO)); + return extensible_ioctl_valid(cmd, PIDFD_GET_INFO, PIDFD_INFO_SIZE_VER0); } return false; diff --git a/include/linux/fs.h b/include/linux/fs.h index 74f2bfc51926..ed0271526103 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -4025,4 +4025,18 @@ static inline bool vfs_empty_path(int dfd, const char __user *path) int generic_atomic_write_valid(struct kiocb *iocb, struct iov_iter *iter); +static inline bool extensible_ioctl_valid(unsigned int cmd_a, + unsigned int cmd_b, size_t min_size) +{ + if (_IOC_DIR(cmd_a) != _IOC_DIR(cmd_b)) + return false; + if (_IOC_TYPE(cmd_a) != _IOC_TYPE(cmd_b)) + return false; + if (_IOC_NR(cmd_a) != _IOC_NR(cmd_b)) + return false; + if (_IOC_SIZE(cmd_a) < min_size) + return false; + return true; +} + #endif /* _LINUX_FS_H */ |