5.10-stable patches

added patches:
	fs-always-return-zero-on-success-from-replace_fd.patch

diff --git a/queue-5.10/fs-always-return-zero-on-success-from-replace_fd.patch b/queue-5.10/fs-always-return-zero-on-success-from-replace_fd.patch
new file mode 100644 (file)
index 0000000..0bf5cfc
--- /dev/null
+++ b/queue-5.10/fs-always-return-zero-on-success-from-replace_fd.patch
@@ -0,0 +1,48 @@
+From 708c04a5c2b78e22f56e2350de41feba74dfccd9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= <thomas.weissschuh@linutronix.de>
+Date: Tue, 5 Aug 2025 14:38:08 +0200
+Subject: fs: always return zero on success from replace_fd()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+commit 708c04a5c2b78e22f56e2350de41feba74dfccd9 upstream.
+
+replace_fd() returns the number of the new file descriptor through the
+return value of do_dup2(). However its callers never care about the
+specific returned number. In fact the caller in receive_fd_replace() treats
+any non-zero return value as an error and therefore never calls
+__receive_sock() for most file descriptors, which is a bug.
+
+To fix the bug in receive_fd_replace() and to avoid the same issue
+happening in future callers, signal success through a plain zero.
+
+Suggested-by: Al Viro <viro@zeniv.linux.org.uk>
+Link: https://lore.kernel.org/lkml/20250801220215.GS222315@ZenIV/
+Fixes: 173817151b15 ("fs: Expand __receive_fd() to accept existing fd")
+Fixes: 42eb0d54c08a ("fs: split receive_fd_replace from __receive_fd")
+Cc: stable@vger.kernel.org
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Link: https://lore.kernel.org/20250805-fix-receive_fd_replace-v3-1-b72ba8b34bac@linutronix.de
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/file.c |    5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/fs/file.c
++++ b/fs/file.c
+@@ -1095,7 +1095,10 @@ int replace_fd(unsigned fd, struct file
+       err = expand_files(files, fd);
+       if (unlikely(err < 0))
+               goto out_unlock;
+-      return do_dup2(files, file, fd, flags);
++      err = do_dup2(files, file, fd, flags);
++      if (err < 0)
++              return err;
++      return 0;
+ 
+ out_unlock:
+       spin_unlock(&files->file_lock);

diff --git a/queue-5.10/series b/queue-5.10/series
index 5cc248a63dadc5161f961f6c07c3a5af8eb2c65c..f95e1c3c39a694c6d8d5775cf0f7e873fa8854f4 100644 (file)
--- a/queue-5.10/series
+++ b/queue-5.10/series
@@ -93,3 +93,4 @@ input-atmel_mxt_ts-allow-reset-gpio-to-sleep.patch
 input-uinput-zero-initialize-uinput_ff_upload_compat-to-avoid-info-leak.patch
 pinctrl-check-the-return-value-of-pinmux_ops-get_function_name.patch
 bus-fsl-mc-check-return-value-of-platform_get_resource.patch
+fs-always-return-zero-on-success-from-replace_fd.patch