From: Jackie Liu Date: Thu, 16 Jul 2026 01:26:06 +0000 (+0800) Subject: liveupdate: fix GET_NAME ioctl argument validation X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=4416f8a9ed5f49256dc69c664f1386b496ca16a1;p=thirdparty%2Fkernel%2Flinux.git liveupdate: fix GET_NAME ioctl argument validation LIVEUPDATE_SESSION_GET_NAME was developed in the liveupdate/next branch while the session type validation change was carried in liveupdate-fixes. When the conflict between the two branches was resolved, the GET_NAME operation descriptor picked up the structure and last member from RETRIEVE_FD. This makes both its known size and minimum size 16 bytes rather than 72. A zero-initialized request still succeeds because luo_session_get_name() writes the full name before luo_ucmd_respond() copies the full GET_NAME response to userspace. However, copy_struct_from_user() treats the output-only name field as unknown trailing data and rejects the request with -E2BIG if any byte in that field is nonzero. Use the GET_NAME structure and its name field in the descriptor. Link: https://lore.kernel.org/all/ahWlYXNjGUbkKoHy@sirena.org.uk/ Assisted-by: Codex:gpt-5.6-sol Reviewed-by: Pratyush Yadav (Google) Signed-off-by: Jackie Liu Link: https://patch.msgid.link/20260716012607.22020-1-liu.yun@linux.dev Signed-off-by: Mike Rapoport (Microsoft) --- diff --git a/kernel/liveupdate/luo_session.c b/kernel/liveupdate/luo_session.c index b79b2a4889741..f38b5b18f3f81 100644 --- a/kernel/liveupdate/luo_session.c +++ b/kernel/liveupdate/luo_session.c @@ -378,7 +378,7 @@ static const struct luo_ioctl_op luo_session_ioctl_ops[] = { IOCTL_OP(LIVEUPDATE_SESSION_RETRIEVE_FD, luo_session_retrieve_fd, struct liveupdate_session_retrieve_fd, token, LUO_IOCTL_INCOMING), IOCTL_OP(LIVEUPDATE_SESSION_GET_NAME, luo_session_get_name, - struct liveupdate_session_retrieve_fd, token, LUO_IOCTL_ALL), + struct liveupdate_session_get_name, name, LUO_IOCTL_ALL), }; static bool luo_ioctl_type_valid(struct luo_session *session,