]> git.ipfire.org Git - thirdparty/kernel/linux.git/commitdiff
liveupdate: fix GET_NAME ioctl argument validation
authorJackie Liu <liuyun01@kylinos.cn>
Thu, 16 Jul 2026 01:26:06 +0000 (09:26 +0800)
committerMike Rapoport (Microsoft) <rppt@kernel.org>
Thu, 16 Jul 2026 06:25:30 +0000 (09:25 +0300)
LIVEUPDATE_SESSION_GET_NAME was developed in the liveupdate/next branch
while the session type validation change was carried in liveupdate-fixes.
When the conflict between the two branches was resolved, the GET_NAME
operation descriptor picked up the structure and last member from
RETRIEVE_FD.

This makes both its known size and minimum size 16 bytes rather than 72.
A zero-initialized request still succeeds because luo_session_get_name()
writes the full name before luo_ucmd_respond() copies the full GET_NAME
response to userspace. However, copy_struct_from_user() treats the
output-only name field as unknown trailing data and rejects the request
with -E2BIG if any byte in that field is nonzero.

Use the GET_NAME structure and its name field in the descriptor.

Link: https://lore.kernel.org/all/ahWlYXNjGUbkKoHy@sirena.org.uk/
Assisted-by: Codex:gpt-5.6-sol
Reviewed-by: Pratyush Yadav (Google) <pratyush@kernel.org>
Signed-off-by: Jackie Liu <liuyun01@kylinos.cn>
Link: https://patch.msgid.link/20260716012607.22020-1-liu.yun@linux.dev
Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
kernel/liveupdate/luo_session.c

index b79b2a4889741363e934d22d229de10fa6be730a..f38b5b18f3f8186bd8e48e6cc3c24b41101752f3 100644 (file)
@@ -378,7 +378,7 @@ static const struct luo_ioctl_op luo_session_ioctl_ops[] = {
        IOCTL_OP(LIVEUPDATE_SESSION_RETRIEVE_FD, luo_session_retrieve_fd,
                 struct liveupdate_session_retrieve_fd, token, LUO_IOCTL_INCOMING),
        IOCTL_OP(LIVEUPDATE_SESSION_GET_NAME, luo_session_get_name,
-                struct liveupdate_session_retrieve_fd, token, LUO_IOCTL_ALL),
+                struct liveupdate_session_get_name, name, LUO_IOCTL_ALL),
 };
 
 static bool luo_ioctl_type_valid(struct luo_session *session,