On Thu, Feb 06, 2025 at 01:16:55PM -0800, Guenter Roeck wrote:
On Tue, Feb 04, 2025 at 02:51:20PM +0100, Christian Brauner wrote:
Pidfs supports extensible and non-extensible ioctls. The extensible ioctls need to check for the ioctl number itself not just the ioctl command otherwise both backward- and forward compatibility are broken.
The pidfs ioctl handler also needs to look at the type of the ioctl command to guard against cases where "[...] a daemon receives some random file descriptor from a (potentially less privileged) client and expects the FD to be of some specific type, it might call ioctl() on this FD with some type-specific command and expect the call to fail if the FD is of the wrong type; but due to the missing type check, the kernel instead performs some action that userspace didn't expect." (cf. [1]]
Reported-by: Jann Horn jannh@google.com Cc: stable@vger.kernel.org # v6.13 Fixes: https://lore.kernel.org/r/CAG48ez2K9A5GwtgqO31u9ZL292we8ZwAA=TJwwEv7wRuJ3j4L... [1]
This is not a proper Fixes: tag.
Fixed.