On Thu, Mar 25, 2021 at 09:22:09AM +0100, Christoph Hellwig wrote:
> receive_fd_replace shares almost no code with the general case, so split
> it out. Also remove the "Bump the sock usage counts" comment from
> both copies, as that is now what __receive_sock actually does.
Nice, except that you've misread that, er, lovely API. This
> -static inline int receive_fd_replace(int fd, struct file *file, unsigned int o_flags)
> -{
> - return __receive_fd(fd, file, NULL, o_flags);
> + return __receive_fd(file, NULL, o_flags);
> }
can get called with negative fd (in which case it turns into an alias for
receive_fd(), of course). As the result, that ioctl got broken in case
when SECCOMP_ADDFD_FLAG_SETFD is not set. Trivially fixed by having the
only caller check the damn condition and call either receive_fd_replace()
or receive_fd().
