From: Christian Brauner <brauner@xxxxxxxxxx>
commit 2714b0d1f36999dbd99a3474a24e7301acbd74f1 upstream.
Currently when passing a closed file descriptor to
fcntl(fd, F_DUPFD_QUERY, fd_dup) the order matters:
fd = open("/dev/null");
fd_dup = dup(fd);
When we now close one of the file descriptors we get:
(1) fcntl(fd, fd_dup) // -EBADF
(2) fcntl(fd_dup, fd) // 0 aka not equal
depending on which file descriptor is passed first. That's not a huge
deal but it gives the api I slightly weird feel. Make it so that the
order doesn't matter by requiring that both file descriptors are valid:
(1') fcntl(fd, fd_dup) // -EBADF
(2') fcntl(fd_dup, fd) // -EBADF
Link: https://lore.kernel.org/r/20241008-duften-formel-251f967602d5@brauner
Fixes: c62b758bae6a ("fcntl: add F_DUPFD_QUERY fcntl()")
Reviewed-by: Jeff Layton <jlayton@xxxxxxxxxx>
Reviewed-By: Lennart Poettering <lennart@xxxxxxxxxxxxxx>
Cc: stable@xxxxxxxxxxxxxxx
Reported-by: Lennart Poettering <lennart@xxxxxxxxxxxxxx>
Signed-off-by: Christian Brauner <brauner@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
fs/fcntl.c | 3 +++
1 file changed, 3 insertions(+)
--- a/fs/fcntl.c
+++ b/fs/fcntl.c
@@ -397,6 +397,9 @@ static long f_dupfd_query(int fd, struct
{
CLASS(fd_raw, f)(fd);
+ if (fd_empty(f))
+ return -EBADF;
+
/*
* We can do the 'fdput()' immediately, as the only thing that
* matters is the pointer value which isn't changed by the fdput.
Patches currently in stable-queue which might be from brauner@xxxxxxxxxx are
queue-6.12/cachefiles-fix-missing-pos-updates-in-cachefiles_ond.patch
queue-6.12/hfsplus-don-t-query-the-device-logical-block-size-mu.patch
queue-6.12/netfs-fscache-add-a-memory-barrier-for-fscache_volum.patch
queue-6.12/efs-fix-the-efs-new-mount-api-implementation.patch
queue-6.12/initramfs-avoid-filename-buffer-overrun.patch
queue-6.12/fs_parser-update-mount_api-doc-to-match-function-sig.patch
queue-6.12/fcntl-make-f_dupfd_query-associative.patch
queue-6.12/selftests-mount_setattr-fix-failures-on-64k-page_siz.patch
queue-6.12/cachefiles-fix-incorrect-length-return-value-in-cach.patch
queue-6.12/cachefiles-fix-null-pointer-dereference-in-object-fi.patch
