On Thu, Feb 06, 2025 at 01:16:55PM -0800, Guenter Roeck wrote: > On Tue, Feb 04, 2025 at 02:51:20PM +0100, Christian Brauner wrote: > > Pidfs supports extensible and non-extensible ioctls. The extensible > > ioctls need to check for the ioctl number itself not just the ioctl > > command otherwise both backward- and forward compatibility are broken. > > > > The pidfs ioctl handler also needs to look at the type of the ioctl > > command to guard against cases where "[...] a daemon receives some > > random file descriptor from a (potentially less privileged) client and > > expects the FD to be of some specific type, it might call ioctl() on > > this FD with some type-specific command and expect the call to fail if > > the FD is of the wrong type; but due to the missing type check, the > > kernel instead performs some action that userspace didn't expect." > > (cf. [1]] > > > > Reported-by: Jann Horn <jannh@xxxxxxxxxx> > > Cc: stable@xxxxxxxxxxxxxxx # v6.13 > > Fixes: https://lore.kernel.org/r/CAG48ez2K9A5GwtgqO31u9ZL292we8ZwAA=TJwwEv7wRuJ3j4Lw@xxxxxxxxxxxxxx [1] > > This is not a proper Fixes: tag. Fixed.
