Skip to content

Commit c81d6dc

Browse files
braunergregkh
authored andcommitted
pidfs: improve ioctl handling
commit 091ee63 upstream. Pidfs supports extensible and non-extensible ioctls. The extensible ioctls need to check for the ioctl number itself not just the ioctl command otherwise both backward- and forward compatibility are broken. The pidfs ioctl handler also needs to look at the type of the ioctl command to guard against cases where "[...] a daemon receives some random file descriptor from a (potentially less privileged) client and expects the FD to be of some specific type, it might call ioctl() on this FD with some type-specific command and expect the call to fail if the FD is of the wrong type; but due to the missing type check, the kernel instead performs some action that userspace didn't expect." (cf. [1]] Link: https://lore.kernel.org/r/[email protected] Link: https://lore.kernel.org/r/CAG48ez2K9A5GwtgqO31u9ZL292we8ZwAA=TJwwEv7wRuJ3j4Lw@mail.gmail.com [1] Fixes: 8ce3528 ("pidfs: check for valid ioctl commands") Acked-by: Luca Boccassi <[email protected]> Reported-by: Jann Horn <[email protected]> Cc: [email protected] # v6.13; please backport with 8ce3528 ("pidfs: check for valid ioctl commands") Signed-off-by: Christian Brauner <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
1 parent 28edfba commit c81d6dc

File tree

1 file changed

+11
-1
lines changed

1 file changed

+11
-1
lines changed

fs/pidfs.c

+11-1
Original file line numberDiff line numberDiff line change
@@ -195,7 +195,6 @@ static bool pidfs_ioctl_valid(unsigned int cmd)
195195
switch (cmd) {
196196
case FS_IOC_GETVERSION:
197197
case PIDFD_GET_CGROUP_NAMESPACE:
198-
case PIDFD_GET_INFO:
199198
case PIDFD_GET_IPC_NAMESPACE:
200199
case PIDFD_GET_MNT_NAMESPACE:
201200
case PIDFD_GET_NET_NAMESPACE:
@@ -208,6 +207,17 @@ static bool pidfs_ioctl_valid(unsigned int cmd)
208207
return true;
209208
}
210209

210+
/* Extensible ioctls require some more careful checks. */
211+
switch (_IOC_NR(cmd)) {
212+
case _IOC_NR(PIDFD_GET_INFO):
213+
/*
214+
* Try to prevent performing a pidfd ioctl when someone
215+
* erronously mistook the file descriptor for a pidfd.
216+
* This is not perfect but will catch most cases.
217+
*/
218+
return (_IOC_TYPE(cmd) == _IOC_TYPE(PIDFD_GET_INFO));
219+
}
220+
211221
return false;
212222
}
213223

0 commit comments

Comments
 (0)