diff options
| author | Jackie Liu <liuyun01@kylinos.cn> | 2026-07-16 09:26:06 +0800 |
|---|---|---|
| committer | Mike Rapoport (Microsoft) <rppt@kernel.org> | 2026-07-16 09:25:30 +0300 |
| commit | 4416f8a9ed5f49256dc69c664f1386b496ca16a1 (patch) | |
| tree | 79ec86a3d24d602acbc6a8711ddb8258dc8ef43a /tools/memory-model/Documentation/README | |
| parent | dc59e4fea9d83f03bad6bddf3fa2e52491777482 (diff) | |
| download | lwn-4416f8a9ed5f49256dc69c664f1386b496ca16a1.tar.gz lwn-4416f8a9ed5f49256dc69c664f1386b496ca16a1.zip | |
liveupdate: fix GET_NAME ioctl argument validation
LIVEUPDATE_SESSION_GET_NAME was developed in the liveupdate/next branch
while the session type validation change was carried in liveupdate-fixes.
When the conflict between the two branches was resolved, the GET_NAME
operation descriptor picked up the structure and last member from
RETRIEVE_FD.
This makes both its known size and minimum size 16 bytes rather than 72.
A zero-initialized request still succeeds because luo_session_get_name()
writes the full name before luo_ucmd_respond() copies the full GET_NAME
response to userspace. However, copy_struct_from_user() treats the
output-only name field as unknown trailing data and rejects the request
with -E2BIG if any byte in that field is nonzero.
Use the GET_NAME structure and its name field in the descriptor.
Link: https://lore.kernel.org/all/ahWlYXNjGUbkKoHy@sirena.org.uk/
Assisted-by: Codex:gpt-5.6-sol
Reviewed-by: Pratyush Yadav (Google) <pratyush@kernel.org>
Signed-off-by: Jackie Liu <liuyun01@kylinos.cn>
Link: https://patch.msgid.link/20260716012607.22020-1-liu.yun@linux.dev
Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Diffstat (limited to 'tools/memory-model/Documentation/README')
0 files changed, 0 insertions, 0 deletions
