[PATCH 1/2] liveupdate: fix GET_NAME ioctl argument validation

Jackie Liu <[email protected]> Wed, 15 Jul 2026 14:06:12 +0800
Newsgroups org.infradead.lists.kexec
Message-ID <[email protected]>
From: Jackie Liu <[email protected]>

LIVEUPDATE_SESSION_GET_NAME was developed in the liveupdate/next branch
while the session type validation change was carried in liveupdate-fixes.
When the conflict between the two branches was resolved, the GET_NAME
operation descriptor picked up the structure and last member from
RETRIEVE_FD.

This makes both its known size and minimum size 16 bytes rather than 72.
Consequently, copy_struct_from_user() treats most of a normal GET_NAME
argument as unknown trailing data and rejects it with -E2BIG when any of
those bytes are nonzero. It also accepts a 16-byte argument and returns
success after copying only a truncated session name.

Use the GET_NAME structure and its name field in the descriptor.

Link: https://lore.kernel.org/all/[email protected]/
Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Jackie Liu <[email protected]>
---
 kernel/liveupdate/luo_session.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/liveupdate/luo_session.c b/kernel/liveupdate/luo_session.c
index b79b2a488974..f38b5b18f3f8 100644
--- a/kernel/liveupdate/luo_session.c
+++ b/kernel/liveupdate/luo_session.c
@@ -378,7 +378,7 @@ static const struct luo_ioctl_op luo_session_ioctl_ops[] = {
 	IOCTL_OP(LIVEUPDATE_SESSION_RETRIEVE_FD, luo_session_retrieve_fd,
 		 struct liveupdate_session_retrieve_fd, token, LUO_IOCTL_INCOMING),
 	IOCTL_OP(LIVEUPDATE_SESSION_GET_NAME, luo_session_get_name,
-		 struct liveupdate_session_retrieve_fd, token, LUO_IOCTL_ALL),
+		 struct liveupdate_session_get_name, name, LUO_IOCTL_ALL),
 };
 
 static bool luo_ioctl_type_valid(struct luo_session *session,
-- 
2.54.0