[PATCH 1/2] liveupdate: fix GET_NAME ioctl argument validation
Jackie Liu <[email protected]> Wed, 15 Jul 2026 14:06:12 +0800
| Newsgroups | org.infradead.lists.kexec |
|---|---|
| Message-ID | <[email protected]> |
From: Jackie Liu <[email protected]> LIVEUPDATE_SESSION_GET_NAME was developed in the liveupdate/next branch while the session type validation change was carried in liveupdate-fixes. When the conflict between the two branches was resolved, the GET_NAME operation descriptor picked up the structure and last member from RETRIEVE_FD. This makes both its known size and minimum size 16 bytes rather than 72. Consequently, copy_struct_from_user() treats most of a normal GET_NAME argument as unknown trailing data and rejects it with -E2BIG when any of those bytes are nonzero. It also accepts a 16-byte argument and returns success after copying only a truncated session name. Use the GET_NAME structure and its name field in the descriptor. Link: https://lore.kernel.org/all/[email protected]/ Assisted-by: Codex:gpt-5.6-sol Signed-off-by: Jackie Liu <[email protected]> --- kernel/liveupdate/luo_session.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/liveupdate/luo_session.c b/kernel/liveupdate/luo_session.c index b79b2a488974..f38b5b18f3f8 100644 --- a/kernel/liveupdate/luo_session.c +++ b/kernel/liveupdate/luo_session.c @@ -378,7 +378,7 @@ static const struct luo_ioctl_op luo_session_ioctl_ops[] = { IOCTL_OP(LIVEUPDATE_SESSION_RETRIEVE_FD, luo_session_retrieve_fd, struct liveupdate_session_retrieve_fd, token, LUO_IOCTL_INCOMING), IOCTL_OP(LIVEUPDATE_SESSION_GET_NAME, luo_session_get_name, - struct liveupdate_session_retrieve_fd, token, LUO_IOCTL_ALL), + struct liveupdate_session_get_name, name, LUO_IOCTL_ALL), }; static bool luo_ioctl_type_valid(struct luo_session *session, -- 2.54.0