[PATCH 6.18 0134/1611] uaccess: fix ignored_trailing logic in copy_struct_to_user()

6.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Stefan Metzmacher <[email protected]>

[ Upstream commit 4911de3145a797389577abfdf9a5185d36cc18d7 ]

Currently all callers pass ignored_trailing=NULL, but I have
code that will make use of.

Now it actually behaves like documented:

* If @usize < @ksize, then the kernel is trying to pass userspace a newer
  struct than it supports. Thus we only copy the interoperable portions
  (@usize) and ignore the rest (but @ignored_trailing is set to %true if
  any of the trailing (@ksize - @usize) bytes are non-zero).

Fixes: 424a55a4a908 ("uaccess: add copy_struct_to_user helper")
Cc: Dmitry Safonov <[email protected]>
Cc: Dmitry Safonov <[email protected]>
Cc: Francesco Ruggeri <[email protected]>
Cc: Salam Noureddine <[email protected]>
Cc: David Ahern <[email protected]>
Cc: David S. Miller <[email protected]>
Cc: Michal Luczaj <[email protected]>
Cc: David Wei <[email protected]>
Cc: Luiz Augusto von Dentz <[email protected]>
Cc: Luiz Augusto von Dentz <[email protected]>
Cc: Marcel Holtmann <[email protected]>
Cc: Xin Long <[email protected]>
Cc: Eric Dumazet <[email protected]>
Cc: Kuniyuki Iwashima <[email protected]>
Cc: Paolo Abeni <[email protected]>
Cc: Willem de Bruijn <[email protected]>
Cc: Neal Cardwell <[email protected]>
Cc: Jakub Kicinski <[email protected]>
Cc: Simon Horman <[email protected]>
Cc: Aleksa Sarai <[email protected]>
Cc: Christian Brauner <[email protected]>
CC: Kees Cook <[email protected]>
Cc: [email protected]
Cc: [email protected]
Cc: [email protected]
Signed-off-by: Stefan Metzmacher <[email protected]>
Link: https://patch.msgid.link/71f69442410c1186ed8ce6d5b4b9d4a5a70edbad.1775576651.git.metze@samba.org
Reviewed-by: Aleksa Sarai <[email protected]>
Signed-off-by: Christian Brauner <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
 include/linux/uaccess.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/uaccess.h b/include/linux/uaccess.h
index 7657904c8db9c8..6973fee49f091c 100644
--- a/include/linux/uaccess.h
+++ b/include/linux/uaccess.h
@@ -499,7 +499,7 @@ copy_struct_to_user(void __user *dst, size_t usize, const void *src,
 			return -EFAULT;
 	}
 	if (ignored_trailing)
-		*ignored_trailing = ksize < usize &&
+		*ignored_trailing = usize < ksize &&
 			memchr_inv(src + size, 0, rest) != NULL;
 	/* Copy the interoperable parts of the struct. */
 	if (copy_to_user(dst, src, size))
-- 
2.53.0