diff options
| author | Arnd Bergmann <arnd@arndb.de> | 2025-07-11 10:46:51 +0200 |
|---|---|---|
| committer | Christian Brauner <brauner@kernel.org> | 2025-07-11 12:05:01 +0200 |
| commit | 42b0ef01e6b5e9c77b383d32c25a0ec2a735d08a (patch) | |
| tree | 09b2ff90bc0f273520ee24a2f3cdb605404853a9 | |
| parent | 4a3def74d9810f4d4148a3aa17b76d2f0c0f6109 (diff) | |
block: fix FS_IOC_GETLBMD_CAP parsing in blkdev_common_ioctl()
Anders and Naresh found that the addition of the FS_IOC_GETLBMD_CAP
handling in the blockdev ioctl handler breaks all ioctls with
_IOC_NR==2, as the new command is not added to the switch but only
a few of the command bits are check.
Move the check into the blk_get_meta_cap() function itself and make
it return -ENOIOCTLCMD for any unsupported command code, including
those with a smaller size that previously returned -EINVAL.
For consistency this also drops the check for NULL 'arg' that
is really useless, as any invalid pointer should return -EFAULT.
Fixes: 9eb22f7fedfc ("fs: add ioctl to query metadata and protection info capabilities")
Link: https://lore.kernel.org/all/CA+G9fYvk9HHE5UJ7cdJHTcY6P5JKnp+_e+sdC5U-ZQFTP9_hqQ@mail.gmail.com/
Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org>
Cc: Anders Roxell <anders.roxell@linaro.org>
Cc: Naresh Kamboju <naresh.kamboju@linaro.org>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/20250711084708.2714436-1-arnd@kernel.org
Tested-by: Anders Roxell <anders.roxell@linaro.org>
Signed-off-by: Christian Brauner <brauner@kernel.org>
| -rw-r--r-- | block/blk-integrity.c | 10 | ||||
| -rw-r--r-- | block/ioctl.c | 6 |
2 files changed, 10 insertions, 6 deletions
diff --git a/block/blk-integrity.c b/block/blk-integrity.c index 9d9dc9c32083..61a79e19c78f 100644 --- a/block/blk-integrity.c +++ b/block/blk-integrity.c @@ -62,10 +62,12 @@ int blk_get_meta_cap(struct block_device *bdev, unsigned int cmd, struct logical_block_metadata_cap meta_cap = {}; size_t usize = _IOC_SIZE(cmd); - if (!argp) - return -EINVAL; - if (usize < LBMD_SIZE_VER0) - return -EINVAL; + if (_IOC_DIR(cmd) != _IOC_DIR(FS_IOC_GETLBMD_CAP) || + _IOC_TYPE(cmd) != _IOC_TYPE(FS_IOC_GETLBMD_CAP) || + _IOC_NR(cmd) != _IOC_NR(FS_IOC_GETLBMD_CAP) || + _IOC_SIZE(cmd) < LBMD_SIZE_VER0) + return -ENOIOCTLCMD; + if (!bi) goto out; diff --git a/block/ioctl.c b/block/ioctl.c index 9ad403733e19..af2e22e5533c 100644 --- a/block/ioctl.c +++ b/block/ioctl.c @@ -566,9 +566,11 @@ static int blkdev_common_ioctl(struct block_device *bdev, blk_mode_t mode, void __user *argp) { unsigned int max_sectors; + int ret; - if (_IOC_NR(cmd) == _IOC_NR(FS_IOC_GETLBMD_CAP)) - return blk_get_meta_cap(bdev, cmd, argp); + ret = blk_get_meta_cap(bdev, cmd, argp); + if (ret != -ENOIOCTLCMD) + return ret; switch (cmd) { case BLKFLSBUF: |