From d1832e648d2be564e4b5e357f94d0f33156590dc Mon Sep 17 00:00:00 2001 From: Al Viro Date: Tue, 27 May 2025 22:39:51 -0400 Subject: [PATCH 1/5] landlock: opened file never has a negative dentry MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Reviewed-by: Christian Brauner Acked-by: Mickaël Salaün Signed-off-by: Al Viro --- security/landlock/syscalls.c | 1 - 1 file changed, 1 deletion(-) diff --git a/security/landlock/syscalls.c b/security/landlock/syscalls.c index 33eafb71e4f3..0116e9f93ffe 100644 --- a/security/landlock/syscalls.c +++ b/security/landlock/syscalls.c @@ -303,7 +303,6 @@ static int get_path_from_fd(const s32 fd, struct path *const path) if ((fd_file(f)->f_op == &ruleset_fops) || (fd_file(f)->f_path.mnt->mnt_flags & MNT_INTERNAL) || (fd_file(f)->f_path.dentry->d_sb->s_flags & SB_NOUSER) || - d_is_negative(fd_file(f)->f_path.dentry) || IS_PRIVATE(d_backing_inode(fd_file(f)->f_path.dentry))) return -EBADFD; From 273a291dd7e62c42ee315777477dade0ede6636e Mon Sep 17 00:00:00 2001 From: Al Viro Date: Tue, 27 May 2025 23:03:43 -0400 Subject: [PATCH 2/5] apparmor: file never has NULL f_path.mnt Reviewed-by: Christian Brauner Signed-off-by: Al Viro --- security/apparmor/file.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/security/apparmor/file.c b/security/apparmor/file.c index d52a5b14dad4..f494217112c9 100644 --- a/security/apparmor/file.c +++ b/security/apparmor/file.c @@ -604,7 +604,7 @@ int aa_file_perm(const char *op, const struct cred *subj_cred, rcu_read_unlock(); /* TODO: label cross check */ - if (file->f_path.mnt && path_mediated_fs(file->f_path.dentry)) + if (path_mediated_fs(file->f_path.dentry)) error = __file_path_perm(op, subj_cred, label, flabel, file, request, denied, in_atomic); From 1812de14f04848daa354f99e9240e0f7c643718c Mon Sep 17 00:00:00 2001 From: Al Viro Date: Wed, 3 May 2023 16:50:18 -0400 Subject: [PATCH 3/5] secretmem: move setting O_LARGEFILE and bumping users' count to the place where we create the file Acked-by: Andrew Morton Acked-by: Mike Rapoport (Microsoft) Signed-off-by: Al Viro --- mm/secretmem.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/mm/secretmem.c b/mm/secretmem.c index 589b26c2d553..ef4922baa1cd 100644 --- a/mm/secretmem.c +++ b/mm/secretmem.c @@ -208,7 +208,7 @@ static struct file *secretmem_file_create(unsigned long flags) } file = alloc_file_pseudo(inode, secretmem_mnt, "secretmem", - O_RDWR, &secretmem_fops); + O_RDWR | O_LARGEFILE, &secretmem_fops); if (IS_ERR(file)) goto err_free_inode; @@ -222,6 +222,8 @@ static struct file *secretmem_file_create(unsigned long flags) inode->i_mode |= S_IFREG; inode->i_size = 0; + atomic_inc(&secretmem_users); + return file; err_free_inode: @@ -255,9 +257,6 @@ SYSCALL_DEFINE1(memfd_secret, unsigned int, flags) goto err_put_fd; } - file->f_flags |= O_LARGEFILE; - - atomic_inc(&secretmem_users); fd_install(fd, file); return fd; From 5a6acd563af4a0789e4a93afb28d71c177e71b8b Mon Sep 17 00:00:00 2001 From: Al Viro Date: Thu, 4 May 2023 17:42:24 -0400 Subject: [PATCH 4/5] binder_ioctl_write_read(): simplify control flow a bit Acked-by: Greg Kroah-Hartman Signed-off-by: Al Viro --- drivers/android/binder.c | 20 ++++++-------------- 1 file changed, 6 insertions(+), 14 deletions(-) diff --git a/drivers/android/binder.c b/drivers/android/binder.c index c463ca4a8fff..b00187ba273f 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -5384,10 +5384,9 @@ static int binder_ioctl_write_read(struct file *filp, unsigned long arg, void __user *ubuf = (void __user *)arg; struct binder_write_read bwr; - if (copy_from_user(&bwr, ubuf, sizeof(bwr))) { - ret = -EFAULT; - goto out; - } + if (copy_from_user(&bwr, ubuf, sizeof(bwr))) + return -EFAULT; + binder_debug(BINDER_DEBUG_READ_WRITE, "%d:%d write %lld at %016llx, read %lld at %016llx\n", proc->pid, thread->pid, @@ -5402,8 +5401,6 @@ static int binder_ioctl_write_read(struct file *filp, unsigned long arg, trace_binder_write_done(ret); if (ret < 0) { bwr.read_consumed = 0; - if (copy_to_user(ubuf, &bwr, sizeof(bwr))) - ret = -EFAULT; goto out; } } @@ -5417,22 +5414,17 @@ static int binder_ioctl_write_read(struct file *filp, unsigned long arg, if (!binder_worklist_empty_ilocked(&proc->todo)) binder_wakeup_proc_ilocked(proc); binder_inner_proc_unlock(proc); - if (ret < 0) { - if (copy_to_user(ubuf, &bwr, sizeof(bwr))) - ret = -EFAULT; + if (ret < 0) goto out; - } } binder_debug(BINDER_DEBUG_READ_WRITE, "%d:%d wrote %lld of %lld, read return %lld of %lld\n", proc->pid, thread->pid, (u64)bwr.write_consumed, (u64)bwr.write_size, (u64)bwr.read_consumed, (u64)bwr.read_size); - if (copy_to_user(ubuf, &bwr, sizeof(bwr))) { - ret = -EFAULT; - goto out; - } out: + if (copy_to_user(ubuf, &bwr, sizeof(bwr))) + ret = -EFAULT; return ret; } From 93c73ab1776fc06f3bee91e249026aad2975e8bf Mon Sep 17 00:00:00 2001 From: Al Viro Date: Thu, 10 Jul 2025 01:43:55 -0400 Subject: [PATCH 5/5] gpib: use file_inode() Signed-off-by: Al Viro --- drivers/staging/gpib/common/gpib_os.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/staging/gpib/common/gpib_os.c b/drivers/staging/gpib/common/gpib_os.c index a193d64db033..38c6abc2ffd2 100644 --- a/drivers/staging/gpib/common/gpib_os.c +++ b/drivers/staging/gpib/common/gpib_os.c @@ -610,7 +610,7 @@ int ibclose(struct inode *inode, struct file *filep) long ibioctl(struct file *filep, unsigned int cmd, unsigned long arg) { - unsigned int minor = iminor(filep->f_path.dentry->d_inode); + unsigned int minor = iminor(file_inode(filep)); struct gpib_board *board; struct gpib_file_private *file_priv = filep->private_data; long retval = -ENOTTY;