vduse: return compat ioctl results directly

The compat handler handles VDUSE_IOTLB_GET_FD and VDUSE_VQ_GET_INFO, but
then calls the native handler. Their different command sizes make native
dispatch return -ENOIOCTLCMD.

For GET_FD, this overwrites receive_fd()'s return value after the
descriptor is installed, leaking one fd per call. Return handled compat
results directly and use native dispatch only for other commands.

Fixes: 455a2a1af9 ("vduse: fix compat handling for VDUSE_IOTLB_GET_FD/VDUSE_VQ_GET_INFO")
Signed-off-by: Linfeng Sun <linfeng.sun.dev@gmail.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260908-fix-vduse_dev_compat_ioctl-v1-1-62264d9bfb8d@gmail.com>
This commit is contained in:
Linfeng Sun 2026-09-08 15:31:51 +08:00 committed by Michael S. Tsirkin
parent d7808b37da
commit 48a4ee65e6

View File

@ -1882,11 +1882,11 @@ static long vduse_dev_compat_ioctl(struct file *file, unsigned int cmd,
break;
}
default:
ret = -ENOIOCTLCMD;
break;
return vduse_dev_ioctl(file, cmd,
(unsigned long)compat_ptr(arg));
}
return vduse_dev_ioctl(file, cmd, (unsigned long)compat_ptr(arg));
return ret;
}
#else
#define vduse_dev_compat_ioctl compat_ptr_ioctl