linux-kernel - [PATCH] iio: buffer: return 0 for buffer getfd ioctl handler

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20210322084135.17536-1-aardelean@deviqon.com>
Date:   Mon, 22 Mar 2021 10:41:35 +0200
From:   Alexandru Ardelean <aardelean@...iqon.com>
To:     linux-iio@...r.kernel.org, linux-kernel@...r.kernel.org
Cc:     jic23@...nel.org, Alexandru Ardelean <aardelean@...iqon.com>,
        Lars-Peter Clausen <lars@...afoo.de>
Subject: [PATCH] iio: buffer: return 0 for buffer getfd ioctl handler

As Lars pointed out, we could either return the FD vs memcpy-ing it to the
userspace data object.

However, this comment exposed a bug. We should return 0 or negative from
these ioctl() handlers. Because an ioctl() handler can also return
IIO_IOCTL_UNHANDLED (which is positive 1), which means that the ioctl()
handler doesn't support this ioctl number. Positive 1 could also be a valid
FD number in some corner cases.

The reason we did this is to be able to differentiate between an error
code and an unsupported ioctl number; for unsupported ioctl numbers, the
main loop should keep going.

Maybe we should change this to a higher negative number, to avoid such
cases when/if we add more ioctl() handlers.

Cc: Lars-Peter Clausen <lars@...afoo.de>
Fixes: f73f7f4da5818 ("iio: buffer: add ioctl() to support opening extra buffers for IIO device")
Signed-off-by: Alexandru Ardelean <aardelean@...iqon.com>
---
 drivers/iio/industrialio-buffer.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
index ee5aab9d4a23..d7a15c9bb0cd 100644
--- a/drivers/iio/industrialio-buffer.c
+++ b/drivers/iio/industrialio-buffer.c
@@ -1442,7 +1442,7 @@ static long iio_device_buffer_getfd(struct iio_dev *indio_dev, unsigned long arg
 		goto error_free_ib;
 	}

-	return fd;
+	return 0;

 error_free_ib:
 	kfree(ib);
-- 
2.30.2