Commit fec7bdfe authored by Peter Oberparleiter's avatar Peter Oberparleiter Committed by Alexander Gordeev
Browse files

s390/hypfs: Avoid unnecessary ioctl registration in debugfs 



Currently, hypfs registers ioctl callbacks for all debugfs files,
despite only one file requiring them. This leads to unintended exposure
of unused interfaces to user space and can trigger side effects such as
restricted access when kernel lockdown is enabled.

Restrict ioctl registration to only those files that implement ioctl
functionality to avoid interface clutter and unnecessary access
restrictions.

Tested-by: default avatarMete Durlu <meted@linux.ibm.com>
Reviewed-by: default avatarVasily Gorbik <gor@linux.ibm.com>
Fixes: 5496197f ("debugfs: Restrict debugfs when the kernel is locked down")
Signed-off-by: default avatarPeter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: default avatarAlexander Gordeev <agordeev@linux.ibm.com>
parent 93f616ff

arch/s390/hypfs/hypfs_dbfs.c

+11 −7
Original line number Diff line number Diff line
@@ -66,23 +66,27 @@ static long dbfs_ioctl(struct file *file, unsigned int cmd, unsigned long arg) 
	long rc;



	mutex_lock(&df->lock);

	if (df->unlocked_ioctl)

	rc = df->unlocked_ioctl(file, cmd, arg);

	else

		rc = -ENOTTY;

	mutex_unlock(&df->lock);

	return rc;

}



static const struct file_operations dbfs_ops = {

static const struct file_operations dbfs_ops_ioctl = {

	.read		= dbfs_read,

	.unlocked_ioctl = dbfs_ioctl,

};



static const struct file_operations dbfs_ops = {

	.read		= dbfs_read,

};



void hypfs_dbfs_create_file(struct hypfs_dbfs_file *df)

{

	df->dentry = debugfs_create_file(df->name, 0400, dbfs_dir, df,

					 &dbfs_ops);

	const struct file_operations *fops = &dbfs_ops;



	if (df->unlocked_ioctl)

		fops = &dbfs_ops_ioctl;

	df->dentry = debugfs_create_file(df->name, 0400, dbfs_dir, df, fops);

	mutex_init(&df->lock);

}