Unverified Commit 58c6cbd9 authored by Christian Brauner's avatar Christian Brauner
Browse files

Merge patch series "nsfs: validate ioctls" 

Christian Brauner <brauner@kernel.org> says:

This series ensures that nsfs protects against ioctl overloading.

* patches from https://lore.kernel.org/r/20250219-work-nsfs-v1-0-21128d73c5e8@kernel.org:
  selftests/nsfs: add ioctl validation tests
  nsfs: validate ioctls

Link: https://lore.kernel.org/r/20250219-work-nsfs-v1-0-21128d73c5e8@kernel.org


Signed-off-by: default avatarChristian Brauner <brauner@kernel.org>
parents 2014c95a 540dcf0f

fs/nsfs.c

+31 −1
Original line number Diff line number Diff line
@@ -152,19 +152,49 @@ static int copy_ns_info_to_user(const struct mnt_namespace *mnt_ns, 
	return 0;

}



static bool nsfs_ioctl_valid(unsigned int cmd)

{

	switch (cmd) {

	case NS_GET_USERNS:

	case NS_GET_PARENT:

	case NS_GET_NSTYPE:

	case NS_GET_OWNER_UID:

	case NS_GET_MNTNS_ID:

	case NS_GET_PID_FROM_PIDNS:

	case NS_GET_TGID_FROM_PIDNS:

	case NS_GET_PID_IN_PIDNS:

	case NS_GET_TGID_IN_PIDNS:

		return (_IOC_TYPE(cmd) == _IOC_TYPE(cmd));

	}



	/* Extensible ioctls require some extra handling. */

	switch (_IOC_NR(cmd)) {

	case _IOC_NR(NS_MNT_GET_INFO):

	case _IOC_NR(NS_MNT_GET_NEXT):

	case _IOC_NR(NS_MNT_GET_PREV):

		return (_IOC_TYPE(cmd) == _IOC_TYPE(cmd));

	}



	return false;

}



static long ns_ioctl(struct file *filp, unsigned int ioctl,

			unsigned long arg)

{

	struct user_namespace *user_ns;

	struct pid_namespace *pid_ns;

	struct task_struct *tsk;

	struct ns_common *ns = get_proc_ns(file_inode(filp));

	struct ns_common *ns;

	struct mnt_namespace *mnt_ns;

	bool previous = false;

	uid_t __user *argp;

	uid_t uid;

	int ret;



	if (!nsfs_ioctl_valid(ioctl))

		return -ENOIOCTLCMD;



	ns = get_proc_ns(file_inode(filp));

	switch (ioctl) {

	case NS_GET_USERNS:

		return open_related_ns(ns, ns_get_owner);

tools/testing/selftests/filesystems/nsfs/iterate_mntns.c

+14 −0
Original line number Diff line number Diff line
@@ -3,6 +3,8 @@ 


#define _GNU_SOURCE

#include <fcntl.h>

#include <linux/auto_dev-ioctl.h>

#include <linux/errno.h>

#include <sched.h>

#include <stdio.h>

#include <string.h>
@@ -146,4 +148,16 @@ TEST_F(iterate_mount_namespaces, iterate_backward) 
	}

}



TEST_F(iterate_mount_namespaces, nfs_valid_ioctl)

{

	ASSERT_NE(ioctl(self->fd_mnt_ns[0], AUTOFS_DEV_IOCTL_OPENMOUNT, NULL), 0);

	ASSERT_EQ(errno, ENOTTY);



	ASSERT_NE(ioctl(self->fd_mnt_ns[0], AUTOFS_DEV_IOCTL_CLOSEMOUNT, NULL), 0);

	ASSERT_EQ(errno, ENOTTY);



	ASSERT_NE(ioctl(self->fd_mnt_ns[0], AUTOFS_DEV_IOCTL_READY, NULL), 0);

	ASSERT_EQ(errno, ENOTTY);

}



TEST_HARNESS_MAIN