Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Fri, 16 Apr 2021 03:38:09 +0000
From:   Al Viro <viro@zeniv.linux.org.uk>
To:     Christoph Hellwig <hch@lst.de>
Cc:     linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
        Kees Cook <keescook@chromium.org>,
        Andy Lutomirski <luto@amacapital.net>,
        Will Drewry <wad@chromium.org>
Subject: Re: [PATCH] fs: split receive_fd_replace from __receive_fd
Message-ID: <YHkGodVOpc/kg3V8@zeniv-ca.linux.org.uk>
References: <20210325082209.1067987-1-hch@lst.de>
 <20210325082209.1067987-2-hch@lst.de>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20210325082209.1067987-2-hch@lst.de>
Sender: Al Viro <viro@ftp.linux.org.uk>
Precedence: bulk

On Thu, Mar 25, 2021 at 09:22:09AM +0100, Christoph Hellwig wrote:
> receive_fd_replace shares almost no code with the general case, so split
> it out.  Also remove the "Bump the sock usage counts" comment from
> both copies, as that is now what __receive_sock actually does.

Nice, except that you've misread that, er, lovely API.  This

> -static inline int receive_fd_replace(int fd, struct file *file, unsigned int o_flags)
> -{
> -	return __receive_fd(fd, file, NULL, o_flags);
> +	return __receive_fd(file, NULL, o_flags);
>  }

can get called with negative fd (in which case it turns into an alias for
receive_fd(), of course).  As the result, that ioctl got broken in case
when SECCOMP_ADDFD_FLAG_SETFD is not set.  Trivially fixed by having the
only caller check the damn condition and call either receive_fd_replace()
or receive_fd().