Re: [PATCH] fs: split receive_fd_replace from __receive_fd

From: Al Viro <viro@zeniv.linux.org.uk>
To: Christoph Hellwig <hch@lst.de>
Cc: linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
	Kees Cook <keescook@chromium.org>,
	Andy Lutomirski <luto@amacapital.net>,
	Will Drewry <wad@chromium.org>
Subject: Re: [PATCH] fs: split receive_fd_replace from __receive_fd
Date: Fri, 16 Apr 2021 03:38:09 +0000	[thread overview]
Message-ID: <YHkGodVOpc/kg3V8@zeniv-ca.linux.org.uk> (raw)
In-Reply-To: <20210325082209.1067987-2-hch@lst.de>

On Thu, Mar 25, 2021 at 09:22:09AM +0100, Christoph Hellwig wrote:
> receive_fd_replace shares almost no code with the general case, so split
> it out.  Also remove the "Bump the sock usage counts" comment from
> both copies, as that is now what __receive_sock actually does.

Nice, except that you've misread that, er, lovely API.  This

> -static inline int receive_fd_replace(int fd, struct file *file, unsigned int o_flags)
> -{
> -	return __receive_fd(fd, file, NULL, o_flags);
> +	return __receive_fd(file, NULL, o_flags);
>  }

can get called with negative fd (in which case it turns into an alias for
receive_fd(), of course).  As the result, that ioctl got broken in case
when SECCOMP_ADDFD_FLAG_SETFD is not set.  Trivially fixed by having the
only caller check the damn condition and call either receive_fd_replace()
or receive_fd().