From: Linfeng Sun <linfeng.sun.dev@gmail.com>
To: "Michael S. Tsirkin" <mst@redhat.com>,
"Jason Wang" <jasowangio@gmail.com>,
"Eugenio Pérez" <eperezma@redhat.com>
Cc: virtualization@lists.linux.dev, linux-kernel@vger.kernel.org,
Linfeng Sun <linfeng.sun.dev@gmail.com>
Subject: [PATCH] vduse: return compat ioctl results directly
Date: Tue, 08 Sep 2026 15:31:51 +0800 [thread overview]
Message-ID: <20260908-fix-vduse_dev_compat_ioctl-v1-1-62264d9bfb8d@gmail.com> (raw)
The compat handler handles VDUSE_IOTLB_GET_FD and VDUSE_VQ_GET_INFO, but
then calls the native handler. Their different command sizes make native
dispatch return -ENOIOCTLCMD.
For GET_FD, this overwrites receive_fd()'s return value after the
descriptor is installed, leaking one fd per call. Return handled compat
results directly and use native dispatch only for other commands.
Fixes: 455a2a1af926 ("vduse: fix compat handling for VDUSE_IOTLB_GET_FD/VDUSE_VQ_GET_INFO")
Signed-off-by: Linfeng Sun <linfeng.sun.dev@gmail.com>
---
drivers/vdpa/vdpa_user/vduse_dev.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/vdpa/vdpa_user/vduse_dev.c b/drivers/vdpa/vdpa_user/vduse_dev.c
index 4dea4d6a3855..49a231bdf948 100644
--- a/drivers/vdpa/vdpa_user/vduse_dev.c
+++ b/drivers/vdpa/vdpa_user/vduse_dev.c
@@ -1882,11 +1882,11 @@ static long vduse_dev_compat_ioctl(struct file *file, unsigned int cmd,
break;
}
default:
- ret = -ENOIOCTLCMD;
- break;
+ return vduse_dev_ioctl(file, cmd,
+ (unsigned long)compat_ptr(arg));
}
- return vduse_dev_ioctl(file, cmd, (unsigned long)compat_ptr(arg));
+ return ret;
}
#else
#define vduse_dev_compat_ioctl compat_ptr_ioctl
---
base-commit: d7808b37da0a619cf1fa541c2384e783fecc2480
Best regards,
--
Linfeng Sun <linfeng.sun.dev@gmail.com>
next reply other threads:[~2026-09-08 7:32 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-08 7:31 Linfeng Sun [this message]
2026-09-08 7:57 ` [PATCH] vduse: return compat ioctl results directly Michael S. Tsirkin
2026-09-08 8:08 ` Arnd Bergmann
2026-09-08 8:32 ` Michael S. Tsirkin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260908-fix-vduse_dev_compat_ioctl-v1-1-62264d9bfb8d@gmail.com \
--to=linfeng.sun.dev@gmail.com \
--cc=eperezma@redhat.com \
--cc=jasowangio@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mst@redhat.com \
--cc=virtualization@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.