From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2D1961F4C90; Tue, 26 Aug 2025 14:27:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1756218429; cv=none; b=cqRQXfcn51eKXogjws5sRSfZ/o+0V0RljW5i7oQ5+ITB7hvQgGndzA42BgOFefpPMm+z//kbVfNFaQW55H2LFtmZDYEVTm7vUr7MCWOVgbBSuVswAO8oUueDgjw4/07Cp1RJW4NeVm75DrRPQzoCLC+GpzAhTMFfmXGyeJM2Qnk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1756218429; c=relaxed/simple; bh=tnqgGERW/gTuirQ2Gc4h817VuCffO3TRBrc8wkGo/YY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=BZcZplcLBxJh+FpOBNDiVny4Tmiek9ZW/wUWvFQ2pxDNZafR2ZzBecAC+K7dBGfFnRvVna33kDEjEaZX+AGuAYhi9zZYs3UAhVQkZilFR3U8Wk8Uk9KiO4vUW9RaXjKsqpj8FgE/I4CscjXnsBpwHzgMobaW0iayMybZaxoYqHs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=QJbsWQB/; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="QJbsWQB/" Received: by smtp.kernel.org (Postfix) with ESMTPSA id A2786C4CEF1; Tue, 26 Aug 2025 14:27:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1756218429; bh=tnqgGERW/gTuirQ2Gc4h817VuCffO3TRBrc8wkGo/YY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=QJbsWQB/U5LnenALPLENtpkxzelk/lQ0EPUa3zmpfU+XCKzo404YYqlj6gJl5JuhY YcKinkS3SXAWn1ARYS5D8vLnBxC0s7aKxItbJ0ixNf/DcwbUiQzz0cuFvQhK14leJ0 0/qrEYALc9iWUTI4TauFpoW+TgFD/mpg8GVYM75o= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Mete Durlu , Vasily Gorbik , Peter Oberparleiter , Alexander Gordeev , Sasha Levin Subject: [PATCH 5.10 519/523] s390/hypfs: Avoid unnecessary ioctl registration in debugfs Date: Tue, 26 Aug 2025 13:12:09 +0200 Message-ID: <20250826110937.239525642@linuxfoundation.org> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20250826110924.562212281@linuxfoundation.org> References: <20250826110924.562212281@linuxfoundation.org> User-Agent: quilt/0.68 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 5.10-stable review patch. If anyone has any objections, please let me know. ------------------ From: Peter Oberparleiter [ Upstream commit fec7bdfe7f8694a0c39e6c3ec026ff61ca1058b9 ] Currently, hypfs registers ioctl callbacks for all debugfs files, despite only one file requiring them. This leads to unintended exposure of unused interfaces to user space and can trigger side effects such as restricted access when kernel lockdown is enabled. Restrict ioctl registration to only those files that implement ioctl functionality to avoid interface clutter and unnecessary access restrictions. Tested-by: Mete Durlu Reviewed-by: Vasily Gorbik Fixes: 5496197f9b08 ("debugfs: Restrict debugfs when the kernel is locked down") Signed-off-by: Peter Oberparleiter Signed-off-by: Alexander Gordeev Signed-off-by: Sasha Levin --- arch/s390/hypfs/hypfs_dbfs.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/arch/s390/hypfs/hypfs_dbfs.c b/arch/s390/hypfs/hypfs_dbfs.c index f4c7dbfaf8ee..c5f53dc3dbbc 100644 --- a/arch/s390/hypfs/hypfs_dbfs.c +++ b/arch/s390/hypfs/hypfs_dbfs.c @@ -64,24 +64,28 @@ static long dbfs_ioctl(struct file *file, unsigned int cmd, unsigned long arg) long rc; mutex_lock(&df->lock); - if (df->unlocked_ioctl) - rc = df->unlocked_ioctl(file, cmd, arg); - else - rc = -ENOTTY; + rc = df->unlocked_ioctl(file, cmd, arg); mutex_unlock(&df->lock); return rc; } -static const struct file_operations dbfs_ops = { +static const struct file_operations dbfs_ops_ioctl = { .read = dbfs_read, .llseek = no_llseek, .unlocked_ioctl = dbfs_ioctl, }; +static const struct file_operations dbfs_ops = { + .read = dbfs_read, +}; + void hypfs_dbfs_create_file(struct hypfs_dbfs_file *df) { - df->dentry = debugfs_create_file(df->name, 0400, dbfs_dir, df, - &dbfs_ops); + const struct file_operations *fops = &dbfs_ops; + + if (df->unlocked_ioctl) + fops = &dbfs_ops_ioctl; + df->dentry = debugfs_create_file(df->name, 0400, dbfs_dir, df, fops); mutex_init(&df->lock); } -- 2.50.1