[PATCH v2 2/4] copy_process: pass clone_flags as u64 across calltree
David Hildenbrand
david at redhat.com
Mon Sep 1 13:38:42 UTC 2025
On 01.09.25 15:09, Simon Schuster via B4 Relay wrote:
> From: Simon Schuster <schuster.simon at siemens-energy.com>
>
> With the introduction of clone3 in commit 7f192e3cd316 ("fork: add
> clone3") the effective bit width of clone_flags on all architectures was
> increased from 32-bit to 64-bit, with a new type of u64 for the flags.
> However, for most consumers of clone_flags the interface was not
> changed from the previous type of unsigned long.
>
> While this works fine as long as none of the new 64-bit flag bits
> (CLONE_CLEAR_SIGHAND and CLONE_INTO_CGROUP) are evaluated, this is still
> undesirable in terms of the principle of least surprise.
>
> Thus, this commit fixes all relevant interfaces of callees to
> sys_clone3/copy_process (excluding the architecture-specific
> copy_thread) to consistently pass clone_flags as u64, so that
> no truncation to 32-bit integers occurs on 32-bit architectures.
>
> Signed-off-by: Simon Schuster <schuster.simon at siemens-energy.com>
> Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes at oracle.com>
> ---
> block/blk-ioc.c | 2 +-
> fs/namespace.c | 2 +-
> include/linux/cgroup.h | 4 ++--
> include/linux/cred.h | 2 +-
> include/linux/iocontext.h | 6 +++---
> include/linux/ipc_namespace.h | 4 ++--
> include/linux/lsm_hook_defs.h | 2 +-
> include/linux/mnt_namespace.h | 2 +-
> include/linux/nsproxy.h | 2 +-
> include/linux/pid_namespace.h | 4 ++--
> include/linux/rseq.h | 4 ++--
> include/linux/sched/task.h | 2 +-
> include/linux/security.h | 4 ++--
> include/linux/sem.h | 4 ++--
> include/linux/time_namespace.h | 4 ++--
> include/linux/uprobes.h | 4 ++--
> include/linux/user_events.h | 4 ++--
> include/linux/utsname.h | 4 ++--
> include/net/net_namespace.h | 4 ++--
> include/trace/events/task.h | 6 +++---
> ipc/namespace.c | 2 +-
> ipc/sem.c | 2 +-
> kernel/cgroup/namespace.c | 2 +-
> kernel/cred.c | 2 +-
> kernel/events/uprobes.c | 2 +-
> kernel/fork.c | 8 ++++----
> kernel/nsproxy.c | 4 ++--
> kernel/pid_namespace.c | 2 +-
> kernel/sched/core.c | 4 ++--
> kernel/sched/fair.c | 2 +-
> kernel/sched/sched.h | 4 ++--
> kernel/time/namespace.c | 2 +-
> kernel/utsname.c | 2 +-
> net/core/net_namespace.c | 2 +-
> security/apparmor/lsm.c | 2 +-
> security/security.c | 2 +-
> security/selinux/hooks.c | 2 +-
> security/tomoyo/tomoyo.c | 2 +-
> 38 files changed, 59 insertions(+), 59 deletions(-)
>
> diff --git a/block/blk-ioc.c b/block/blk-ioc.c
> index 9fda3906e5f5..d15918d7fabb 100644
> --- a/block/blk-ioc.c
(adjust To: list)
Hopefully we caught most of them. The ones not called "clone_flags" are
a bit nasty.
We could have split of some changes (e.g., trace event), but likely not
worth it.
Thanks!
Acked-by: David Hildenbrand <david at redhat.com>
--
Cheers
David / dhildenb
More information about the Linux-security-module-archive
mailing list