lkml.org 
[lkml]   [2005]   [May]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
SubjectRe: [PATCH] Fix root hole in pktcdvd
From
Date
Al Viro <viro@parcelfarce.linux.theplanet.co.uk> writes:

> On Tue, May 17, 2005 at 06:00:25AM +0100, Al Viro wrote:
> > Same comment as for previous patch. I'll take a look at that sucker,
> > it might happen to be OK, seeing that most of the bdev ->ioctl() instances
> > ignore file argument and we might get away with passing odd stuff to
> > anything that could occur here.
>
> Oh, lovely - pkt_open() opens underlying device, unless we already have our
> device opened. Guess what happens if you open() with O_RDONLY and
> then - with O_RDWR?

You get I/O errors when you submit write requests, which is definitely
not good. I don't know if it also has security implications.

A check got lost in the char dev control device conversion patch. The
patch below fixes it.

-
If you tried to open a packet device first in read-only mode and then
a second time in read-write mode, the second open succeeded even
though the device was not correctly set up for writing. If you then
tried to write data to the device, the writes would fail with I/O
errors.

This patch prevents that problem by making the second open fail with
-EBUSY.

Signed-off-by: Peter Osterlund <petero2@telia.com>
---

linux-petero/drivers/block/pktcdvd.c | 8 +++++++-
1 files changed, 7 insertions(+), 1 deletion(-)

diff -puN drivers/block/pktcdvd.c~packet-multi-open-fix drivers/block/pktcdvd.c
--- linux/drivers/block/pktcdvd.c~packet-multi-open-fix 2005-05-17 19:52:30.000000000 +0200
+++ linux-petero/drivers/block/pktcdvd.c 2005-05-17 19:52:30.000000000 +0200
@@ -2025,7 +2025,13 @@ static int pkt_open(struct inode *inode,
BUG_ON(pd->refcnt < 0);

pd->refcnt++;
- if (pd->refcnt == 1) {
+ if (pd->refcnt > 1) {
+ if ((file->f_mode & FMODE_WRITE) &&
+ !test_bit(PACKET_WRITABLE, &pd->flags)) {
+ ret = -EBUSY;
+ goto out_dec;
+ }
+ } else {
if (pkt_open_dev(pd, file->f_mode & FMODE_WRITE)) {
ret = -EIO;
goto out_dec;
_
--
Peter Osterlund - petero2@telia.com
http://web.telia.com/~u89404340
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-05-17 20:17    [W:0.070 / U:0.112 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site