lkml.org 
[lkml]   [2010]   [Aug]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[21/34] xfs: prevent swapext from operating on write-only files
    2.6.32-stable review patch.  If anyone has any objections, please let us know.

    ------------------

    From: Dan Rosenberg <dan.j.rosenberg@gmail.com>

    commit 1817176a86352f65210139d4c794ad2d19fc6b63 upstream.

    This patch prevents user "foo" from using the SWAPEXT ioctl to swap
    a write-only file owned by user "bar" into a file owned by "foo" and
    subsequently reading it. It does so by checking that the file
    descriptors passed to the ioctl are also opened for reading.

    Signed-off-by: Dan Rosenberg <dan.j.rosenberg@gmail.com>
    Reviewed-by: Christoph Hellwig <hch@lst.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    fs/xfs/xfs_dfrag.c | 5 ++++-
    1 file changed, 4 insertions(+), 1 deletion(-)

    --- a/fs/xfs/xfs_dfrag.c
    +++ b/fs/xfs/xfs_dfrag.c
    @@ -62,7 +62,9 @@ xfs_swapext(
    goto out;
    }

    - if (!(file->f_mode & FMODE_WRITE) || (file->f_flags & O_APPEND)) {
    + if (!(file->f_mode & FMODE_WRITE) ||
    + !(file->f_mode & FMODE_READ) ||
    + (file->f_flags & O_APPEND)) {
    error = XFS_ERROR(EBADF);
    goto out_put_file;
    }
    @@ -74,6 +76,7 @@ xfs_swapext(
    }

    if (!(target_file->f_mode & FMODE_WRITE) ||
    + !(target_file->f_mode & FMODE_READ) ||
    (target_file->f_flags & O_APPEND)) {
    error = XFS_ERROR(EBADF);
    goto out_put_target_file;



    \
     
     \ /
      Last update: 2010-08-06 21:15    [W:0.021 / U:88.564 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site