lkml.org 
[lkml]   [2018]   [Jun]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH 19/39] ovl: add ovl_mmap()
On Tue, May 29, 2018 at 04:43:19PM +0200, Miklos Szeredi wrote:
> Implement stacked mmap.
>
> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
> ---
> fs/overlayfs/file.c | 28 ++++++++++++++++++++++++++++
> 1 file changed, 28 insertions(+)
>
> diff --git a/fs/overlayfs/file.c b/fs/overlayfs/file.c
> index 7b47dce4b072..4057bbf2e141 100644
> --- a/fs/overlayfs/file.c
> +++ b/fs/overlayfs/file.c
> @@ -255,6 +255,33 @@ static int ovl_fsync(struct file *file, loff_t start, loff_t end, int datasync)
> return ret;
> }
>
> +static int ovl_mmap(struct file *file, struct vm_area_struct *vma)
> +{
> + struct fd real;
> + const struct cred *old_cred;
> + int ret;
> +
> + ret = ovl_real_fdget(file, &real);
> + if (ret)
> + return ret;
> +
> + /* transfer ref: */
> + fput(vma->vm_file);
> + vma->vm_file = get_file(real.file);
> + fdput(real);
> +
> + if (!vma->vm_file->f_op->mmap)
> + return -ENODEV;

That's broken. ->mmap() failure will fput(file), not fput(vma->vm_file).
What's more, _here_ your "corner case" is a huge DoS - open file r/o,
then have somebody else trigger copyup, then do tons of MAP_PRIVATE
mmaps on the r/o descriptor. *EACH* *OF* *THEM* will open a separate
struct file and stash into into new vmas.

NAK with extreme prejudice, sensu PTerry...

\
 
 \ /
  Last update: 2018-06-10 07:26    [W:0.261 / U:6.900 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site