Prev: [0/4] 2.6.27.50-stable review
Next: [4/4] GFS2: rename causes kernel Oops
From: Greg KH on 6 Aug 2010 14:30
2.6.27-stable review patch. If anyone has any objections, please let us know.

------------------

From: Dan Rosenberg <dan.j.rosenberg(a)gmail.com>

commit 1817176a86352f65210139d4c794ad2d19fc6b63 upstream.

This patch prevents user "foo" from using the SWAPEXT ioctl to swap
a write-only file owned by user "bar" into a file owned by "foo" and
subsequently reading it. It does so by checking that the file
descriptors passed to the ioctl are also opened for reading.

Signed-off-by: Dan Rosenberg <dan.j.rosenberg(a)gmail.com>
Reviewed-by: Christoph Hellwig <hch(a)lst.de>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)suse.de>

---
fs/xfs/xfs_dfrag.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)

--- a/fs/xfs/xfs_dfrag.c
+++ b/fs/xfs/xfs_dfrag.c
@@ -74,7 +74,9 @@ xfs_swapext(
goto out_free_sxp;
}

- if (!(file->f_mode & FMODE_WRITE) || (file->f_flags & O_APPEND)) {
+ if (!(file->f_mode & FMODE_WRITE) ||
+ !(file->f_mode & FMODE_READ) ||
+ (file->f_flags & O_APPEND)) {
error = XFS_ERROR(EBADF);
goto out_put_file;
}
@@ -86,6 +88,7 @@ xfs_swapext(
}

if (!(target_file->f_mode & FMODE_WRITE) ||
+ !(target_file->f_mode & FMODE_READ) ||
(target_file->f_flags & O_APPEND)) {
error = XFS_ERROR(EBADF);
goto out_put_target_file;


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo(a)vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
 | 
Pages: 1
Prev: [0/4] 2.6.27.50-stable review
Next: [4/4] GFS2: rename causes kernel Oops