lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

xfs: prevent swapext from operating on write-only files

Browse Source 
This patch prevents user "foo" from using the SWAPEXT ioctl to swap
a write-only file owned by user "bar" into a file owned by "foo" and
subsequently reading it.  It does so by checking that the file
descriptors passed to the ioctl are also opened for reading.

Signed-off-by: Dan Rosenberg <dan.j.rosenberg@gmail.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
This commit is contained in:
Dan Rosenberg
2010-06-24 12:07:47 +10:00
committed by Dave Chinner
parent 7e27d6e778
commit 1817176a86
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
fs/xfs/xfs_dfrag.c
View File

@@ -69,7 +69,9 @@ xfs_swapext(
goto out; goto out;
} }
if (!(file->f_mode & FMODE_WRITE) || (file->f_flags & O_APPEND)) { if (!(file->f_mode & FMODE_WRITE) ||
!(file->f_mode & FMODE_READ) ||
(file->f_flags & O_APPEND)) {
error = XFS_ERROR(EBADF); error = XFS_ERROR(EBADF);
goto out_put_file; goto out_put_file;
} }
@@ -81,6 +83,7 @@ xfs_swapext(
} }
if (!(tmp_file->f_mode & FMODE_WRITE) || if (!(tmp_file->f_mode & FMODE_WRITE) ||
!(tmp_file->f_mode & FMODE_READ) ||
(tmp_file->f_flags & O_APPEND)) { (tmp_file->f_flags & O_APPEND)) {
error = XFS_ERROR(EBADF); error = XFS_ERROR(EBADF);
goto out_put_tmp_file; goto out_put_tmp_file;