diff options
| author | Dan Rosenberg <dan.j.rosenberg@gmail.com> | 2010-06-24 12:07:47 +1000 |
|---|---|---|
| committer | Dave Chinner <david@fromorbit.com> | 2010-06-24 12:07:47 +1000 |
| commit | 1817176a86352f65210139d4c794ad2d19fc6b63 (patch) | |
| tree | 59ccbcb634d87882fc899b0d21438c4bb86f8632 | |
| parent | 7e27d6e778cd87b6f2415515d7127eba53fe5d02 (diff) | |
| download | linux-stable-1817176a86352f65210139d4c794ad2d19fc6b63.tar.gz linux-stable-1817176a86352f65210139d4c794ad2d19fc6b63.tar.bz2 linux-stable-1817176a86352f65210139d4c794ad2d19fc6b63.zip | |
xfs: prevent swapext from operating on write-only files
This patch prevents user "foo" from using the SWAPEXT ioctl to swap
a write-only file owned by user "bar" into a file owned by "foo" and
subsequently reading it. It does so by checking that the file
descriptors passed to the ioctl are also opened for reading.
Signed-off-by: Dan Rosenberg <dan.j.rosenberg@gmail.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
| -rw-r--r-- | fs/xfs/xfs_dfrag.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/fs/xfs/xfs_dfrag.c b/fs/xfs/xfs_dfrag.c index 5bba29a07812..7f159d2a429a 100644 --- a/fs/xfs/xfs_dfrag.c +++ b/fs/xfs/xfs_dfrag.c @@ -69,7 +69,9 @@ xfs_swapext( goto out; } - if (!(file->f_mode & FMODE_WRITE) || (file->f_flags & O_APPEND)) { + if (!(file->f_mode & FMODE_WRITE) || + !(file->f_mode & FMODE_READ) || + (file->f_flags & O_APPEND)) { error = XFS_ERROR(EBADF); goto out_put_file; } @@ -81,6 +83,7 @@ xfs_swapext( } if (!(tmp_file->f_mode & FMODE_WRITE) || + !(tmp_file->f_mode & FMODE_READ) || (tmp_file->f_flags & O_APPEND)) { error = XFS_ERROR(EBADF); goto out_put_tmp_file; |