summaryrefslogtreecommitdiffstats
path: root/fs
diff options
context:
space:
mode:
authorDan Rosenberg <dan.j.rosenberg@gmail.com>2010-06-24 12:07:47 +1000
committerDave Chinner <david@fromorbit.com>2010-06-24 12:07:47 +1000
commit1817176a86352f65210139d4c794ad2d19fc6b63 (patch)
tree59ccbcb634d87882fc899b0d21438c4bb86f8632 /fs
parent7e27d6e778cd87b6f2415515d7127eba53fe5d02 (diff)
downloadlinux-1817176a86352f65210139d4c794ad2d19fc6b63.tar.gz
linux-1817176a86352f65210139d4c794ad2d19fc6b63.tar.bz2
linux-1817176a86352f65210139d4c794ad2d19fc6b63.zip
xfs: prevent swapext from operating on write-only files
This patch prevents user "foo" from using the SWAPEXT ioctl to swap a write-only file owned by user "bar" into a file owned by "foo" and subsequently reading it. It does so by checking that the file descriptors passed to the ioctl are also opened for reading. Signed-off-by: Dan Rosenberg <dan.j.rosenberg@gmail.com> Reviewed-by: Christoph Hellwig <hch@lst.de>
Diffstat (limited to 'fs')
-rw-r--r--fs/xfs/xfs_dfrag.c5
1 files changed, 4 insertions, 1 deletions
diff --git a/fs/xfs/xfs_dfrag.c b/fs/xfs/xfs_dfrag.c
index 5bba29a07812..7f159d2a429a 100644
--- a/fs/xfs/xfs_dfrag.c
+++ b/fs/xfs/xfs_dfrag.c
@@ -69,7 +69,9 @@ xfs_swapext(
goto out;
}
- if (!(file->f_mode & FMODE_WRITE) || (file->f_flags & O_APPEND)) {
+ if (!(file->f_mode & FMODE_WRITE) ||
+ !(file->f_mode & FMODE_READ) ||
+ (file->f_flags & O_APPEND)) {
error = XFS_ERROR(EBADF);
goto out_put_file;
}
@@ -81,6 +83,7 @@ xfs_swapext(
}
if (!(tmp_file->f_mode & FMODE_WRITE) ||
+ !(tmp_file->f_mode & FMODE_READ) ||
(tmp_file->f_flags & O_APPEND)) {
error = XFS_ERROR(EBADF);
goto out_put_tmp_file;