Commit 90da2e3f authored by Pavel Begunkov's avatar Pavel Begunkov Committed by Jens Axboe

splice: move f_mode checks to do_{splice,tee}()

do_splice() is used by io_uring, as will be do_tee(). Move f_mode
checks from sys_{splice,tee}() to do_{splice,tee}(), so they're
enforced for io_uring as well.

Fixes: 7d67af2c ("io_uring: add splice(2) support")
Reported-by: default avatarJann Horn <jannh@google.com>
Signed-off-by: default avatarPavel Begunkov <asml.silence@gmail.com>
Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 7f13657d
...@@ -1118,6 +1118,10 @@ long do_splice(struct file *in, loff_t __user *off_in, ...@@ -1118,6 +1118,10 @@ long do_splice(struct file *in, loff_t __user *off_in,
loff_t offset; loff_t offset;
long ret; long ret;
if (unlikely(!(in->f_mode & FMODE_READ) ||
!(out->f_mode & FMODE_WRITE)))
return -EBADF;
ipipe = get_pipe_info(in); ipipe = get_pipe_info(in);
opipe = get_pipe_info(out); opipe = get_pipe_info(out);
...@@ -1125,12 +1129,6 @@ long do_splice(struct file *in, loff_t __user *off_in, ...@@ -1125,12 +1129,6 @@ long do_splice(struct file *in, loff_t __user *off_in,
if (off_in || off_out) if (off_in || off_out)
return -ESPIPE; return -ESPIPE;
if (!(in->f_mode & FMODE_READ))
return -EBADF;
if (!(out->f_mode & FMODE_WRITE))
return -EBADF;
/* Splicing to self would be fun, but... */ /* Splicing to self would be fun, but... */
if (ipipe == opipe) if (ipipe == opipe)
return -EINVAL; return -EINVAL;
...@@ -1153,9 +1151,6 @@ long do_splice(struct file *in, loff_t __user *off_in, ...@@ -1153,9 +1151,6 @@ long do_splice(struct file *in, loff_t __user *off_in,
offset = out->f_pos; offset = out->f_pos;
} }
if (unlikely(!(out->f_mode & FMODE_WRITE)))
return -EBADF;
if (unlikely(out->f_flags & O_APPEND)) if (unlikely(out->f_flags & O_APPEND))
return -EINVAL; return -EINVAL;
...@@ -1440,16 +1435,12 @@ SYSCALL_DEFINE6(splice, int, fd_in, loff_t __user *, off_in, ...@@ -1440,16 +1435,12 @@ SYSCALL_DEFINE6(splice, int, fd_in, loff_t __user *, off_in,
error = -EBADF; error = -EBADF;
in = fdget(fd_in); in = fdget(fd_in);
if (in.file) { if (in.file) {
if (in.file->f_mode & FMODE_READ) {
out = fdget(fd_out); out = fdget(fd_out);
if (out.file) { if (out.file) {
if (out.file->f_mode & FMODE_WRITE) error = do_splice(in.file, off_in, out.file, off_out,
error = do_splice(in.file, off_in,
out.file, off_out,
len, flags); len, flags);
fdput(out); fdput(out);
} }
}
fdput(in); fdput(in);
} }
return error; return error;
...@@ -1770,6 +1761,10 @@ static long do_tee(struct file *in, struct file *out, size_t len, ...@@ -1770,6 +1761,10 @@ static long do_tee(struct file *in, struct file *out, size_t len,
struct pipe_inode_info *opipe = get_pipe_info(out); struct pipe_inode_info *opipe = get_pipe_info(out);
int ret = -EINVAL; int ret = -EINVAL;
if (unlikely(!(in->f_mode & FMODE_READ) ||
!(out->f_mode & FMODE_WRITE)))
return -EBADF;
/* /*
* Duplicate the contents of ipipe to opipe without actually * Duplicate the contents of ipipe to opipe without actually
* copying the data. * copying the data.
...@@ -1795,7 +1790,7 @@ static long do_tee(struct file *in, struct file *out, size_t len, ...@@ -1795,7 +1790,7 @@ static long do_tee(struct file *in, struct file *out, size_t len,
SYSCALL_DEFINE4(tee, int, fdin, int, fdout, size_t, len, unsigned int, flags) SYSCALL_DEFINE4(tee, int, fdin, int, fdout, size_t, len, unsigned int, flags)
{ {
struct fd in; struct fd in, out;
int error; int error;
if (unlikely(flags & ~SPLICE_F_ALL)) if (unlikely(flags & ~SPLICE_F_ALL))
...@@ -1807,15 +1802,11 @@ SYSCALL_DEFINE4(tee, int, fdin, int, fdout, size_t, len, unsigned int, flags) ...@@ -1807,15 +1802,11 @@ SYSCALL_DEFINE4(tee, int, fdin, int, fdout, size_t, len, unsigned int, flags)
error = -EBADF; error = -EBADF;
in = fdget(fdin); in = fdget(fdin);
if (in.file) { if (in.file) {
if (in.file->f_mode & FMODE_READ) { out = fdget(fdout);
struct fd out = fdget(fdout);
if (out.file) { if (out.file) {
if (out.file->f_mode & FMODE_WRITE) error = do_tee(in.file, out.file, len, flags);
error = do_tee(in.file, out.file,
len, flags);
fdput(out); fdput(out);
} }
}
fdput(in); fdput(in);
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment