Commit e80358ad authored by Arnd Bergmann's avatar Arnd Bergmann Committed by Paul Mackerras

[PATCH] spufs: check for proper file pointer in sys_spu_run

Only checking for SPUFS_MAGIC is not reliable, because
it might not be unique in theory. Worse than that,
we accidentally allow spu_run to be performed on
any file in spufs, not just those returned from
spu_create as intended.

Noticed by Al Viro.
Signed-off-by: default avatarArnd Bergmann <arndb@de.ibm.com>
Signed-off-by: default avatarPaul Mackerras <paulus@samba.org>
parent c8ca0633
...@@ -212,7 +212,7 @@ struct inode_operations spufs_dir_inode_operations = { ...@@ -212,7 +212,7 @@ struct inode_operations spufs_dir_inode_operations = {
.lookup = simple_lookup, .lookup = simple_lookup,
}; };
struct file_operations spufs_autodelete_dir_operations = { struct file_operations spufs_context_fops = {
.open = dcache_dir_open, .open = dcache_dir_open,
.release = spufs_dir_close, .release = spufs_dir_close,
.llseek = dcache_dir_lseek, .llseek = dcache_dir_lseek,
...@@ -301,7 +301,7 @@ spufs_create_thread(struct nameidata *nd, const char *name, ...@@ -301,7 +301,7 @@ spufs_create_thread(struct nameidata *nd, const char *name,
put_unused_fd(ret); put_unused_fd(ret);
ret = PTR_ERR(filp); ret = PTR_ERR(filp);
} else { } else {
filp->f_op = &spufs_autodelete_dir_operations; filp->f_op = &spufs_context_fops;
fd_install(ret, filp); fd_install(ret, filp);
} }
......
...@@ -103,6 +103,7 @@ long spufs_run_spu(struct file *file, ...@@ -103,6 +103,7 @@ long spufs_run_spu(struct file *file,
struct spu_context *ctx, u32 *npc, u32 *status); struct spu_context *ctx, u32 *npc, u32 *status);
long spufs_create_thread(struct nameidata *nd, const char *name, long spufs_create_thread(struct nameidata *nd, const char *name,
unsigned int flags, mode_t mode); unsigned int flags, mode_t mode);
extern struct file_operations spufs_context_fops;
/* context management */ /* context management */
struct spu_context * alloc_spu_context(struct address_space *local_store); struct spu_context * alloc_spu_context(struct address_space *local_store);
......
...@@ -39,8 +39,9 @@ long do_spu_run(struct file *filp, __u32 __user *unpc, __u32 __user *ustatus) ...@@ -39,8 +39,9 @@ long do_spu_run(struct file *filp, __u32 __user *unpc, __u32 __user *ustatus)
if (get_user(npc, unpc) || get_user(status, ustatus)) if (get_user(npc, unpc) || get_user(status, ustatus))
goto out; goto out;
/* check if this file was created by spu_create */
ret = -EINVAL; ret = -EINVAL;
if (filp->f_vfsmnt->mnt_sb->s_magic != SPUFS_MAGIC) if (filp->f_op != &spufs_context_fops)
goto out; goto out;
i = SPUFS_I(filp->f_dentry->d_inode); i = SPUFS_I(filp->f_dentry->d_inode);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment