Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c43e259c authored by James Morris's avatar James Morris
Browse files

security: call security_file_permission from rw_verify_area 



All instances of rw_verify_area() are followed by a call to
security_file_permission(), so just call the latter from the former.

Acked-by: default avatarEric Paris <eparis@redhat.com>
Signed-off-by: default avatarJames Morris <jmorris@namei.org>
parent bced9528

fs/compat.c

+0 −4
Original line number Original line Diff line number Diff line
@@ -1104,10 +1104,6 @@ static ssize_t compat_do_readv_writev(int type, struct file *file, 
	if (ret < 0)

	if (ret < 0)

		goto out;

		goto out;





	ret = security_file_permission(file, type == READ ? MAY_READ:MAY_WRITE);

	if (ret)

		goto out;



	fnv = NULL;

	fnv = NULL;

	if (type == READ) {

	if (type == READ) {

		fn = file->f_op->read;

		fn = file->f_op->read;

fs/read_write.c

+24 −39
Original line number Original line Diff line number Diff line
@@ -197,25 +197,27 @@ int rw_verify_area(int read_write, struct file *file, loff_t *ppos, size_t count 
{

{

	struct inode *inode;

	struct inode *inode;

	loff_t pos;

	loff_t pos;

	int retval = -EINVAL;





	inode = file->f_path.dentry->d_inode;

	inode = file->f_path.dentry->d_inode;

	if (unlikely((ssize_t) count < 0))

	if (unlikely((ssize_t) count < 0))

		goto Einval;

		return retval;

	pos = *ppos;

	pos = *ppos;

	if (unlikely((pos < 0) || (loff_t) (pos + count) < 0))

	if (unlikely((pos < 0) || (loff_t) (pos + count) < 0))

		goto Einval;

		return retval;





	if (unlikely(inode->i_flock && mandatory_lock(inode))) {

	if (unlikely(inode->i_flock && mandatory_lock(inode))) {

		int retval = locks_mandatory_area(

		retval = locks_mandatory_area(

			read_write == READ ? FLOCK_VERIFY_READ : FLOCK_VERIFY_WRITE,

			read_write == READ ? FLOCK_VERIFY_READ : FLOCK_VERIFY_WRITE,

			inode, file, pos, count);

			inode, file, pos, count);

		if (retval < 0)

		if (retval < 0)

			return retval;

			return retval;

	}

	}

	retval = security_file_permission(file,

				read_write == READ ? MAY_READ : MAY_WRITE);

	if (retval)

		return retval;

	return count > MAX_RW_COUNT ? MAX_RW_COUNT : count;

	return count > MAX_RW_COUNT ? MAX_RW_COUNT : count;



Einval:

	return -EINVAL;

}

}





static void wait_on_retry_sync_kiocb(struct kiocb *iocb)

static void wait_on_retry_sync_kiocb(struct kiocb *iocb)
@@ -267,8 +269,6 @@ ssize_t vfs_read(struct file *file, char __user *buf, size_t count, loff_t *pos) 
	ret = rw_verify_area(READ, file, pos, count);

	ret = rw_verify_area(READ, file, pos, count);

	if (ret >= 0) {

	if (ret >= 0) {

		count = ret;

		count = ret;

		ret = security_file_permission (file, MAY_READ);

		if (!ret) {

		if (file->f_op->read)

		if (file->f_op->read)

			ret = file->f_op->read(file, buf, count, pos);

			ret = file->f_op->read(file, buf, count, pos);

		else

		else
@@ -279,7 +279,6 @@ ssize_t vfs_read(struct file *file, char __user *buf, size_t count, loff_t *pos) 
		}

		}

		inc_syscr(current);

		inc_syscr(current);

	}

	}

	}





	return ret;

	return ret;

}

}
@@ -325,8 +324,6 @@ ssize_t vfs_write(struct file *file, const char __user *buf, size_t count, loff_ 
	ret = rw_verify_area(WRITE, file, pos, count);

	ret = rw_verify_area(WRITE, file, pos, count);

	if (ret >= 0) {

	if (ret >= 0) {

		count = ret;

		count = ret;

		ret = security_file_permission (file, MAY_WRITE);

		if (!ret) {

		if (file->f_op->write)

		if (file->f_op->write)

			ret = file->f_op->write(file, buf, count, pos);

			ret = file->f_op->write(file, buf, count, pos);

		else

		else
@@ -337,7 +334,6 @@ ssize_t vfs_write(struct file *file, const char __user *buf, size_t count, loff_ 
		}

		}

		inc_syscw(current);

		inc_syscw(current);

	}

	}

	}





	return ret;

	return ret;

}

}
@@ -603,9 +599,6 @@ static ssize_t do_readv_writev(int type, struct file *file, 
	ret = rw_verify_area(type, file, pos, tot_len);

	ret = rw_verify_area(type, file, pos, tot_len);

	if (ret < 0)

	if (ret < 0)

		goto out;

		goto out;

	ret = security_file_permission(file, type == READ ? MAY_READ : MAY_WRITE);

	if (ret)

		goto out;





	fnv = NULL;

	fnv = NULL;

	if (type == READ) {

	if (type == READ) {
@@ -737,10 +730,6 @@ static ssize_t do_sendfile(int out_fd, int in_fd, loff_t *ppos, 
		goto fput_in;

		goto fput_in;

	count = retval;

	count = retval;





	retval = security_file_permission (in_file, MAY_READ);

	if (retval)

		goto fput_in;



	/*

	/*

	 * Get output file, and verify that it is ok..

	 * Get output file, and verify that it is ok..

	 */

	 */
@@ -759,10 +748,6 @@ static ssize_t do_sendfile(int out_fd, int in_fd, loff_t *ppos, 
		goto fput_out;

		goto fput_out;

	count = retval;

	count = retval;





	retval = security_file_permission (out_file, MAY_WRITE);

	if (retval)

		goto fput_out;



	if (!max)

	if (!max)

		max = min(in_inode->i_sb->s_maxbytes, out_inode->i_sb->s_maxbytes);

		max = min(in_inode->i_sb->s_maxbytes, out_inode->i_sb->s_maxbytes);

fs/splice.c

+0 −8
Original line number Original line Diff line number Diff line
@@ -908,10 +908,6 @@ static long do_splice_from(struct pipe_inode_info *pipe, struct file *out, 
	if (unlikely(ret < 0))

	if (unlikely(ret < 0))

		return ret;

		return ret;





	ret = security_file_permission(out, MAY_WRITE);

	if (unlikely(ret < 0))

		return ret;



	return out->f_op->splice_write(pipe, out, ppos, len, flags);

	return out->f_op->splice_write(pipe, out, ppos, len, flags);

}

}
@@ -934,10 +930,6 @@ static long do_splice_to(struct file *in, loff_t *ppos, 
	if (unlikely(ret < 0))

	if (unlikely(ret < 0))

		return ret;

		return ret;





	ret = security_file_permission(in, MAY_READ);

	if (unlikely(ret < 0))

		return ret;



	return in->f_op->splice_read(in, ppos, pipe, len, flags);

	return in->f_op->splice_read(in, ppos, pipe, len, flags);

}

}