Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1817176a authored by Dan Rosenberg's avatar Dan Rosenberg Committed by Dave Chinner
Browse files

xfs: prevent swapext from operating on write-only files 



This patch prevents user "foo" from using the SWAPEXT ioctl to swap
a write-only file owned by user "bar" into a file owned by "foo" and
subsequently reading it.  It does so by checking that the file
descriptors passed to the ioctl are also opened for reading.

Signed-off-by: default avatarDan Rosenberg <dan.j.rosenberg@gmail.com>
Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
parent 7e27d6e7

fs/xfs/xfs_dfrag.c

+4 −1
Original line number Diff line number Diff line
@@ -69,7 +69,9 @@ xfs_swapext( 
		goto out;

	}



	if (!(file->f_mode & FMODE_WRITE) || (file->f_flags & O_APPEND)) {

	if (!(file->f_mode & FMODE_WRITE) ||

	    !(file->f_mode & FMODE_READ) ||

	    (file->f_flags & O_APPEND)) {

		error = XFS_ERROR(EBADF);

		goto out_put_file;

	}
@@ -81,6 +83,7 @@ xfs_swapext( 
	}



	if (!(tmp_file->f_mode & FMODE_WRITE) ||

	    !(tmp_file->f_mode & FMODE_READ) ||

	    (tmp_file->f_flags & O_APPEND)) {

		error = XFS_ERROR(EBADF);

		goto out_put_tmp_file;