Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5dc64164 authored by Dan Rosenberg's avatar Dan Rosenberg Committed by Chris Mason
Browse files

Btrfs: check for read permission on src file in the clone ioctl 



The existing code would have allowed you to clone a file that was
only open for writing

Signed-off-by: default avatarChris Mason <chris.mason@oracle.com>
parent 9f680ce0

fs/btrfs/ioctl.c

+5 −0
Original line number Original line Diff line number Diff line
@@ -1480,12 +1480,17 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd, 
		ret = -EBADF;

		ret = -EBADF;

		goto out_drop_write;

		goto out_drop_write;

	}

	}



	src = src_file->f_dentry->d_inode;

	src = src_file->f_dentry->d_inode;





	ret = -EINVAL;

	ret = -EINVAL;

	if (src == inode)

	if (src == inode)

		goto out_fput;

		goto out_fput;





	/* the src must be open for reading */

	if (!(src_file->f_mode & FMODE_READ))

		goto out_fput;



	ret = -EISDIR;

	ret = -EISDIR;

	if (S_ISDIR(src->i_mode) || S_ISDIR(inode->i_mode))

	if (S_ISDIR(src->i_mode) || S_ISDIR(inode->i_mode))

		goto out_fput;

		goto out_fput;