Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5dc64164 authored by Dan Rosenberg's avatar Dan Rosenberg Committed by Chris Mason
Browse files

Btrfs: check for read permission on src file in the clone ioctl



The existing code would have allowed you to clone a file that was
only open for writing

Signed-off-by: default avatarChris Mason <chris.mason@oracle.com>
parent 9f680ce0
Loading
Loading
Loading
Loading
+5 −0
Original line number Original line Diff line number Diff line
@@ -1480,12 +1480,17 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd,
		ret = -EBADF;
		ret = -EBADF;
		goto out_drop_write;
		goto out_drop_write;
	}
	}

	src = src_file->f_dentry->d_inode;
	src = src_file->f_dentry->d_inode;


	ret = -EINVAL;
	ret = -EINVAL;
	if (src == inode)
	if (src == inode)
		goto out_fput;
		goto out_fput;


	/* the src must be open for reading */
	if (!(src_file->f_mode & FMODE_READ))
		goto out_fput;

	ret = -EISDIR;
	ret = -EISDIR;
	if (S_ISDIR(src->i_mode) || S_ISDIR(inode->i_mode))
	if (S_ISDIR(src->i_mode) || S_ISDIR(inode->i_mode))
		goto out_fput;
		goto out_fput;