Commit 7f1b6245 authored Jul 20, 2016 by Jann Horn Committed by Dave Chinner Jul 20, 2016

xfs: fix type confusion in xfs_ioc_swapext



When calling fdget() in xfs_ioc_swapext(), we need to verify that
the file descriptors passed into the ioctl point to XFS inodes
before we start operations on them. If we don't do this, we could be
referencing arbitrary kernel memory as an XFS inode. THis could lead
to memory corruption and/or performing locking operations on
attacker-chosen structures in kernel memory.

[dchinner: rewrite commit message ]
[dchinner: add comment explaining new check ]

Signed-off-by: Jann Horn <jann@thejh.net>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
Signed-off-by: Dave Chinner <david@fromorbit.com>

parent 1a695a90

fs/xfs/xfs_ioctl.c

+11 −0

Original line number	Diff line number	Diff line
		@@ -1575,6 +1575,17 @@ xfs_ioc_swapext(
		goto out_put_tmp_file;
		}

		/*
		* We need to ensure that the fds passed in point to XFS inodes
		* before we cast and access them as XFS structures as we have no
		* control over what the user passes us here.
		*/
		if (f.file->f_op != &xfs_file_operations \|\|
		tmp.file->f_op != &xfs_file_operations) {
		error = -EINVAL;
		goto out_put_tmp_file;
		}

		ip = XFS_I(file_inode(f.file));
		tip = XFS_I(file_inode(tmp.file));