Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e80358ad authored by Arnd Bergmann's avatar Arnd Bergmann Committed by Paul Mackerras
Browse files

[PATCH] spufs: check for proper file pointer in sys_spu_run 



Only checking for SPUFS_MAGIC is not reliable, because
it might not be unique in theory. Worse than that,
we accidentally allow spu_run to be performed on
any file in spufs, not just those returned from
spu_create as intended.

Noticed by Al Viro.

Signed-off-by: default avatarArnd Bergmann <arndb@de.ibm.com>
Signed-off-by: default avatarPaul Mackerras <paulus@samba.org>
parent c8ca0633

arch/powerpc/platforms/cell/spufs/inode.c

+2 −2
Original line number Diff line number Diff line
@@ -212,7 +212,7 @@ struct inode_operations spufs_dir_inode_operations = { 
	.lookup = simple_lookup,

};



struct file_operations spufs_autodelete_dir_operations = {

struct file_operations spufs_context_fops = {

	.open		= dcache_dir_open,

	.release	= spufs_dir_close,

	.llseek		= dcache_dir_lseek,
@@ -301,7 +301,7 @@ spufs_create_thread(struct nameidata *nd, const char *name, 
		put_unused_fd(ret);

		ret = PTR_ERR(filp);

	} else {

		filp->f_op = &spufs_autodelete_dir_operations;

		filp->f_op = &spufs_context_fops;

		fd_install(ret, filp);

	}

arch/powerpc/platforms/cell/spufs/spufs.h

+1 −0
Original line number Diff line number Diff line
@@ -103,6 +103,7 @@ long spufs_run_spu(struct file *file, 
		   struct spu_context *ctx, u32 *npc, u32 *status);

long spufs_create_thread(struct nameidata *nd, const char *name,

			 unsigned int flags, mode_t mode);

extern struct file_operations spufs_context_fops;



/* context management */

struct spu_context * alloc_spu_context(struct address_space *local_store);

arch/powerpc/platforms/cell/spufs/syscalls.c

+2 −1
Original line number Diff line number Diff line
@@ -39,8 +39,9 @@ long do_spu_run(struct file *filp, __u32 __user *unpc, __u32 __user *ustatus) 
	if (get_user(npc, unpc) || get_user(status, ustatus))

		goto out;



	/* check if this file was created by spu_create */

	ret = -EINVAL;

	if (filp->f_vfsmnt->mnt_sb->s_magic != SPUFS_MAGIC)

	if (filp->f_op != &spufs_context_fops)

		goto out;



	i = SPUFS_I(filp->f_dentry->d_inode);