From: Arnd Bergmann <arnd@arndb.de>
To: Paul Mackerras <paulus@samba.org>
Cc: linuxppc64-dev@ozlabs.org, linux-kernel@vger.kernel.org,
Al Viro <viro@ftp.linux.org.uk>, Mark Nutter <mnutter@us.ibm.com>,
Arnd Bergmann <arndb@de.ibm.com>
Subject: [PATCH 03/13] spufs: check for proper file pointer in sys_spu_run
Date: Wed, 04 Jan 2006 20:31:23 +0100 [thread overview]
Message-ID: <20060104194500.522025000@localhost> (raw)
In-Reply-To: 20060104193120.050539000@localhost
[-- Attachment #1: spufs-run-check-fd.diff --]
[-- Type: text/plain, Size: 2349 bytes --]
Only checking for SPUFS_MAGIC is not reliable, because
it might not be unique in theory. Worse than that,
we accidentally allow spu_run to be performed on
any file in spufs, not just those returned from
spu_create as intended.
Noticed by Al Viro.
Signed-off-by: Arnd Bergmann <arndb@de.ibm.com>
Index: linux-2.6.15-rc/arch/powerpc/platforms/cell/spufs/inode.c
===================================================================
--- linux-2.6.15-rc.orig/arch/powerpc/platforms/cell/spufs/inode.c
+++ linux-2.6.15-rc/arch/powerpc/platforms/cell/spufs/inode.c
@@ -212,7 +212,7 @@ struct inode_operations spufs_dir_inode_
.lookup = simple_lookup,
};
-struct file_operations spufs_autodelete_dir_operations = {
+struct file_operations spufs_context_fops = {
.open = dcache_dir_open,
.release = spufs_dir_close,
.llseek = dcache_dir_lseek,
@@ -301,7 +301,7 @@ spufs_create_thread(struct nameidata *nd
put_unused_fd(ret);
ret = PTR_ERR(filp);
} else {
- filp->f_op = &spufs_autodelete_dir_operations;
+ filp->f_op = &spufs_context_fops;
fd_install(ret, filp);
}
Index: linux-2.6.15-rc/arch/powerpc/platforms/cell/spufs/spufs.h
===================================================================
--- linux-2.6.15-rc.orig/arch/powerpc/platforms/cell/spufs/spufs.h
+++ linux-2.6.15-rc/arch/powerpc/platforms/cell/spufs/spufs.h
@@ -103,6 +103,7 @@ long spufs_run_spu(struct file *file,
struct spu_context *ctx, u32 *npc, u32 *status);
long spufs_create_thread(struct nameidata *nd, const char *name,
unsigned int flags, mode_t mode);
+extern struct file_operations spufs_context_fops;
/* context management */
struct spu_context * alloc_spu_context(struct address_space *local_store);
Index: linux-2.6.15-rc/arch/powerpc/platforms/cell/spufs/syscalls.c
===================================================================
--- linux-2.6.15-rc.orig/arch/powerpc/platforms/cell/spufs/syscalls.c
+++ linux-2.6.15-rc/arch/powerpc/platforms/cell/spufs/syscalls.c
@@ -39,8 +39,9 @@ long do_spu_run(struct file *filp, __u32
if (get_user(npc, unpc) || get_user(status, ustatus))
goto out;
+ /* check if this file was created by spu_create */
ret = -EINVAL;
- if (filp->f_vfsmnt->mnt_sb->s_magic != SPUFS_MAGIC)
+ if (filp->f_op != &spufs_context_fops)
goto out;
i = SPUFS_I(filp->f_dentry->d_inode);
--
next prev parent reply other threads:[~2006-01-04 19:57 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2006-01-04 19:31 [PATCH 00/13] spufs fixes and cleanups Arnd Bergmann
2006-01-04 19:31 ` [PATCH 01/13] spufs: fix locking in spu_acquire_runnable Arnd Bergmann
2006-01-04 19:31 ` [PATCH 02/13] spufs: dont hold root->isem in spu_forget Arnd Bergmann
2006-01-04 19:31 ` Arnd Bergmann [this message]
2006-01-04 19:31 ` [PATCH 04/13] spufs: serialize sys_spu_run per spu Arnd Bergmann
2006-01-04 19:31 ` [PATCH 05/13] spufs fix spu_acquire_runnable error path Arnd Bergmann
2006-01-04 19:31 ` [PATCH 06/13] spufs: dont leak directories in failed spu_create Arnd Bergmann
2006-01-04 19:31 ` [PATCH 07/13] spufs: fix spufs_fill_dir error path Arnd Bergmann
2006-01-04 19:31 ` [PATCH 08/13] spufs: clean up use of bitops Arnd Bergmann
2006-01-04 19:31 ` [PATCH 09/13] spufs: move spu_run call to its own file Arnd Bergmann
2006-01-04 19:31 ` [PATCH 10/13] spufs: abstract priv1 register access Arnd Bergmann
2006-01-04 19:31 ` [PATCH 11/13] spufs: fix sparse warnings Arnd Bergmann
2006-01-04 19:31 ` [PATCH 12/13] spufs: fix allocation on 64k pages Arnd Bergmann
2006-01-04 19:31 ` [PATCH 13/13] spufs: set irq affinity for running threads Arnd Bergmann
2006-01-05 4:42 ` Nathan Lynch
2006-01-05 14:05 ` Arnd Bergmann
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20060104194500.522025000@localhost \
--to=arnd@arndb.de \
--cc=arndb@de.ibm.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linuxppc64-dev@ozlabs.org \
--cc=mnutter@us.ibm.com \
--cc=paulus@samba.org \
--cc=viro@ftp.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox