[PATCH] splice : Must fully check for fifos

[Eric Dumazet <dada1@cosmosbay.com>]

[-- Attachment #1: Type: text/plain, Size: 754 bytes --]

With the patch this time :( Sorry guys

Hi Andrew

I think this patch is necessary. It's quite easy to crash a 2.6.19-rc4 box :(

AFAIK the problem come from inode-diet (by Theodore Ts'o, (2006/Sep/27))

Thank you

[PATCH] splice : Must fully check for FIFO

It appears that i_pipe, i_cdev and i_bdev share the same memory location 
(anonymous union in struct inode) since commits 
577c4eb09d1034d0739e3135fd2cff50588024be
eaf796e7ef6014f208c409b2b14fddcfaafe7e3a

Because of that, testing i_pipe being NULL is not anymore sufficient to tell 
if an inode is a FIFO or not.

Therefore, we must use the S_ISFIFO(inode->i_mode) test before assuming i_pipe 
pointer is pointing to a struct pipe_inode_info.

Signed-off-by: Eric Dumazet <dada1@cosmosbay.com>

[-- Attachment #2: splice_fix.patch --]
[-- Type: text/plain, Size: 2262 bytes --]

--- linux-2.6.19-rc4/fs/splice.c	2006-11-02 17:14:55.000000000 +0100
+++ linux-2.6.19-rc4-ed/fs/splice.c	2006-11-02 17:38:29.000000000 +0100
@@ -1115,12 +1115,14 @@
 		      struct file *out, loff_t __user *off_out,
 		      size_t len, unsigned int flags)
 {
+	struct inode *inode;
 	struct pipe_inode_info *pipe;
 	loff_t offset, *off;
 	long ret;
 
-	pipe = in->f_dentry->d_inode->i_pipe;
-	if (pipe) {
+	inode = in->f_dentry->d_inode;
+	pipe = inode->i_pipe;
+	if (pipe && S_ISFIFO(inode->i_mode)) {
 		if (off_in)
 			return -ESPIPE;
 		if (off_out) {
@@ -1140,8 +1142,9 @@
 		return ret;
 	}
 
-	pipe = out->f_dentry->d_inode->i_pipe;
-	if (pipe) {
+	inode = out->f_dentry->d_inode;
+	pipe = inode->i_pipe;
+	if (pipe && S_ISFIFO(inode->i_mode)) {
 		if (off_out)
 			return -ESPIPE;
 		if (off_in) {
@@ -1298,7 +1301,8 @@
 static long do_vmsplice(struct file *file, const struct iovec __user *iov,
 			unsigned long nr_segs, unsigned int flags)
 {
-	struct pipe_inode_info *pipe = file->f_dentry->d_inode->i_pipe;
+	struct inode *inode = file->f_dentry->d_inode;
+	struct pipe_inode_info *pipe = inode->i_pipe;
 	struct page *pages[PIPE_BUFFERS];
 	struct partial_page partial[PIPE_BUFFERS];
 	struct splice_pipe_desc spd = {
@@ -1308,7 +1312,7 @@
 		.ops = &user_page_pipe_buf_ops,
 	};
 
-	if (unlikely(!pipe))
+	if (unlikely(!pipe || !S_ISFIFO(inode->i_mode)))
 		return -EBADF;
 	if (unlikely(nr_segs > UIO_MAXIOV))
 		return -EINVAL;
@@ -1535,11 +1539,21 @@
 static long do_tee(struct file *in, struct file *out, size_t len,
 		   unsigned int flags)
 {
-	struct pipe_inode_info *ipipe = in->f_dentry->d_inode->i_pipe;
-	struct pipe_inode_info *opipe = out->f_dentry->d_inode->i_pipe;
+	struct inode *in_inode = in->f_dentry->d_inode;
+	struct inode *out_inode = out->f_dentry->d_inode;
+	struct pipe_inode_info *ipipe;
+	struct pipe_inode_info *opipe;
 	int ret = -EINVAL;
 
 	/*
+	 * CAUTION : As i_pipe/i_bdev/i_cdev share the same location,
+	 * we must check we deal with fifos/pipes, not cdev or bdev.
+	 */
+	if (!S_ISFIFO(in_inode->i_mode) || !S_ISFIFO(out_inode->i_mode))
+		return ret;
+	ipipe = in_inode->i_pipe;
+	opipe = out_inode->i_pipe;
+	/*
 	 * Duplicate the contents of ipipe to opipe without actually
 	 * copying the data.
 	 */