From: Jiri Pirko <jpirko@redhat.com> Date: Mon, 12 Jul 2010 17:20:13 -0400 Subject: [fs] xfs: don't let swapext operate on write-only files Message-id: <20100712172013.GD2648@psychotron.redhat.com> Patchwork-id: 26816 O-Subject: [RHEL5.6 patch] BZ605161 xfs: prevent swapext from operating on write-only files Bugzilla: 605161 CVE: CVE-2010-2226 RH-Acked-by: Eric Sandeen <sandeen@redhat.com> RH-Acked-by: Dave Chinner <dchinner@redhat.com> BZ605161 https://bugzilla.redhat.com/show_bug.cgi?id=605161 Description: This patch prevents user "foo" from using the SWAPEXT ioctl to swap a write-only file owned by user "bar" into a file owned by "foo" and subsequently reading it. It does so by checking that the file descriptors passed to the ioctl are also opened for reading. Upstream: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=1817176a86352f65210139d4c794ad2d19fc6b63 Brew: https://brewweb.devel.redhat.com/taskinfo?taskID=2588697 Jirka Signed-off-by: Jiri Pirko <jpirko@redhat.com> Signed-off-by: Jarod Wilson <jarod@redhat.com> diff --git a/fs/xfs/xfs_dfrag.c b/fs/xfs/xfs_dfrag.c index 6df261f..2cd2468 100644 --- a/fs/xfs/xfs_dfrag.c +++ b/fs/xfs/xfs_dfrag.c @@ -62,7 +62,9 @@ xfs_swapext( goto out; } - if (!(file->f_mode & FMODE_WRITE) || (file->f_flags & O_APPEND)) { + if (!(file->f_mode & FMODE_WRITE) || + !(file->f_mode & FMODE_READ) || + (file->f_flags & O_APPEND)) { error = XFS_ERROR(EBADF); goto out_put_file; } @@ -74,6 +76,7 @@ xfs_swapext( } if (!(target_file->f_mode & FMODE_WRITE) || + !(target_file->f_mode & FMODE_READ) || (target_file->f_flags & O_APPEND)) { error = XFS_ERROR(EBADF); goto out_put_target_file;