Home Home > GIT Browse
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJohannes Thumshirn <jthumshirn@suse.de>2016-12-09 11:10:09 +0100
committerJiri Kosina <jkosina@suse.cz>2016-12-12 14:06:13 +0100
commitec496d6d3b5745fad09f88038ccef157199cdfbc (patch)
tree59dde29de1bce3fa9a474540c2051be57085ae2c
parente8cf15ec990d3dfaaed33dd70ed2abac3dcda1d5 (diff)
splice: introduce FMODE_SPLICE_READ and FMODE_SPLICE_WRITErpm-3.0.101-91
(CVE-2016-9576, bsc#1013604). Conflicts: series.conf suse-commit: 544b9d1ad5d464dedafcf917a71ddab94014ca6d
-rw-r--r--fs/open.c4
-rw-r--r--fs/splice.c7
-rw-r--r--include/linux/fs.h5
3 files changed, 16 insertions, 0 deletions
diff --git a/fs/open.c b/fs/open.c
index 7fd8e3e2e609..a97b846e3a4f 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -740,6 +740,10 @@ static struct file *__dentry_open(struct dentry *dentry, struct vfsmount *mnt,
return f;
}
+ if (S_ISREG(inode->i_mode))
+ f->f_mode |= FMODE_SPLICE_WRITE | FMODE_SPLICE_READ;
+
+
f->f_op = fops_get(inode->i_fop);
error = security_dentry_open(f, cred);
diff --git a/fs/splice.c b/fs/splice.c
index b2571e4b7859..372da4f30255 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -608,6 +608,10 @@ ssize_t default_file_splice_read(struct file *in, loff_t *ppos,
.spd_release = spd_release_page,
};
+ if (unlikely(!(in->f_mode & FMODE_SPLICE_READ)))
+ return -EINVAL;
+
+
if (splice_grow_spd(pipe, &spd))
return -ENOMEM;
@@ -1077,6 +1081,9 @@ static ssize_t default_file_splice_write(struct pipe_inode_info *pipe,
{
ssize_t ret;
+ if (unlikely(!(out->f_mode & FMODE_SPLICE_WRITE)))
+ return -EINVAL;
+
ret = splice_from_pipe(pipe, out, ppos, len, flags, write_pipe_buf);
if (ret > 0)
*ppos += ret;
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 12fe5d82b0bd..04afc374ae42 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -115,6 +115,11 @@ struct inodes_stat_t {
/* File was opened by fanotify and shouldn't generate fanotify events */
#define FMODE_NONOTIFY ((__force fmode_t)0x1000000)
+/* File can be read using splice */
+#define FMODE_SPLICE_READ ((__force fmode_t)0x8000000)
+/* File can be written using splice */
+#define FMODE_SPLICE_WRITE ((__force fmode_t)0x10000000)
+
/*
* The below are the various read and write types that we support. Some of
* them include behavioral modifiers that send information down to the