DivestOS/Patches/Linux_CVEs/CVE-2016-9576/3.10/0002.patch
2017-11-07 22:03:58 -05:00

72 lines
2.1 KiB
Diff

From f569aee1087fa3da9712952fc00daa72b028424c Mon Sep 17 00:00:00 2001
From: Linus Torvalds <torvalds@linux-foundation.org>
Date: Sat, 07 Jan 2017 19:14:29 +0100
Subject: [PATCH] splice: introduce FMODE_SPLICE_READ and FMODE_SPLICE_WRITE
Introduce FMODE_SPLICE_READ and FMODE_SPLICE_WRITE. These modes check
whether it is legal to read or write a file using splice. Both get
automatically set on regular files and are not checked when a 'struct
fileoperations' includes the splice_{read,write} methods.
Change-Id: Ice6a3fab20bf0ac131f8d908f4bb0f7dc34bf4e3
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Johannes Thumshirn <jthumshirn@suse.de>
---
diff --git a/fs/open.c b/fs/open.c
index 9bf7fa0..e0e2a37 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -680,6 +680,10 @@
return 0;
}
+ if (S_ISREG(inode->i_mode))
+ f->f_mode |= FMODE_SPLICE_WRITE | FMODE_SPLICE_READ;
+
+
f->f_op = fops_get(inode->i_fop);
error = security_file_open(f, cred);
diff --git a/fs/splice.c b/fs/splice.c
index f183f13..8ba78ce 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -381,6 +381,9 @@
index++;
}
+ if (unlikely(!(in->f_mode & FMODE_SPLICE_READ)))
+ return -EINVAL;
+
/*
* Now loop over the map and see if we need to start IO on any
* pages, fill in the partial map, etc.
@@ -1084,6 +1087,9 @@
{
ssize_t ret;
+ if (unlikely(!(out->f_mode & FMODE_SPLICE_WRITE)))
+ return -EINVAL;
+
ret = splice_from_pipe(pipe, out, ppos, len, flags, write_pipe_buf);
if (ret > 0)
*ppos += ret;
diff --git a/include/linux/fs.h b/include/linux/fs.h
index e6f1180..78300ef 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -125,6 +125,11 @@
/* File was opened by fanotify and shouldn't generate fanotify events */
#define FMODE_NONOTIFY ((__force fmode_t)0x1000000)
+/* File can be read using splice */
+#define FMODE_SPLICE_READ ((__force fmode_t)0x8000000)
+/* File can be written using splice */
+#define FMODE_SPLICE_WRITE ((__force fmode_t)0x10000000)
+
/*
* Flag for rw_copy_check_uvector and compat_rw_copy_check_uvector
* that indicates that they should check the contents of the iovec are