diff options
author | Arnd Bergmann <arnd@arndb.de> | 2006-01-04 14:31:23 -0500 |
---|---|---|
committer | Paul Mackerras <paulus@samba.org> | 2006-01-08 23:44:38 -0500 |
commit | e80358ad8606382154d97165121602dfae213e4a (patch) | |
tree | b63e3e21cd0f4c1c086f958d05c6fa3298408746 /arch/powerpc | |
parent | c8ca0633e5f2bceab7b4eba4475820fd7674dece (diff) |
[PATCH] spufs: check for proper file pointer in sys_spu_run
Only checking for SPUFS_MAGIC is not reliable, because
it might not be unique in theory. Worse than that,
we accidentally allow spu_run to be performed on
any file in spufs, not just those returned from
spu_create as intended.
Noticed by Al Viro.
Signed-off-by: Arnd Bergmann <arndb@de.ibm.com>
Signed-off-by: Paul Mackerras <paulus@samba.org>
Diffstat (limited to 'arch/powerpc')
-rw-r--r-- | arch/powerpc/platforms/cell/spufs/inode.c | 4 | ||||
-rw-r--r-- | arch/powerpc/platforms/cell/spufs/spufs.h | 1 | ||||
-rw-r--r-- | arch/powerpc/platforms/cell/spufs/syscalls.c | 3 |
3 files changed, 5 insertions, 3 deletions
diff --git a/arch/powerpc/platforms/cell/spufs/inode.c b/arch/powerpc/platforms/cell/spufs/inode.c index 45944012b06a..e314f18eccdd 100644 --- a/arch/powerpc/platforms/cell/spufs/inode.c +++ b/arch/powerpc/platforms/cell/spufs/inode.c | |||
@@ -212,7 +212,7 @@ struct inode_operations spufs_dir_inode_operations = { | |||
212 | .lookup = simple_lookup, | 212 | .lookup = simple_lookup, |
213 | }; | 213 | }; |
214 | 214 | ||
215 | struct file_operations spufs_autodelete_dir_operations = { | 215 | struct file_operations spufs_context_fops = { |
216 | .open = dcache_dir_open, | 216 | .open = dcache_dir_open, |
217 | .release = spufs_dir_close, | 217 | .release = spufs_dir_close, |
218 | .llseek = dcache_dir_lseek, | 218 | .llseek = dcache_dir_lseek, |
@@ -301,7 +301,7 @@ spufs_create_thread(struct nameidata *nd, const char *name, | |||
301 | put_unused_fd(ret); | 301 | put_unused_fd(ret); |
302 | ret = PTR_ERR(filp); | 302 | ret = PTR_ERR(filp); |
303 | } else { | 303 | } else { |
304 | filp->f_op = &spufs_autodelete_dir_operations; | 304 | filp->f_op = &spufs_context_fops; |
305 | fd_install(ret, filp); | 305 | fd_install(ret, filp); |
306 | } | 306 | } |
307 | 307 | ||
diff --git a/arch/powerpc/platforms/cell/spufs/spufs.h b/arch/powerpc/platforms/cell/spufs/spufs.h index 17cae5e5fdf5..420953b58881 100644 --- a/arch/powerpc/platforms/cell/spufs/spufs.h +++ b/arch/powerpc/platforms/cell/spufs/spufs.h | |||
@@ -103,6 +103,7 @@ long spufs_run_spu(struct file *file, | |||
103 | struct spu_context *ctx, u32 *npc, u32 *status); | 103 | struct spu_context *ctx, u32 *npc, u32 *status); |
104 | long spufs_create_thread(struct nameidata *nd, const char *name, | 104 | long spufs_create_thread(struct nameidata *nd, const char *name, |
105 | unsigned int flags, mode_t mode); | 105 | unsigned int flags, mode_t mode); |
106 | extern struct file_operations spufs_context_fops; | ||
106 | 107 | ||
107 | /* context management */ | 108 | /* context management */ |
108 | struct spu_context * alloc_spu_context(struct address_space *local_store); | 109 | struct spu_context * alloc_spu_context(struct address_space *local_store); |
diff --git a/arch/powerpc/platforms/cell/spufs/syscalls.c b/arch/powerpc/platforms/cell/spufs/syscalls.c index 17a2b51c94bc..0c2896ac9518 100644 --- a/arch/powerpc/platforms/cell/spufs/syscalls.c +++ b/arch/powerpc/platforms/cell/spufs/syscalls.c | |||
@@ -39,8 +39,9 @@ long do_spu_run(struct file *filp, __u32 __user *unpc, __u32 __user *ustatus) | |||
39 | if (get_user(npc, unpc) || get_user(status, ustatus)) | 39 | if (get_user(npc, unpc) || get_user(status, ustatus)) |
40 | goto out; | 40 | goto out; |
41 | 41 | ||
42 | /* check if this file was created by spu_create */ | ||
42 | ret = -EINVAL; | 43 | ret = -EINVAL; |
43 | if (filp->f_vfsmnt->mnt_sb->s_magic != SPUFS_MAGIC) | 44 | if (filp->f_op != &spufs_context_fops) |
44 | goto out; | 45 | goto out; |
45 | 46 | ||
46 | i = SPUFS_I(filp->f_dentry->d_inode); | 47 | i = SPUFS_I(filp->f_dentry->d_inode); |