iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fs/fuse: fix ioctl type confusion

Browse Source 
fuse_dev_ioctl() performed fuse_get_dev() on a user-supplied fd,
leading to a type confusion issue. Fix it by checking file->f_op.

Signed-off-by: Jann Horn <jann@thejh.net>
Acked-by: Miklos Szeredi <miklos@szeredi.hu>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
Jann Horn 2015-08-16 20:27:01 +02:00 committed by Linus Torvalds
parent 1efdb5f0a9
commit 8ed1f0e22f
1 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
fs/fuse/dev.c
View File

@ -2246,7 +2246,15 @@ static long fuse_dev_ioctl(struct file *file, unsigned int cmd,
err = -EINVAL; err = -EINVAL;
if (old) { if (old) {
struct fuse_dev *fud = fuse_get_dev(old); struct fuse_dev *fud = NULL;
/*
* Check against file->f_op because CUSE
* uses the same ioctl handler.
*/
if (old->f_op == file->f_op &&
old->f_cred->user_ns == file->f_cred->user_ns)
fud = fuse_get_dev(old);
if (fud) { if (fud) {
mutex_lock(&fuse_mutex); mutex_lock(&fuse_mutex);