iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

net/9p: validate fds in p9_fd_open

Browse Source 
p9_fd_open just fgets file descriptors passed in from userspace, but
doesn't verify that they are valid for read or writing.  This gets
cought down in the VFS when actually attempting a read or write, but
a new warning added in linux-next upsets syzcaller.

Fix this by just verifying the fds early on.

Link: http://lkml.kernel.org/r/20200710085722.435850-1-hch@lst.de
Reported-by: syzbot+e6f77e16ff68b2434a2c@syzkaller.appspotmail.com
Signed-off-by: Christoph Hellwig <hch@lst.de>
[Dominique: amend goto as per Doug Nazar's review]
Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
This commit is contained in:
Christoph Hellwig 2020-07-10 10:57:22 +02:00 committed by Dominique Martinet
parent 11ba468877
commit a39c46067c
1 changed files with 16 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
net/9p/trans_fd.c
View File

@ -803,20 +803,28 @@ static int p9_fd_open(struct p9_client *client, int rfd, int wfd)
return -ENOMEM; return -ENOMEM;
ts->rd = fget(rfd); ts->rd = fget(rfd);
if (!ts->rd)
goto out_free_ts;
if (!(ts->rd->f_mode & FMODE_READ))
goto out_put_rd;
ts->wr = fget(wfd); ts->wr = fget(wfd);
if (!ts->rd || !ts->wr) { if (!ts->wr)
if (ts->rd) goto out_put_rd;
fput(ts->rd); if (!(ts->wr->f_mode & FMODE_WRITE))
if (ts->wr) goto out_put_wr;
fput(ts->wr);
kfree(ts);
return -EIO;
}
client->trans = ts; client->trans = ts;
client->status = Connected; client->status = Connected;
return 0; return 0;
out_put_wr:
fput(ts->wr);
out_put_rd:
fput(ts->rd);
out_free_ts:
kfree(ts);
return -EIO;
} }
static int p9_socket_open(struct p9_client *client, struct socket *csocket) static int p9_socket_open(struct p9_client *client, struct socket *csocket)