Messages in this thread Patch in this message | | | From | Alexey Kardashevskiy <> | Subject | [PATCH kernel] 9p/trans_fd: Check file mode at opening | Date | Tue, 28 Jul 2020 22:41:29 +1000 |
| |
The "fd" transport layer uses 2 file descriptors passed externally and calls kernel_write()/kernel_read() on these. If files were opened without FMODE_WRITE/FMODE_READ, WARN_ON_ONCE() will fire.
This adds file mode checking in p9_fd_open; this returns -EBADF to preserve the original behavior.
Found by syzkaller.
Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> --- net/9p/trans_fd.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c index 13cd683a658a..62cdfbd01f0a 100644 --- a/net/9p/trans_fd.c +++ b/net/9p/trans_fd.c @@ -797,6 +797,7 @@ static int parse_opts(char *params, struct p9_fd_opts *opts) static int p9_fd_open(struct p9_client *client, int rfd, int wfd) { + bool perm; struct p9_trans_fd *ts = kzalloc(sizeof(struct p9_trans_fd), GFP_KERNEL); if (!ts) @@ -804,12 +805,16 @@ static int p9_fd_open(struct p9_client *client, int rfd, int wfd) ts->rd = fget(rfd); ts->wr = fget(wfd); - if (!ts->rd || !ts->wr) { + perm = ts->rd && (ts->rd->f_mode & FMODE_READ) && + ts->wr && (ts->wr->f_mode & FMODE_WRITE); + if (!ts->rd || !ts->wr || !perm) { if (ts->rd) fput(ts->rd); if (ts->wr) fput(ts->wr); kfree(ts); + if (!perm) + return -EBADF; return -EIO; } -- 2.17.1
| |