From e80358ad8606382154d97165121602dfae213e4a Mon Sep 17 00:00:00 2001 From: Arnd Bergmann Date: Wed, 4 Jan 2006 20:31:23 +0100 Subject: [PATCH] [PATCH] spufs: check for proper file pointer in sys_spu_run Only checking for SPUFS_MAGIC is not reliable, because it might not be unique in theory. Worse than that, we accidentally allow spu_run to be performed on any file in spufs, not just those returned from spu_create as intended. Noticed by Al Viro. Signed-off-by: Arnd Bergmann Signed-off-by: Paul Mackerras --- arch/powerpc/platforms/cell/spufs/inode.c | 4 ++-- arch/powerpc/platforms/cell/spufs/spufs.h | 1 + arch/powerpc/platforms/cell/spufs/syscalls.c | 3 ++- 3 files changed, 5 insertions(+), 3 deletions(-) diff --git a/arch/powerpc/platforms/cell/spufs/inode.c b/arch/powerpc/platforms/cell/spufs/inode.c index 45944012b06a..e314f18eccdd 100644 --- a/arch/powerpc/platforms/cell/spufs/inode.c +++ b/arch/powerpc/platforms/cell/spufs/inode.c @@ -212,7 +212,7 @@ struct inode_operations spufs_dir_inode_operations = { .lookup = simple_lookup, }; -struct file_operations spufs_autodelete_dir_operations = { +struct file_operations spufs_context_fops = { .open = dcache_dir_open, .release = spufs_dir_close, .llseek = dcache_dir_lseek, @@ -301,7 +301,7 @@ spufs_create_thread(struct nameidata *nd, const char *name, put_unused_fd(ret); ret = PTR_ERR(filp); } else { - filp->f_op = &spufs_autodelete_dir_operations; + filp->f_op = &spufs_context_fops; fd_install(ret, filp); } diff --git a/arch/powerpc/platforms/cell/spufs/spufs.h b/arch/powerpc/platforms/cell/spufs/spufs.h index 17cae5e5fdf5..420953b58881 100644 --- a/arch/powerpc/platforms/cell/spufs/spufs.h +++ b/arch/powerpc/platforms/cell/spufs/spufs.h @@ -103,6 +103,7 @@ long spufs_run_spu(struct file *file, struct spu_context *ctx, u32 *npc, u32 *status); long spufs_create_thread(struct nameidata *nd, const char *name, unsigned int flags, mode_t mode); +extern struct file_operations spufs_context_fops; /* context management */ struct spu_context * alloc_spu_context(struct address_space *local_store); diff --git a/arch/powerpc/platforms/cell/spufs/syscalls.c b/arch/powerpc/platforms/cell/spufs/syscalls.c index 17a2b51c94bc..0c2896ac9518 100644 --- a/arch/powerpc/platforms/cell/spufs/syscalls.c +++ b/arch/powerpc/platforms/cell/spufs/syscalls.c @@ -39,8 +39,9 @@ long do_spu_run(struct file *filp, __u32 __user *unpc, __u32 __user *ustatus) if (get_user(npc, unpc) || get_user(status, ustatus)) goto out; + /* check if this file was created by spu_create */ ret = -EINVAL; - if (filp->f_vfsmnt->mnt_sb->s_magic != SPUFS_MAGIC) + if (filp->f_op != &spufs_context_fops) goto out; i = SPUFS_I(filp->f_dentry->d_inode); -- 2.30.2