diff options
| author |   Arnd Bergmann <arnd@arndb.de> | 2006-01-04 20:31:23 +0100 |
|---|---|---|
| committer |   Paul Mackerras <paulus@samba.org> | 2006-01-09 15:44:38 +1100 |
| commit | e80358ad8606382154d97165121602dfae213e4a (patch) | |
| tree | b63e3e21cd0f4c1c086f958d05c6fa3298408746 /arch/powerpc/platforms/cell/spufs/syscalls.c | |
| parent | [PATCH] spufs: dont hold root->isem in spu_forget (diff) | |
| download | linux-dev-e80358ad8606382154d97165121602dfae213e4a.tar.xz linux-dev-e80358ad8606382154d97165121602dfae213e4a.zip | |
[PATCH] spufs: check for proper file pointer in sys_spu_run
Only checking for SPUFS_MAGIC is not reliable, because
it might not be unique in theory. Worse than that,
we accidentally allow spu_run to be performed on
any file in spufs, not just those returned from
spu_create as intended.
Noticed by Al Viro.
Signed-off-by: Arnd Bergmann <arndb@de.ibm.com>
Signed-off-by: Paul Mackerras <paulus@samba.org>
Diffstat (limited to '')
| -rw-r--r-- | arch/powerpc/platforms/cell/spufs/syscalls.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/arch/powerpc/platforms/cell/spufs/syscalls.c b/arch/powerpc/platforms/cell/spufs/syscalls.c index 17a2b51c94bc..0c2896ac9518 100644 --- a/arch/powerpc/platforms/cell/spufs/syscalls.c +++ b/arch/powerpc/platforms/cell/spufs/syscalls.c @@ -39,8 +39,9 @@ long do_spu_run(struct file *filp, __u32 __user *unpc, __u32 __user *ustatus) if (get_user(npc, unpc) || get_user(status, ustatus)) goto out; + /* check if this file was created by spu_create */ ret = -EINVAL; - if (filp->f_vfsmnt->mnt_sb->s_magic != SPUFS_MAGIC) + if (filp->f_op != &spufs_context_fops) goto out; i = SPUFS_I(filp->f_dentry->d_inode); |