diff options
| author |   Jann Horn <jann@thejh.net> | 2015-08-16 20:27:01 +0200 |
|---|---|---|
| committer |   Linus Torvalds <torvalds@linux-foundation.org> | 2015-08-16 12:35:44 -0700 |
| commit | 8ed1f0e22f49ef42e63875fd2529389a32ff3566 (patch) | |
| tree | 9f388d7ec994747b8703d371b49e1e27921b2533 /fs/fuse/dev.c | |
| parent | Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi (diff) | |
| download | linux-dev-8ed1f0e22f49ef42e63875fd2529389a32ff3566.tar.xz linux-dev-8ed1f0e22f49ef42e63875fd2529389a32ff3566.zip | |
fs/fuse: fix ioctl type confusion
fuse_dev_ioctl() performed fuse_get_dev() on a user-supplied fd,
leading to a type confusion issue. Fix it by checking file->f_op.
Signed-off-by: Jann Horn <jann@thejh.net>
Acked-by: Miklos Szeredi <miklos@szeredi.hu>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to '')
| -rw-r--r-- | fs/fuse/dev.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c index 80cc1b35d460..ebb5e37455a0 100644 --- a/fs/fuse/dev.c +++ b/fs/fuse/dev.c @@ -2246,7 +2246,15 @@ static long fuse_dev_ioctl(struct file *file, unsigned int cmd, err = -EINVAL; if (old) { - struct fuse_dev *fud = fuse_get_dev(old); + struct fuse_dev *fud = NULL; + + /* + * Check against file->f_op because CUSE + * uses the same ioctl handler. + */ + if (old->f_op == file->f_op && + old->f_cred->user_ns == file->f_cred->user_ns) + fud = fuse_get_dev(old); if (fud) { mutex_lock(&fuse_mutex); |