Commit 2030a42c authored by Al Viro's avatar Al Viro
Browse files

[PATCH] sanitize anon_inode_getfd() 



a) none of the callers even looks at inode or file returned by anon_inode_getfd()
b) any caller that would try to look at those would be racy, since by the time
it returns we might have raced with close() from another thread and that
file would be pining for fjords.

Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent 9f3acc31

fs/anon_inodes.c

+3 −10
Original line number Diff line number Diff line
@@ -57,9 +57,6 @@ static struct dentry_operations anon_inodefs_dentry_operations = { 
 *                    anonymous inode, and a dentry that describe the "class"

 *                    of the file

 *

 * @pfd:     [out]   pointer to the file descriptor

 * @dpinode: [out]   pointer to the inode

 * @pfile:   [out]   pointer to the file struct

 * @name:    [in]    name of the "class" of the new file

 * @fops     [in]    file operations for the new file

 * @priv     [in]    private data for the new file (will be file's private_data)
@@ -68,10 +65,9 @@ static struct dentry_operations anon_inodefs_dentry_operations = { 
 * that do not need to have a full-fledged inode in order to operate correctly.

 * All the files created with anon_inode_getfd() will share a single inode,

 * hence saving memory and avoiding code duplication for the file/inode/dentry

 * setup.

 * setup.  Returns new descriptor or -error.

 */

int anon_inode_getfd(int *pfd, struct inode **pinode, struct file **pfile,

		     const char *name, const struct file_operations *fops,

int anon_inode_getfd(const char *name, const struct file_operations *fops,

		     void *priv)

{

	struct qstr this;
@@ -125,10 +121,7 @@ int anon_inode_getfd(int *pfd, struct inode **pinode, struct file **pfile, 


	fd_install(fd, file);



	*pfd = fd;

	*pinode = anon_inode_inode;

	*pfile = file;

	return 0;

	return fd;



err_dput:

	dput(dentry);

fs/eventfd.c

+5 −10
Original line number Diff line number Diff line
@@ -200,10 +200,8 @@ struct file *eventfd_fget(int fd) 


asmlinkage long sys_eventfd(unsigned int count)

{

	int error, fd;

	int fd;

	struct eventfd_ctx *ctx;

	struct file *file;

	struct inode *inode;



	ctx = kmalloc(sizeof(*ctx), GFP_KERNEL);

	if (!ctx)
@@ -216,12 +214,9 @@ asmlinkage long sys_eventfd(unsigned int count) 
	 * When we call this, the initialization must be complete, since

	 * anon_inode_getfd() will install the fd.

	 */

	error = anon_inode_getfd(&fd, &inode, &file, "[eventfd]",

				 &eventfd_fops, ctx);

	if (!error)

		return fd;



	fd = anon_inode_getfd("[eventfd]", &eventfd_fops, ctx);

	if (fd < 0)

		kfree(ctx);

	return error;

	return fd;

}

fs/eventpoll.c

+8 −15
Original line number Diff line number Diff line
@@ -1050,8 +1050,6 @@ asmlinkage long sys_epoll_create(int size) 
{

	int error, fd = -1;

	struct eventpoll *ep;

	struct inode *inode;

	struct file *file;



	DNPRINTK(3, (KERN_INFO "[%p] eventpoll: sys_epoll_create(%d)\n",

		     current, size));
@@ -1061,29 +1059,24 @@ asmlinkage long sys_epoll_create(int size) 
	 * structure ( "struct eventpoll" ).

	 */

	error = -EINVAL;

	if (size <= 0 || (error = ep_alloc(&ep)) != 0)

	if (size <= 0 || (error = ep_alloc(&ep)) < 0) {

		fd = error;

		goto error_return;

	}



	/*

	 * Creates all the items needed to setup an eventpoll file. That is,

	 * a file structure, and inode and a free file descriptor.

	 * a file structure and a free file descriptor.

	 */

	error = anon_inode_getfd(&fd, &inode, &file, "[eventpoll]",

				 &eventpoll_fops, ep);

	if (error)

		goto error_free;

	fd = anon_inode_getfd("[eventpoll]", &eventpoll_fops, ep);

	if (fd < 0)

		ep_free(ep);



error_return:

	DNPRINTK(3, (KERN_INFO "[%p] eventpoll: sys_epoll_create(%d) = %d\n",

		     current, size, fd));



	return fd;



error_free:

	ep_free(ep);

error_return:

	DNPRINTK(3, (KERN_INFO "[%p] eventpoll: sys_epoll_create(%d) = %d\n",

		     current, size, error));

	return error;

}



/*

fs/signalfd.c

+4 −13
Original line number Diff line number Diff line
@@ -207,11 +207,8 @@ static const struct file_operations signalfd_fops = { 


asmlinkage long sys_signalfd(int ufd, sigset_t __user *user_mask, size_t sizemask)

{

	int error;

	sigset_t sigmask;

	struct signalfd_ctx *ctx;

	struct file *file;

	struct inode *inode;



	if (sizemask != sizeof(sigset_t) ||

	    copy_from_user(&sigmask, user_mask, sizeof(sigmask)))
@@ -230,12 +227,11 @@ asmlinkage long sys_signalfd(int ufd, sigset_t __user *user_mask, size_t sizemas 
		 * When we call this, the initialization must be complete, since

		 * anon_inode_getfd() will install the fd.

		 */

		error = anon_inode_getfd(&ufd, &inode, &file, "[signalfd]",

					 &signalfd_fops, ctx);

		if (error)

			goto err_fdalloc;

		ufd = anon_inode_getfd("[signalfd]", &signalfd_fops, ctx);

		if (ufd < 0)

			kfree(ctx);

	} else {

		file = fget(ufd);

		struct file *file = fget(ufd);

		if (!file)

			return -EBADF;

		ctx = file->private_data;
@@ -252,9 +248,4 @@ asmlinkage long sys_signalfd(int ufd, sigset_t __user *user_mask, size_t sizemas 
	}



	return ufd;



err_fdalloc:

	kfree(ctx);

	return error;

}

fs/timerfd.c

+3 −8
Original line number Diff line number Diff line
@@ -181,10 +181,8 @@ static struct file *timerfd_fget(int fd) 


asmlinkage long sys_timerfd_create(int clockid, int flags)

{

	int error, ufd;

	int ufd;

	struct timerfd_ctx *ctx;

	struct file *file;

	struct inode *inode;



	if (flags)

		return -EINVAL;
@@ -200,12 +198,9 @@ asmlinkage long sys_timerfd_create(int clockid, int flags) 
	ctx->clockid = clockid;

	hrtimer_init(&ctx->tmr, clockid, HRTIMER_MODE_ABS);



	error = anon_inode_getfd(&ufd, &inode, &file, "[timerfd]",

				 &timerfd_fops, ctx);

	if (error) {

	ufd = anon_inode_getfd("[timerfd]", &timerfd_fops, ctx);

	if (ufd < 0)

		kfree(ctx);

		return error;

	}



	return ufd;

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE