Commit 90da2e3f authored by Pavel Begunkov's avatar Pavel Begunkov Committed by Jens Axboe
Browse files

splice: move f_mode checks to do_{splice,tee}() 



do_splice() is used by io_uring, as will be do_tee(). Move f_mode
checks from sys_{splice,tee}() to do_{splice,tee}(), so they're
enforced for io_uring as well.

Fixes: 7d67af2c ("io_uring: add splice(2) support")
Reported-by: default avatarJann Horn <jannh@google.com>
Signed-off-by: default avatarPavel Begunkov <asml.silence@gmail.com>
Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 7f13657d

fs/splice.c

+18 −27
Original line number Diff line number Diff line
@@ -1118,6 +1118,10 @@ long do_splice(struct file *in, loff_t __user *off_in, 
	loff_t offset;

	long ret;



	if (unlikely(!(in->f_mode & FMODE_READ) ||

		     !(out->f_mode & FMODE_WRITE)))

		return -EBADF;



	ipipe = get_pipe_info(in);

	opipe = get_pipe_info(out);
@@ -1125,12 +1129,6 @@ long do_splice(struct file *in, loff_t __user *off_in, 
		if (off_in || off_out)

			return -ESPIPE;



		if (!(in->f_mode & FMODE_READ))

			return -EBADF;



		if (!(out->f_mode & FMODE_WRITE))

			return -EBADF;



		/* Splicing to self would be fun, but... */

		if (ipipe == opipe)

			return -EINVAL;
@@ -1153,9 +1151,6 @@ long do_splice(struct file *in, loff_t __user *off_in, 
			offset = out->f_pos;

		}



		if (unlikely(!(out->f_mode & FMODE_WRITE)))

			return -EBADF;



		if (unlikely(out->f_flags & O_APPEND))

			return -EINVAL;
@@ -1440,16 +1435,12 @@ SYSCALL_DEFINE6(splice, int, fd_in, loff_t __user *, off_in, 
	error = -EBADF;

	in = fdget(fd_in);

	if (in.file) {

		if (in.file->f_mode & FMODE_READ) {

		out = fdget(fd_out);

		if (out.file) {

				if (out.file->f_mode & FMODE_WRITE)

					error = do_splice(in.file, off_in,

							  out.file, off_out,

			error = do_splice(in.file, off_in, out.file, off_out,

					  len, flags);

			fdput(out);

		}

		}

		fdput(in);

	}

	return error;
@@ -1770,6 +1761,10 @@ static long do_tee(struct file *in, struct file *out, size_t len, 
	struct pipe_inode_info *opipe = get_pipe_info(out);

	int ret = -EINVAL;



	if (unlikely(!(in->f_mode & FMODE_READ) ||

		     !(out->f_mode & FMODE_WRITE)))

		return -EBADF;



	/*

	 * Duplicate the contents of ipipe to opipe without actually

	 * copying the data.
@@ -1795,7 +1790,7 @@ static long do_tee(struct file *in, struct file *out, size_t len, 


SYSCALL_DEFINE4(tee, int, fdin, int, fdout, size_t, len, unsigned int, flags)

{

	struct fd in;

	struct fd in, out;

	int error;



	if (unlikely(flags & ~SPLICE_F_ALL))
@@ -1807,15 +1802,11 @@ SYSCALL_DEFINE4(tee, int, fdin, int, fdout, size_t, len, unsigned int, flags) 
	error = -EBADF;

	in = fdget(fdin);

	if (in.file) {

		if (in.file->f_mode & FMODE_READ) {

			struct fd out = fdget(fdout);

		out = fdget(fdout);

		if (out.file) {

				if (out.file->f_mode & FMODE_WRITE)

					error = do_tee(in.file, out.file,

							len, flags);

			error = do_tee(in.file, out.file, len, flags);

			fdput(out);

		}

		}

 		fdput(in);

 	}

CRA Git | Maintained and supported by SUSTech CRA and CCSE