Commit e68726ff authored Aug 15, 2012 by Miklos Szeredi

vfs: canonicalize create mode in build_open_flags()



Userspace can pass weird create mode in open(2) that we canonicalize to 
"(mode & S_IALLUGO) | S_IFREG" in vfs_create().

The problem is that we use the uncanonicalized mode before calling vfs_create()
with unforseen consequences.

So do the canonicalization early in build_open_flags().

Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
Tested-by: Richard W.M. Jones <rjones@redhat.com>
CC: stable@vger.kernel.org

parent ddf343f6

fs/open.c

+4 −3

Original line number	Original line	Diff line number	Diff line
	@@ -852,9 +852,10 @@ static inline int build_open_flags(int flags, umode_t mode, struct open_flags *o
	int lookup_flags = 0;		int lookup_flags = 0;
	int acc_mode;		int acc_mode;

	if (!(flags & O_CREAT))		if (flags & O_CREAT)
	mode = 0;		op->mode = (mode & S_IALLUGO) \| S_IFREG;
	op->mode = mode;		else
			op->mode = 0;

	/* Must never be set by userspace */		/* Must never be set by userspace */
	flags &= ~FMODE_NONOTIFY;		flags &= ~FMODE_NONOTIFY;

Admin message