diff options
| author | Jann Horn | 2015-08-16 20:27:01 +0200 |
|---|---|---|
| committer | Linus Torvalds | 2015-08-16 12:35:44 -0700 |
| commit | 8ed1f0e22f49ef42e63875fd2529389a32ff3566 (patch) | |
| tree | 9f388d7ec994747b8703d371b49e1e27921b2533 /fs | |
| parent | 1efdb5f0a9243ca8f3460a5ce1b407b06a021f02 (diff) | |
fs/fuse: fix ioctl type confusion
fuse_dev_ioctl() performed fuse_get_dev() on a user-supplied fd,
leading to a type confusion issue. Fix it by checking file->f_op.
Signed-off-by: Jann Horn <jann@thejh.net>
Acked-by: Miklos Szeredi <miklos@szeredi.hu>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/fuse/dev.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c index 80cc1b35d460..ebb5e37455a0 100644 --- a/fs/fuse/dev.c +++ b/fs/fuse/dev.c @@ -2246,7 +2246,15 @@ static long fuse_dev_ioctl(struct file *file, unsigned int cmd, err = -EINVAL; if (old) { - struct fuse_dev *fud = fuse_get_dev(old); + struct fuse_dev *fud = NULL; + + /* + * Check against file->f_op because CUSE + * uses the same ioctl handler. + */ + if (old->f_op == file->f_op && + old->f_cred->user_ns == file->f_cred->user_ns) + fud = fuse_get_dev(old); if (fud) { mutex_lock(&fuse_mutex); |