Only checking for SPUFS_MAGIC is not reliable, because
it might not be unique in theory. Worse than that,
we accidentally allow spu_run to be performed on
any file in spufs, not just those returned from
spu_create as intended.
Noticed by Al Viro.
Signed-off-by: Arnd Bergmann <[email protected]>
Index: linux-2.6.15-rc/arch/powerpc/platforms/cell/spufs/inode.c
===================================================================
--- linux-2.6.15-rc.orig/arch/powerpc/platforms/cell/spufs/inode.c
+++ linux-2.6.15-rc/arch/powerpc/platforms/cell/spufs/inode.c
@@ -212,7 +212,7 @@ struct inode_operations spufs_dir_inode_
.lookup = simple_lookup,
};
-struct file_operations spufs_autodelete_dir_operations = {
+struct file_operations spufs_context_fops = {
.open = dcache_dir_open,
.release = spufs_dir_close,
.llseek = dcache_dir_lseek,
@@ -301,7 +301,7 @@ spufs_create_thread(struct nameidata *nd
put_unused_fd(ret);
ret = PTR_ERR(filp);
} else {
- filp->f_op = &spufs_autodelete_dir_operations;
+ filp->f_op = &spufs_context_fops;
fd_install(ret, filp);
}
Index: linux-2.6.15-rc/arch/powerpc/platforms/cell/spufs/spufs.h
===================================================================
--- linux-2.6.15-rc.orig/arch/powerpc/platforms/cell/spufs/spufs.h
+++ linux-2.6.15-rc/arch/powerpc/platforms/cell/spufs/spufs.h
@@ -103,6 +103,7 @@ long spufs_run_spu(struct file *file,
struct spu_context *ctx, u32 *npc, u32 *status);
long spufs_create_thread(struct nameidata *nd, const char *name,
unsigned int flags, mode_t mode);
+extern struct file_operations spufs_context_fops;
/* context management */
struct spu_context * alloc_spu_context(struct address_space *local_store);
Index: linux-2.6.15-rc/arch/powerpc/platforms/cell/spufs/syscalls.c
===================================================================
--- linux-2.6.15-rc.orig/arch/powerpc/platforms/cell/spufs/syscalls.c
+++ linux-2.6.15-rc/arch/powerpc/platforms/cell/spufs/syscalls.c
@@ -39,8 +39,9 @@ long do_spu_run(struct file *filp, __u32
if (get_user(npc, unpc) || get_user(status, ustatus))
goto out;
+ /* check if this file was created by spu_create */
ret = -EINVAL;
- if (filp->f_vfsmnt->mnt_sb->s_magic != SPUFS_MAGIC)
+ if (filp->f_op != &spufs_context_fops)
goto out;
i = SPUFS_I(filp->f_dentry->d_inode);
--
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[Index of Archives]
[Kernel Newbies]
[Netfilter]
[Bugtraq]
[Photo]
[Stuff]
[Gimp]
[Yosemite News]
[MIPS Linux]
[ARM Linux]
[Linux Security]
[Linux RAID]
[Video 4 Linux]
[Linux for the blind]
[Linux Resources]
