With the patch this time :( Sorry guys
Hi Andrew
I think this patch is necessary. It's quite easy to crash a 2.6.19-rc4 box :(
AFAIK the problem come from inode-diet (by Theodore Ts'o, (2006/Sep/27))
Thank you
[PATCH] splice : Must fully check for FIFO
It appears that i_pipe, i_cdev and i_bdev share the same memory location
(anonymous union in struct inode) since commits
577c4eb09d1034d0739e3135fd2cff50588024be
eaf796e7ef6014f208c409b2b14fddcfaafe7e3a
Because of that, testing i_pipe being NULL is not anymore sufficient to tell
if an inode is a FIFO or not.
Therefore, we must use the S_ISFIFO(inode->i_mode) test before assuming i_pipe
pointer is pointing to a struct pipe_inode_info.
Signed-off-by: Eric Dumazet <[email protected]>
--- linux-2.6.19-rc4/fs/splice.c 2006-11-02 17:14:55.000000000 +0100
+++ linux-2.6.19-rc4-ed/fs/splice.c 2006-11-02 17:38:29.000000000 +0100
@@ -1115,12 +1115,14 @@
struct file *out, loff_t __user *off_out,
size_t len, unsigned int flags)
{
+ struct inode *inode;
struct pipe_inode_info *pipe;
loff_t offset, *off;
long ret;
- pipe = in->f_dentry->d_inode->i_pipe;
- if (pipe) {
+ inode = in->f_dentry->d_inode;
+ pipe = inode->i_pipe;
+ if (pipe && S_ISFIFO(inode->i_mode)) {
if (off_in)
return -ESPIPE;
if (off_out) {
@@ -1140,8 +1142,9 @@
return ret;
}
- pipe = out->f_dentry->d_inode->i_pipe;
- if (pipe) {
+ inode = out->f_dentry->d_inode;
+ pipe = inode->i_pipe;
+ if (pipe && S_ISFIFO(inode->i_mode)) {
if (off_out)
return -ESPIPE;
if (off_in) {
@@ -1298,7 +1301,8 @@
static long do_vmsplice(struct file *file, const struct iovec __user *iov,
unsigned long nr_segs, unsigned int flags)
{
- struct pipe_inode_info *pipe = file->f_dentry->d_inode->i_pipe;
+ struct inode *inode = file->f_dentry->d_inode;
+ struct pipe_inode_info *pipe = inode->i_pipe;
struct page *pages[PIPE_BUFFERS];
struct partial_page partial[PIPE_BUFFERS];
struct splice_pipe_desc spd = {
@@ -1308,7 +1312,7 @@
.ops = &user_page_pipe_buf_ops,
};
- if (unlikely(!pipe))
+ if (unlikely(!pipe || !S_ISFIFO(inode->i_mode)))
return -EBADF;
if (unlikely(nr_segs > UIO_MAXIOV))
return -EINVAL;
@@ -1535,11 +1539,21 @@
static long do_tee(struct file *in, struct file *out, size_t len,
unsigned int flags)
{
- struct pipe_inode_info *ipipe = in->f_dentry->d_inode->i_pipe;
- struct pipe_inode_info *opipe = out->f_dentry->d_inode->i_pipe;
+ struct inode *in_inode = in->f_dentry->d_inode;
+ struct inode *out_inode = out->f_dentry->d_inode;
+ struct pipe_inode_info *ipipe;
+ struct pipe_inode_info *opipe;
int ret = -EINVAL;
/*
+ * CAUTION : As i_pipe/i_bdev/i_cdev share the same location,
+ * we must check we deal with fifos/pipes, not cdev or bdev.
+ */
+ if (!S_ISFIFO(in_inode->i_mode) || !S_ISFIFO(out_inode->i_mode))
+ return ret;
+ ipipe = in_inode->i_pipe;
+ opipe = out_inode->i_pipe;
+ /*
* Duplicate the contents of ipipe to opipe without actually
* copying the data.
*/
[Index of Archives]
[Kernel Newbies]
[Netfilter]
[Bugtraq]
[Photo]
[Stuff]
[Gimp]
[Yosemite News]
[MIPS Linux]
[ARM Linux]
[Linux Security]
[Linux RAID]
[Video 4 Linux]
[Linux for the blind]
[Linux Resources]