diff options
| author | Trond Myklebust <Trond.Myklebust@netapp.com> | 2006-05-07 23:02:42 -0400 |
|---|---|---|
| committer | Chris Wright <chrisw@sous-sol.org> | 2006-05-10 18:56:15 -0700 |
| commit | 1f0e637c94a9b041833947c79110d6c02fff8618 (patch) | |
| tree | ae48fe2d180c18ec056d26c58bdeb153e15f2656 /fs | |
| parent | 90a03936acb1c3400a5833cc7b5c58e01b6106b8 (diff) | |
[PATCH] fs/locks.c: Fix lease_init (CVE-2006-1860)
It is insane to be giving lease_init() the task of freeing the lock it is
supposed to initialise, given that the lock is not guaranteed to be
allocated on the stack. This causes lockups in fcntl_setlease().
Problem diagnosed by Daniel Hokka Zakrisson <daniel@hozac.com>
Also fix a slab leak in __setlease() due to an uninitialised return value.
Problem diagnosed by Björn Steinbrink.
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Tested-by: Daniel Hokka Zakrisson <daniel@hozac.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Cc: Björn Steinbrink <B.Steinbrink@gmx.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/locks.c | 21 |
1 files changed, 12 insertions, 9 deletions
diff --git a/fs/locks.c b/fs/locks.c index e75ac392a31..aa7f6609182 100644 --- a/fs/locks.c +++ b/fs/locks.c @@ -432,15 +432,14 @@ static struct lock_manager_operations lease_manager_ops = { */ static int lease_init(struct file *filp, int type, struct file_lock *fl) { + if (assign_type(fl, type) != 0) + return -EINVAL; + fl->fl_owner = current->files; fl->fl_pid = current->tgid; fl->fl_file = filp; fl->fl_flags = FL_LEASE; - if (assign_type(fl, type) != 0) { - locks_free_lock(fl); - return -EINVAL; - } fl->fl_start = 0; fl->fl_end = OFFSET_MAX; fl->fl_ops = NULL; @@ -452,16 +451,19 @@ static int lease_init(struct file *filp, int type, struct file_lock *fl) static int lease_alloc(struct file *filp, int type, struct file_lock **flp) { struct file_lock *fl = locks_alloc_lock(); - int error; + int error = -ENOMEM; if (fl == NULL) - return -ENOMEM; + goto out; error = lease_init(filp, type, fl); - if (error) - return error; + if (error) { + locks_free_lock(fl); + fl = NULL; + } +out: *flp = fl; - return 0; + return error; } /* Check if two locks overlap each other. @@ -1337,6 +1339,7 @@ static int __setlease(struct file *filp, long arg, struct file_lock **flp) goto out; if (my_before != NULL) { + *flp = *my_before; error = lease->fl_lmops->fl_change(my_before, arg); goto out; } |