Commit 0ec4f431eb56d633da3a55da67d5c4b88886ccc7
Committed by
Linus Torvalds
1 parent
a66d2c8f7e
Exists in
master
and in
20 other branches
locks: fix checking of fcntl_setlease argument
The only checks of the long argument passed to fcntl(fd,F_SETLEASE,.) are done after converting the long to an int. Thus some illegal values may be let through and cause problems in later code. [ They actually *don't* cause problems in mainline, as of Dave Jones's commit 8d657eb3b438 "Remove easily user-triggerable BUG from generic_setlease", but we should fix this anyway. And this patch will be necessary to fix real bugs on earlier kernels. ] Cc: stable@vger.kernel.org Signed-off-by: J. Bruce Fields <bfields@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Showing 1 changed file with 3 additions and 3 deletions Side-by-side Diff
fs/locks.c
... | ... | @@ -308,7 +308,7 @@ |
308 | 308 | return 0; |
309 | 309 | } |
310 | 310 | |
311 | -static int assign_type(struct file_lock *fl, int type) | |
311 | +static int assign_type(struct file_lock *fl, long type) | |
312 | 312 | { |
313 | 313 | switch (type) { |
314 | 314 | case F_RDLCK: |
... | ... | @@ -445,7 +445,7 @@ |
445 | 445 | /* |
446 | 446 | * Initialize a lease, use the default lock manager operations |
447 | 447 | */ |
448 | -static int lease_init(struct file *filp, int type, struct file_lock *fl) | |
448 | +static int lease_init(struct file *filp, long type, struct file_lock *fl) | |
449 | 449 | { |
450 | 450 | if (assign_type(fl, type) != 0) |
451 | 451 | return -EINVAL; |
... | ... | @@ -463,7 +463,7 @@ |
463 | 463 | } |
464 | 464 | |
465 | 465 | /* Allocate a file_lock initialised to this type of lease */ |
466 | -static struct file_lock *lease_alloc(struct file *filp, int type) | |
466 | +static struct file_lock *lease_alloc(struct file *filp, long type) | |
467 | 467 | { |
468 | 468 | struct file_lock *fl = locks_alloc_lock(); |
469 | 469 | int error = -ENOMEM; |