linux-kernel - Re: [take25 6/6] kevent: Pipe notifications.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20061122113057.GA28808@2ka.mipt.ru>
Date:	Wed, 22 Nov 2006 14:30:59 +0300
From:	Evgeniy Polyakov <johnpol@....mipt.ru>
To:	Eric Dumazet <dada1@...mosbay.com>
Cc:	David Miller <davem@...emloft.net>,
	Ulrich Drepper <drepper@...hat.com>,
	Andrew Morton <akpm@...l.org>, netdev <netdev@...r.kernel.org>,
	Zach Brown <zach.brown@...cle.com>,
	Christoph Hellwig <hch@...radead.org>,
	Chase Venters <chase.venters@...entec.com>,
	Johann Borck <johann.borck@...sedata.com>,
	linux-kernel@...r.kernel.org, Jeff Garzik <jeff@...zik.org>
Subject: Re: [take25 6/6] kevent: Pipe notifications.

On Wed, Nov 22, 2006 at 12:20:50PM +0100, Eric Dumazet (dada1@...mosbay.com) wrote:
> On Tuesday 21 November 2006 17:29, Evgeniy Polyakov wrote:
> > Pipe notifications.
> 
> > +int kevent_pipe_enqueue(struct kevent *k)
> > +{
> > +	struct file *pipe;
> > +	int err = -EBADF;
> > +	struct inode *inode;
> > +
> > +	pipe = fget(k->event.id.raw[0]);
> > +	if (!pipe)
> > +		goto err_out_exit;
> > +
> > +	inode = igrab(pipe->f_dentry->d_inode);
> > +	if (!inode)
> > +		goto err_out_fput;
> > +
> 
> Well...
> 
> How can you be sure 'pipe/inode' really refers to a pipe/fifo here ?
> 
> Hint : i_pipe <> NULL is not sufficient because i_pipe, i_bdev, i_cdev share 
> the same location. (check pipe_info() in fs/splice.c)
> 
> So I guess you need :
> 
> err = -EINVAL;
> if  (!S_ISFIFO(inode->i_mode))
> 	goto err_out_iput;
 
You are correct, I did not perform that check, since all pipe open
functions do rely on the i_pipe, which can not be block device at that
point, but with kevent file descriptor can be anything, so that check
must be performed.

I will put it into the tree, thanks Eric.
 
> Eric

-- 
	Evgeniy Polyakov
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/