diff options
author | Jann Horn <jann@thejh.net> | 2015-09-11 21:39:33 +0200 |
---|---|---|
committer | Linus Torvalds <torvalds@linux-foundation.org> | 2016-07-16 06:30:06 +0900 |
commit | 3e0a396546450536679ae4d3bd70290ce0b0c79c (patch) | |
tree | 1de0a003e5f230a2f5dfd63dfa837488ef8a728a /fs/orangefs/orangefs-sysfs.c | |
parent | aa93d1fee85c890a34f2510a310e55ee76a27848 (diff) |
xfs: fix type confusion in xfs_ioc_swapext
Without this check, the following XFS_I invocations would return bad
pointers when used on non-XFS inodes (perhaps pointers into preceding
allocator chunks).
This could be used by an attacker to trick xfs_swap_extents into
performing locking operations on attacker-chosen structures in kernel
memory, potentially leading to code execution in the kernel. (I have
not investigated how likely this is to be usable for an attack in
practice.)
Signed-off-by: Jann Horn <jann@thejh.net>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Dave Chinner <david@fromorbit.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'fs/orangefs/orangefs-sysfs.c')
0 files changed, 0 insertions, 0 deletions