tree 100222921c788e68009ba1b2dccbeaba06b81e89
parent 33ea2f52b8758ef62ae4a9d2f91821c47d999ee9
author Robert Love <[EMAIL PROTECTED]> Mon, 25 Jul 2005 23:10:08 -0400
committer Linus Torvalds <[EMAIL PROTECTED]> Wed, 27 Jul 2005 03:37:21 -0700
[PATCH] inotify: oops fix
Bug fix: Ensure that the fd passed to inotify_add_watch() and
inotify_rm_watch() belongs to inotify.
Signed-off-by: Robert Love <[EMAIL PROTECTED]>
Signed-off-by: John McCutchan <[EMAIL PROTECTED]>
Signed-off-by: Linus Torvalds <[EMAIL PROTECTED]>
fs/inotify.c | 16 +++++++++++++++-
1 files changed, 15 insertions(+), 1 deletion(-)
diff --git a/fs/inotify.c b/fs/inotify.c
--- a/fs/inotify.c
+++ b/fs/inotify.c
@@ -929,6 +929,12 @@ asmlinkage long sys_inotify_add_watch(in
if (unlikely(!filp))
return -EBADF;
+ /* verify that this is indeed an inotify instance */
+ if (unlikely(filp->f_op != &inotify_fops)) {
+ ret = -EINVAL;
+ goto fput_and_out;
+ }
+
ret = find_inode(path, &nd);
if (unlikely(ret))
goto fput_and_out;
@@ -986,10 +992,18 @@ asmlinkage long sys_inotify_rm_watch(int
filp = fget_light(fd, &fput_needed);
if (unlikely(!filp))
return -EBADF;
+
+ /* verify that this is indeed an inotify instance */
+ if (unlikely(filp->f_op != &inotify_fops)) {
+ ret = -EINVAL;
+ goto out;
+ }
+
dev = filp->private_data;
ret = inotify_ignore(dev, wd);
- fput_light(filp, fput_needed);
+out:
+ fput_light(filp, fput_needed);
return ret;
}
-
To unsubscribe from this list: send the line "unsubscribe bk-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
