diff options
| author | Dave Chinner <david@fromorbit.com> | 2016-07-20 11:51:08 +1000 |
|---|---|---|
| committer | Dave Chinner <david@fromorbit.com> | 2016-07-20 11:51:08 +1000 |
| commit | f63716175c0730c2f29b4591146f0045cfcaa8dc (patch) | |
| tree | f8237ef0ea0c321ffddb99fe2c84ae1bc54eec45 /fs/xfs/xfs_ioctl.c | |
| parent | f477cedc4e79a3233847106a18bf67be9bdf20e9 (diff) | |
| parent | ad70328a503fae813a563dbe97dd3466ac079e8e (diff) | |
Merge branch 'xfs-4.8-misc-fixes-3' into for-next
Diffstat (limited to 'fs/xfs/xfs_ioctl.c')
| -rw-r--r-- | fs/xfs/xfs_ioctl.c | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/fs/xfs/xfs_ioctl.c b/fs/xfs/xfs_ioctl.c index dbca7375deef..408f3ad348ab 100644 --- a/fs/xfs/xfs_ioctl.c +++ b/fs/xfs/xfs_ioctl.c @@ -1575,6 +1575,17 @@ xfs_ioc_swapext( goto out_put_tmp_file; } + /* + * We need to ensure that the fds passed in point to XFS inodes + * before we cast and access them as XFS structures as we have no + * control over what the user passes us here. + */ + if (f.file->f_op != &xfs_file_operations || + tmp.file->f_op != &xfs_file_operations) { + error = -EINVAL; + goto out_put_tmp_file; + } + ip = XFS_I(file_inode(f.file)); tip = XFS_I(file_inode(tmp.file)); |