• Maxim Giryaev's avatar
    [PATCH] lost fput in 32bit ioctl on x86-64 · 8cd943eb
    Maxim Giryaev authored
    This patch adds lost fput in 32bit tiocgdev ioctl on x86-64
    
    I believe this is a security issues, since user can fget() file as
    many times as he wants to. So file refcounter can be overlapped and
    first fput() will free resources though there will be still structures
    pointing to the file, mnt, dentry etc.  Also fput() sets f_dentry and
    f_vfsmnt to NULL, so other file users will OOPS.
    
    The oops can be done under files_lock and others, so this is really
    exploitable DoS on SMP. Didn't checked it on practice actually.
    
    (chrisw: Update to use fget_light/fput_light)
    Signed-Off-By: default avatarKirill Korotaev <dev@sw.ru>
    Signed-Off-By: default avatarMaxim Giryaev <gem@sw.ru>
    Signed-off-by: default avatarChris Wright <chrisw@osdl.org>
    8cd943eb
ia32_ioctl.c 6.1 KB