Skip to content
Commit 3e0a3965 authored by Jann Horn's avatar Jann Horn Committed by Linus Torvalds
Browse files

xfs: fix type confusion in xfs_ioc_swapext



Without this check, the following XFS_I invocations would return bad
pointers when used on non-XFS inodes (perhaps pointers into preceding
allocator chunks).

This could be used by an attacker to trick xfs_swap_extents into
performing locking operations on attacker-chosen structures in kernel
memory, potentially leading to code execution in the kernel.  (I have
not investigated how likely this is to be usable for an attack in
practice.)

Signed-off-by: default avatarJann Horn <jann@thejh.net>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Dave Chinner <david@fromorbit.com>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent aa93d1fe
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment