[PATCH] lost fput in 32bit ioctl on x86-64

This patch adds lost fput in 32bit tiocgdev ioctl on x86-64

I believe this is a security issues, since user can fget() file as
many times as he wants to. So file refcounter can be overlapped and
first fput() will free resources though there will be still structures
pointing to the file, mnt, dentry etc.  Also fput() sets f_dentry and
f_vfsmnt to NULL, so other file users will OOPS.

The oops can be done under files_lock and others, so this is really
exploitable DoS on SMP. Didn't checked it on practice actually.

(chrisw: Update to use fget_light/fput_light)

Signed-Off-By: Kirill Korotaev <dev@sw.ru>
Signed-Off-By: Maxim Giryaev <gem@sw.ru>
Signed-off-by: Chris Wright <chrisw@osdl.org>

diff --git a/arch/x86_64/ia32/ia32_ioctl.c b/arch/x86_64/ia32/ia32_ioctl.c
index d259f8a6f811d7761a5bc6d850e7c137da576075..419758f19ca4f4ec4da887da494b89f397f149c7 100644 (file)
--- a/arch/x86_64/ia32/ia32_ioctl.c
+++ b/arch/x86_64/ia32/ia32_ioctl.c
@@ -24,17 +24,26 @@
 static int tiocgdev(unsigned fd, unsigned cmd,  unsigned int __user *ptr) 
 { 
 
-       struct file *file = fget(fd);
+       struct file *file;
        struct tty_struct *real_tty;
+       int fput_needed, ret;
 
+       file = fget_light(fd, &fput_needed);
        if (!file)
                return -EBADF;
+
+       ret = -EINVAL;
        if (file->f_op->ioctl != tty_ioctl)
-               return -EINVAL; 
+               goto out;
        real_tty = (struct tty_struct *)file->private_data;
        if (!real_tty)  
-               return -EINVAL; 
-       return put_user(new_encode_dev(tty_devnum(real_tty)), ptr); 
+               goto out;
+
+       ret = put_user(new_encode_dev(tty_devnum(real_tty)), ptr); 
+
+out:
+       fput_light(file, fput_needed);
+       return ret;
 } 
 
 #define RTC_IRQP_READ32        _IOR('p', 0x0b, unsigned int)    /* Read IRQ rate   */