mirror of
https://github.com/torvalds/linux.git
synced 2024-12-06 11:01:43 +00:00
ee12595147
This code calls fd_install() which gives the userspace access to the fd.
Then if copy_info_records_to_user() fails it calls put_unused_fd(fd) but
that will not release it and leads to a stale entry in the file
descriptor table.
Generally you can't trust the fd after a call to fd_install(). The fix
is to delay the fd_install() until everything else has succeeded.
Fortunately it requires CAP_SYS_ADMIN to reach this code so the security
impact is less.
Fixes:
|
||
---|---|---|
.. | ||
dnotify | ||
fanotify | ||
inotify | ||
fdinfo.c | ||
fdinfo.h | ||
fsnotify.c | ||
fsnotify.h | ||
group.c | ||
Kconfig | ||
Makefile | ||
mark.c | ||
notification.c |