xfs: fix type confusion in xfs_ioc_swapext
authorJann Horn <jann@thejh.net>
Fri, 11 Sep 2015 19:39:33 +0000 (21:39 +0200)
committerLinus Torvalds <torvalds@linux-foundation.org>
Fri, 15 Jul 2016 21:30:06 +0000 (06:30 +0900)
commit3e0a396546450536679ae4d3bd70290ce0b0c79c
tree1de0a003e5f230a2f5dfd63dfa837488ef8a728a
parentaa93d1fee85c890a34f2510a310e55ee76a27848
xfs: fix type confusion in xfs_ioc_swapext

Without this check, the following XFS_I invocations would return bad
pointers when used on non-XFS inodes (perhaps pointers into preceding
allocator chunks).

This could be used by an attacker to trick xfs_swap_extents into
performing locking operations on attacker-chosen structures in kernel
memory, potentially leading to code execution in the kernel.  (I have
not investigated how likely this is to be usable for an attack in
practice.)

Signed-off-by: Jann Horn <jann@thejh.net>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Dave Chinner <david@fromorbit.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
fs/xfs/xfs_ioctl.c