vfs: missed source of ->f_pos races
compat_sys_{read,write}v() need the same "pass a copy of file->f_pos" thing as sys_{read,write}{,v}(). Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Cc: stable@kernel.org Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
parent
90785be317
commit
0e665d5d11
10
fs/compat.c
10
fs/compat.c
|
@ -1155,11 +1155,14 @@ compat_sys_readv(unsigned long fd, const struct compat_iovec __user *vec,
|
|||
struct file *file;
|
||||
int fput_needed;
|
||||
ssize_t ret;
|
||||
loff_t pos;
|
||||
|
||||
file = fget_light(fd, &fput_needed);
|
||||
if (!file)
|
||||
return -EBADF;
|
||||
ret = compat_readv(file, vec, vlen, &file->f_pos);
|
||||
pos = file->f_pos;
|
||||
ret = compat_readv(file, vec, vlen, &pos);
|
||||
file->f_pos = pos;
|
||||
fput_light(file, fput_needed);
|
||||
return ret;
|
||||
}
|
||||
|
@ -1221,11 +1224,14 @@ compat_sys_writev(unsigned long fd, const struct compat_iovec __user *vec,
|
|||
struct file *file;
|
||||
int fput_needed;
|
||||
ssize_t ret;
|
||||
loff_t pos;
|
||||
|
||||
file = fget_light(fd, &fput_needed);
|
||||
if (!file)
|
||||
return -EBADF;
|
||||
ret = compat_writev(file, vec, vlen, &file->f_pos);
|
||||
pos = file->f_pos;
|
||||
ret = compat_writev(file, vec, vlen, &pos);
|
||||
file->f_pos = pos;
|
||||
fput_light(file, fput_needed);
|
||||
return ret;
|
||||
}
|
||||
|
|
Loading…
Reference in New Issue