vfs: fix permission checking in sys_utimensat

[safe/jmp/linux-2.6] / fs / utimes.c

diff --git a/fs/utimes.c b/fs/utimes.c
index 480f7c8..af059d5 100644 (file)
--- a/fs/utimes.c
+++ b/fs/utimes.c
@@ -2,10 +2,12 @@
 #include <linux/file.h>
 #include <linux/fs.h>
 #include <linux/linkage.h>
+#include <linux/mount.h>
 #include <linux/namei.h>
 #include <linux/sched.h>
 #include <linux/stat.h>
 #include <linux/utime.h>
+#include <linux/syscalls.h>
 #include <asm/uaccess.h>
 #include <asm/unistd.h>
 
@@ -38,6 +40,19 @@ asmlinkage long sys_utime(char __user *filename, struct utimbuf __user *times)
 
 #endif
 
+static bool nsec_special(long nsec)
+{
+       return nsec == UTIME_OMIT || nsec == UTIME_NOW;
+}
+
+static bool nsec_valid(long nsec)
+{
+       if (nsec_special(nsec))
+               return true;
+
+       return nsec >= 0 && nsec <= 999999999;
+}
+
 /* If times==NULL, set access and modification to current time,
  * must be owner or have write permission.
  * Else, update from *times, must be owner or super user.
@@ -50,8 +65,14 @@ long do_utimes(int dfd, char __user *filename, struct timespec *times, int flags
        struct inode *inode;
        struct iattr newattrs;
        struct file *f = NULL;
+       struct vfsmount *mnt;
 
        error = -EINVAL;
+       if (times && (!nsec_valid(times[0].tv_nsec) ||
+                     !nsec_valid(times[1].tv_nsec))) {
+               goto out;
+       }
+
        if (flags & ~AT_SYMLINK_NOFOLLOW)
                goto out;
 
@@ -65,18 +86,20 @@ long do_utimes(int dfd, char __user *filename, struct timespec *times, int flags
                if (!f)
                        goto out;
                dentry = f->f_path.dentry;
+               mnt = f->f_path.mnt;
        } else {
                error = __user_walk_fd(dfd, filename, (flags & AT_SYMLINK_NOFOLLOW) ? 0 : LOOKUP_FOLLOW, &nd);
                if (error)
                        goto out;
 
-               dentry = nd.dentry;
+               dentry = nd.path.dentry;
+               mnt = nd.path.mnt;
        }
 
        inode = dentry->d_inode;
 
-       error = -EROFS;
-       if (IS_RDONLY(inode))
+       error = mnt_want_write(mnt);
+       if (error)
                goto dput_and_out;
 
        /* Don't worry, the checks are done in inode_change_ok() */
@@ -84,7 +107,7 @@ long do_utimes(int dfd, char __user *filename, struct timespec *times, int flags
        if (times) {
                error = -EPERM;
                 if (IS_APPEND(inode) || IS_IMMUTABLE(inode))
-                        goto dput_and_out;
+                       goto mnt_drop_write_and_out;
 
                if (times[0].tv_nsec == UTIME_OMIT)
                        newattrs.ia_valid &= ~ATTR_ATIME;
@@ -101,23 +124,40 @@ long do_utimes(int dfd, char __user *filename, struct timespec *times, int flags
                        newattrs.ia_mtime.tv_nsec = times[1].tv_nsec;
                        newattrs.ia_valid |= ATTR_MTIME_SET;
                }
-       } else {
+       }
+
+       /*
+        * If times is NULL or both times are either UTIME_OMIT or
+        * UTIME_NOW, then need to check permissions, because
+        * inode_change_ok() won't do it.
+        */
+       if (!times || (nsec_special(times[0].tv_nsec) &&
+                      nsec_special(times[1].tv_nsec))) {
                error = -EACCES;
                 if (IS_IMMUTABLE(inode))
-                        goto dput_and_out;
-
-               if (current->fsuid != inode->i_uid &&
-                   (error = vfs_permission(&nd, MAY_WRITE)) != 0)
-                       goto dput_and_out;
+                       goto mnt_drop_write_and_out;
+
+               if (!is_owner_or_cap(inode)) {
+                       if (f) {
+                               if (!(f->f_mode & FMODE_WRITE))
+                                       goto mnt_drop_write_and_out;
+                       } else {
+                               error = vfs_permission(&nd, MAY_WRITE);
+                               if (error)
+                                       goto mnt_drop_write_and_out;
+                       }
+               }
        }
        mutex_lock(&inode->i_mutex);
        error = notify_change(dentry, &newattrs);
        mutex_unlock(&inode->i_mutex);
+mnt_drop_write_and_out:
+       mnt_drop_write(mnt);
 dput_and_out:
        if (f)
                fput(f);
        else
-               path_release(&nd);
+               path_put(&nd.path);
 out:
        return error;
 }