From: Miklos Szeredi <mszeredi@suse.cz>
Date: Wed, 15 Aug 2012 11:01:24 +0000 (+0200)
Subject: vfs: canonicalize create mode in build_open_flags()
X-Git-Tag: firefly_0821_release~7541^2~766
X-Git-Url: http://demsky.eecs.uci.edu/git/?a=commitdiff_plain;h=3db5984ef1f9ca0f47be7751a26ce776eba20b1b;p=firefly-linux-kernel-4.4.55.git

vfs: canonicalize create mode in build_open_flags()

commit e68726ff72cf7ba5e7d789857fcd9a75ca573f03 upstream.

Userspace can pass weird create mode in open(2) that we canonicalize to
"(mode & S_IALLUGO) | S_IFREG" in vfs_create().

The problem is that we use the uncanonicalized mode before calling vfs_create()
with unforseen consequences.

So do the canonicalization early in build_open_flags().

Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
Tested-by: Richard W.M. Jones <rjones@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---

diff --git a/fs/open.c b/fs/open.c
index 7e18c4d6e1f2..bf00a8652a83 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -900,9 +900,10 @@ static inline int build_open_flags(int flags, int mode, struct open_flags *op)
 	int lookup_flags = 0;
 	int acc_mode;
 
-	if (!(flags & O_CREAT))
-		mode = 0;
-	op->mode = mode;
+	if (flags & O_CREAT)
+		op->mode = (mode & S_IALLUGO) | S_IFREG;
+	else
+		op->mode = 0;
 
 	/* Must never be set by userspace */
 	flags &= ~FMODE_NONOTIFY;