
From: Manfred Spraul <manfred@colorfullife.com>

I found a security bug in the new mqueue code: a process that has only
write permissions to a message queue could call mq_notify(SIGEV_THREAD) and
use the returned notification file descriptor to read from the message
queue.


---

 25-akpm/ipc/mqueue.c |   13 +++++++------
 1 files changed, 7 insertions(+), 6 deletions(-)

diff -puN ipc/mqueue.c~mq-security-fix ipc/mqueue.c
--- 25/ipc/mqueue.c~mq-security-fix	Wed Apr  7 12:12:48 2004
+++ 25-akpm/ipc/mqueue.c	Wed Apr  7 12:12:48 2004
@@ -837,11 +837,11 @@ asmlinkage long sys_mq_timedsend(mqd_t m
 		goto out;
 
 	inode = filp->f_dentry->d_inode;
-	if (unlikely(inode->i_sb != mqueue_mnt->mnt_sb))
+	if (unlikely(filp->f_op != &mqueue_file_operations))
 		goto out_fput;
 	info = MQUEUE_I(inode);
 
-	if (unlikely((filp->f_flags & O_ACCMODE) == O_RDONLY))
+	if (unlikely(!(filp->f_mode & FMODE_WRITE)))
 		goto out_fput;
 
 	if (unlikely(msg_len > info->attr.mq_msgsize)) {
@@ -915,11 +915,11 @@ asmlinkage ssize_t sys_mq_timedreceive(m
 		goto out;
 
 	inode = filp->f_dentry->d_inode;
-	if (unlikely(inode->i_sb != mqueue_mnt->mnt_sb))
+	if (unlikely(filp->f_op != &mqueue_file_operations))
 		goto out_fput;
 	info = MQUEUE_I(inode);
 
-	if (unlikely((filp->f_flags & O_ACCMODE) == O_WRONLY))
+	if (unlikely(!(filp->f_mode & FMODE_READ)))
 		goto out_fput;
 
 	/* checks if buffer is big enough */
@@ -1004,7 +1004,7 @@ asmlinkage long sys_mq_notify(mqd_t mqde
 		goto out;
 
 	inode = filp->f_dentry->d_inode;
-	if (unlikely(inode->i_sb != mqueue_mnt->mnt_sb))
+	if (unlikely(filp->f_op != &mqueue_file_operations))
 		goto out_fput;
 	info = MQUEUE_I(inode);
 
@@ -1024,6 +1024,7 @@ asmlinkage long sys_mq_notify(mqd_t mqde
 		nfilp->f_vfsmnt = mntget(mqueue_mnt);
 		nfilp->f_dentry = dget(filp->f_dentry);
 		nfilp->f_mapping = filp->f_dentry->d_inode->i_mapping;
+		nfilp->f_flags = O_RDONLY;
 		nfilp->f_mode = FMODE_READ;
 	} else {
 		nfilp = NULL;
@@ -1088,7 +1089,7 @@ asmlinkage long sys_mq_getsetattr(mqd_t 
 		goto out;
 
 	inode = filp->f_dentry->d_inode;
-	if (unlikely(inode->i_sb != mqueue_mnt->mnt_sb))
+	if (unlikely(filp->f_op != &mqueue_file_operations))
 		goto out_fput;
 	info = MQUEUE_I(inode);
 

_
