block: move CAP_SYS_ADMIN check in blkdev_roset()

Check for CAP_SYS_ADMIN before calling into the driver, similar to blkdev_flushbuf(). This is safer and can spare a check in the driver. (Currently BLKROSET is overridden by md and rbd, rbd is missing the check. md has the check, but it covers a lot more than BLKROSET.) Acked-by: Al Viro <[email protected]> Signed-off-by: Ilya Dryomov <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
vieko · Oct 25, 2017 · bb749b3 · bb749b3
1 parent 351499a
commit bb749b3
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/block/ioctl.c b/block/ioctl.c
@@ -443,11 +443,12 @@ static int blkdev_roset(struct block_device *bdev, fmode_t mode,
 {
 	int ret, n;
 
+	if (!capable(CAP_SYS_ADMIN))
+		return -EACCES;
+
 	ret = __blkdev_driver_ioctl(bdev, mode, cmd, arg);
 	if (!is_unrecognized_ioctl(ret))
 		return ret;
-	if (!capable(CAP_SYS_ADMIN))
-		return -EACCES;
 	if (get_user(n, (int __user *)arg))
 		return -EFAULT;
 	set_device_ro(bdev, n);