F_SET_RW_HINT controls the placement of written file data. A read-only fd should not allow for that. Signed-off-by: Christoph Hellwig <hch@xxxxxx> --- fs/fcntl.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/fcntl.c b/fs/fcntl.c index 7fc6190da342..12f60c42743a 100644 --- a/fs/fcntl.c +++ b/fs/fcntl.c @@ -377,6 +377,8 @@ static long fcntl_set_rw_hint(struct file *file, unsigned int cmd, if (!inode_owner_or_capable(file_mnt_idmap(file), inode)) return -EPERM; + if (!(file->f_mode & FMODE_WRITE)) + return -EBADF; if (copy_from_user(&hint, argp, sizeof(hint))) return -EFAULT; -- 2.45.2