Commit a1f14df3 authored by Wang Shilong's avatar Wang Shilong Committed by Greg Kroah-Hartman

f2fs: fix setattr project check upon fssetxattr ioctl

[ Upstream commit c8e92757 ]

Currently, project quota could be changed by fssetxattr
ioctl, and existed permission check inode_owner_or_capable()
is obviously not enough, just think that common users could
change project id of file, that could make users to
break project quota easily.

This patch try to follow same regular of xfs project
quota:

"Project Quota ID state is only allowed to change from
within the init namespace. Enforce that restriction only
if we are trying to change the quota ID state.
Everything else is allowed in user namespaces."

Besides that, check and set project id'state should
be an atomic operation, protect whole operation with
inode lock.
Signed-off-by: default avatarWang Shilong <wshilong@ddn.com>
Reviewed-by: default avatarChao Yu <yuchao0@huawei.com>
Signed-off-by: default avatarJaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 7b55102c
...@@ -2618,34 +2618,26 @@ static int f2fs_ioc_setproject(struct file *filp, __u32 projid) ...@@ -2618,34 +2618,26 @@ static int f2fs_ioc_setproject(struct file *filp, __u32 projid)
if (projid_eq(kprojid, F2FS_I(inode)->i_projid)) if (projid_eq(kprojid, F2FS_I(inode)->i_projid))
return 0; return 0;
err = mnt_want_write_file(filp);
if (err)
return err;
err = -EPERM; err = -EPERM;
inode_lock(inode);
/* Is it quota file? Do not allow user to mess with it */ /* Is it quota file? Do not allow user to mess with it */
if (IS_NOQUOTA(inode)) if (IS_NOQUOTA(inode))
goto out_unlock; return err;
ipage = f2fs_get_node_page(sbi, inode->i_ino); ipage = f2fs_get_node_page(sbi, inode->i_ino);
if (IS_ERR(ipage)) { if (IS_ERR(ipage))
err = PTR_ERR(ipage); return PTR_ERR(ipage);
goto out_unlock;
}
if (!F2FS_FITS_IN_INODE(F2FS_INODE(ipage), fi->i_extra_isize, if (!F2FS_FITS_IN_INODE(F2FS_INODE(ipage), fi->i_extra_isize,
i_projid)) { i_projid)) {
err = -EOVERFLOW; err = -EOVERFLOW;
f2fs_put_page(ipage, 1); f2fs_put_page(ipage, 1);
goto out_unlock; return err;
} }
f2fs_put_page(ipage, 1); f2fs_put_page(ipage, 1);
err = dquot_initialize(inode); err = dquot_initialize(inode);
if (err) if (err)
goto out_unlock; return err;
transfer_to[PRJQUOTA] = dqget(sb, make_kqid_projid(kprojid)); transfer_to[PRJQUOTA] = dqget(sb, make_kqid_projid(kprojid));
if (!IS_ERR(transfer_to[PRJQUOTA])) { if (!IS_ERR(transfer_to[PRJQUOTA])) {
...@@ -2659,9 +2651,6 @@ static int f2fs_ioc_setproject(struct file *filp, __u32 projid) ...@@ -2659,9 +2651,6 @@ static int f2fs_ioc_setproject(struct file *filp, __u32 projid)
inode->i_ctime = current_time(inode); inode->i_ctime = current_time(inode);
out_dirty: out_dirty:
f2fs_mark_inode_dirty_sync(inode, true); f2fs_mark_inode_dirty_sync(inode, true);
out_unlock:
inode_unlock(inode);
mnt_drop_write_file(filp);
return err; return err;
} }
#else #else
...@@ -2737,6 +2726,30 @@ static int f2fs_ioc_fsgetxattr(struct file *filp, unsigned long arg) ...@@ -2737,6 +2726,30 @@ static int f2fs_ioc_fsgetxattr(struct file *filp, unsigned long arg)
return 0; return 0;
} }
static int f2fs_ioctl_check_project(struct inode *inode, struct fsxattr *fa)
{
/*
* Project Quota ID state is only allowed to change from within the init
* namespace. Enforce that restriction only if we are trying to change
* the quota ID state. Everything else is allowed in user namespaces.
*/
if (current_user_ns() == &init_user_ns)
return 0;
if (__kprojid_val(F2FS_I(inode)->i_projid) != fa->fsx_projid)
return -EINVAL;
if (F2FS_I(inode)->i_flags & F2FS_PROJINHERIT_FL) {
if (!(fa->fsx_xflags & FS_XFLAG_PROJINHERIT))
return -EINVAL;
} else {
if (fa->fsx_xflags & FS_XFLAG_PROJINHERIT)
return -EINVAL;
}
return 0;
}
static int f2fs_ioc_fssetxattr(struct file *filp, unsigned long arg) static int f2fs_ioc_fssetxattr(struct file *filp, unsigned long arg)
{ {
struct inode *inode = file_inode(filp); struct inode *inode = file_inode(filp);
...@@ -2764,19 +2777,20 @@ static int f2fs_ioc_fssetxattr(struct file *filp, unsigned long arg) ...@@ -2764,19 +2777,20 @@ static int f2fs_ioc_fssetxattr(struct file *filp, unsigned long arg)
return err; return err;
inode_lock(inode); inode_lock(inode);
err = f2fs_ioctl_check_project(inode, &fa);
if (err)
goto out;
flags = (fi->i_flags & ~F2FS_FL_XFLAG_VISIBLE) | flags = (fi->i_flags & ~F2FS_FL_XFLAG_VISIBLE) |
(flags & F2FS_FL_XFLAG_VISIBLE); (flags & F2FS_FL_XFLAG_VISIBLE);
err = __f2fs_ioc_setflags(inode, flags); err = __f2fs_ioc_setflags(inode, flags);
inode_unlock(inode);
mnt_drop_write_file(filp);
if (err) if (err)
return err; goto out;
err = f2fs_ioc_setproject(filp, fa.fsx_projid); err = f2fs_ioc_setproject(filp, fa.fsx_projid);
if (err) out:
return err; inode_unlock(inode);
mnt_drop_write_file(filp);
return 0; return err;
} }
int f2fs_pin_file_control(struct inode *inode, bool inc) int f2fs_pin_file_control(struct inode *inode, bool inc)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment