diff options
| author | Zhan Xusheng <zhanxusheng@xiaomi.com> | 2026-07-27 09:47:44 +0800 |
|---|---|---|
| committer | Ilya Dryomov <idryomov@gmail.com> | 2026-08-12 21:21:41 +0200 |
| commit | 91880e4a7fac45bc407771bc57bbaf4f37e9b4c3 (patch) | |
| tree | c32bc60a5f3a06e305795d0a745bce7eb143b760 | |
| parent | 2c11c4bfdb7bd2808b3b3ac228e1f2d9bcf25457 (diff) | |
| download | linux-91880e4a7fac45bc407771bc57bbaf4f37e9b4c3.tar.gz linux-91880e4a7fac45bc407771bc57bbaf4f37e9b4c3.zip | |
ceph: use the mount idmap for the owner checks in the SET_LAYOUT ioctls
ceph_ioctl_set_layout() and ceph_ioctl_set_layout_policy() call
inode_owner_or_capable() with &nop_mnt_idmap instead of the idmap of the
mount the ioctl was issued on.
CephFS supports idmapped mounts (FS_ALLOW_IDMAP), so on such a mount this
compares the caller's fsuid against the unmapped on-disk owner rather than
the mapped owner: the actual owner can be wrongly denied with -EACCES and
an unrelated caller wrongly allowed. Both functions already have the
struct file, so use file_mnt_idmap(file) instead.
Cc: stable@vger.kernel.org
Fixes: cee38bbf5556 ("ceph: add owner/capability checks for CEPH_IOC_SET_LAYOUT*")
Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
Reviewed-by: Xiubo Li <xiubo.li@clyso.com>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
| -rw-r--r-- | fs/ceph/ioctl.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/fs/ceph/ioctl.c b/fs/ceph/ioctl.c index de07f19b0caa..12cb50e0a166 100644 --- a/fs/ceph/ioctl.c +++ b/fs/ceph/ioctl.c @@ -72,7 +72,7 @@ static long ceph_ioctl_set_layout(struct file *file, void __user *arg) struct ceph_ioctl_layout nl; int err; - if (!inode_owner_or_capable(&nop_mnt_idmap, inode)) + if (!inode_owner_or_capable(file_mnt_idmap(file), inode)) return -EACCES; if (copy_from_user(&l, arg, sizeof(l))) @@ -145,7 +145,7 @@ static long ceph_ioctl_set_layout_policy (struct file *file, void __user *arg) int err; struct ceph_mds_client *mdsc = ceph_sb_to_fs_client(inode->i_sb)->mdsc; - if (!inode_owner_or_capable(&nop_mnt_idmap, inode)) + if (!inode_owner_or_capable(file_mnt_idmap(file), inode)) return -EACCES; /* copy and validate */ |