diff options
| author | Pierre Barre <pierre@barre.sh> | 2026-04-02 12:03:12 +0200 |
|---|---|---|
| committer | Dominique Martinet <asmadeus@codewreck.org> | 2026-04-16 02:56:29 +0000 |
| commit | da2346a48a5a1fed86c3fe3d73c0b60e7b3027c9 (patch) | |
| tree | 9dec454e2f40afc4536b05a93ce0b2571e54dfb9 /fs/9p | |
| parent | 0fd76f1be20d19ac593138ceec502cb044c909bd (diff) | |
| download | linux-next-da2346a48a5a1fed86c3fe3d73c0b60e7b3027c9.tar.gz linux-next-da2346a48a5a1fed86c3fe3d73c0b60e7b3027c9.zip | |
9p: fix access mode flags being ORed instead of replaced
Since commit 1f3e4142c0eb ("9p: convert to the new mount API"),
v9fs_apply_options() applies parsed mount flags with |= onto flags
already set by v9fs_session_init(). For 9P2000.L, session_init sets
V9FS_ACCESS_CLIENT as the default, so when the user mounts with
"access=user", both bits end up set. Access mode checks compare
against exact values, so having both bits set matches neither mode.
This causes v9fs_fid_lookup() to fall through to the default switch
case, using INVALID_UID (nobody/65534) instead of current_fsuid()
for all fid lookups. Root is then unable to chown or perform other
privileged operations.
Fix by clearing the access mask before applying the user's choice.
Fixes: 1f3e4142c0eb ("9p: convert to the new mount API")
Signed-off-by: Pierre Barre <pierre@barre.sh>
Reviewed-by: Christian Schoenebeck <linux_oss@crudebyte.com>
Message-ID: <0ddc72da-d196-4f01-8755-0086f670e779@app.fastmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
Diffstat (limited to 'fs/9p')
| -rw-r--r-- | fs/9p/v9fs.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c index 057487efaaeb..acda42499ca9 100644 --- a/fs/9p/v9fs.c +++ b/fs/9p/v9fs.c @@ -413,7 +413,11 @@ static void v9fs_apply_options(struct v9fs_session_info *v9ses, /* * Note that we must |= flags here as session_init already * set basic flags. This adds in flags from parsed options. + * Default access flags must be cleared if session options + * changes them to avoid mangling the setting. */ + if (ctx->session_opts.flags & V9FS_ACCESS_MASK) + v9ses->flags &= ~V9FS_ACCESS_MASK; v9ses->flags |= ctx->session_opts.flags; #ifdef CONFIG_9P_FSCACHE v9ses->cachetag = ctx->session_opts.cachetag; |