diff options
| author | Miklos Szeredi <miklos@szeredi.hu> | 2015-12-11 16:30:49 +0100 |
|---|---|---|
| committer | Sasha Levin <sasha.levin@oracle.com> | 2016-02-01 11:37:32 -0500 |
| commit | c8e1bebf86dff9277e21e9a2769724ca05f40c02 (patch) | |
| tree | cc52a5d19df60bbf50f64d163dcde7666f0e5053 /fs | |
| parent | 3d51d36e7148182e76fc36d66c494d192c410fdd (diff) | |
| download | lwn-c8e1bebf86dff9277e21e9a2769724ca05f40c02.tar.gz lwn-c8e1bebf86dff9277e21e9a2769724ca05f40c02.zip | |
ovl: setattr: check permissions before copy-up
[ Upstream commit cf9a6784f7c1b5ee2b9159a1246e327c331c5697 ]
Without this copy-up of a file can be forced, even without actually being
allowed to do anything on the file.
[Arnd Bergmann] include <linux/pagemap.h> for PAGE_CACHE_SIZE (used by
MAX_LFS_FILESIZE definition).
Signed-off-by: Miklos Szeredi <miklos@szeredi.hu>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/overlayfs/inode.c | 13 | ||||
| -rw-r--r-- | fs/overlayfs/super.c | 2 |
2 files changed, 15 insertions, 0 deletions
diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c index ba0db2638946..a1b069e5e363 100644 --- a/fs/overlayfs/inode.c +++ b/fs/overlayfs/inode.c @@ -45,6 +45,19 @@ int ovl_setattr(struct dentry *dentry, struct iattr *attr) int err; struct dentry *upperdentry; + /* + * Check for permissions before trying to copy-up. This is redundant + * since it will be rechecked later by ->setattr() on upper dentry. But + * without this, copy-up can be triggered by just about anybody. + * + * We don't initialize inode->size, which just means that + * inode_newsize_ok() will always check against MAX_LFS_FILESIZE and not + * check for a swapfile (which this won't be anyway). + */ + err = inode_change_ok(dentry->d_inode, attr); + if (err) + return err; + err = ovl_want_write(dentry); if (err) goto out; diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c index c4b595e2fc20..bd6d5c1e667d 100644 --- a/fs/overlayfs/super.c +++ b/fs/overlayfs/super.c @@ -9,6 +9,7 @@ #include <linux/fs.h> #include <linux/namei.h> +#include <linux/pagemap.h> #include <linux/xattr.h> #include <linux/security.h> #include <linux/mount.h> @@ -847,6 +848,7 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent) } sb->s_stack_depth = 0; + sb->s_maxbytes = MAX_LFS_FILESIZE; if (ufs->config.upperdir) { if (!ufs->config.workdir) { pr_err("overlayfs: missing 'workdir'\n"); |