linux-kernel - Re: [f2fs-dev] [PATCH] f2fs: return -EPERM given generic mask

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <YJTdp0Rj170TYm24@sol.localdomain>
Date:   Thu, 6 May 2021 23:26:47 -0700
From:   Eric Biggers <ebiggers@...nel.org>
To:     Jaegeuk Kim <jaegeuk@...nel.org>
Cc:     linux-kernel@...r.kernel.org,
        linux-f2fs-devel@...ts.sourceforge.net
Subject: Re: [f2fs-dev] [PATCH] f2fs: return -EPERM given generic mask

On Thu, May 06, 2021 at 12:13:47PM -0700, Jaegeuk Kim wrote:
> In f2fs_fileattr_set(),
> 
> 	if (!fa->flags_valid)
> 		mask &= FS_COMMON_FL;
> 
> In this case, we should not allow to set FS_COMPR_FL, instead of BUG_ON.
> 
> /* Flags shared betwen flags/xflags */
> 	(FS_SYNC_FL | FS_IMMUTABLE_FL | FS_APPEND_FL | \
> 	 FS_NODUMP_FL |	FS_NOATIME_FL | FS_DAX_FL | \
> 	 FS_PROJINHERIT_FL)
> 
> Fixes: 4c5b47997521 ("vfs: add fileattr ops")
> Signed-off-by: Jaegeuk Kim <jaegeuk@...nel.org>
> ---
>  fs/f2fs/file.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
> index e01ce802cf10..38015ef84893 100644
> --- a/fs/f2fs/file.c
> +++ b/fs/f2fs/file.c
> @@ -1817,7 +1817,9 @@ static int f2fs_setflags_common(struct inode *inode, u32 iflags, u32 mask)
>  	struct f2fs_inode_info *fi = F2FS_I(inode);
>  	u32 masked_flags = fi->i_flags & mask;
>  
> -	f2fs_bug_on(F2FS_I_SB(inode), (iflags & ~mask));
> +	/* mask can be shrunk by flags_valid selector */
> +	if (iflags & ~mask)
> +		return -EPERM;
>  
>  	/* Is it quota file? Do not allow user to mess with it */
>  	if (IS_NOQUOTA(inode))
> -- 
> 2.31.1.607.g51e8a6a459-goog

This looks like the wrong fix.  AFAICS, 'mask' is the set of inode flags that
the specific ioctl (FS_IOC_SETFLAGS or FS_IOC_FSSETXATTR) can potentially
modify, while 'iflags' is the new set of inode flags among the set that either
ioctl can potentially modify.  So this change will stop FS_IOC_FSSETXATTR from
working on files that have already flags set which are only modifiable by
FS_IOC_SETFLAGS, e.g. the compression flag.

I think the correct fix would be to just do something like 'iflags &= mask'.

- Eric