linux-kernel - [PATCH] xfs: not allow rename if src is quota enabled and project IDs are different

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20211214031517.508012-1-renlei1@chinatelecom.cn>
Date:   Tue, 14 Dec 2021 11:15:17 +0800
From:   renlei1@...natelecom.cn
To:     djwong@...nel.org
Cc:     linux-xfs@...r.kernel.org, linux-kernel@...r.kernel.org,
        Ren Lei <renlei1@...natelecom.cn>
Subject: [PATCH] xfs: not allow rename if src is quota enabled and project IDs are different

From: Ren Lei <renlei1@...natelecom.cn>

xfs not allow rename if target is using project inheritance and
project IDs are different to avoid tree quota mechanism not work.

But if only src with directory quota enabled, rename to other directory
without quota enabled can succeed and skip quota mechanism. which might
result to unexpected quota behavior.

This patch fix this by disable rename if src is using project inheritance
and the project IDs are not the same.

following steps can easy reproduce this issue:
1. first init a directory quota /mnt/test
	mount -o prjquota /dev/sdb  /mnt
	mkdir /mnt/test
	echo 1:/mnt/test >> /etc/projects
	echo test:1 >> /etc/projid
	xfs_quota -x -c 'project -s test' /mnt
	xfs_quota -x -c 'limit -p bhard=10m test' /mnt

2. fill /mnt/test with tesfile util directory full:
	[root@...st1 test]# dd if=/dev/zero of=/mnt/test/testfile
	dd: writing to '/mnt/test/testfile': No space left on device

3. mv testfile out to /mnt,  test is empty but cannot create files:
	[root@...st1 test]# mv testfile ../
	[root@...st1 test]# ls -a
	.  ..
	[root@...st1 test]# touch aaa
	touch: cannot touch 'aaa': Disk quota exceeded

Signed-off-by: Ren Lei <renlei1@...natelecom.cn>
---
 fs/xfs/xfs_inode.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index 6771f357ad2c..f8c115b014f9 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -3177,7 +3177,8 @@ xfs_rename(
 	 * into our tree when the project IDs are the same; else the
 	 * tree quota mechanism would be circumvented.
 	 */
-	if (unlikely((target_dp->i_diflags & XFS_DIFLAG_PROJINHERIT) &&
+	if (unlikely((target_dp->i_diflags & XFS_DIFLAG_PROJINHERIT ||
+		     src_dp->i_diflags & XFS_DIFLAG_PROJINHERIT) &&
 		     target_dp->i_projid != src_ip->i_projid)) {
 		error = -EXDEV;
 		goto out_trans_cancel;
-- 
2.27.0