[PATCH] f2fs: reject setattr writes on large folio files

[PATCH] f2fs: reject setattr writes on large folio files

[Wenjie Qi]

F2FS large folio support is read-only. It rejects writable opens and
mmap writes when an inode mapping supports large folios, but setattr can
still reach the inode without going through those checks.

For immutable large-folio files, clearing the immutable flag keeps the
cached inode and its large-folio mapping alive until the inode is
dropped. A path-based truncate(2) can then call f2fs_setattr() with
ATTR_SIZE and change the file size without opening the file for write.

The user.fadvise path adds another visible case: after the file is
reopened with large folios, chmod(WRITE) is documented to fail, but
f2fs_setattr() currently allows ATTR_MODE to add write bits back.

Reject size changes and mode changes that enable write permissions while
the mapping still supports large folios. Read-only mode changes and
unrelated metadata updates remain allowed.

Fixes: 05e65c14ea59 ("f2fs: support large folio for immutable non-compressed case")
Signed-off-by: Wenjie Qi <qiwenjie@xiaomi.com>
---
 fs/f2fs/file.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index 71385ca4163d..3880ff5e6740 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -1097,6 +1097,11 @@ int f2fs_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
 				  ATTR_GID | ATTR_TIMES_SET))))
 		return -EPERM;
 
+	if (mapping_large_folio_support(inode->i_mapping) &&
+	    ((attr->ia_valid & ATTR_SIZE) ||
+	     ((attr->ia_valid & ATTR_MODE) && (attr->ia_mode & 0222))))
+		return -EOPNOTSUPP;
+
 	if ((attr->ia_valid & ATTR_SIZE)) {
 		if (!f2fs_is_compress_backend_ready(inode) ||
 				IS_DEVICE_ALIASING(inode))
-- 
2.43.0

[f2fs-dev] [PATCH] f2fs: reject setattr writes on large folio files

[Wenjie Qi]

F2FS large folio support is read-only. It rejects writable opens and
mmap writes when an inode mapping supports large folios, but setattr can
still reach the inode without going through those checks.

For immutable large-folio files, clearing the immutable flag keeps the
cached inode and its large-folio mapping alive until the inode is
dropped. A path-based truncate(2) can then call f2fs_setattr() with
ATTR_SIZE and change the file size without opening the file for write.

The user.fadvise path adds another visible case: after the file is
reopened with large folios, chmod(WRITE) is documented to fail, but
f2fs_setattr() currently allows ATTR_MODE to add write bits back.

Reject size changes and mode changes that enable write permissions while
the mapping still supports large folios. Read-only mode changes and
unrelated metadata updates remain allowed.

Fixes: 05e65c14ea59 ("f2fs: support large folio for immutable non-compressed case")
Signed-off-by: Wenjie Qi <qiwenjie@xiaomi.com>
---
 fs/f2fs/file.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index 71385ca4163d..3880ff5e6740 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -1097,6 +1097,11 @@ int f2fs_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
 				  ATTR_GID | ATTR_TIMES_SET))))
 		return -EPERM;
 
+	if (mapping_large_folio_support(inode->i_mapping) &&
+	    ((attr->ia_valid & ATTR_SIZE) ||
+	     ((attr->ia_valid & ATTR_MODE) && (attr->ia_mode & 0222))))
+		return -EOPNOTSUPP;
+
 	if ((attr->ia_valid & ATTR_SIZE)) {
 		if (!f2fs_is_compress_backend_ready(inode) ||
 				IS_DEVICE_ALIASING(inode))
-- 
2.43.0



_______________________________________________
Linux-f2fs-devel mailing list
Linux-f2fs-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel

Re: [f2fs-dev] [PATCH] f2fs: reject setattr writes on large folio files

[Jaegeuk Kim via Linux-f2fs-devel]

On 05/21, Wenjie Qi wrote:
> F2FS large folio support is read-only. It rejects writable opens and
> mmap writes when an inode mapping supports large folios, but setattr can
> still reach the inode without going through those checks.
> 
> For immutable large-folio files, clearing the immutable flag keeps the
> cached inode and its large-folio mapping alive until the inode is
> dropped. A path-based truncate(2) can then call f2fs_setattr() with
> ATTR_SIZE and change the file size without opening the file for write.
> 
> The user.fadvise path adds another visible case: after the file is
> reopened with large folios, chmod(WRITE) is documented to fail, but
> f2fs_setattr() currently allows ATTR_MODE to add write bits back.

We don't add this anymore. Can you update?

> 
> Reject size changes and mode changes that enable write permissions while
> the mapping still supports large folios. Read-only mode changes and
> unrelated metadata updates remain allowed.
> 
> Fixes: 05e65c14ea59 ("f2fs: support large folio for immutable non-compressed case")
> Signed-off-by: Wenjie Qi <qiwenjie@xiaomi.com>
> ---
>  fs/f2fs/file.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
> index 71385ca4163d..3880ff5e6740 100644
> --- a/fs/f2fs/file.c
> +++ b/fs/f2fs/file.c
> @@ -1097,6 +1097,11 @@ int f2fs_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
>  				  ATTR_GID | ATTR_TIMES_SET))))
>  		return -EPERM;
>  
> +	if (mapping_large_folio_support(inode->i_mapping) &&
> +	    ((attr->ia_valid & ATTR_SIZE) ||
> +	     ((attr->ia_valid & ATTR_MODE) && (attr->ia_mode & 0222))))
> +		return -EOPNOTSUPP;
> +
>  	if ((attr->ia_valid & ATTR_SIZE)) {
>  		if (!f2fs_is_compress_backend_ready(inode) ||
>  				IS_DEVICE_ALIASING(inode))
> -- 
> 2.43.0
> 
> 
> 
> _______________________________________________
> Linux-f2fs-devel mailing list
> Linux-f2fs-devel@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel


_______________________________________________
Linux-f2fs-devel mailing list
Linux-f2fs-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel

Re: [f2fs-dev] [PATCH] f2fs: reject setattr writes on large folio files

[Jaegeuk Kim]

On 05/21, Wenjie Qi wrote:
> F2FS large folio support is read-only. It rejects writable opens and
> mmap writes when an inode mapping supports large folios, but setattr can
> still reach the inode without going through those checks.
> 
> For immutable large-folio files, clearing the immutable flag keeps the
> cached inode and its large-folio mapping alive until the inode is
> dropped. A path-based truncate(2) can then call f2fs_setattr() with
> ATTR_SIZE and change the file size without opening the file for write.
> 
> The user.fadvise path adds another visible case: after the file is
> reopened with large folios, chmod(WRITE) is documented to fail, but
> f2fs_setattr() currently allows ATTR_MODE to add write bits back.

We don't add this anymore. Can you update?

> 
> Reject size changes and mode changes that enable write permissions while
> the mapping still supports large folios. Read-only mode changes and
> unrelated metadata updates remain allowed.
> 
> Fixes: 05e65c14ea59 ("f2fs: support large folio for immutable non-compressed case")
> Signed-off-by: Wenjie Qi <qiwenjie@xiaomi.com>
> ---
>  fs/f2fs/file.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
> index 71385ca4163d..3880ff5e6740 100644
> --- a/fs/f2fs/file.c
> +++ b/fs/f2fs/file.c
> @@ -1097,6 +1097,11 @@ int f2fs_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
>  				  ATTR_GID | ATTR_TIMES_SET))))
>  		return -EPERM;
>  
> +	if (mapping_large_folio_support(inode->i_mapping) &&
> +	    ((attr->ia_valid & ATTR_SIZE) ||
> +	     ((attr->ia_valid & ATTR_MODE) && (attr->ia_mode & 0222))))
> +		return -EOPNOTSUPP;
> +
>  	if ((attr->ia_valid & ATTR_SIZE)) {
>  		if (!f2fs_is_compress_backend_ready(inode) ||
>  				IS_DEVICE_ALIASING(inode))
> -- 
> 2.43.0
> 
> 
> 
> _______________________________________________
> Linux-f2fs-devel mailing list
> Linux-f2fs-devel@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel