Re: [PATCH v13 06/23] fsverity: don't allow setting DAX file attribute on fsverity files

[Eric Biggers <ebiggers@kernel.org>]

On Tue, Jul 21, 2026 at 08:40:43PM +0200, Andrey Albershteyn wrote:
> When fsverity is enabled on the file, with FS_IOC_ENABLE_VERITY ioctl(),
> it checks if file has DAX enabled and fails if that's true. However, the
> opposite case is not checked.
> 
> Signed-off-by: Andrey Albershteyn <aalbersh@kernel.org>
> ---
>  fs/file_attr.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/fs/file_attr.c b/fs/file_attr.c
> index bfb00d256dd5..5424ec4e3949 100644
> --- a/fs/file_attr.c
> +++ b/fs/file_attr.c
> @@ -246,6 +246,11 @@ static int fileattr_set_prepare(struct inode *inode,
>  	if (fa->fsx_cowextsize == 0)
>  		fa->fsx_xflags &= ~FS_XFLAG_COWEXTSIZE;
>  
> +	/* Can not enable DAX on fsverity file */
> +	if ((old_ma->fsx_xflags & FS_XFLAG_VERITY) &&
> +			fa->fsx_xflags & FS_XFLAG_DAX)
> +		return -EINVAL;
> +

As mentioned elsewhere, this is actually already checked in ext4, and
the commit message should mention this.

Also, I notice this function already checks conditions on when the DAX
flag can be enabled:

        /*                                                                       
         * It is only valid to set the DAX flag on regular files and             
         * directories on filesystems.                                           
         */                                                                      
        if ((fa->fsx_xflags & FS_XFLAG_DAX) &&                                   
            !(S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode)))                 
                return -EINVAL;                                                  

Could we combine those into something like the following so the DAX
enablement conditions are in one place?

        if (fa->fsx_xflags & FS_XFLAG_DAX) {                                     
                if (!S_ISREG(inode->i_mode) && !S_ISDIR(inode->i_mode))          
                        return -EINVAL;                                          
                if (old_ma->fsx_xflags & FS_XFLAG_VERITY)                        
                        return -EINVAL;                                          
        }                                                                        

- Eric