From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0C1BC194A6C; Thu, 30 Jul 2026 16:10:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785427813; cv=none; b=YJst4FT9M70BpKg6UpeDUJO5nEYB8t/zeiOkfYQ+6ybyUBIipJMzWqgVC4Sq/boNAoAMuXhpbyUXsN/BBuvkedf1FOrQTMKRDuBi9Diq4TP8Ju60y8DgCaHI9qZbNLgYBkvoyE0FQnWMtj1t5raBk5JIc8CFJ7IisUvqOmw7wOY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785427813; c=relaxed/simple; bh=U3oPfVghvdlL6qS2mTmmE7EbaiApDXUXYc/IjCUr9c8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=MaHIUgtQpbIJkHdoHh3oIq/RpSmcZGzsac5TIGyil3M/0XJZQHAmiAMkqwrPgpdt1wNXMgbybisuRHBu/rEXeiy4l4RlupbNsfSLjk4C7wL36f4xsp62geXfqnZ101187bNusUOidv+hmjrAQIvW30QEHcOK9kwnpZzVW1xnPEg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Tgw9xBKU; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="Tgw9xBKU" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6568D1F000E9; Thu, 30 Jul 2026 16:10:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1785427811; bh=GFf1qgGLk21drbJvp1qVvDOtk4DZ0GMJ0AfF6//h+bg=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=Tgw9xBKUrhabGtDLt19tSFB+9pJY3bGnAgE1NGv4lWZq0drIMNea161sN56mSFZ6K Ylsj2UlqyaJ0wMgA/K6pQwZOj2RC/2Fdv5kNKtfWbl42q8WG4kNF1Ypzr2XpVZ2xQE An7Ka+ern+FgIGVg51FFJ3slyGNLu7nkUgwwv11Y= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Max Kellermann , Xiubo Li , Ilya Dryomov Subject: [PATCH 6.6 302/484] ceph: add owner/capability checks for CEPH_IOC_SET_LAYOUT* Date: Thu, 30 Jul 2026 16:13:19 +0200 Message-ID: <20260730141430.052514003@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260730141423.392222816@linuxfoundation.org> References: <20260730141423.392222816@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.6-stable review patch. If anyone has any objections, please let me know. ------------------ From: Max Kellermann commit cee38bbf5556a8e0a232ccae41649580827d7806 upstream. These permission checks were already missing in the initial impementation of these ioctls. This Ceph allows any user who owns a file descriptor to manipulate the layout of any file, even if they don't have write permissions. It might be a good idea to guard other ioctls with permission checks as well or even disallow regular users (even if they own the file) to manipulate layout settings completely, as this may be abused to DoS the Ceph servers, but right now, I find it most urgent to have setter checks at all. Cc: stable@vger.kernel.org Fixes: 8f4e91dee2a2 ("ceph: ioctls") Signed-off-by: Max Kellermann Reviewed-by: Xiubo Li Signed-off-by: Ilya Dryomov Signed-off-by: Greg Kroah-Hartman --- fs/ceph/ioctl.c | 6 ++++++ 1 file changed, 6 insertions(+) --- a/fs/ceph/ioctl.c +++ b/fs/ceph/ioctl.c @@ -72,6 +72,9 @@ static long ceph_ioctl_set_layout(struct struct ceph_ioctl_layout nl; int err; + if (!inode_owner_or_capable(&nop_mnt_idmap, inode)) + return -EACCES; + if (copy_from_user(&l, arg, sizeof(l))) return -EFAULT; @@ -142,6 +145,9 @@ static long ceph_ioctl_set_layout_policy int err; struct ceph_mds_client *mdsc = ceph_sb_to_fs_client(inode->i_sb)->mdsc; + if (!inode_owner_or_capable(&nop_mnt_idmap, inode)) + return -EACCES; + /* copy and validate */ if (copy_from_user(&l, arg, sizeof(l))) return -EFAULT;