[PATCH 1/2] ksmbd: protect SET_INFO metadata updates against filesystem freezing

[Namjae Jeon <linkinjeon@kernel.org>]

SET_INFO calls notify_change() and set_posix_acl() without a mount write
reference. During a filesystem freeze, these updates can reach ext4
without the usual freeze protection and trigger WARN_ON() in
ext4_journal_check_start().

Hold a write reference around the metadata updates. Drop it before storing
the security descriptor xattrs, whose helpers acquire their own references.

Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Cc: stable@vger.kernel.org
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
---
 fs/smb/server/smb2pdu.c | 17 +++++++++++++----
 fs/smb/server/smbacl.c  |  9 +++++++++
 2 files changed, 22 insertions(+), 4 deletions(-)

diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index fc0987d99a57..1b8471d75afa 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -8998,6 +8998,10 @@ static int set_file_basic_info(struct ksmbd_file *fp,
 	    (file_info->Attributes & FILE_ATTRIBUTE_TEMPORARY_LE))
 		return -EINVAL;
 
+	rc = mnt_want_write_file(filp);
+	if (rc)
+		return rc;
+
 	crtime = (s64)le64_to_cpu(file_info->CreationTime);
 	if (crtime > 0)
 		fp->create_time = crtime;
@@ -9025,7 +9029,8 @@ static int set_file_basic_info(struct ksmbd_file *fp,
 		if (!S_ISDIR(inode->i_mode) &&
 		    file_info->Attributes & FILE_ATTRIBUTE_DIRECTORY_LE) {
 			pr_err("can't change a file to a directory\n");
-			return -EINVAL;
+			rc = -EINVAL;
+			goto out;
 		}
 
 		if (!(S_ISDIR(inode->i_mode) && file_info->Attributes == FILE_ATTRIBUTE_NORMAL_LE))
@@ -9046,7 +9051,7 @@ static int set_file_basic_info(struct ksmbd_file *fp,
 			XATTR_DOSINFO_ITIME;
 
 		rc = ksmbd_vfs_set_dos_attrib_xattr(idmap, &filp->f_path, &da,
-				true);
+				false);
 		if (rc)
 			ksmbd_debug(SMB,
 				    "failed to restore file attribute in EA\n");
@@ -9057,13 +9062,17 @@ static int set_file_basic_info(struct ksmbd_file *fp,
 		struct dentry *dentry = filp->f_path.dentry;
 		struct inode *inode = d_inode(dentry);
 
-		if (IS_IMMUTABLE(inode) || IS_APPEND(inode))
-			return -EACCES;
+		if (IS_IMMUTABLE(inode) || IS_APPEND(inode)) {
+			rc = -EACCES;
+			goto out;
+		}
 
 		inode_lock(inode);
 		rc = notify_change(idmap, dentry, &attrs, NULL);
 		inode_unlock(inode);
 	}
+out:
+	mnt_drop_write_file(filp);
 	return rc;
 }
 
diff --git a/fs/smb/server/smbacl.c b/fs/smb/server/smbacl.c
index 6b5f22d6280c..04dd4a6d7092 100644
--- a/fs/smb/server/smbacl.c
+++ b/fs/smb/server/smbacl.c
@@ -12,6 +12,7 @@
 #include <linux/slab.h>
 #include <linux/string.h>
 #include <linux/mnt_idmapping.h>
+#include <linux/mount.h>
 
 #include "smbacl.h"
 #include "smb_common.h"
@@ -1944,6 +1945,12 @@ int set_info_sec(struct ksmbd_conn *conn, struct ksmbd_tree_connect *tcon,
 				   (fattr.cf_mode & 0777);
 
 	ksmbd_vfs_remove_acl_xattrs(idmap, path);
+	if (get_write) {
+		rc = mnt_want_write(path->mnt);
+		if (rc)
+			goto out;
+	}
+
 	/* Update posix acls */
 	if (IS_ENABLED(CONFIG_FS_POSIX_ACL) && fattr.cf_dacls) {
 		rc = set_posix_acl(idmap, path->dentry,
@@ -1965,6 +1972,8 @@ int set_info_sec(struct ksmbd_conn *conn, struct ksmbd_tree_connect *tcon,
 	inode_lock(inode);
 	rc = notify_change(idmap, path->dentry, &newattrs, NULL);
 	inode_unlock(inode);
+	if (get_write)
+		mnt_drop_write(path->mnt);
 	if (rc)
 		goto out;
 
-- 
2.25.1