[PATCH 2/2] ksmbd: protect CREATE metadata updates against filesystem freezing

[Namjae Jeon <linkinjeon@kernel.org>]

Since commit 4e45cca31d4e, smb2_open() no longer holds a write reference
after path lookup. The CREATE path still writes EAs, security descriptor
and stream xattrs, inherited DACLs, and initial POSIX ACLs.

Request write protection in the xattr helpers and hold a reference around
the initial POSIX ACL updates.

Fixes: 4e45cca31d4e ("smb/server: add ksmbd_vfs_kern_path()")
Cc: stable@vger.kernel.org
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
---
 fs/smb/server/smb2pdu.c | 10 +++++-----
 fs/smb/server/smbacl.c  |  2 +-
 fs/smb/server/vfs.c     |  6 ++++++
 3 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index 1b8471d75afa..d8da0b259cfd 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -3719,7 +3719,7 @@ static noinline int smb2_set_stream_name_xattr(const struct path *path,
 			};
 			rc = ksmbd_vfs_setxattr(idmap, path, xattr_stream_name,
 						(void *)afpinfo_empty,
-						sizeof(afpinfo_empty), 0, false);
+						sizeof(afpinfo_empty), 0, true);
 			return rc < 0 ? rc : 0;
 		}
 		ksmbd_debug(SMB, "XATTR stream name lookup failed: %d\n", rc);
@@ -3729,7 +3729,7 @@ static noinline int smb2_set_stream_name_xattr(const struct path *path,
 	if (!test_tree_conn_flag(fp->tcon, KSMBD_TREE_CONN_FLAG_WRITABLE))
 		return -EACCES;
 
-	rc = ksmbd_vfs_setxattr(idmap, path, xattr_stream_name, NULL, 0, 0, false);
+	rc = ksmbd_vfs_setxattr(idmap, path, xattr_stream_name, NULL, 0, 0, true);
 	if (rc < 0)
 		pr_err("Failed to store XATTR stream name :%d\n", rc);
 	else
@@ -3944,7 +3944,7 @@ static int smb2_create_sd_buffer(struct ksmbd_work *work,
 	    sizeof(struct create_sd_buf_req))
 		return -EINVAL;
 	return set_info_sec(work->conn, work->tcon, path, &sd_buf->ntsd,
-			    le32_to_cpu(sd_buf->ccontext.DataLength), true, false,
+			    le32_to_cpu(sd_buf->ccontext.DataLength), true, true,
 			    true, true);
 }
 
@@ -5075,7 +5075,7 @@ int smb2_open(struct ksmbd_work *work)
 
 			rc = smb2_set_ea(&ea_buf->ea,
 					 le32_to_cpu(ea_buf->ccontext.DataLength),
-					 &path, false);
+					 &path, true);
 			if (rc == -EOPNOTSUPP)
 				rc = 0;
 			else if (rc)
@@ -5280,7 +5280,7 @@ int smb2_open(struct ksmbd_work *work)
 								    &path,
 								    pntsd,
 								    pntsd_size,
-								    false);
+								    true);
 					kvfree(pntsd);
 					if (rc)
 						pr_err("failed to store ntacl in xattr : %d\n",
diff --git a/fs/smb/server/smbacl.c b/fs/smb/server/smbacl.c
index 04dd4a6d7092..0ca093de83c6 100644
--- a/fs/smb/server/smbacl.c
+++ b/fs/smb/server/smbacl.c
@@ -1443,7 +1443,7 @@ int smb_inherit_dacl(struct ksmbd_conn *conn,
 			pntsd_size += sizeof(struct smb_acl) + nt_size;
 		}
 
-		ksmbd_vfs_set_sd_xattr(conn, idmap, path, pntsd, pntsd_size, false);
+		ksmbd_vfs_set_sd_xattr(conn, idmap, path, pntsd, pntsd_size, true);
 		kfree(pntsd);
 	}
 
diff --git a/fs/smb/server/vfs.c b/fs/smb/server/vfs.c
index 0c95d4668370..09dad151360c 100644
--- a/fs/smb/server/vfs.c
+++ b/fs/smb/server/vfs.c
@@ -2334,6 +2334,10 @@ int ksmbd_vfs_set_init_posix_acl(const struct mnt_idmap *idmap,
 	}
 	posix_state_to_acl(&acl_state, acls->a_entries);
 
+	rc = mnt_want_write(path->mnt);
+	if (rc)
+		goto out;
+
 	rc = set_posix_acl(idmap, dentry, ACL_TYPE_ACCESS, acls);
 	if (rc < 0)
 		ksmbd_debug(SMB, "Set posix acl(ACL_TYPE_ACCESS) failed, rc : %d\n",
@@ -2345,7 +2349,9 @@ int ksmbd_vfs_set_init_posix_acl(const struct mnt_idmap *idmap,
 			ksmbd_debug(SMB, "Set posix acl(ACL_TYPE_DEFAULT) failed, rc : %d\n",
 				    rc);
 	}
+	mnt_drop_write(path->mnt);
 
+out:
 	free_acl_state(&acl_state);
 	posix_acl_release(acls);
 	return rc;
-- 
2.25.1