[PATCH 1/2] ksmbd: protect SET_INFO metadata updates against filesystem freezing

[PATCH 1/2] ksmbd: protect SET_INFO metadata updates against filesystem freezing

[Namjae Jeon]

SET_INFO calls notify_change() and set_posix_acl() without a mount write
reference. During a filesystem freeze, these updates can reach ext4
without the usual freeze protection and trigger WARN_ON() in
ext4_journal_check_start().

Hold a write reference around the metadata updates. Drop it before storing
the security descriptor xattrs, whose helpers acquire their own references.

Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Cc: stable@vger.kernel.org
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
---
 fs/smb/server/smb2pdu.c | 17 +++++++++++++----
 fs/smb/server/smbacl.c  |  9 +++++++++
 2 files changed, 22 insertions(+), 4 deletions(-)

diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index fc0987d99a57..1b8471d75afa 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -8998,6 +8998,10 @@ static int set_file_basic_info(struct ksmbd_file *fp,
 	    (file_info->Attributes & FILE_ATTRIBUTE_TEMPORARY_LE))
 		return -EINVAL;
 
+	rc = mnt_want_write_file(filp);
+	if (rc)
+		return rc;
+
 	crtime = (s64)le64_to_cpu(file_info->CreationTime);
 	if (crtime > 0)
 		fp->create_time = crtime;
@@ -9025,7 +9029,8 @@ static int set_file_basic_info(struct ksmbd_file *fp,
 		if (!S_ISDIR(inode->i_mode) &&
 		    file_info->Attributes & FILE_ATTRIBUTE_DIRECTORY_LE) {
 			pr_err("can't change a file to a directory\n");
-			return -EINVAL;
+			rc = -EINVAL;
+			goto out;
 		}
 
 		if (!(S_ISDIR(inode->i_mode) && file_info->Attributes == FILE_ATTRIBUTE_NORMAL_LE))
@@ -9046,7 +9051,7 @@ static int set_file_basic_info(struct ksmbd_file *fp,
 			XATTR_DOSINFO_ITIME;
 
 		rc = ksmbd_vfs_set_dos_attrib_xattr(idmap, &filp->f_path, &da,
-				true);
+				false);
 		if (rc)
 			ksmbd_debug(SMB,
 				    "failed to restore file attribute in EA\n");
@@ -9057,13 +9062,17 @@ static int set_file_basic_info(struct ksmbd_file *fp,
 		struct dentry *dentry = filp->f_path.dentry;
 		struct inode *inode = d_inode(dentry);
 
-		if (IS_IMMUTABLE(inode) || IS_APPEND(inode))
-			return -EACCES;
+		if (IS_IMMUTABLE(inode) || IS_APPEND(inode)) {
+			rc = -EACCES;
+			goto out;
+		}
 
 		inode_lock(inode);
 		rc = notify_change(idmap, dentry, &attrs, NULL);
 		inode_unlock(inode);
 	}
+out:
+	mnt_drop_write_file(filp);
 	return rc;
 }
 
diff --git a/fs/smb/server/smbacl.c b/fs/smb/server/smbacl.c
index 6b5f22d6280c..04dd4a6d7092 100644
--- a/fs/smb/server/smbacl.c
+++ b/fs/smb/server/smbacl.c
@@ -12,6 +12,7 @@
 #include <linux/slab.h>
 #include <linux/string.h>
 #include <linux/mnt_idmapping.h>
+#include <linux/mount.h>
 
 #include "smbacl.h"
 #include "smb_common.h"
@@ -1944,6 +1945,12 @@ int set_info_sec(struct ksmbd_conn *conn, struct ksmbd_tree_connect *tcon,
 				   (fattr.cf_mode & 0777);
 
 	ksmbd_vfs_remove_acl_xattrs(idmap, path);
+	if (get_write) {
+		rc = mnt_want_write(path->mnt);
+		if (rc)
+			goto out;
+	}
+
 	/* Update posix acls */
 	if (IS_ENABLED(CONFIG_FS_POSIX_ACL) && fattr.cf_dacls) {
 		rc = set_posix_acl(idmap, path->dentry,
@@ -1965,6 +1972,8 @@ int set_info_sec(struct ksmbd_conn *conn, struct ksmbd_tree_connect *tcon,
 	inode_lock(inode);
 	rc = notify_change(idmap, path->dentry, &newattrs, NULL);
 	inode_unlock(inode);
+	if (get_write)
+		mnt_drop_write(path->mnt);
 	if (rc)
 		goto out;
 
-- 
2.25.1

[PATCH 2/2] ksmbd: protect CREATE metadata updates against filesystem freezing

[Namjae Jeon]

Since commit 4e45cca31d4e, smb2_open() no longer holds a write reference
after path lookup. The CREATE path still writes EAs, security descriptor
and stream xattrs, inherited DACLs, and initial POSIX ACLs.

Request write protection in the xattr helpers and hold a reference around
the initial POSIX ACL updates.

Fixes: 4e45cca31d4e ("smb/server: add ksmbd_vfs_kern_path()")
Cc: stable@vger.kernel.org
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
---
 fs/smb/server/smb2pdu.c | 10 +++++-----
 fs/smb/server/smbacl.c  |  2 +-
 fs/smb/server/vfs.c     |  6 ++++++
 3 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index 1b8471d75afa..d8da0b259cfd 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -3719,7 +3719,7 @@ static noinline int smb2_set_stream_name_xattr(const struct path *path,
 			};
 			rc = ksmbd_vfs_setxattr(idmap, path, xattr_stream_name,
 						(void *)afpinfo_empty,
-						sizeof(afpinfo_empty), 0, false);
+						sizeof(afpinfo_empty), 0, true);
 			return rc < 0 ? rc : 0;
 		}
 		ksmbd_debug(SMB, "XATTR stream name lookup failed: %d\n", rc);
@@ -3729,7 +3729,7 @@ static noinline int smb2_set_stream_name_xattr(const struct path *path,
 	if (!test_tree_conn_flag(fp->tcon, KSMBD_TREE_CONN_FLAG_WRITABLE))
 		return -EACCES;
 
-	rc = ksmbd_vfs_setxattr(idmap, path, xattr_stream_name, NULL, 0, 0, false);
+	rc = ksmbd_vfs_setxattr(idmap, path, xattr_stream_name, NULL, 0, 0, true);
 	if (rc < 0)
 		pr_err("Failed to store XATTR stream name :%d\n", rc);
 	else
@@ -3944,7 +3944,7 @@ static int smb2_create_sd_buffer(struct ksmbd_work *work,
 	    sizeof(struct create_sd_buf_req))
 		return -EINVAL;
 	return set_info_sec(work->conn, work->tcon, path, &sd_buf->ntsd,
-			    le32_to_cpu(sd_buf->ccontext.DataLength), true, false,
+			    le32_to_cpu(sd_buf->ccontext.DataLength), true, true,
 			    true, true);
 }
 
@@ -5075,7 +5075,7 @@ int smb2_open(struct ksmbd_work *work)
 
 			rc = smb2_set_ea(&ea_buf->ea,
 					 le32_to_cpu(ea_buf->ccontext.DataLength),
-					 &path, false);
+					 &path, true);
 			if (rc == -EOPNOTSUPP)
 				rc = 0;
 			else if (rc)
@@ -5280,7 +5280,7 @@ int smb2_open(struct ksmbd_work *work)
 								    &path,
 								    pntsd,
 								    pntsd_size,
-								    false);
+								    true);
 					kvfree(pntsd);
 					if (rc)
 						pr_err("failed to store ntacl in xattr : %d\n",
diff --git a/fs/smb/server/smbacl.c b/fs/smb/server/smbacl.c
index 04dd4a6d7092..0ca093de83c6 100644
--- a/fs/smb/server/smbacl.c
+++ b/fs/smb/server/smbacl.c
@@ -1443,7 +1443,7 @@ int smb_inherit_dacl(struct ksmbd_conn *conn,
 			pntsd_size += sizeof(struct smb_acl) + nt_size;
 		}
 
-		ksmbd_vfs_set_sd_xattr(conn, idmap, path, pntsd, pntsd_size, false);
+		ksmbd_vfs_set_sd_xattr(conn, idmap, path, pntsd, pntsd_size, true);
 		kfree(pntsd);
 	}
 
diff --git a/fs/smb/server/vfs.c b/fs/smb/server/vfs.c
index 0c95d4668370..09dad151360c 100644
--- a/fs/smb/server/vfs.c
+++ b/fs/smb/server/vfs.c
@@ -2334,6 +2334,10 @@ int ksmbd_vfs_set_init_posix_acl(const struct mnt_idmap *idmap,
 	}
 	posix_state_to_acl(&acl_state, acls->a_entries);
 
+	rc = mnt_want_write(path->mnt);
+	if (rc)
+		goto out;
+
 	rc = set_posix_acl(idmap, dentry, ACL_TYPE_ACCESS, acls);
 	if (rc < 0)
 		ksmbd_debug(SMB, "Set posix acl(ACL_TYPE_ACCESS) failed, rc : %d\n",
@@ -2345,7 +2349,9 @@ int ksmbd_vfs_set_init_posix_acl(const struct mnt_idmap *idmap,
 			ksmbd_debug(SMB, "Set posix acl(ACL_TYPE_DEFAULT) failed, rc : %d\n",
 				    rc);
 	}
+	mnt_drop_write(path->mnt);
 
+out:
 	free_acl_state(&acl_state);
 	posix_acl_release(acls);
 	return rc;
-- 
2.25.1