[PATCH] ceph: use the mount idmap for the owner checks in the SET_LAYOUT ioctls

[PATCH] ceph: use the mount idmap for the owner checks in the SET_LAYOUT ioctls

[Zhan Xusheng]

From: Zhan Xusheng <zhanxusheng@xiaomi.com>

ceph_ioctl_set_layout() and ceph_ioctl_set_layout_policy() call
inode_owner_or_capable() with &nop_mnt_idmap instead of the idmap of the
mount the ioctl was issued on.

CephFS supports idmapped mounts (FS_ALLOW_IDMAP), so on such a mount this
compares the caller's fsuid against the unmapped on-disk owner rather than
the mapped owner: the actual owner can be wrongly denied with -EACCES and
an unrelated caller wrongly allowed.  Both functions already have the
struct file, so use file_mnt_idmap(file) instead.

Fixes: cee38bbf5556 ("ceph: add owner/capability checks for CEPH_IOC_SET_LAYOUT*")
Cc: stable@vger.kernel.org
Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
---
 fs/ceph/ioctl.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/ceph/ioctl.c b/fs/ceph/ioctl.c
index de07f19b0caa..12cb50e0a166 100644
--- a/fs/ceph/ioctl.c
+++ b/fs/ceph/ioctl.c
@@ -72,7 +72,7 @@ static long ceph_ioctl_set_layout(struct file *file, void __user *arg)
 	struct ceph_ioctl_layout nl;
 	int err;
 
-	if (!inode_owner_or_capable(&nop_mnt_idmap, inode))
+	if (!inode_owner_or_capable(file_mnt_idmap(file), inode))
 		return -EACCES;
 
 	if (copy_from_user(&l, arg, sizeof(l)))
@@ -145,7 +145,7 @@ static long ceph_ioctl_set_layout_policy (struct file *file, void __user *arg)
 	int err;
 	struct ceph_mds_client *mdsc = ceph_sb_to_fs_client(inode->i_sb)->mdsc;
 
-	if (!inode_owner_or_capable(&nop_mnt_idmap, inode))
+	if (!inode_owner_or_capable(file_mnt_idmap(file), inode))
 		return -EACCES;
 
 	/* copy and validate */
-- 
2.43.0

Re: [PATCH] ceph: use the mount idmap for the owner checks in the SET_LAYOUT ioctls

[Ilya Dryomov]

On Mon, Jul 27, 2026 at 3:47 AM Zhan Xusheng <zhanxusheng1024@gmail.com> wrote:
>
> From: Zhan Xusheng <zhanxusheng@xiaomi.com>
>
> ceph_ioctl_set_layout() and ceph_ioctl_set_layout_policy() call
> inode_owner_or_capable() with &nop_mnt_idmap instead of the idmap of the
> mount the ioctl was issued on.
>
> CephFS supports idmapped mounts (FS_ALLOW_IDMAP), so on such a mount this
> compares the caller's fsuid against the unmapped on-disk owner rather than
> the mapped owner: the actual owner can be wrongly denied with -EACCES and
> an unrelated caller wrongly allowed.  Both functions already have the
> struct file, so use file_mnt_idmap(file) instead.
>
> Fixes: cee38bbf5556 ("ceph: add owner/capability checks for CEPH_IOC_SET_LAYOUT*")
> Cc: stable@vger.kernel.org
> Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
> ---
>  fs/ceph/ioctl.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/fs/ceph/ioctl.c b/fs/ceph/ioctl.c
> index de07f19b0caa..12cb50e0a166 100644
> --- a/fs/ceph/ioctl.c
> +++ b/fs/ceph/ioctl.c
> @@ -72,7 +72,7 @@ static long ceph_ioctl_set_layout(struct file *file, void __user *arg)
>         struct ceph_ioctl_layout nl;
>         int err;
>
> -       if (!inode_owner_or_capable(&nop_mnt_idmap, inode))
> +       if (!inode_owner_or_capable(file_mnt_idmap(file), inode))
>                 return -EACCES;
>
>         if (copy_from_user(&l, arg, sizeof(l)))
> @@ -145,7 +145,7 @@ static long ceph_ioctl_set_layout_policy (struct file *file, void __user *arg)
>         int err;
>         struct ceph_mds_client *mdsc = ceph_sb_to_fs_client(inode->i_sb)->mdsc;
>
> -       if (!inode_owner_or_capable(&nop_mnt_idmap, inode))
> +       if (!inode_owner_or_capable(file_mnt_idmap(file), inode))

Hi Max,

Was there any specific reason you used nop_mnt_idmap for these checks?

Thanks,

                Ilya

Re: [PATCH] ceph: use the mount idmap for the owner checks in the SET_LAYOUT ioctls

[Max Kellermann]

On Tue, Jul 28, 2026 at 1:31 PM Ilya Dryomov <idryomov@gmail.com> wrote:
> Was there any specific reason you used nop_mnt_idmap for these checks?

No, I copied that check from another filesystem, probably ext2. I had
no idea what this parameter means (and I have never used idmappings).
I guess the amended parameter in this patch is correct.

-- 
Max Kellermann
Principal Architect
Hosting Technology

cm4all | Im Mediapark 6a | 50670 Köln | Germany
General information about the company can be found here:
https://www.cm4all.com/impressum
A member of the IONOS Group

Re: [PATCH] ceph: use the mount idmap for the owner checks in the SET_LAYOUT ioctls

[Ilya Dryomov]

On Sat, Aug 8, 2026 at 8:31 AM Max Kellermann <max.kellermann@ionos.com> wrote:
>
> On Tue, Jul 28, 2026 at 1:31 PM Ilya Dryomov <idryomov@gmail.com> wrote:
> > Was there any specific reason you used nop_mnt_idmap for these checks?
>
> No, I copied that check from another filesystem, probably ext2. I had
> no idea what this parameter means (and I have never used idmappings).
> I guess the amended parameter in this patch is correct.

Hi Xiubo,

You reviewed Max's "ceph: add owner/capability checks for
CEPH_IOC_SET_LAYOUT*" patch.  Would you be able to review this fixup as
well?

Thanks,

                Ilya

Re: [PATCH] ceph: use the mount idmap for the owner checks in the SET_LAYOUT ioctls

[Xiubo Li]

Hi Ilya,

I'm not sure why I couldn't find the original email of this. I checked
the changes on lore.kernel.org.

The fix looks correct to me.

On an idmapped mount, using &nop_mnt_idmap compares the caller's fsuid
against the unmapped on-disk uid directly, which would wrongly deny
the actual mapped owner and potentially allow an unrelated caller.
Both functions already have the struct file, so switching to
file_mnt_idmap(file) is the right thing to do.

Reviewed-by: Xiubo Li <xiubo.li@clyso.com>

Thanks
Xiubo Li

On Sun, 9 Aug 2026 at 10:33, Ilya Dryomov <idryomov@gmail.com> wrote:
>
> On Sat, Aug 8, 2026 at 8:31 AM Max Kellermann <max.kellermann@ionos.com> wrote:
> >
> > On Tue, Jul 28, 2026 at 1:31 PM Ilya Dryomov <idryomov@gmail.com> wrote:
> > > Was there any specific reason you used nop_mnt_idmap for these checks?
> >
> > No, I copied that check from another filesystem, probably ext2. I had
> > no idea what this parameter means (and I have never used idmappings).
> > I guess the amended parameter in this patch is correct.
>
> Hi Xiubo,
>
> You reviewed Max's "ceph: add owner/capability checks for
> CEPH_IOC_SET_LAYOUT*" patch.  Would you be able to review this fixup as
> well?
>
> Thanks,
>
>                 Ilya

Re: [PATCH] ceph: use the mount idmap for the owner checks in the SET_LAYOUT ioctls

[Ilya Dryomov]

On Wed, Aug 12, 2026 at 1:32 PM Xiubo Li <xiubo.li@clyso.com> wrote:
>
> Hi Ilya,
>
> I'm not sure why I couldn't find the original email of this. I checked
> the changes on lore.kernel.org.
>
> The fix looks correct to me.
>
> On an idmapped mount, using &nop_mnt_idmap compares the caller's fsuid
> against the unmapped on-disk uid directly, which would wrongly deny
> the actual mapped owner and potentially allow an unrelated caller.
> Both functions already have the struct file, so switching to
> file_mnt_idmap(file) is the right thing to do.
>
> Reviewed-by: Xiubo Li <xiubo.li@clyso.com>

Applied.

Thanks,

                Ilya

>
> Thanks
> Xiubo Li
>
> On Sun, 9 Aug 2026 at 10:33, Ilya Dryomov <idryomov@gmail.com> wrote:
> >
> > On Sat, Aug 8, 2026 at 8:31 AM Max Kellermann <max.kellermann@ionos.com> wrote:
> > >
> > > On Tue, Jul 28, 2026 at 1:31 PM Ilya Dryomov <idryomov@gmail.com> wrote:
> > > > Was there any specific reason you used nop_mnt_idmap for these checks?
> > >
> > > No, I copied that check from another filesystem, probably ext2. I had
> > > no idea what this parameter means (and I have never used idmappings).
> > > I guess the amended parameter in this patch is correct.
> >
> > Hi Xiubo,
> >
> > You reviewed Max's "ceph: add owner/capability checks for
> > CEPH_IOC_SET_LAYOUT*" patch.  Would you be able to review this fixup as
> > well?
> >
> > Thanks,
> >
> >                 Ilya