[PATCH] f2fs: require inode ownership for ioctls that change per-file state

[PATCH] f2fs: require inode ownership for ioctls that change per-file state

[Hungyu Lin]

F2FS_IOC_RELEASE_COMPRESS_BLOCKS, F2FS_IOC_RESERVE_COMPRESS_BLOCKS,
F2FS_IOC_SET_PIN_FILE and F2FS_IOC_IO_PRIO change the state of the inode
behind the file descriptor without checking who the caller is. Any user
who can open a file, even read-only, can:

 - release its compressed blocks, after which writes to the file fail
   with -EPERM until the blocks are reserved again or the file is
   truncated to zero;
 - reserve released blocks again, which consumes free space;
 - pin it while it has no data blocks, after which writes that extend
   the file fail with -EIO;
 - unpin it, so that garbage collection may move blocks that a user of
   F2FS_IOC_SET_PIN_FILE expects to stay in place;
 - set its write I/O priority hint.

F2FS_IOC_SET_PIN_FILE checked inode_owner_or_capable() when it was
added. Commit aff7b628ac2d ("f2fs: set pin_file under CAP_SYS_ADMIN")
replaced that with a CAP_SYS_ADMIN check, and commit b13bdf03bb80
("f2fs: allow all the users to pin a file") then removed the
CAP_SYS_ADMIN check, leaving the ioctl without any permission check.

The atomic write ioctls require both FMODE_WRITE and
inode_owner_or_capable(). Requiring FMODE_WRITE here would break
f2fs_io, which releases and reserves compressed blocks through a
read-only file descriptor, and Android, which releases them the same
way. Require only inode_owner_or_capable(), as F2FS_IOC_SET_PIN_FILE
originally did, so that only the owner or a caller with CAP_FOWNER can
change this state. Users can still pin their own files.

Fixes: b13bdf03bb80 ("f2fs: allow all the users to pin a file")
Fixes: ef8d563f184e ("f2fs: introduce F2FS_IOC_RELEASE_COMPRESS_BLOCKS")
Fixes: c75488fb4d82 ("f2fs: introduce F2FS_IOC_RESERVE_COMPRESS_BLOCKS")
Fixes: 5f95c1812a65 ("f2fs: add ioctl to get IO priority hint")
Cc: stable@vger.kernel.org
Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
---
 fs/f2fs/file.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index e2c0f5083313..0730de36554a 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -3664,6 +3664,9 @@ static int f2fs_ioc_set_pin_file(struct file *filp, unsigned long arg)
 	if (!pin && IS_DEVICE_ALIASING(inode))
 		return -EOPNOTSUPP;
 
+	if (!inode_owner_or_capable(file_mnt_idmap(filp), inode))
+		return -EACCES;
+
 	ret = mnt_want_write_file(filp);
 	if (ret)
 		return ret;
@@ -3982,6 +3985,9 @@ static int f2fs_ioc_io_prio(struct file *filp, unsigned long arg)
 	if (!S_ISREG(inode->i_mode) || level >= F2FS_IOPRIO_MAX)
 		return -EINVAL;
 
+	if (!inode_owner_or_capable(file_mnt_idmap(filp), inode))
+		return -EACCES;
+
 	inode_lock(inode);
 	F2FS_I(inode)->ioprio_hint = level;
 	inode_unlock(inode);
@@ -4235,6 +4241,9 @@ static int f2fs_release_compress_blocks(struct file *filp, unsigned long arg)
 	if (f2fs_readonly(sbi->sb))
 		return -EROFS;
 
+	if (!inode_owner_or_capable(file_mnt_idmap(filp), inode))
+		return -EACCES;
+
 	ret = mnt_want_write_file(filp);
 	if (ret)
 		return ret;
@@ -4430,6 +4439,9 @@ static int f2fs_reserve_compress_blocks(struct file *filp, unsigned long arg)
 	if (f2fs_readonly(sbi->sb))
 		return -EROFS;
 
+	if (!inode_owner_or_capable(file_mnt_idmap(filp), inode))
+		return -EACCES;
+
 	ret = mnt_want_write_file(filp);
 	if (ret)
 		return ret;
-- 
2.43.0