[PATCH] f2fs: require CAP_SYS_ADMIN for fallocate on pinned files

[PATCH] f2fs: require CAP_SYS_ADMIN for fallocate on pinned files

[Hungyu Lin]

fallocate() on a pinned file allocates blocks without zeroing them, so
reading the file returns whatever the blocks held before.
Documentation/filesystems/f2fs.rst describes this as "zero or random
data". Commit cad3836f9eb2 ("f2fs: allocate blocks for pinned file")
added this while F2FS_IOC_SET_PIN_FILE required CAP_SYS_ADMIN, but
commit b13bdf03bb80 ("f2fs: allow all the users to pin a file") then let
any user pin a file. Since then any user can create a file, pin it,
fallocate() it and read back data of files that other users have
deleted.

Require CAP_SYS_ADMIN for fallocate() on a pinned file. The documented
use of these blocks needs write access to the block device anyway, and
Android's gsid, which creates pinned image files through libfiemap, has
CAP_SYS_ADMIN. Users without CAP_SYS_ADMIN can still pin files, but can
no longer preallocate blocks for them. fallocate() on files that are not
pinned is not affected.

Fixes: b13bdf03bb80 ("f2fs: allow all the users to pin a file")
Cc: stable@vger.kernel.org
Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
---
 fs/f2fs/file.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index e2c0f5083313..d1b52b41a1eb 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -1973,6 +1973,9 @@ static int f2fs_expand_inode_data(struct inode *inode, loff_t offset,
 	block_t expanded = 0;
 	int err;
 
+	if (f2fs_is_pinned_file(inode) && !capable(CAP_SYS_ADMIN))
+		return -EPERM;
+
 	err = inode_newsize_ok(inode, (len + offset));
 	if (err)
 		return err;
-- 
2.43.0