[PATCH v2 0/4] f2fs: require write permission for ioctls that change per-file state

[PATCH v2 0/4] f2fs: require write permission for ioctls that change per-file state

[Hungyu Lin]

F2FS_IOC_SET_PIN_FILE, F2FS_IOC_RELEASE_COMPRESS_BLOCKS,
F2FS_IOC_RESERVE_COMPRESS_BLOCKS and F2FS_IOC_IO_PRIO change the state
of the inode behind the file descriptor without checking who the
caller is, so any user who can open a file read-only can change that
state. Each patch requires write permission on the inode in one of
these ioctls.

inode_permission() does not depend on how the file was opened, so
f2fs_io can keep using read-only file descriptors and does not need to
change. It does refuse write access to immutable files, so these ioctls
now fail on immutable files as well.

Changes since v1:
- Check write permission with inode_permission() instead of
  inode_owner_or_capable(), as suggested by Chao Yu.
- Split into one patch per ioctl.

v1: https://lore.kernel.org/all/20261108045722.12091-1-dennylin0707@gmail.com/

Hungyu Lin (4):
  f2fs: require write permission for F2FS_IOC_SET_PIN_FILE
  f2fs: require write permission for F2FS_IOC_RELEASE_COMPRESS_BLOCKS
  f2fs: require write permission for F2FS_IOC_RESERVE_COMPRESS_BLOCKS
  f2fs: require write permission for F2FS_IOC_IO_PRIO

 fs/f2fs/file.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)


base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
-- 
2.43.0

[PATCH v2 1/4] f2fs: require write permission for F2FS_IOC_SET_PIN_FILE

[Hungyu Lin]

F2FS_IOC_SET_PIN_FILE does not check who the caller is. Any user who
can open a file, even read-only, can:

 - pin it while it has no data blocks, after which writes that extend
   the file fail with -EIO;
 - unpin it, so that garbage collection may move blocks that a user of
   F2FS_IOC_SET_PIN_FILE expects to stay in place.

The ioctl checked inode_owner_or_capable() when it was added. Commit
aff7b628ac2d ("f2fs: set pin_file under CAP_SYS_ADMIN") replaced that
with a CAP_SYS_ADMIN check, and commit b13bdf03bb80 ("f2fs: allow all
the users to pin a file") then removed the CAP_SYS_ADMIN check, leaving
the ioctl without any permission check.

Require write permission on the inode. Users can still pin files that
they can write to.

Fixes: b13bdf03bb80 ("f2fs: allow all the users to pin a file")
Suggested-by: Chao Yu <chao@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
---
 fs/f2fs/file.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index e2c0f5083313..cfd24a5fa271 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -3664,6 +3664,9 @@ static int f2fs_ioc_set_pin_file(struct file *filp, unsigned long arg)
 	if (!pin && IS_DEVICE_ALIASING(inode))
 		return -EOPNOTSUPP;
 
+	if (inode_permission(file_mnt_idmap(filp), inode, MAY_WRITE))
+		return -EACCES;
+
 	ret = mnt_want_write_file(filp);
 	if (ret)
 		return ret;
-- 
2.43.0

[PATCH v2 2/4] f2fs: require write permission for F2FS_IOC_RELEASE_COMPRESS_BLOCKS

[Hungyu Lin]

F2FS_IOC_RELEASE_COMPRESS_BLOCKS does not check who the caller is, so
any user who can open a compressed file, even read-only, can release
its compressed blocks. After that, writes to the file fail with -EPERM
until the blocks are reserved again or the file is truncated to zero.

Require write permission on the inode. inode_permission() does not
depend on how the file was opened, so a caller with write permission
can still release the blocks through a read-only file descriptor, as
f2fs_io and Android do.

Fixes: ef8d563f184e ("f2fs: introduce F2FS_IOC_RELEASE_COMPRESS_BLOCKS")
Suggested-by: Chao Yu <chao@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
---
 fs/f2fs/file.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index cfd24a5fa271..93f892b11915 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -4238,6 +4238,9 @@ static int f2fs_release_compress_blocks(struct file *filp, unsigned long arg)
 	if (f2fs_readonly(sbi->sb))
 		return -EROFS;
 
+	if (inode_permission(file_mnt_idmap(filp), inode, MAY_WRITE))
+		return -EACCES;
+
 	ret = mnt_want_write_file(filp);
 	if (ret)
 		return ret;
-- 
2.43.0

[PATCH v2 3/4] f2fs: require write permission for F2FS_IOC_RESERVE_COMPRESS_BLOCKS

[Hungyu Lin]

F2FS_IOC_RESERVE_COMPRESS_BLOCKS does not check who the caller is, so
any user who can open a file whose compressed blocks were released,
even read-only, can reserve the blocks again, which consumes free
space.

Require write permission on the inode. inode_permission() does not
depend on how the file was opened, so a caller with write permission
can still reserve the blocks through a read-only file descriptor, as
f2fs_io does.

Fixes: c75488fb4d82 ("f2fs: introduce F2FS_IOC_RESERVE_COMPRESS_BLOCKS")
Suggested-by: Chao Yu <chao@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
---
 fs/f2fs/file.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index 93f892b11915..9d09ce597f72 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -4436,6 +4436,9 @@ static int f2fs_reserve_compress_blocks(struct file *filp, unsigned long arg)
 	if (f2fs_readonly(sbi->sb))
 		return -EROFS;
 
+	if (inode_permission(file_mnt_idmap(filp), inode, MAY_WRITE))
+		return -EACCES;
+
 	ret = mnt_want_write_file(filp);
 	if (ret)
 		return ret;
-- 
2.43.0

[PATCH v2 4/4] f2fs: require write permission for F2FS_IOC_IO_PRIO

[Hungyu Lin]

F2FS_IOC_IO_PRIO does not check who the caller is, so any user who can
open a file, even read-only, can set its write I/O priority hint.

Require write permission on the inode.

Fixes: 5f95c1812a65 ("f2fs: add ioctl to get IO priority hint")
Suggested-by: Chao Yu <chao@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
---
 fs/f2fs/file.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index 9d09ce597f72..e25c7166c367 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -3985,6 +3985,9 @@ static int f2fs_ioc_io_prio(struct file *filp, unsigned long arg)
 	if (!S_ISREG(inode->i_mode) || level >= F2FS_IOPRIO_MAX)
 		return -EINVAL;
 
+	if (inode_permission(file_mnt_idmap(filp), inode, MAY_WRITE))
+		return -EACCES;
+
 	inode_lock(inode);
 	F2FS_I(inode)->ioprio_hint = level;
 	inode_unlock(inode);
-- 
2.43.0