Ensure that overlayfs only allows decoding exportable file handles.
Signed-off-by: Christian Brauner <brauner@xxxxxxxxxx>
---
fs/overlayfs/util.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/fs/overlayfs/util.c b/fs/overlayfs/util.c
index 9aa7493b1e10365cbcc97fceab26d614a319727f..b498c74084f3950d8e4d9f63a804d1abe08258fc 100644
--- a/fs/overlayfs/util.c
+++ b/fs/overlayfs/util.c
@@ -83,10 +83,15 @@ void ovl_revert_creds(const struct cred *old_cred)
*/
int ovl_can_decode_fh(struct super_block *sb)
{
+ const struct export_operations *nop = sb->s_export_op;
+
if (!capable(CAP_DAC_READ_SEARCH))
return 0;
- if (!exportfs_can_decode_fh(sb->s_export_op))
+ if (!exportfs_can_decode_fh(nop))
+ return 0;
+
+ if (nop && nop->flags & EXPORT_OP_LOCAL_FILE_HANDLE)
return 0;
return sb->s_export_op->encode_fh ? -1 : FILEID_INO32_GEN;
--
2.45.2
