On Fri, Mar 09, 2018 at 10:17:43AM +0200, Nikolay Borisov wrote:
> From: Ernesto A. Fernández <ernesto.mnd.fernandez@xxxxxxxxx>
>
> When changing a file's acl mask, btrfs_set_acl() will first set the
> group bits of i_mode to the value of the mask, and only then set the
> actual extended attribute representing the new acl.
>
> If the second part fails (due to lack of space, for example) and the
> file had no acl attribute to begin with, the system will from now on
> assume that the mask permission bits are actual group permission bits,
> potentially granting access to the wrong users.
>
> Prevent this by restoring the original mode bits if __btrfs_set_acl
> fails.
>
> Signed-off-by: Ernesto A. Fernández <ernesto.mnd.fernandez@xxxxxxxxx>
> Reviewed-by: David Sterba <dsterba@xxxxxxxx>
> Signed-off-by: David Sterba <dsterba@xxxxxxxx>
> Signed-off-by: Nikolay Borisov <nborisov@xxxxxxxx>
> ---
> fs/btrfs/acl.c | 6 +++++-
> 1 file changed, 5 insertions(+), 1 deletion(-)
>
> diff --git a/fs/btrfs/acl.c b/fs/btrfs/acl.c
> index 8d8370ddb6b2..1ba49ebe67da 100644
> --- a/fs/btrfs/acl.c
> +++ b/fs/btrfs/acl.c
> @@ -114,13 +114,17 @@ static int __btrfs_set_acl(struct btrfs_trans_handle *trans,
> int btrfs_set_acl(struct inode *inode, struct posix_acl *acl, int type)
> {
> int ret;
> + umode_t old_mode = inode->i_mode;
>
> if (type == ACL_TYPE_ACCESS && acl) {
> ret = posix_acl_update_mode(inode, &inode->i_mode, &acl);
> if (ret)
> return ret;
> }
> - return __btrfs_set_acl(NULL, inode, acl, type);
> + ret = __btrfs_set_acl(NULL, inode, acl, type);
> + if (ret)
> + inode->i_mode = old_mode;
> + return ret;
> }
>
> /*
> --
> 2.7.4
Thanks for the patches, all now queued up.
greg k-h